Analysis
-
max time kernel
35s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
10-11-2020 11:36
Static task
static1
Behavioral task
behavioral1
Sample
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe
Resource
win10v20201028
General
-
Target
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe
-
Size
166KB
-
MD5
30168bc8ecd55affc43b224091c6945f
-
SHA1
e5cdc65b57a027d7123307ecaf12031bb789aed7
-
SHA256
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb
-
SHA512
60650f2779128ef54d648dbf8e83b5ed079aef99f23df5a29ec50e3672793e8a103214f03af4d74e132aa35cc099aab5eaa4f8e0a76f0878f591470f7bafb138
Malware Config
Extracted
revengerat
NyanCatRevenge
hpdndbnb.duckdns.org:2404
90a49aa7c27647e
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe\"" b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe -
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Drops startup file 2 IoCs
Processes:
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe -
Processes:
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe = "0" b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe = "0" b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe" b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe" b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exepid process 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exedescription pid process target process PID 756 set thread context of 4116 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4256 756 WerFault.exe b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeb2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exeWerFault.exepid process 2824 powershell.exe 2672 powershell.exe 4008 powershell.exe 1764 powershell.exe 2672 powershell.exe 2824 powershell.exe 1764 powershell.exe 4008 powershell.exe 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe 2824 powershell.exe 1764 powershell.exe 2672 powershell.exe 4008 powershell.exe 4256 WerFault.exe 4256 WerFault.exe 4256 WerFault.exe 4256 WerFault.exe 4256 WerFault.exe 4256 WerFault.exe 4256 WerFault.exe 4256 WerFault.exe 4256 WerFault.exe 4256 WerFault.exe 4256 WerFault.exe 4256 WerFault.exe 4256 WerFault.exe 4256 WerFault.exe 4256 WerFault.exe 4256 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exepowershell.exepowershell.exepowershell.exepowershell.exeWerFault.exedescription pid process Token: SeDebugPrivilege 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe Token: SeDebugPrivilege 2672 powershell.exe Token: SeDebugPrivilege 2824 powershell.exe Token: SeDebugPrivilege 4008 powershell.exe Token: SeDebugPrivilege 1764 powershell.exe Token: SeRestorePrivilege 4256 WerFault.exe Token: SeBackupPrivilege 4256 WerFault.exe Token: SeDebugPrivilege 4256 WerFault.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exedescription pid process target process PID 756 wrote to memory of 2672 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe powershell.exe PID 756 wrote to memory of 2672 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe powershell.exe PID 756 wrote to memory of 2672 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe powershell.exe PID 756 wrote to memory of 2824 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe powershell.exe PID 756 wrote to memory of 2824 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe powershell.exe PID 756 wrote to memory of 2824 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe powershell.exe PID 756 wrote to memory of 4008 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe powershell.exe PID 756 wrote to memory of 4008 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe powershell.exe PID 756 wrote to memory of 4008 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe powershell.exe PID 756 wrote to memory of 1764 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe powershell.exe PID 756 wrote to memory of 1764 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe powershell.exe PID 756 wrote to memory of 1764 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe powershell.exe PID 756 wrote to memory of 4116 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe PID 756 wrote to memory of 4116 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe PID 756 wrote to memory of 4116 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe PID 756 wrote to memory of 4116 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe PID 756 wrote to memory of 4116 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe PID 756 wrote to memory of 4116 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe PID 756 wrote to memory of 4116 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe PID 756 wrote to memory of 4116 756 b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe"C:\Users\Admin\AppData\Local\Temp\b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe"C:\Users\Admin\AppData\Local\Temp\b2bd3de3e5b0e35313263bef4b1ca49c5478d472f6d37d1070a57b1f6aa4f7bb.exe"2⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 21962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
5300bce03b8940c3647d921f9d748fee
SHA12a52bd3bbbe4c8ba062f5e7c8608497d39cfbb25
SHA256ca334a4d92ecac77692a5446499cbc695af4973a91dd679ba1de07bb9a90d0ba
SHA51284560535c0c9733bb151e9f09a8bf7dfdb7e66a4877b716d376096794901a6c9a33f4ab49a2213f3f22538098b2edf57bbfcfb62402303c537fa55972f6d0a2d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
252e350197c98c1e253568caa0bb55b5
SHA1df8df418d3eae38521f826f4104248789b30c318
SHA256f1e333ebb6a7a896fd65517554d9e51b16b4c879b066c2d0ab7ea3ebaca23b19
SHA51203e395c331b4c2f39834bc2c6c40737016b5126405c28f221d97af8d265f177b3551d7d9f1869a1f8a82d53701f312d58628105f62da19f444360c49aadc1276
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
f4f46f90dc340199cfdb7cdaf49ff91b
SHA17e3e1ae5ce536e4f8f39af3d34a5f62647b7139a
SHA25679b6e6f769516908810a23e18dce78af696acb0e1c9669d0e7e69c9bb4853f10
SHA5123e8d751c0cdf9f74df2035d6cc107f828f9737418e2b238f1c2552bedbdefede5e07ec35977a005f742af15dcae20118df6a7b12de3e5e00e9556bc9b829a568
-
memory/756-1-0x0000000000310000-0x0000000000311000-memory.dmpFilesize
4KB
-
memory/756-3-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/756-4-0x0000000004A80000-0x0000000004A9C000-memory.dmpFilesize
112KB
-
memory/756-5-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/756-0-0x00000000739A0000-0x000000007408E000-memory.dmpFilesize
6.9MB
-
memory/1764-19-0x00000000739A0000-0x000000007408E000-memory.dmpFilesize
6.9MB
-
memory/1764-10-0x0000000000000000-mapping.dmp
-
memory/1764-100-0x00000000099B0000-0x00000000099B1000-memory.dmpFilesize
4KB
-
memory/2672-27-0x0000000007510000-0x0000000007511000-memory.dmpFilesize
4KB
-
memory/2672-13-0x0000000006DE0000-0x0000000006DE1000-memory.dmpFilesize
4KB
-
memory/2672-6-0x0000000000000000-mapping.dmp
-
memory/2672-22-0x0000000006B10000-0x0000000006B11000-memory.dmpFilesize
4KB
-
memory/2672-24-0x0000000006BB0000-0x0000000006BB1000-memory.dmpFilesize
4KB
-
memory/2672-25-0x0000000006C20000-0x0000000006C21000-memory.dmpFilesize
4KB
-
memory/2672-11-0x0000000004170000-0x0000000004171000-memory.dmpFilesize
4KB
-
memory/2672-38-0x0000000006CF0000-0x0000000006CF1000-memory.dmpFilesize
4KB
-
memory/2672-39-0x0000000007C20000-0x0000000007C21000-memory.dmpFilesize
4KB
-
memory/2672-9-0x00000000739A0000-0x000000007408E000-memory.dmpFilesize
6.9MB
-
memory/2824-104-0x0000000009D00000-0x0000000009D01000-memory.dmpFilesize
4KB
-
memory/2824-110-0x00000000097A0000-0x00000000097A1000-memory.dmpFilesize
4KB
-
memory/2824-52-0x0000000008A80000-0x0000000008A81000-memory.dmpFilesize
4KB
-
memory/2824-12-0x00000000739A0000-0x000000007408E000-memory.dmpFilesize
6.9MB
-
memory/2824-7-0x0000000000000000-mapping.dmp
-
memory/4008-91-0x0000000008F20000-0x0000000008F21000-memory.dmpFilesize
4KB
-
memory/4008-87-0x0000000008A60000-0x0000000008A61000-memory.dmpFilesize
4KB
-
memory/4008-14-0x00000000739A0000-0x000000007408E000-memory.dmpFilesize
6.9MB
-
memory/4008-63-0x0000000008DF0000-0x0000000008E23000-memory.dmpFilesize
204KB
-
memory/4008-8-0x0000000000000000-mapping.dmp
-
memory/4116-48-0x00000000739A0000-0x000000007408E000-memory.dmpFilesize
6.9MB
-
memory/4116-46-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4116-47-0x000000000040501E-mapping.dmp
-
memory/4256-57-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/4256-56-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB