Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-01-2021 17:06
Static task
static1
Behavioral task
behavioral1
Sample
EbookReader2019.exe
Resource
win7v20201028
General
-
Target
EbookReader2019.exe
-
Size
6.3MB
-
MD5
847c79e639fb34c2058728ca2fda7bd4
-
SHA1
7f1612cae512f41aa91fec27fab0dac73f65e4da
-
SHA256
8e866375a8d49db2282a0ef0d38667b38ee10bcb23fd63692c65749fb3217f2d
-
SHA512
05c5f5943a432c7e5080e8403d6ca1fa31ea1f47fb4820fed1ad14cd972caa7bb8f620500fa72fd4f66bba63820f6d1d984b6e370524e2ea71a0bf32688875bc
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 5 IoCs
Processes:
1.exe2.exe3.exe1.exe1.exepid process 1760 1.exe 1724 2.exe 1284 3.exe 2200 1.exe 2460 1.exe -
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
1.exe2.exe3.exe1.exe1.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3.exe -
Identifies Wine through registry keys 2 TTPs 5 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
1.exe2.exe3.exe1.exe1.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Wine 1.exe Key opened \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Wine 2.exe Key opened \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Wine 3.exe Key opened \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Wine 1.exe Key opened \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Wine 1.exe -
Loads dropped DLL 4 IoCs
Processes:
EbookReader2019.exe1.exepid process 744 EbookReader2019.exe 744 EbookReader2019.exe 1760 1.exe 1760 1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
1.exe2.exe3.exe1.exe1.exepid process 1760 1.exe 1724 2.exe 1284 3.exe 2200 1.exe 2460 1.exe -
Drops file in Program Files directory 3 IoCs
Processes:
EbookReader2019.exedescription ioc process File created C:\Program Files (x86)\Margin\Marg\1.exe EbookReader2019.exe File created C:\Program Files (x86)\Margin\Marg\2.exe EbookReader2019.exe File created C:\Program Files (x86)\Margin\Marg\3.exe EbookReader2019.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
1.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 2396 timeout.exe 2620 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1.exetaskmgr.exe2.exe3.exe1.exe1.exepid process 1760 1.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 1724 2.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 1284 3.exe 756 taskmgr.exe 756 taskmgr.exe 2200 1.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 2460 1.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 756 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 756 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
1.exetaskmgr.exepid process 1760 1.exe 1760 1.exe 1760 1.exe 1760 1.exe 1760 1.exe 1760 1.exe 1760 1.exe 1760 1.exe 1760 1.exe 1760 1.exe 1760 1.exe 1760 1.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe 756 taskmgr.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
EbookReader2019.exe1.execmd.exe1.execmd.exedescription pid process target process PID 744 wrote to memory of 1760 744 EbookReader2019.exe 1.exe PID 744 wrote to memory of 1760 744 EbookReader2019.exe 1.exe PID 744 wrote to memory of 1760 744 EbookReader2019.exe 1.exe PID 744 wrote to memory of 1760 744 EbookReader2019.exe 1.exe PID 744 wrote to memory of 1760 744 EbookReader2019.exe 1.exe PID 744 wrote to memory of 1760 744 EbookReader2019.exe 1.exe PID 744 wrote to memory of 1760 744 EbookReader2019.exe 1.exe PID 2200 wrote to memory of 2364 2200 1.exe cmd.exe PID 2200 wrote to memory of 2364 2200 1.exe cmd.exe PID 2200 wrote to memory of 2364 2200 1.exe cmd.exe PID 2200 wrote to memory of 2364 2200 1.exe cmd.exe PID 2364 wrote to memory of 2396 2364 cmd.exe timeout.exe PID 2364 wrote to memory of 2396 2364 cmd.exe timeout.exe PID 2364 wrote to memory of 2396 2364 cmd.exe timeout.exe PID 2364 wrote to memory of 2396 2364 cmd.exe timeout.exe PID 2460 wrote to memory of 2588 2460 1.exe cmd.exe PID 2460 wrote to memory of 2588 2460 1.exe cmd.exe PID 2460 wrote to memory of 2588 2460 1.exe cmd.exe PID 2460 wrote to memory of 2588 2460 1.exe cmd.exe PID 2588 wrote to memory of 2620 2588 cmd.exe timeout.exe PID 2588 wrote to memory of 2620 2588 cmd.exe timeout.exe PID 2588 wrote to memory of 2620 2588 cmd.exe timeout.exe PID 2588 wrote to memory of 2620 2588 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\EbookReader2019.exe"C:\Users\Admin\AppData\Local\Temp\EbookReader2019.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Program Files (x86)\Margin\Marg\1.exe"C:\Program Files (x86)\Margin\Marg\1.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1760
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:756
-
C:\Program Files (x86)\Margin\Marg\2.exe"C:\Program Files (x86)\Margin\Marg\2.exe"1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1724
-
C:\Program Files (x86)\Margin\Marg\3.exe"C:\Program Files (x86)\Margin\Marg\3.exe"1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1284
-
C:\Program Files (x86)\Margin\Marg\1.exe"C:\Program Files (x86)\Margin\Marg\1.exe"1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\ProgramData\HAVg1Dg5ptUnw & timeout 2 & del /f /q "C:\Program Files (x86)\Margin\Marg\1.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
PID:2396
-
C:\Program Files (x86)\Margin\Marg\1.exe"C:\Program Files (x86)\Margin\Marg\1.exe"1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\ProgramData\qauBPzvs & timeout 2 & del /f /q "C:\Program Files (x86)\Margin\Marg\1.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
PID:2620
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Margin\Marg\1.exeMD5
987a9a9e0d4bbad66a9b823b3f939bc1
SHA1b1e733fcf656d37326d12650406676903f10090a
SHA25615f2a0a15572b7e7d229f7c309f3f4599aa7404b18f020b1fdb8518e584a48fe
SHA512791fff5b437ab8ac856cdb70b366897e90695235ca73c06320f638957bf8c007e6aa5eba6fd34a883abcd2f0748822490b7716b301b22a388828731b2bab486d
-
C:\Program Files (x86)\Margin\Marg\1.exeMD5
987a9a9e0d4bbad66a9b823b3f939bc1
SHA1b1e733fcf656d37326d12650406676903f10090a
SHA25615f2a0a15572b7e7d229f7c309f3f4599aa7404b18f020b1fdb8518e584a48fe
SHA512791fff5b437ab8ac856cdb70b366897e90695235ca73c06320f638957bf8c007e6aa5eba6fd34a883abcd2f0748822490b7716b301b22a388828731b2bab486d
-
C:\Program Files (x86)\Margin\Marg\1.exeMD5
987a9a9e0d4bbad66a9b823b3f939bc1
SHA1b1e733fcf656d37326d12650406676903f10090a
SHA25615f2a0a15572b7e7d229f7c309f3f4599aa7404b18f020b1fdb8518e584a48fe
SHA512791fff5b437ab8ac856cdb70b366897e90695235ca73c06320f638957bf8c007e6aa5eba6fd34a883abcd2f0748822490b7716b301b22a388828731b2bab486d
-
C:\Program Files (x86)\Margin\Marg\1.exeMD5
987a9a9e0d4bbad66a9b823b3f939bc1
SHA1b1e733fcf656d37326d12650406676903f10090a
SHA25615f2a0a15572b7e7d229f7c309f3f4599aa7404b18f020b1fdb8518e584a48fe
SHA512791fff5b437ab8ac856cdb70b366897e90695235ca73c06320f638957bf8c007e6aa5eba6fd34a883abcd2f0748822490b7716b301b22a388828731b2bab486d
-
C:\Program Files (x86)\Margin\Marg\2.exeMD5
c9cd7540515bf1b247b61683e37c6137
SHA17ecdf3f713d77cda0ac4c2589f5bd1d96375999f
SHA256292cd3448949482950fbfbe79117db0758d0d4b45f6dea494f63aecc7a99fedd
SHA512333be7de8c9eab112c8463a8522df65ac02035620d4e3aa604db7323600233c7b6e084f80ebfc0f231662863a6de8efa2a8d22c9d583f54d20159ca16cab3bf6
-
C:\Program Files (x86)\Margin\Marg\2.exeMD5
c9cd7540515bf1b247b61683e37c6137
SHA17ecdf3f713d77cda0ac4c2589f5bd1d96375999f
SHA256292cd3448949482950fbfbe79117db0758d0d4b45f6dea494f63aecc7a99fedd
SHA512333be7de8c9eab112c8463a8522df65ac02035620d4e3aa604db7323600233c7b6e084f80ebfc0f231662863a6de8efa2a8d22c9d583f54d20159ca16cab3bf6
-
C:\Program Files (x86)\Margin\Marg\3.exeMD5
6a3e5757838c7c670eb04968a03fff90
SHA1e2b5e4898f42e7e58b4649180e4d1c5f5e514002
SHA256d0ba8f2f1313e51ec63fa715e211c8d50f5823357487198236569eb9e76552df
SHA51283ab15f4c5ce459b148c0a5e360c580be3e03fd12e855a33e873b839477a421703da2ff6e7b59985816aa7b7a54021e3646c6ac175f7e37432b0bc312b1a4047
-
C:\Program Files (x86)\Margin\Marg\3.exeMD5
6a3e5757838c7c670eb04968a03fff90
SHA1e2b5e4898f42e7e58b4649180e4d1c5f5e514002
SHA256d0ba8f2f1313e51ec63fa715e211c8d50f5823357487198236569eb9e76552df
SHA51283ab15f4c5ce459b148c0a5e360c580be3e03fd12e855a33e873b839477a421703da2ff6e7b59985816aa7b7a54021e3646c6ac175f7e37432b0bc312b1a4047
-
\Program Files (x86)\Margin\Marg\1.exeMD5
987a9a9e0d4bbad66a9b823b3f939bc1
SHA1b1e733fcf656d37326d12650406676903f10090a
SHA25615f2a0a15572b7e7d229f7c309f3f4599aa7404b18f020b1fdb8518e584a48fe
SHA512791fff5b437ab8ac856cdb70b366897e90695235ca73c06320f638957bf8c007e6aa5eba6fd34a883abcd2f0748822490b7716b301b22a388828731b2bab486d
-
\Program Files (x86)\Margin\Marg\1.exeMD5
987a9a9e0d4bbad66a9b823b3f939bc1
SHA1b1e733fcf656d37326d12650406676903f10090a
SHA25615f2a0a15572b7e7d229f7c309f3f4599aa7404b18f020b1fdb8518e584a48fe
SHA512791fff5b437ab8ac856cdb70b366897e90695235ca73c06320f638957bf8c007e6aa5eba6fd34a883abcd2f0748822490b7716b301b22a388828731b2bab486d
-
\Program Files (x86)\Margin\Marg\1.exeMD5
987a9a9e0d4bbad66a9b823b3f939bc1
SHA1b1e733fcf656d37326d12650406676903f10090a
SHA25615f2a0a15572b7e7d229f7c309f3f4599aa7404b18f020b1fdb8518e584a48fe
SHA512791fff5b437ab8ac856cdb70b366897e90695235ca73c06320f638957bf8c007e6aa5eba6fd34a883abcd2f0748822490b7716b301b22a388828731b2bab486d
-
\Users\Admin\AppData\Local\Temp\nsi2AD9.tmp\UAC.dllMD5
adb29e6b186daa765dc750128649b63d
SHA1160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA2562f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
-
memory/744-2-0x0000000075E51000-0x0000000075E53000-memory.dmpFilesize
8KB
-
memory/756-34-0x000007FEFBC41000-0x000007FEFBC43000-memory.dmpFilesize
8KB
-
memory/756-35-0x0000000002080000-0x0000000002081000-memory.dmpFilesize
4KB
-
memory/1284-95-0x0000000009550000-0x0000000009551000-memory.dmpFilesize
4KB
-
memory/1284-99-0x00000000094A0000-0x00000000094A2000-memory.dmpFilesize
8KB
-
memory/1284-94-0x00000000094B0000-0x00000000094B1000-memory.dmpFilesize
4KB
-
memory/1284-74-0x0000000009240000-0x0000000009241000-memory.dmpFilesize
4KB
-
memory/1284-75-0x0000000009340000-0x0000000009341000-memory.dmpFilesize
4KB
-
memory/1284-76-0x0000000009350000-0x0000000009351000-memory.dmpFilesize
4KB
-
memory/1284-87-0x0000000009490000-0x0000000009491000-memory.dmpFilesize
4KB
-
memory/1284-88-0x0000000009510000-0x0000000009511000-memory.dmpFilesize
4KB
-
memory/1284-89-0x0000000009440000-0x0000000009441000-memory.dmpFilesize
4KB
-
memory/1284-90-0x00000000093F0000-0x00000000093F1000-memory.dmpFilesize
4KB
-
memory/1284-91-0x0000000009420000-0x0000000009421000-memory.dmpFilesize
4KB
-
memory/1284-92-0x0000000009530000-0x0000000009531000-memory.dmpFilesize
4KB
-
memory/1284-98-0x0000000009410000-0x0000000009411000-memory.dmpFilesize
4KB
-
memory/1284-93-0x00000000094F0000-0x00000000094F1000-memory.dmpFilesize
4KB
-
memory/1284-73-0x0000000009310000-0x0000000009311000-memory.dmpFilesize
4KB
-
memory/1284-96-0x00000000094E0000-0x00000000094E1000-memory.dmpFilesize
4KB
-
memory/1284-83-0x00000000092D0000-0x00000000092D1000-memory.dmpFilesize
4KB
-
memory/1284-86-0x0000000009280000-0x0000000009281000-memory.dmpFilesize
4KB
-
memory/1284-97-0x00000000094C0000-0x00000000094C1000-memory.dmpFilesize
4KB
-
memory/1284-100-0x0000000009520000-0x0000000009521000-memory.dmpFilesize
4KB
-
memory/1284-80-0x00000000092B0000-0x00000000092B1000-memory.dmpFilesize
4KB
-
memory/1284-81-0x00000000092A0000-0x00000000092A1000-memory.dmpFilesize
4KB
-
memory/1284-84-0x0000000009470000-0x0000000009471000-memory.dmpFilesize
4KB
-
memory/1284-78-0x0000000009300000-0x0000000009301000-memory.dmpFilesize
4KB
-
memory/1284-82-0x0000000009230000-0x0000000009231000-memory.dmpFilesize
4KB
-
memory/1284-77-0x00000000092C0000-0x00000000092C1000-memory.dmpFilesize
4KB
-
memory/1284-85-0x0000000000401000-0x000000000045D000-memory.dmpFilesize
368KB
-
memory/1284-70-0x0000000008A80000-0x0000000008A91000-memory.dmpFilesize
68KB
-
memory/1284-71-0x0000000008E90000-0x0000000008EA1000-memory.dmpFilesize
68KB
-
memory/1284-79-0x0000000009320000-0x0000000009322000-memory.dmpFilesize
8KB
-
memory/1576-30-0x000007FEF7590000-0x000007FEF780A000-memory.dmpFilesize
2.5MB
-
memory/1724-49-0x00000000092D0000-0x00000000092D1000-memory.dmpFilesize
4KB
-
memory/1724-51-0x0000000000401000-0x000000000045D000-memory.dmpFilesize
368KB
-
memory/1724-52-0x0000000009340000-0x0000000009341000-memory.dmpFilesize
4KB
-
memory/1724-53-0x0000000008E30000-0x0000000008E31000-memory.dmpFilesize
4KB
-
memory/1724-55-0x0000000009550000-0x0000000009551000-memory.dmpFilesize
4KB
-
memory/1724-54-0x00000000094B0000-0x00000000094B1000-memory.dmpFilesize
4KB
-
memory/1724-56-0x0000000009460000-0x0000000009461000-memory.dmpFilesize
4KB
-
memory/1724-58-0x0000000009440000-0x0000000009441000-memory.dmpFilesize
4KB
-
memory/1724-57-0x0000000009400000-0x0000000009401000-memory.dmpFilesize
4KB
-
memory/1724-59-0x0000000009430000-0x0000000009431000-memory.dmpFilesize
4KB
-
memory/1724-60-0x0000000009570000-0x0000000009571000-memory.dmpFilesize
4KB
-
memory/1724-62-0x00000000094F0000-0x00000000094F1000-memory.dmpFilesize
4KB
-
memory/1724-64-0x0000000009510000-0x0000000009511000-memory.dmpFilesize
4KB
-
memory/1724-65-0x0000000009500000-0x0000000009501000-memory.dmpFilesize
4KB
-
memory/1724-66-0x00000000094D0000-0x00000000094D1000-memory.dmpFilesize
4KB
-
memory/1724-63-0x0000000009590000-0x0000000009591000-memory.dmpFilesize
4KB
-
memory/1724-61-0x0000000009520000-0x0000000009521000-memory.dmpFilesize
4KB
-
memory/1724-67-0x0000000009560000-0x0000000009561000-memory.dmpFilesize
4KB
-
memory/1724-50-0x0000000009490000-0x0000000009491000-memory.dmpFilesize
4KB
-
memory/1724-48-0x0000000008E00000-0x0000000008E01000-memory.dmpFilesize
4KB
-
memory/1724-47-0x00000000092B0000-0x00000000092B1000-memory.dmpFilesize
4KB
-
memory/1724-46-0x0000000009330000-0x0000000009331000-memory.dmpFilesize
4KB
-
memory/1724-44-0x00000000092C0000-0x00000000092C1000-memory.dmpFilesize
4KB
-
memory/1724-45-0x0000000009300000-0x0000000009301000-memory.dmpFilesize
4KB
-
memory/1724-43-0x0000000009350000-0x0000000009351000-memory.dmpFilesize
4KB
-
memory/1724-41-0x0000000009310000-0x0000000009311000-memory.dmpFilesize
4KB
-
memory/1724-42-0x0000000008DF0000-0x0000000008DF1000-memory.dmpFilesize
4KB
-
memory/1724-38-0x0000000008D30000-0x0000000008D41000-memory.dmpFilesize
68KB
-
memory/1724-39-0x0000000009140000-0x0000000009151000-memory.dmpFilesize
68KB
-
memory/1760-18-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/1760-17-0x0000000000460000-0x0000000000461000-memory.dmpFilesize
4KB
-
memory/1760-12-0x0000000005110000-0x0000000005121000-memory.dmpFilesize
68KB
-
memory/1760-13-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/1760-14-0x0000000000B40000-0x0000000000B41000-memory.dmpFilesize
4KB
-
memory/1760-16-0x0000000000E30000-0x0000000000E31000-memory.dmpFilesize
4KB
-
memory/1760-15-0x0000000000E20000-0x0000000000E21000-memory.dmpFilesize
4KB
-
memory/1760-33-0x0000000000540000-0x0000000000541000-memory.dmpFilesize
4KB
-
memory/1760-31-0x0000000000C40000-0x0000000000C41000-memory.dmpFilesize
4KB
-
memory/1760-32-0x0000000000E40000-0x0000000000E41000-memory.dmpFilesize
4KB
-
memory/1760-29-0x0000000000E90000-0x0000000000E91000-memory.dmpFilesize
4KB
-
memory/1760-28-0x00000000027D0000-0x00000000027D1000-memory.dmpFilesize
4KB
-
memory/1760-27-0x0000000000C90000-0x0000000000C91000-memory.dmpFilesize
4KB
-
memory/1760-26-0x00000000007A0000-0x00000000007A1000-memory.dmpFilesize
4KB
-
memory/1760-25-0x00000000004D0000-0x00000000004D1000-memory.dmpFilesize
4KB
-
memory/1760-24-0x00000000004C0000-0x00000000004C1000-memory.dmpFilesize
4KB
-
memory/1760-23-0x0000000000470000-0x0000000000471000-memory.dmpFilesize
4KB
-
memory/1760-22-0x0000000000CC0000-0x0000000000CC1000-memory.dmpFilesize
4KB
-
memory/1760-21-0x0000000000B60000-0x0000000000B61000-memory.dmpFilesize
4KB
-
memory/1760-19-0x00000000004F0000-0x00000000004F1000-memory.dmpFilesize
4KB
-
memory/1760-11-0x0000000004D00000-0x0000000004D11000-memory.dmpFilesize
68KB
-
memory/1760-5-0x0000000000000000-mapping.dmp
-
memory/1760-20-0x0000000000CA0000-0x0000000000CA1000-memory.dmpFilesize
4KB
-
memory/2200-109-0x0000000002850000-0x0000000002851000-memory.dmpFilesize
4KB
-
memory/2200-113-0x0000000000930000-0x0000000000931000-memory.dmpFilesize
4KB
-
memory/2200-107-0x0000000000C00000-0x0000000000C01000-memory.dmpFilesize
4KB
-
memory/2200-110-0x0000000002860000-0x0000000002861000-memory.dmpFilesize
4KB
-
memory/2200-102-0x00000000049A0000-0x00000000049B1000-memory.dmpFilesize
68KB
-
memory/2200-112-0x0000000000E90000-0x0000000000E91000-memory.dmpFilesize
4KB
-
memory/2200-111-0x0000000000760000-0x0000000000761000-memory.dmpFilesize
4KB
-
memory/2200-108-0x0000000000BF0000-0x0000000000BF1000-memory.dmpFilesize
4KB
-
memory/2200-115-0x0000000000C60000-0x0000000000C61000-memory.dmpFilesize
4KB
-
memory/2200-114-0x0000000000E80000-0x0000000000E81000-memory.dmpFilesize
4KB
-
memory/2200-117-0x0000000000C10000-0x0000000000C11000-memory.dmpFilesize
4KB
-
memory/2200-116-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB
-
memory/2200-103-0x0000000004DB0000-0x0000000004DC1000-memory.dmpFilesize
68KB
-
memory/2364-105-0x0000000000000000-mapping.dmp
-
memory/2396-106-0x0000000000000000-mapping.dmp
-
memory/2460-120-0x0000000004DC0000-0x0000000004DD1000-memory.dmpFilesize
68KB
-
memory/2460-129-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/2460-125-0x00000000009B0000-0x00000000009B1000-memory.dmpFilesize
4KB
-
memory/2460-135-0x0000000000AD0000-0x0000000000AD1000-memory.dmpFilesize
4KB
-
memory/2460-124-0x0000000000AC0000-0x0000000000AC1000-memory.dmpFilesize
4KB
-
memory/2460-127-0x0000000000D10000-0x0000000000D11000-memory.dmpFilesize
4KB
-
memory/2460-126-0x0000000000CC0000-0x0000000000CC1000-memory.dmpFilesize
4KB
-
memory/2460-119-0x00000000049B0000-0x00000000049C1000-memory.dmpFilesize
68KB
-
memory/2460-128-0x00000000008E0000-0x00000000008E1000-memory.dmpFilesize
4KB
-
memory/2460-131-0x0000000000B80000-0x0000000000B81000-memory.dmpFilesize
4KB
-
memory/2460-130-0x0000000000920000-0x0000000000921000-memory.dmpFilesize
4KB
-
memory/2460-133-0x0000000000CA0000-0x0000000000CA1000-memory.dmpFilesize
4KB
-
memory/2460-132-0x0000000000AE0000-0x0000000000AE1000-memory.dmpFilesize
4KB
-
memory/2460-134-0x00000000008F0000-0x00000000008F1000-memory.dmpFilesize
4KB
-
memory/2588-122-0x0000000000000000-mapping.dmp
-
memory/2620-123-0x0000000000000000-mapping.dmp