Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 22:17
Behavioral task
behavioral1
Sample
5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe
Resource
win10v2004-20240508-en
General
-
Target
5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe
-
Size
2.5MB
-
MD5
8cd04ae4856d169cae59d16a72b587f5
-
SHA1
3a5e7c94b6d2469ae700a9d58c4c4a4507ea3fd0
-
SHA256
5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969
-
SHA512
df5f41ad7de876a28ebb85f1ebed238c2f888a2e5bb15f8058d7158750c34c4b2d0c229cb7a51f9facbad76af95493d6eff8c18f97a3291cd6d6aae589e9adf3
-
SSDEEP
49152:MxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxU:Mxx9NUFkQx753uWuCyyxU
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Detects executables packed with Themida 18 IoCs
Processes:
resource yara_rule behavioral2/memory/3552-0-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Windows\Resources\Themes\explorer.exe INDICATOR_EXE_Packed_Themida behavioral2/memory/3220-10-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Windows\Resources\spoolsv.exe INDICATOR_EXE_Packed_Themida behavioral2/memory/768-19-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Windows\Resources\svchost.exe INDICATOR_EXE_Packed_Themida behavioral2/memory/984-28-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4532-33-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/4532-38-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3552-42-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/768-41-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3220-43-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/984-44-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3220-45-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3220-50-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3220-56-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/984-63-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/984-65-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exe5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exeexplorer.exespoolsv.exespoolsv.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 3220 explorer.exe 768 spoolsv.exe 984 svchost.exe 4532 spoolsv.exe -
Processes:
resource yara_rule behavioral2/memory/3552-0-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\Themes\explorer.exe themida behavioral2/memory/3220-10-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\spoolsv.exe themida behavioral2/memory/768-19-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\svchost.exe themida behavioral2/memory/984-28-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4532-33-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/4532-38-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3552-42-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/768-41-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3220-43-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/984-44-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3220-45-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3220-50-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3220-56-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/984-63-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/984-65-0x0000000000400000-0x0000000000A0E000-memory.dmp themida -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Processes:
5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exeexplorer.exespoolsv.exesvchost.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe -
Drops file in System32 directory 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3220 explorer.exe 768 spoolsv.exe 984 svchost.exe 4532 spoolsv.exe -
Drops file in Windows directory 4 IoCs
Processes:
explorer.exespoolsv.exe5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exedescription ioc process File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exeexplorer.exepid process 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe 3220 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 3220 explorer.exe 984 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe 3220 explorer.exe 3220 explorer.exe 768 spoolsv.exe 768 spoolsv.exe 984 svchost.exe 984 svchost.exe 4532 spoolsv.exe 4532 spoolsv.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 3552 wrote to memory of 3220 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe explorer.exe PID 3552 wrote to memory of 3220 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe explorer.exe PID 3552 wrote to memory of 3220 3552 5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe explorer.exe PID 3220 wrote to memory of 768 3220 explorer.exe spoolsv.exe PID 3220 wrote to memory of 768 3220 explorer.exe spoolsv.exe PID 3220 wrote to memory of 768 3220 explorer.exe spoolsv.exe PID 768 wrote to memory of 984 768 spoolsv.exe svchost.exe PID 768 wrote to memory of 984 768 spoolsv.exe svchost.exe PID 768 wrote to memory of 984 768 spoolsv.exe svchost.exe PID 984 wrote to memory of 4532 984 svchost.exe spoolsv.exe PID 984 wrote to memory of 4532 984 svchost.exe spoolsv.exe PID 984 wrote to memory of 4532 984 svchost.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe"C:\Users\Admin\AppData\Local\Temp\5689bff09fb7baab355dd6f7062b00e24050c6234af0d0a159de1a4c2202b969.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4532
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Resources\Themes\explorer.exeFilesize
2.5MB
MD5127d0b386ddd86e105992092e8740dcc
SHA174483d6e5cb7c43623cd8e2e55506ac99d853e4d
SHA256cffe3d7f75baff050a75a0fb57a69cc491604826cc87eccc4b368155cf411b55
SHA5121b3cfe652c08cb463c406332b0ab3dd82e0316d0f4a6e3fa9144bb627d341e8871c2cb27e0d3ac012922b85bbf9580499182b991eb35e801c1801a281601a4ff
-
C:\Windows\Resources\spoolsv.exeFilesize
2.5MB
MD533952705473f33187489f6edeebb1dbe
SHA1d5bfa33226abad8b703f9188b6ce39a3680a2cc6
SHA2567a39b950c71683c120f3ed4473989c55bf13fea01164470fda5c3d0a4d358db3
SHA5129d5cf33922cd958ac2bf42d220558e6d0cd8afec4ffaecd2c00471f6e2a21ac385cdd15eba628feae3bd7e072e93baceb8cb58e95d811b26b037f8dde3328226
-
C:\Windows\Resources\svchost.exeFilesize
2.5MB
MD59a4c8e1f8ed361759e7cdd6c6ef0c15d
SHA10e2da952bccfab75e059b0add55107d70feda531
SHA25679b9780d97554faea8c0d4cdb1bf279731fb31877f35d95e433bf099511bb9d2
SHA512423d1d97fb0bba2f23a54c603938b3a4a816bc231328070bf1a6959359345008eef906ba2c16b3f2345da584767fd1a20aab1712f5eba78ce75365169ca0b9ab
-
memory/768-41-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/768-19-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/984-65-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/984-63-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/984-28-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/984-44-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3220-43-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3220-45-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3220-50-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3220-56-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3220-10-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3552-42-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3552-0-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3552-1-0x0000000077C34000-0x0000000077C36000-memory.dmpFilesize
8KB
-
memory/4532-38-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/4532-33-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB