Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 23:54
Behavioral task
behavioral1
Sample
7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe
Resource
win10v2004-20240426-en
General
-
Target
7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe
-
Size
2.5MB
-
MD5
b3853be45e0b9a932cfbd7e560a8480d
-
SHA1
e34f75fc6b7f6f8978e814d123fadc6ea01b38cc
-
SHA256
7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082
-
SHA512
f476081140204c578f18bb4fb22c490bb8e4518d9b7f23523dd7a08f31e9b8e904f28d12f0ddabe20209453a4b0c563a17853c416a580617492ec0f60ab080d1
-
SSDEEP
49152:hxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxc:hxx9NUFkQx753uWuCyyxc
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
svchost.exeexplorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Detects executables packed with Themida 16 IoCs
Processes:
resource yara_rule behavioral2/memory/3300-0-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Windows\Resources\Themes\explorer.exe INDICATOR_EXE_Packed_Themida behavioral2/memory/2808-10-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Windows\Resources\spoolsv.exe INDICATOR_EXE_Packed_Themida behavioral2/memory/2832-19-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida C:\Windows\Resources\svchost.exe INDICATOR_EXE_Packed_Themida behavioral2/memory/3864-28-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/1316-33-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/1316-39-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3300-42-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/2832-41-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/2808-45-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3864-44-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/2808-54-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/2808-62-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida behavioral2/memory/3864-65-0x0000000000400000-0x0000000000A0E000-memory.dmp INDICATOR_EXE_Packed_Themida -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
Processes:
spoolsv.exe7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exeexplorer.exespoolsv.exesvchost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ spoolsv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svchost.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
spoolsv.exesvchost.exe7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exeexplorer.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoolsv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe -
Executes dropped EXE 4 IoCs
Processes:
explorer.exespoolsv.exesvchost.exespoolsv.exepid process 2808 explorer.exe 2832 spoolsv.exe 3864 svchost.exe 1316 spoolsv.exe -
Processes:
resource yara_rule behavioral2/memory/3300-0-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\Themes\explorer.exe themida behavioral2/memory/2808-10-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\spoolsv.exe themida behavioral2/memory/2832-19-0x0000000000400000-0x0000000000A0E000-memory.dmp themida C:\Windows\Resources\svchost.exe themida behavioral2/memory/3864-28-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/1316-33-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/1316-39-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3300-42-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/2832-41-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/2808-45-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3864-44-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/2808-54-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/2808-62-0x0000000000400000-0x0000000000A0E000-memory.dmp themida behavioral2/memory/3864-65-0x0000000000400000-0x0000000000A0E000-memory.dmp themida -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe -
Processes:
svchost.exespoolsv.exe7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exeexplorer.exespoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA explorer.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA spoolsv.exe -
Drops file in System32 directory 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 2808 explorer.exe 2832 spoolsv.exe 3864 svchost.exe 1316 spoolsv.exe -
Drops file in Windows directory 4 IoCs
Processes:
7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exeexplorer.exespoolsv.exedescription ioc process File opened for modification \??\c:\windows\resources\themes\explorer.exe 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exeexplorer.exepid process 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe 2808 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
explorer.exesvchost.exepid process 2808 explorer.exe 3864 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exeexplorer.exespoolsv.exesvchost.exespoolsv.exepid process 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe 2808 explorer.exe 2808 explorer.exe 2832 spoolsv.exe 2832 spoolsv.exe 3864 svchost.exe 3864 svchost.exe 1316 spoolsv.exe 1316 spoolsv.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exeexplorer.exespoolsv.exesvchost.exedescription pid process target process PID 3300 wrote to memory of 2808 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe explorer.exe PID 3300 wrote to memory of 2808 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe explorer.exe PID 3300 wrote to memory of 2808 3300 7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe explorer.exe PID 2808 wrote to memory of 2832 2808 explorer.exe spoolsv.exe PID 2808 wrote to memory of 2832 2808 explorer.exe spoolsv.exe PID 2808 wrote to memory of 2832 2808 explorer.exe spoolsv.exe PID 2832 wrote to memory of 3864 2832 spoolsv.exe svchost.exe PID 2832 wrote to memory of 3864 2832 spoolsv.exe svchost.exe PID 2832 wrote to memory of 3864 2832 spoolsv.exe svchost.exe PID 3864 wrote to memory of 1316 3864 svchost.exe spoolsv.exe PID 3864 wrote to memory of 1316 3864 svchost.exe spoolsv.exe PID 3864 wrote to memory of 1316 3864 svchost.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe"C:\Users\Admin\AppData\Local\Temp\7dab476be2380a0836602d2fab4c22ed7a79f2cdb8339b0a5f518dd464915082.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1316
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Resources\Themes\explorer.exeFilesize
2.5MB
MD533d14f1ba4c9daf120a1e2d3426b6e10
SHA11565f3ce9df4ab7f94c2a79699546bfe9536d76b
SHA2566fd03faabd30c18c22a3937b73b5dc7c4941a273936924e8ed32d446c06cc955
SHA512f83800a3eca7923b8188d3c3d73466ea5d7457df248fa17a497cda7c4f7cb35ac9347809f70e600b50635ebaae61ace19a1995ab904ef3717f93b68def243529
-
C:\Windows\Resources\spoolsv.exeFilesize
2.5MB
MD53e0c664cdd06a38dda12f0ca39a3376f
SHA12cb4e06e90794a15a5fb05e351f6c45a8258545c
SHA256c9a12307bcc1731e81cdd719629d28286bb015c546c231aaf03fdaf5c8ec8b92
SHA5123215ea1caf868a6b593ddbcbbf4910d720c1861e9fdd8b0065d106d0ea381bcc1d85c7ef2c74a727a2e29645294a5195078b46094cfc643f41a0f5a08258f46d
-
C:\Windows\Resources\svchost.exeFilesize
2.5MB
MD5bb34b2fad13dcb8bf4329ed329b3c791
SHA1290295575e36da151c026998928f56c3c52aa8ca
SHA256b7d76c63f5bd86ae8601cd7563ad901bbb22b2f50969c906f513e8109f8b0341
SHA51265434436da6a5c108ce1f356a22895138854ee06b906c6d442621020208f63d88a68b12d99872c3ece87de9b92ae654bea6b89f6b9555e4ade5b70cb3ada6155
-
memory/1316-33-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/1316-39-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/2808-54-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/2808-10-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/2808-45-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/2808-62-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/2832-19-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/2832-41-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3300-1-0x0000000077A74000-0x0000000077A76000-memory.dmpFilesize
8KB
-
memory/3300-0-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3300-42-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3864-28-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3864-44-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB
-
memory/3864-65-0x0000000000400000-0x0000000000A0E000-memory.dmpFilesize
6.1MB