Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
29-07-2020 05:32
Static task
static1
Behavioral task
behavioral1
Sample
SKM_454e20070310530.scr
Resource
win7v200722
Behavioral task
behavioral2
Sample
SKM_454e20070310530.scr
Resource
win10
General
-
Target
SKM_454e20070310530.scr
-
Size
809KB
-
MD5
f5b3048dd2e673f152d32b45a627f75a
-
SHA1
231899877604d50a2692781358f090f0fdd21c62
-
SHA256
b1e971ba689623d9fbc5befb741a9d9e046515a0c05d0adc27a165471bc6303d
-
SHA512
36d5ee0eeb2472fd5f61ce34906f4b17ae64b609262009e5548697911216aa31f139cf95739cbbbb4036b9ff07de7135cb4bf990b7985e99c6cd6e4ade76c130
Malware Config
Signatures
-
Suspicious use of SetThreadContext 7 IoCs
Processes:
SKM_454e20070310530.scrgaqevoevyn.execmd.exenet.exedescription pid process target process PID 1516 set thread context of 1504 1516 SKM_454e20070310530.scr SKM_454e20070310530.scr PID 1804 set thread context of 1744 1804 gaqevoevyn.exe gaqevoevyn.exe PID 1628 set thread context of 1492 1628 cmd.exe ipconfig.exe PID 1628 set thread context of 1696 1628 cmd.exe tasklist.exe PID 1628 set thread context of 752 1628 cmd.exe netsh.exe PID 1628 set thread context of 1592 1628 cmd.exe net.exe PID 1592 set thread context of 1872 1592 net.exe net1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 1280 WinMail.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
gaqevoevyn.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\SOFTWARE\Microsoft\Windows\Currentversion\Run gaqevoevyn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Currentversion\Run gaqevoevyn.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ywzaileqyq = "C:\\Users\\Admin\\AppData\\Roaming\\Xyanarru\\gaqevoevyn.exe" gaqevoevyn.exe -
Modifies Windows Firewall 1 TTPs
-
Executes dropped EXE 2 IoCs
Processes:
gaqevoevyn.exegaqevoevyn.exepid process 1804 gaqevoevyn.exe 1744 gaqevoevyn.exe -
Modifies service 2 TTPs 7 IoCs
Processes:
netsh.exeipconfig.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas ipconfig.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs ipconfig.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
WinMail.exepid process 1280 WinMail.exe -
Processes:
resource yara_rule behavioral1/memory/1492-86-0x0000000000250000-0x00000000002BC000-memory.dmp upx behavioral1/memory/1696-89-0x0000000002340000-0x00000000023AC000-memory.dmp upx behavioral1/memory/752-92-0x0000000000210000-0x000000000027C000-memory.dmp upx behavioral1/memory/1872-98-0x0000000001EA0000-0x0000000001F0C000-memory.dmp upx -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
SKM_454e20070310530.scrSKM_454e20070310530.scrgaqevoevyn.exegaqevoevyn.exepid process 1516 SKM_454e20070310530.scr 1504 SKM_454e20070310530.scr 1804 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe -
Suspicious use of WriteProcessMemory 109 IoCs
Processes:
SKM_454e20070310530.scrSKM_454e20070310530.scrgaqevoevyn.exegaqevoevyn.execmd.exedescription pid process target process PID 1516 wrote to memory of 1504 1516 SKM_454e20070310530.scr SKM_454e20070310530.scr PID 1516 wrote to memory of 1504 1516 SKM_454e20070310530.scr SKM_454e20070310530.scr PID 1516 wrote to memory of 1504 1516 SKM_454e20070310530.scr SKM_454e20070310530.scr PID 1516 wrote to memory of 1504 1516 SKM_454e20070310530.scr SKM_454e20070310530.scr PID 1504 wrote to memory of 1804 1504 SKM_454e20070310530.scr gaqevoevyn.exe PID 1504 wrote to memory of 1804 1504 SKM_454e20070310530.scr gaqevoevyn.exe PID 1504 wrote to memory of 1804 1504 SKM_454e20070310530.scr gaqevoevyn.exe PID 1504 wrote to memory of 1804 1504 SKM_454e20070310530.scr gaqevoevyn.exe PID 1804 wrote to memory of 1744 1804 gaqevoevyn.exe gaqevoevyn.exe PID 1804 wrote to memory of 1744 1804 gaqevoevyn.exe gaqevoevyn.exe PID 1804 wrote to memory of 1744 1804 gaqevoevyn.exe gaqevoevyn.exe PID 1804 wrote to memory of 1744 1804 gaqevoevyn.exe gaqevoevyn.exe PID 1504 wrote to memory of 1840 1504 SKM_454e20070310530.scr cmd.exe PID 1504 wrote to memory of 1840 1504 SKM_454e20070310530.scr cmd.exe PID 1504 wrote to memory of 1840 1504 SKM_454e20070310530.scr cmd.exe PID 1504 wrote to memory of 1840 1504 SKM_454e20070310530.scr cmd.exe PID 1744 wrote to memory of 1092 1744 gaqevoevyn.exe taskhost.exe PID 1744 wrote to memory of 1092 1744 gaqevoevyn.exe taskhost.exe PID 1744 wrote to memory of 1092 1744 gaqevoevyn.exe taskhost.exe PID 1744 wrote to memory of 1092 1744 gaqevoevyn.exe taskhost.exe PID 1744 wrote to memory of 1092 1744 gaqevoevyn.exe taskhost.exe PID 1744 wrote to memory of 1176 1744 gaqevoevyn.exe Dwm.exe PID 1744 wrote to memory of 1176 1744 gaqevoevyn.exe Dwm.exe PID 1744 wrote to memory of 1176 1744 gaqevoevyn.exe Dwm.exe PID 1744 wrote to memory of 1176 1744 gaqevoevyn.exe Dwm.exe PID 1744 wrote to memory of 1176 1744 gaqevoevyn.exe Dwm.exe PID 1744 wrote to memory of 1236 1744 gaqevoevyn.exe Explorer.EXE PID 1744 wrote to memory of 1236 1744 gaqevoevyn.exe Explorer.EXE PID 1744 wrote to memory of 1236 1744 gaqevoevyn.exe Explorer.EXE PID 1744 wrote to memory of 1236 1744 gaqevoevyn.exe Explorer.EXE PID 1744 wrote to memory of 1236 1744 gaqevoevyn.exe Explorer.EXE PID 1744 wrote to memory of 1628 1744 gaqevoevyn.exe cmd.exe PID 1744 wrote to memory of 1628 1744 gaqevoevyn.exe cmd.exe PID 1744 wrote to memory of 1628 1744 gaqevoevyn.exe cmd.exe PID 1744 wrote to memory of 1628 1744 gaqevoevyn.exe cmd.exe PID 1744 wrote to memory of 2024 1744 gaqevoevyn.exe DllHost.exe PID 1744 wrote to memory of 2024 1744 gaqevoevyn.exe DllHost.exe PID 1744 wrote to memory of 2024 1744 gaqevoevyn.exe DllHost.exe PID 1744 wrote to memory of 2024 1744 gaqevoevyn.exe DllHost.exe PID 1744 wrote to memory of 2024 1744 gaqevoevyn.exe DllHost.exe PID 1744 wrote to memory of 752 1744 gaqevoevyn.exe DllHost.exe PID 1744 wrote to memory of 752 1744 gaqevoevyn.exe DllHost.exe PID 1744 wrote to memory of 752 1744 gaqevoevyn.exe DllHost.exe PID 1744 wrote to memory of 752 1744 gaqevoevyn.exe DllHost.exe PID 1744 wrote to memory of 752 1744 gaqevoevyn.exe DllHost.exe PID 1744 wrote to memory of 1628 1744 gaqevoevyn.exe cmd.exe PID 1744 wrote to memory of 1628 1744 gaqevoevyn.exe cmd.exe PID 1744 wrote to memory of 1628 1744 gaqevoevyn.exe cmd.exe PID 1744 wrote to memory of 1628 1744 gaqevoevyn.exe cmd.exe PID 1744 wrote to memory of 1628 1744 gaqevoevyn.exe cmd.exe PID 1628 wrote to memory of 1604 1628 cmd.exe HOSTNAME.EXE PID 1628 wrote to memory of 1604 1628 cmd.exe HOSTNAME.EXE PID 1628 wrote to memory of 1604 1628 cmd.exe HOSTNAME.EXE PID 1628 wrote to memory of 1604 1628 cmd.exe HOSTNAME.EXE PID 1628 wrote to memory of 1492 1628 cmd.exe ipconfig.exe PID 1628 wrote to memory of 1492 1628 cmd.exe ipconfig.exe PID 1628 wrote to memory of 1492 1628 cmd.exe ipconfig.exe PID 1628 wrote to memory of 1492 1628 cmd.exe ipconfig.exe PID 1628 wrote to memory of 1492 1628 cmd.exe ipconfig.exe PID 1628 wrote to memory of 1492 1628 cmd.exe ipconfig.exe PID 1628 wrote to memory of 1492 1628 cmd.exe ipconfig.exe PID 1628 wrote to memory of 1492 1628 cmd.exe ipconfig.exe PID 1628 wrote to memory of 1492 1628 cmd.exe ipconfig.exe PID 1744 wrote to memory of 1560 1744 gaqevoevyn.exe conhost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
SKM_454e20070310530.scrgaqevoevyn.exepid process 1516 SKM_454e20070310530.scr 1804 gaqevoevyn.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1840 cmd.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WinMail.exepid process 1280 WinMail.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\41884390-00000001.eml:OECustomProperty WinMail.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1492 ipconfig.exe -
Loads dropped DLL 6 IoCs
Processes:
SKM_454e20070310530.scrgaqevoevyn.exepid process 1504 SKM_454e20070310530.scr 1504 SKM_454e20070310530.scr 1504 SKM_454e20070310530.scr 1504 SKM_454e20070310530.scr 1744 gaqevoevyn.exe 1744 gaqevoevyn.exe -
Suspicious use of AdjustPrivilegeToken 1436 IoCs
Processes:
SKM_454e20070310530.scrgaqevoevyn.exedescription pid process Token: SeSecurityPrivilege 1504 SKM_454e20070310530.scr Token: SeSecurityPrivilege 1504 SKM_454e20070310530.scr Token: SeSecurityPrivilege 1504 SKM_454e20070310530.scr Token: SeSecurityPrivilege 1504 SKM_454e20070310530.scr Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe Token: SeSecurityPrivilege 1744 gaqevoevyn.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Privacy cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" cmd.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\SKM_454e20070310530.scr"C:\Users\Admin\AppData\Local\Temp\SKM_454e20070310530.scr" /S2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\SKM_454e20070310530.scr"C:\Users\Admin\AppData\Local\Temp\SKM_454e20070310530.scr" /S3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Xyanarru\gaqevoevyn.exe"C:\Users\Admin\AppData\Roaming\Xyanarru\gaqevoevyn.exe"4⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\Xyanarru\gaqevoevyn.exe"C:\Users\Admin\AppData\Roaming\Xyanarru\gaqevoevyn.exe"5⤵
- Adds Run key to start application
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\HOSTNAME.EXEhostname7⤵
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all7⤵
- Modifies service
- Gathers network information
-
C:\Windows\SysWOW64\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable7⤵
- Modifies service
-
C:\Windows\SysWOW64\net.exenet share7⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpfaa8735e.bat"4⤵
- Deletes itself
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "596256797714484377-5645258011643653190-7302763492490255151284170058-687544750"1⤵
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of SendNotifyMessage
- Suspicious use of FindShellTrayWindow
- NTFS ADS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
-
C:\Users\Admin\AppData\Local\Temp\tmpfaa8735e.bat
-
C:\Users\Admin\AppData\Roaming\Liqeyfzy\tenoeranxo.teu
-
C:\Users\Admin\AppData\Roaming\Owygipimemha\yrpoobcu.uqr
-
C:\Users\Admin\AppData\Roaming\Owygipimemha\yrpoobcu.uqr
-
C:\Users\Admin\AppData\Roaming\Xyanarru\gaqevoevyn.exe
-
C:\Users\Admin\AppData\Roaming\Xyanarru\gaqevoevyn.exe
-
C:\Users\Admin\AppData\Roaming\Xyanarru\gaqevoevyn.exe
-
\Users\Admin\AppData\Local\Temp\tmp6C39.tmp
-
\Users\Admin\AppData\Local\Temp\tmp6CD6.tmp
-
\Users\Admin\AppData\Local\Temp\tmp7C9E.tmp
-
\Users\Admin\AppData\Local\Temp\tmp7CCE.tmp
-
\Users\Admin\AppData\Roaming\Xyanarru\gaqevoevyn.exe
-
\Users\Admin\AppData\Roaming\Xyanarru\gaqevoevyn.exe
-
memory/752-92-0x0000000000210000-0x000000000027C000-memory.dmpFilesize
432KB
-
memory/752-91-0x000000000007025A-mapping.dmp
-
memory/1280-67-0x0000000005870000-0x0000000005872000-memory.dmpFilesize
8KB
-
memory/1280-56-0x0000000004BD0000-0x0000000004BD2000-memory.dmpFilesize
8KB
-
memory/1280-79-0x0000000002390000-0x00000000023A0000-memory.dmpFilesize
64KB
-
memory/1280-73-0x00000000023F0000-0x0000000002400000-memory.dmpFilesize
64KB
-
memory/1280-71-0x00000000038F0000-0x00000000039F0000-memory.dmpFilesize
1024KB
-
memory/1280-70-0x0000000004C30000-0x0000000004C32000-memory.dmpFilesize
8KB
-
memory/1280-24-0x00000000038F0000-0x00000000039F0000-memory.dmpFilesize
1024KB
-
memory/1280-26-0x00000000038F0000-0x0000000003AF0000-memory.dmpFilesize
2.0MB
-
memory/1280-28-0x00000000038F0000-0x00000000039F0000-memory.dmpFilesize
1024KB
-
memory/1280-29-0x00000000038F0000-0x0000000003AF0000-memory.dmpFilesize
2.0MB
-
memory/1280-30-0x00000000039F0000-0x0000000003AF0000-memory.dmpFilesize
1024KB
-
memory/1280-34-0x0000000002550000-0x0000000002552000-memory.dmpFilesize
8KB
-
memory/1280-35-0x0000000002560000-0x0000000002562000-memory.dmpFilesize
8KB
-
memory/1280-36-0x0000000003AF0000-0x0000000003AF2000-memory.dmpFilesize
8KB
-
memory/1280-37-0x0000000002560000-0x0000000002562000-memory.dmpFilesize
8KB
-
memory/1280-38-0x0000000003F90000-0x0000000003F92000-memory.dmpFilesize
8KB
-
memory/1280-39-0x0000000003DD0000-0x0000000003DD2000-memory.dmpFilesize
8KB
-
memory/1280-40-0x0000000003EE0000-0x0000000003EE2000-memory.dmpFilesize
8KB
-
memory/1280-41-0x0000000003B40000-0x0000000003B42000-memory.dmpFilesize
8KB
-
memory/1280-42-0x0000000003DC0000-0x0000000003DC2000-memory.dmpFilesize
8KB
-
memory/1280-43-0x0000000003F20000-0x0000000003F22000-memory.dmpFilesize
8KB
-
memory/1280-44-0x0000000003B40000-0x0000000003B42000-memory.dmpFilesize
8KB
-
memory/1280-45-0x0000000003EE0000-0x0000000003EE2000-memory.dmpFilesize
8KB
-
memory/1280-46-0x0000000002550000-0x0000000002552000-memory.dmpFilesize
8KB
-
memory/1280-47-0x0000000003B40000-0x0000000003B42000-memory.dmpFilesize
8KB
-
memory/1280-48-0x0000000003F00000-0x0000000003F02000-memory.dmpFilesize
8KB
-
memory/1280-49-0x0000000004320000-0x0000000004322000-memory.dmpFilesize
8KB
-
memory/1280-50-0x0000000003DD0000-0x0000000003DD2000-memory.dmpFilesize
8KB
-
memory/1280-51-0x0000000004A90000-0x0000000004A92000-memory.dmpFilesize
8KB
-
memory/1280-52-0x0000000004AA0000-0x0000000004AA2000-memory.dmpFilesize
8KB
-
memory/1280-53-0x00000000044C0000-0x00000000044C2000-memory.dmpFilesize
8KB
-
memory/1280-54-0x0000000004AB0000-0x0000000004AB2000-memory.dmpFilesize
8KB
-
memory/1280-55-0x00000000044B0000-0x00000000044B2000-memory.dmpFilesize
8KB
-
memory/1280-69-0x00000000057D0000-0x00000000057D2000-memory.dmpFilesize
8KB
-
memory/1280-57-0x00000000044A0000-0x00000000044A2000-memory.dmpFilesize
8KB
-
memory/1280-58-0x0000000004BF0000-0x0000000004BF2000-memory.dmpFilesize
8KB
-
memory/1280-59-0x0000000004490000-0x0000000004492000-memory.dmpFilesize
8KB
-
memory/1280-60-0x0000000004C00000-0x0000000004C02000-memory.dmpFilesize
8KB
-
memory/1280-61-0x0000000004480000-0x0000000004482000-memory.dmpFilesize
8KB
-
memory/1280-62-0x0000000004C10000-0x0000000004C12000-memory.dmpFilesize
8KB
-
memory/1280-63-0x0000000004C20000-0x0000000004C22000-memory.dmpFilesize
8KB
-
memory/1280-64-0x0000000003DB0000-0x0000000003DB2000-memory.dmpFilesize
8KB
-
memory/1280-65-0x0000000003D60000-0x0000000003D62000-memory.dmpFilesize
8KB
-
memory/1280-66-0x0000000005880000-0x0000000005882000-memory.dmpFilesize
8KB
-
memory/1280-68-0x00000000057E0000-0x00000000057E2000-memory.dmpFilesize
8KB
-
memory/1492-23-0x000000000007025A-mapping.dmp
-
memory/1492-22-0x0000000000050000-0x0000000000097000-memory.dmpFilesize
284KB
-
memory/1492-86-0x0000000000250000-0x00000000002BC000-memory.dmpFilesize
432KB
-
memory/1504-1-0x000000000043F4D4-mapping.dmp
-
memory/1504-2-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/1504-0-0x0000000000400000-0x0000000000447000-memory.dmpFilesize
284KB
-
memory/1592-93-0x00000000000C0000-0x0000000000107000-memory.dmpFilesize
284KB
-
memory/1592-94-0x00000000000E025A-mapping.dmp
-
memory/1604-21-0x0000000000000000-mapping.dmp
-
memory/1628-19-0x0000000000000000-mapping.dmp
-
memory/1628-18-0x0000000000000000-mapping.dmp
-
memory/1696-89-0x0000000002340000-0x00000000023AC000-memory.dmpFilesize
432KB
-
memory/1696-88-0x000000000007025A-mapping.dmp
-
memory/1696-87-0x0000000000050000-0x0000000000097000-memory.dmpFilesize
284KB
-
memory/1744-11-0x000000000043F4D4-mapping.dmp
-
memory/1804-7-0x0000000000000000-mapping.dmp
-
memory/1840-14-0x0000000000000000-mapping.dmp
-
memory/1872-96-0x0000000000050000-0x0000000000097000-memory.dmpFilesize
284KB
-
memory/1872-97-0x000000000007025A-mapping.dmp
-
memory/1872-98-0x0000000001EA0000-0x0000000001F0C000-memory.dmpFilesize
432KB