Analysis
-
max time kernel
135s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23-07-2024 20:35
Behavioral task
behavioral1
Sample
39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe
Resource
win7-20240704-en
General
-
Target
39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe
-
Size
1.1MB
-
MD5
e14412124707736758d337173318fdf8
-
SHA1
cae1daaf19b641cb2a30dd8c4c130d9c4dcd7086
-
SHA256
39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00
-
SHA512
7bdb1efd0e0b4ec6bb21c2a9af2a42fd7fe6eb30426905c5d5f7476784acd2f6f8d25fab28a33649c2086ceb812524a4ddf7215eb8657927146716080d650abd
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUSTsU9+s8juCCh9:E5aIwC+Agr6SNasrsFCK
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\WinSocket\39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/1140-15-0x0000000000310000-0x0000000000339000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exepid process 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe 2396 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe 1944 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe -
Loads dropped DLL 2 IoCs
Processes:
39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exepid process 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 2836 sc.exe 2852 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
powershell.exe39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.execmd.execmd.exesc.exe39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.execmd.exesc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exepowershell.exepid process 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe 2776 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exe39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exedescription pid process Token: SeDebugPrivilege 2776 powershell.exe Token: SeTcbPrivilege 2396 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe Token: SeTcbPrivilege 1944 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exepid process 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe 2396 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe 1944 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.execmd.execmd.execmd.exe39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exetaskeng.exe39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exedescription pid process target process PID 1140 wrote to memory of 2788 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe cmd.exe PID 1140 wrote to memory of 2788 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe cmd.exe PID 1140 wrote to memory of 2788 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe cmd.exe PID 1140 wrote to memory of 2788 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe cmd.exe PID 1140 wrote to memory of 2884 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe cmd.exe PID 1140 wrote to memory of 2884 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe cmd.exe PID 1140 wrote to memory of 2884 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe cmd.exe PID 1140 wrote to memory of 2884 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe cmd.exe PID 1140 wrote to memory of 2904 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe cmd.exe PID 1140 wrote to memory of 2904 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe cmd.exe PID 1140 wrote to memory of 2904 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe cmd.exe PID 1140 wrote to memory of 2904 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe cmd.exe PID 1140 wrote to memory of 2912 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe PID 1140 wrote to memory of 2912 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe PID 1140 wrote to memory of 2912 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe PID 1140 wrote to memory of 2912 1140 39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe PID 2788 wrote to memory of 2836 2788 cmd.exe sc.exe PID 2788 wrote to memory of 2836 2788 cmd.exe sc.exe PID 2788 wrote to memory of 2836 2788 cmd.exe sc.exe PID 2788 wrote to memory of 2836 2788 cmd.exe sc.exe PID 2884 wrote to memory of 2852 2884 cmd.exe sc.exe PID 2884 wrote to memory of 2852 2884 cmd.exe sc.exe PID 2884 wrote to memory of 2852 2884 cmd.exe sc.exe PID 2884 wrote to memory of 2852 2884 cmd.exe sc.exe PID 2904 wrote to memory of 2776 2904 cmd.exe powershell.exe PID 2904 wrote to memory of 2776 2904 cmd.exe powershell.exe PID 2904 wrote to memory of 2776 2904 cmd.exe powershell.exe PID 2904 wrote to memory of 2776 2904 cmd.exe powershell.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2912 wrote to memory of 2864 2912 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2200 wrote to memory of 2396 2200 taskeng.exe 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe PID 2200 wrote to memory of 2396 2200 taskeng.exe 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe PID 2200 wrote to memory of 2396 2200 taskeng.exe 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe PID 2200 wrote to memory of 2396 2200 taskeng.exe 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe PID 2396 wrote to memory of 396 2396 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2396 wrote to memory of 396 2396 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2396 wrote to memory of 396 2396 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe PID 2396 wrote to memory of 396 2396 39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe"C:\Users\Admin\AppData\Local\Temp\39466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\WinSocket\39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exeC:\Users\Admin\AppData\Roaming\WinSocket\39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {8B81A049-91A3-4F6B-86D5-1E61042EA5E7} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinSocket\39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exeC:\Users\Admin\AppData\Roaming\WinSocket\39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exeC:\Users\Admin\AppData\Roaming\WinSocket\39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\WinSocket\39477363b09bce284ea3834b196862c89d8091d33a7afacd19c913d170c96d00.exeFilesize
1.1MB
MD5e14412124707736758d337173318fdf8
SHA1cae1daaf19b641cb2a30dd8c4c130d9c4dcd7086
SHA25639466353b09bce274ea3734b195752c78d7091d33a6afacd19c913d160c95d00
SHA5127bdb1efd0e0b4ec6bb21c2a9af2a42fd7fe6eb30426905c5d5f7476784acd2f6f8d25fab28a33649c2086ceb812524a4ddf7215eb8657927146716080d650abd
-
memory/1140-5-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1140-8-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1140-18-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/1140-13-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1140-12-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1140-11-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1140-10-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1140-7-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1140-14-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1140-4-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1140-3-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1140-2-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1140-15-0x0000000000310000-0x0000000000339000-memory.dmpFilesize
164KB
-
memory/1140-17-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/1140-6-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1140-9-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2396-73-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2396-66-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2396-74-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2396-72-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2396-64-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2396-63-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2396-65-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2396-71-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2396-67-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2396-68-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2396-69-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2396-70-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2864-55-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2864-50-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/2864-51-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/2912-41-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2912-30-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2912-31-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2912-32-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2912-33-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2912-34-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2912-35-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2912-36-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2912-37-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2912-38-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2912-39-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2912-40-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2912-44-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/2912-49-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB