Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 18:30
Static task
static1
Behavioral task
behavioral1
Sample
688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe
Resource
win10v2004-20240426-en
General
-
Target
688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe
-
Size
711KB
-
MD5
b7136b0a4fd467638a8ac1c1b232b0e1
-
SHA1
05d726269f87b5fbc098930de52cc26b794d502e
-
SHA256
688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a
-
SHA512
b7cae8b6d24b4524f50b2c3e9e537117d753420ea7335b447332b5dd7e1596e192cbe074959d8fc8c4809a99c6c88949184abf5e852bfa6c9002a893367d83d6
-
SSDEEP
12288:8pKfC6Aj+TN5uixZN+8rKhUdTC/wE1ZD0Ca5ZIXV:8pGLOS2opPIXV
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Logo1_.exe688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exepid process 1504 Logo1_.exe 3236 688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Logo1_.exedescription ioc process File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Logo1_.exedescription ioc process File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Resources\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\tr-tr\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ky\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hr-hr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\sv-se\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-ma\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Views\Utilities\Styling\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\EnsoUI\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\es-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\oc\_desktop.ini Logo1_.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\contrast-standard\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe Logo1_.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Java\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\sk\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
Processes:
688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exeLogo1_.exedescription ioc process File created C:\Windows\rundl132.exe 688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe File created C:\Windows\Logo1_.exe 688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
Logo1_.exepid process 1504 Logo1_.exe 1504 Logo1_.exe 1504 Logo1_.exe 1504 Logo1_.exe 1504 Logo1_.exe 1504 Logo1_.exe 1504 Logo1_.exe 1504 Logo1_.exe 1504 Logo1_.exe 1504 Logo1_.exe 1504 Logo1_.exe 1504 Logo1_.exe 1504 Logo1_.exe 1504 Logo1_.exe 1504 Logo1_.exe 1504 Logo1_.exe 1504 Logo1_.exe 1504 Logo1_.exe 1504 Logo1_.exe 1504 Logo1_.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exeLogo1_.exenet.execmd.exedescription pid process target process PID 1536 wrote to memory of 2768 1536 688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe cmd.exe PID 1536 wrote to memory of 2768 1536 688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe cmd.exe PID 1536 wrote to memory of 2768 1536 688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe cmd.exe PID 1536 wrote to memory of 1504 1536 688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe Logo1_.exe PID 1536 wrote to memory of 1504 1536 688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe Logo1_.exe PID 1536 wrote to memory of 1504 1536 688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe Logo1_.exe PID 1504 wrote to memory of 4828 1504 Logo1_.exe net.exe PID 1504 wrote to memory of 4828 1504 Logo1_.exe net.exe PID 1504 wrote to memory of 4828 1504 Logo1_.exe net.exe PID 4828 wrote to memory of 1472 4828 net.exe net1.exe PID 4828 wrote to memory of 1472 4828 net.exe net1.exe PID 4828 wrote to memory of 1472 4828 net.exe net1.exe PID 2768 wrote to memory of 3236 2768 cmd.exe 688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe PID 2768 wrote to memory of 3236 2768 cmd.exe 688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe PID 1504 wrote to memory of 3404 1504 Logo1_.exe Explorer.EXE PID 1504 wrote to memory of 3404 1504 Logo1_.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe"C:\Users\Admin\AppData\Local\Temp\688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3836.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe"C:\Users\Admin\AppData\Local\Temp\688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe"4⤵
- Executes dropped EXE
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exeFilesize
252KB
MD50b2679dc1eb882abf56d11ca591aeb76
SHA17a5c7ff9a42f9c84873d269d1e776a89045a1f45
SHA2563d1b129d45f7fe6c861e380906a0c97576a804240426a0d2408f131cbaedc354
SHA5128661ecb16631ac033db4d7ee8aa291647ca3311888988693633acd1a69fd9d6eb890c94c97656602c47964219a082f875bce41710fe036cf546c29ae49e2e114
-
C:\Program Files\7-Zip\7z.exeFilesize
571KB
MD514a1606ee014690541ddd1c51169cba2
SHA12a75e583a802f1737912793c4977721b976a29b8
SHA25641a57fc5677fdb1ae06acc8ad9c88f8ca184d986ef55a0551c5558372da8e065
SHA512cd36672cd1ad94990e928c81e872d2ec9fa0cb0765b0002b5b676d62f801ac6df077ab042eb978a1f9fef644e92d08ef2cdc6f860d2161b0e12848108fa7fef7
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exeFilesize
637KB
MD59cba1e86016b20490fff38fb45ff4963
SHA1378720d36869d50d06e9ffeef87488fbc2a8c8f7
SHA256a22e6d0f5c7d44fefc2204e0f7c7b048e1684f6cf249ba98c006bbf791c22d19
SHA5122f3737d29ea3925d10ea5c717786425f6434be732974586328f03691a35cd1539828e3301685749e5c4135b8094f15b87fb9659915de63678a25749e2f8f5765
-
C:\Users\Admin\AppData\Local\Temp\$$a3836.batFilesize
722B
MD52e1ba8502b194d968e229bac7f98c9b4
SHA122953c01f7e226b0ffc1390b5dcbba36ee37bfef
SHA256be28401b5baf7b3127c4e3d73f25bd20aa967f80b15d123137a64b8df6aa4809
SHA512f19fa1b270e2c35fc5859a4ebafc2a07d99b0236e3ce07d56979b91cab3f9c412b2dd988245cda320ed3975af8231fb60460e57e3699401c00f048b03b5ae8db
-
C:\Users\Admin\AppData\Local\Temp\688687fa3a90436342e29494c85c5025adbfce0c9761611ec6c7c21fc0c1594a.exe.exeFilesize
684KB
MD550f289df0c19484e970849aac4e6f977
SHA13dc77c8830836ab844975eb002149b66da2e10be
SHA256b9b179b305c5268ad428b6ae59de10b4fe99cf0199bbc89b7017181905e97305
SHA512877d852ea1062b90e2fd2f3c4dc7d05d9697e9a9b2929c830a770b62741f6a11e06de73275eb871113f11143faf1cb40d99f7c247862ffb778d26833ed5d7e38
-
C:\Windows\Logo1_.exeFilesize
27KB
MD5d0d42004d5e14fecf764dc99963c82fa
SHA12b05a3b17e23a16df2a838d31d8c4113993dd833
SHA256fe58d080c6a43f69deaec1b3fa9ffa2963dd9a3384b6f3aa9895c4dd2c485a8f
SHA51272f9b71e46512dfcec9bd294930cc9a01acdb8c5b33a3c9a48c9475889f300e35d13191e5868c9798fd335af5a32793f19180b9d015ec18d2b112d0ac1749bee
-
F:\$RECYCLE.BIN\S-1-5-21-4018855536-2201274732-320770143-1000\_desktop.iniFilesize
9B
MD53b22ce0fee2d1aaf2c66dcd142740e29
SHA194d542b4bb9854a9419753c38e6ffe747653d91c
SHA2568284772f28954a109c16f1583e6e34e29f06673b34e04f268bda961b57ba9f79
SHA512efd4900a49624170e51ea401f0845634f49484a49335845258dc3d41a12e2022bf413a6751fcbcfd1ec68cde506f3363beae57f20e8eaca8b214d28baa138c5b
-
memory/1504-26-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1504-32-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1504-36-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1504-19-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1504-1230-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1504-4796-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1504-10-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1504-5235-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1536-0-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1536-8-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB