Analysis
-
max time kernel
150s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 18:30
Static task
static1
Behavioral task
behavioral1
Sample
b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
Resource
win10v2004-20240426-en
General
-
Target
b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe
-
Size
484KB
-
MD5
85a87698ab94b041f97c4829132d6173
-
SHA1
37da2d86b37878508d384c78302ad749b1f302cf
-
SHA256
b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b
-
SHA512
7f197123662f611dc83a76d4b1b840c568f78ffaea752410558be06d170cfde53745728930c6b9e780bb299bfeb16ed36eb54629f2f7714d54be803b00b142c5
-
SSDEEP
6144:TVfgPRz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCG:pYR1gL5pRTcAkS/3hzN8qE43fm78V
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Logo1_.exeb40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exepid process 4000 Logo1_.exe 4196 b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Logo1_.exedescription ioc process File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Logo1_.exedescription ioc process File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\zh-TW\View3d\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Photo Viewer\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-GB\en-GB_female_TTS\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ro-ro\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\uz-Latn-UZ\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\legal\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.AppTk.NativeDirect3d.UAP\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ca-es\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\tr-tr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Photo Viewer\fr-FR\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\CortanaApp.ViewElements\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jre-1.8\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ar-ae\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\assets\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Defender\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
Processes:
b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exeLogo1_.exedescription ioc process File created C:\Windows\rundl132.exe b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe File created C:\Windows\Logo1_.exe b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
Logo1_.exepid process 4000 Logo1_.exe 4000 Logo1_.exe 4000 Logo1_.exe 4000 Logo1_.exe 4000 Logo1_.exe 4000 Logo1_.exe 4000 Logo1_.exe 4000 Logo1_.exe 4000 Logo1_.exe 4000 Logo1_.exe 4000 Logo1_.exe 4000 Logo1_.exe 4000 Logo1_.exe 4000 Logo1_.exe 4000 Logo1_.exe 4000 Logo1_.exe 4000 Logo1_.exe 4000 Logo1_.exe 4000 Logo1_.exe 4000 Logo1_.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exeLogo1_.exenet.execmd.exedescription pid process target process PID 4652 wrote to memory of 2016 4652 b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe cmd.exe PID 4652 wrote to memory of 2016 4652 b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe cmd.exe PID 4652 wrote to memory of 2016 4652 b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe cmd.exe PID 4652 wrote to memory of 4000 4652 b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe Logo1_.exe PID 4652 wrote to memory of 4000 4652 b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe Logo1_.exe PID 4652 wrote to memory of 4000 4652 b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe Logo1_.exe PID 4000 wrote to memory of 1200 4000 Logo1_.exe net.exe PID 4000 wrote to memory of 1200 4000 Logo1_.exe net.exe PID 4000 wrote to memory of 1200 4000 Logo1_.exe net.exe PID 1200 wrote to memory of 2372 1200 net.exe net1.exe PID 1200 wrote to memory of 2372 1200 net.exe net1.exe PID 1200 wrote to memory of 2372 1200 net.exe net1.exe PID 2016 wrote to memory of 4196 2016 cmd.exe b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe PID 2016 wrote to memory of 4196 2016 cmd.exe b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe PID 4000 wrote to memory of 2940 4000 Logo1_.exe Explorer.EXE PID 4000 wrote to memory of 2940 4000 Logo1_.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe"C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a351A.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe"C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe"4⤵
- Executes dropped EXE
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exeFilesize
251KB
MD5a8bcad95d5ae82bbd579a77cbca70d4c
SHA10404b31bbe8d12f77e26edfbd27573f729382e1a
SHA256662862ac5c4edbaf8ad7483a8deb8ac06855ead35c2d9541bde22535283d3881
SHA512ed1969e6659530edfdfae5bcab18af7558674cd6bb87b0bfb0ade77700d4c01de79e9685eceffdb48a53c5a94026f26fbdfb3de47ddb8986a07222310aa61aca
-
C:\Program Files\7-Zip\7z.exeFilesize
570KB
MD518931813e78b1f2f20c798ccc65caa45
SHA13ea910f3b09412dd8cddde3da0b42154cb78c60e
SHA2563873df5384a7449171451d94fb989c753c214fff58dd0a2c1926523f99b7913b
SHA512a6e29f632ee13a9cd007f6f592901086c6a30be5bd3b92cac94bdc7509228ca17d6166ff167162419f4441488360baf50a6746d380961428a37c5f86b981e882
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exeFilesize
636KB
MD526f10ae795ba6df10c2779f4a535b449
SHA1f00986886ad07550c909b9f02b7b3a9c310e8b0f
SHA256996761040fa3726dbdda9dd94f543e7d0f26f58b5c7a122e900e56b2dacdc7b8
SHA5125f5ea3a050876256571610eec85456ac6b3469ddaa10a6c62d621081718cf8eeedc21cf6381c49c835c6b61690b7c41107b357bb14c044ace1dfe7f827baa93c
-
C:\Users\Admin\AppData\Local\Temp\$$a351A.batFilesize
722B
MD59fd9b6b9a208ff6389a98f1777f4e803
SHA1b738a743be6170ef56556c3cf88f7dfcb04a9619
SHA25655e4e9786cec4e4ca76087e470690572ad983fcc681dd16f13599312223033f8
SHA5126d207e94ee5d3c686854f399c7cd0e0555062b034521e5706985c6eb56febed4d90d623920382539272444f108120a650740d7f6dfee42947c31aae20fd59d3f
-
C:\Users\Admin\AppData\Local\Temp\b40a50a77e54abe10c6193c940775ce5c08b6b6fbfade9831eb6a6e33347134b.exe.exeFilesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
C:\Windows\Logo1_.exeFilesize
26KB
MD57e2d4dc228c87c716412c5f88c8ba1bc
SHA168a1f791f9c818e50919266b4b8fdacbd342f8a4
SHA25660da23d6016a27add33a1c2376bb53a25d04ff24679e9fde80ea37e8204abe4a
SHA512acd4e4ace4c823cf71bcfa44ea4ef8058f9feca480b671cab8e4effd4271e94084c7119a711dbfc9fe7bcb7005e912531c6406141e11748ed3811ac8023d63db
-
F:\$RECYCLE.BIN\S-1-5-21-540404634-651139247-2967210625-1000\_desktop.iniFilesize
9B
MD53b22ce0fee2d1aaf2c66dcd142740e29
SHA194d542b4bb9854a9419753c38e6ffe747653d91c
SHA2568284772f28954a109c16f1583e6e34e29f06673b34e04f268bda961b57ba9f79
SHA512efd4900a49624170e51ea401f0845634f49484a49335845258dc3d41a12e2022bf413a6751fcbcfd1ec68cde506f3363beae57f20e8eaca8b214d28baa138c5b
-
memory/4000-27-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4000-33-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4000-37-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4000-20-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4000-1231-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4000-4797-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4000-11-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4000-5236-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4652-0-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4652-9-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB