Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 18:19
Behavioral task
behavioral1
Sample
c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6e.exe
Resource
win7-20240508-en
General
-
Target
c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6e.exe
-
Size
1.3MB
-
MD5
531a42f1252ff1b533ac9353cf2efba8
-
SHA1
d8c2089b31bf5d254d15d6cdc87b0433f8da1d39
-
SHA256
c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6e
-
SHA512
1ba00aa9af501e9142cc05d67c9f7c3ccb70145cf0266609a5b60a76f8dbfba6a58214fc314107b0783a363bd9a5fc00a5ab49fc7caf34e24ea110dc661ded34
-
SSDEEP
24576:Dc3Ct5gIRjgUM8NSz+OY8KoQ2SnpEQKQoMC5FzamgaTsv7ecCald9z94GWGkAVyr:Dc3E4sIuIxMaQKQluFFTQqcDldLqGkH
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6eSrv.exeDesktopLayer.exepid process 3100 c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6eSrv.exe 3960 DesktopLayer.exe -
Processes:
resource yara_rule behavioral2/memory/652-0-0x0000000000400000-0x000000000074B000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6eSrv.exe upx behavioral2/memory/3100-4-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3100-6-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3960-11-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3960-14-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3960-12-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3960-17-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/652-29-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-30-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-31-0x0000000002750000-0x00000000027BC000-memory.dmp upx behavioral2/memory/652-32-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-33-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-52-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-53-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-54-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-64-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-65-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-66-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-67-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-68-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-69-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-79-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-80-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-81-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-82-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-93-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-95-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-96-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-97-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-99-0x0000000000400000-0x000000000074B000-memory.dmp upx behavioral2/memory/652-101-0x0000000000400000-0x000000000074B000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6eSrv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\pxEB5A.tmp c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6eSrv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6eSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6eSrv.exe -
Drops file in Windows directory 1 IoCs
Processes:
c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6e.exedescription ioc process File opened for modification C:\Windows\ c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6e.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3452988239" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3452988239" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31108413" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F7EE2A5F-1930-11EF-B9F7-7E3D4A1755AD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31108413" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423253337" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3488144163" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31108413" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
DesktopLayer.exepid process 3960 DesktopLayer.exe 3960 DesktopLayer.exe 3960 DesktopLayer.exe 3960 DesktopLayer.exe 3960 DesktopLayer.exe 3960 DesktopLayer.exe 3960 DesktopLayer.exe 3960 DesktopLayer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6e.exedescription pid process Token: SeDebugPrivilege 652 c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6e.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3216 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6e.exeiexplore.exeIEXPLORE.EXEpid process 652 c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6e.exe 652 c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6e.exe 3216 iexplore.exe 3216 iexplore.exe 3920 IEXPLORE.EXE 3920 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6e.exec0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6eSrv.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 652 wrote to memory of 3100 652 c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6e.exe c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6eSrv.exe PID 652 wrote to memory of 3100 652 c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6e.exe c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6eSrv.exe PID 652 wrote to memory of 3100 652 c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6e.exe c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6eSrv.exe PID 3100 wrote to memory of 3960 3100 c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6eSrv.exe DesktopLayer.exe PID 3100 wrote to memory of 3960 3100 c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6eSrv.exe DesktopLayer.exe PID 3100 wrote to memory of 3960 3100 c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6eSrv.exe DesktopLayer.exe PID 3960 wrote to memory of 3216 3960 DesktopLayer.exe iexplore.exe PID 3960 wrote to memory of 3216 3960 DesktopLayer.exe iexplore.exe PID 3216 wrote to memory of 3920 3216 iexplore.exe IEXPLORE.EXE PID 3216 wrote to memory of 3920 3216 iexplore.exe IEXPLORE.EXE PID 3216 wrote to memory of 3920 3216 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6e.exe"C:\Users\Admin\AppData\Local\Temp\c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6e.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6eSrv.exeC:\Users\Admin\AppData\Local\Temp\c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6eSrv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3216 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3776 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5bb731d10ae296efa591560e65d7fc776
SHA12f5d9d2f70054ff418d8f50cd87208f505d707e3
SHA256a3a0eed8a3d24d7f58cd8b0996d7f1fa331d9263afaefabaff20989ac2cc8b6e
SHA51274168436f730f9599511bc88d6bbbd14dbe88defa3e4690dd51c30bb84db701fa3f29c70cb1fcfa16e1060761a5de8c5b7bc0fe7a297d7f74bbf9e92dfc4fc39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD55436ca19d4415af55cc98db1a6cbaef6
SHA1176a6387934222b3eb2c373549fab7eb4b56be95
SHA256424febebf944859da0b7850a4e97749bc89980eeb5bccc35c3066627bc09c034
SHA51243ace9dc4fb1c2e1eb4d0df6ff03e3a808a53aa769ed7a6e5f4ac724c839fdbd17b826b3db38fb2cbd51d934abbbaee19558eed77d0ec78e9d9efb27ef631603
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O8VM10HV\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\Config_Proxy.iniFilesize
761B
MD5276f6ccbf64b363b905347ff284315ec
SHA1564e19436bfbc8f98c01394ca649e2c2fd684106
SHA25628d3eda0d8429aff3672dc739b577d22eeddf4b92f1aa8ee23c56bcd127f2665
SHA512464feb90d0200541607c8db525e6bff3e170fef631509fc33f377ba0f0acbd7fec0285e4847abb4cc54cb87bdfb39afea35e07f06d515b1804daf3984db76b36
-
C:\Users\Admin\AppData\Local\Temp\c0cfa5a0ca9559d148359725cadb599a2138715bd8aa6056f4c6214458f11c6eSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
memory/652-19-0x0000000010000000-0x0000000010041000-memory.dmpFilesize
260KB
-
memory/652-65-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-101-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-99-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-97-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-0-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-29-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-30-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-31-0x0000000002750000-0x00000000027BC000-memory.dmpFilesize
432KB
-
memory/652-32-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-33-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-34-0x0000000000D60000-0x0000000000D61000-memory.dmpFilesize
4KB
-
memory/652-52-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-53-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-54-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-96-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-64-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-95-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-66-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-67-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-68-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-69-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-93-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-82-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-79-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-80-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/652-81-0x0000000000400000-0x000000000074B000-memory.dmpFilesize
3.3MB
-
memory/3100-5-0x0000000000560000-0x000000000056F000-memory.dmpFilesize
60KB
-
memory/3100-4-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3100-6-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3960-14-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3960-11-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3960-17-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3960-16-0x00000000005D0000-0x00000000005D1000-memory.dmpFilesize
4KB
-
memory/3960-12-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB