Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-03-2024 20:26
Static task
static1
Behavioral task
behavioral1
Sample
6fc8872d56daab1ba2653b9bcb9ff31451f08ea264df1abec225185b03a2a3ac.dll
Resource
win7-20240221-en
General
-
Target
6fc8872d56daab1ba2653b9bcb9ff31451f08ea264df1abec225185b03a2a3ac.dll
-
Size
120KB
-
MD5
36eae6416ac6cb365c05bc7a22484539
-
SHA1
2146d672184a2c013d19028a1a88c4f341bad40e
-
SHA256
6fc8872d56daab1ba2653b9bcb9ff31451f08ea264df1abec225185b03a2a3ac
-
SHA512
07c91fb844cc81a6ccfd45723f4e2b38cd79db80aa06fcaa12573772b64c995e31d9ea863b8aa82269b4dce9fb9348a24492b8989174811e8e764acc5dcdb3f9
-
SSDEEP
3072:RFEkfFmQpZykF2lqAXu+0bloQmzkQC5BZlHW3eyH:RC48Qpgm2lTP0b2QtPHy
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
f761d7f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f761d7f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f761d7f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f761d7f.exe -
Processes:
f761d7f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761d7f.exe -
Processes:
f761d7f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761d7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761d7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761d7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761d7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761d7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761d7f.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 30 IoCs
Processes:
resource yara_rule behavioral1/memory/3060-11-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-13-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-14-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-17-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-18-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-26-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-27-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-28-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-29-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-30-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-31-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-32-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-33-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-34-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-35-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-37-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-38-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-39-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-41-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-43-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-45-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-47-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-49-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-52-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-53-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-56-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-57-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-59-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-61-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3060-64-0x0000000000630000-0x00000000016EA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 31 IoCs
Processes:
resource yara_rule behavioral1/memory/3060-10-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/3060-11-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-13-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-14-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-17-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-18-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-26-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-27-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-28-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-29-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-30-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-31-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-32-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-33-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-34-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-35-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-37-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-38-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-39-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-41-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-43-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-45-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-47-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-49-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-52-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-53-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-56-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-57-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-59-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-61-0x0000000000630000-0x00000000016EA000-memory.dmp UPX behavioral1/memory/3060-64-0x0000000000630000-0x00000000016EA000-memory.dmp UPX -
Executes dropped EXE 1 IoCs
Processes:
f761d7f.exepid process 3060 f761d7f.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exepid process 2972 rundll32.exe 2972 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/3060-11-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-13-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-14-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-17-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-18-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-26-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-27-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-28-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-29-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-30-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-31-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-32-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-33-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-34-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-35-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-37-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-38-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-39-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-41-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-43-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-45-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-47-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-49-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-52-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-53-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-56-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-57-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-59-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-61-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/3060-64-0x0000000000630000-0x00000000016EA000-memory.dmp upx -
Processes:
f761d7f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761d7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761d7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761d7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761d7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761d7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f761d7f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761d7f.exe -
Processes:
f761d7f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761d7f.exe -
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f761d7f.exedescription ioc process File opened (read-only) \??\I: f761d7f.exe File opened (read-only) \??\J: f761d7f.exe File opened (read-only) \??\K: f761d7f.exe File opened (read-only) \??\L: f761d7f.exe File opened (read-only) \??\N: f761d7f.exe File opened (read-only) \??\E: f761d7f.exe File opened (read-only) \??\G: f761d7f.exe File opened (read-only) \??\H: f761d7f.exe File opened (read-only) \??\O: f761d7f.exe File opened (read-only) \??\P: f761d7f.exe File opened (read-only) \??\M: f761d7f.exe File opened (read-only) \??\Q: f761d7f.exe -
Drops file in Windows directory 2 IoCs
Processes:
f761d7f.exedescription ioc process File created C:\Windows\f761e5a f761d7f.exe File opened for modification C:\Windows\SYSTEM.INI f761d7f.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
f761d7f.exepid process 3060 f761d7f.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
f761d7f.exedescription pid process Token: SeDebugPrivilege 3060 f761d7f.exe Token: SeDebugPrivilege 3060 f761d7f.exe Token: SeDebugPrivilege 3060 f761d7f.exe Token: SeDebugPrivilege 3060 f761d7f.exe Token: SeDebugPrivilege 3060 f761d7f.exe Token: SeDebugPrivilege 3060 f761d7f.exe Token: SeDebugPrivilege 3060 f761d7f.exe Token: SeDebugPrivilege 3060 f761d7f.exe Token: SeDebugPrivilege 3060 f761d7f.exe Token: SeDebugPrivilege 3060 f761d7f.exe Token: SeDebugPrivilege 3060 f761d7f.exe Token: SeDebugPrivilege 3060 f761d7f.exe Token: SeDebugPrivilege 3060 f761d7f.exe Token: SeDebugPrivilege 3060 f761d7f.exe Token: SeDebugPrivilege 3060 f761d7f.exe Token: SeDebugPrivilege 3060 f761d7f.exe Token: SeDebugPrivilege 3060 f761d7f.exe Token: SeDebugPrivilege 3060 f761d7f.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
rundll32.exerundll32.exef761d7f.exedescription pid process target process PID 1048 wrote to memory of 2972 1048 rundll32.exe rundll32.exe PID 1048 wrote to memory of 2972 1048 rundll32.exe rundll32.exe PID 1048 wrote to memory of 2972 1048 rundll32.exe rundll32.exe PID 1048 wrote to memory of 2972 1048 rundll32.exe rundll32.exe PID 1048 wrote to memory of 2972 1048 rundll32.exe rundll32.exe PID 1048 wrote to memory of 2972 1048 rundll32.exe rundll32.exe PID 1048 wrote to memory of 2972 1048 rundll32.exe rundll32.exe PID 2972 wrote to memory of 3060 2972 rundll32.exe f761d7f.exe PID 2972 wrote to memory of 3060 2972 rundll32.exe f761d7f.exe PID 2972 wrote to memory of 3060 2972 rundll32.exe f761d7f.exe PID 2972 wrote to memory of 3060 2972 rundll32.exe f761d7f.exe PID 3060 wrote to memory of 1116 3060 f761d7f.exe taskhost.exe PID 3060 wrote to memory of 1172 3060 f761d7f.exe Dwm.exe PID 3060 wrote to memory of 1224 3060 f761d7f.exe Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
f761d7f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761d7f.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6fc8872d56daab1ba2653b9bcb9ff31451f08ea264df1abec225185b03a2a3ac.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6fc8872d56daab1ba2653b9bcb9ff31451f08ea264df1abec225185b03a2a3ac.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f761d7f.exeC:\Users\Admin\AppData\Local\Temp\f761d7f.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\f761d7f.exeFilesize
97KB
MD531e569cda6fbc584573f924788810d7a
SHA1a6097df8abc417bf3a1b55722cdb5b79cd50e508
SHA25667eddb6ad3e12fda050ae63c1adba55432034d47c639628252217674068babe5
SHA5126fc2f8f9699364180711120f2b439a7678f979b7cf33bdbbac29ff9368778be2ff095d429b8bee00ec290d408f8e395ae66d14b9cb0d043f846b134cb5e5af47
-
memory/1116-15-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/2972-3-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2972-8-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3060-32-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-35-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-14-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-11-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-17-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-18-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-26-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-27-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-28-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-29-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-30-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-31-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3060-33-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-34-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-13-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-37-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-38-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-39-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-41-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-43-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-45-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-47-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-49-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-52-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-53-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-56-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-57-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-59-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-61-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB
-
memory/3060-64-0x0000000000630000-0x00000000016EA000-memory.dmpFilesize
16.7MB