Analysis
-
max time kernel
146s -
max time network
122s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
16-07-2021 23:42
Static task
static1
Behavioral task
behavioral1
Sample
6EA14E473644F3BEA03782F41D7C5246.exe
Resource
win7v20210408
General
-
Target
6EA14E473644F3BEA03782F41D7C5246.exe
-
Size
696KB
-
MD5
6ea14e473644f3bea03782f41d7c5246
-
SHA1
3be05d9f18b574c5c4eea2f8ab8160c470553aeb
-
SHA256
c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
-
SHA512
7fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
Malware Config
Extracted
pony
http://fuckoff.av.com/gate.php
http://mrson.dan.al/sddob/gate.php
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
lsass.exelsass.exelsass.exelsass.exepid process 1064 lsass.exe 852 lsass.exe 1540 lsass.exe 1376 lsass.exe -
Processes:
resource yara_rule behavioral1/memory/1672-63-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1672-77-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
6EA14E473644F3BEA03782F41D7C5246.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe 6EA14E473644F3BEA03782F41D7C5246.exe -
Loads dropped DLL 2 IoCs
Processes:
6EA14E473644F3BEA03782F41D7C5246.exepid process 1216 6EA14E473644F3BEA03782F41D7C5246.exe 1216 6EA14E473644F3BEA03782F41D7C5246.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 7 IoCs
Processes:
6EA14E473644F3BEA03782F41D7C5246.exe6EA14E473644F3BEA03782F41D7C5246.exelsass.exelsass.exedescription pid process target process PID 1640 set thread context of 1672 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1672 set thread context of 1216 1672 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1640 set thread context of 1372 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1064 set thread context of 852 1064 lsass.exe lsass.exe PID 852 set thread context of 1540 852 lsass.exe lsass.exe PID 1064 set thread context of 1376 1064 lsass.exe lsass.exe PID 1064 set thread context of 1376 1064 lsass.exe lsass.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
pid process 1244 1244 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1244 -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
lsass.exeexplorer.exelsass.exepid process 1540 lsass.exe 1352 explorer.exe 1244 1244 1244 1244 1064 lsass.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
6EA14E473644F3BEA03782F41D7C5246.exe6EA14E473644F3BEA03782F41D7C5246.exelsass.exelsass.exedescription pid process Token: SeDebugPrivilege 1216 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeImpersonatePrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeTcbPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeChangeNotifyPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeCreateTokenPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeBackupPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeRestorePrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeIncreaseQuotaPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeAssignPrimaryTokenPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeDebugPrivilege 1540 lsass.exe Token: SeDebugPrivilege 1244 Token: SeImpersonatePrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeTcbPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeChangeNotifyPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeCreateTokenPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeBackupPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeRestorePrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeIncreaseQuotaPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeAssignPrimaryTokenPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeImpersonatePrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeTcbPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeChangeNotifyPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeCreateTokenPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeBackupPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeRestorePrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeIncreaseQuotaPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeAssignPrimaryTokenPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeImpersonatePrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeTcbPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeChangeNotifyPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeCreateTokenPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeBackupPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeRestorePrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeIncreaseQuotaPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeAssignPrimaryTokenPrivilege 1372 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeImpersonatePrivilege 1376 lsass.exe Token: SeTcbPrivilege 1376 lsass.exe Token: SeChangeNotifyPrivilege 1376 lsass.exe Token: SeCreateTokenPrivilege 1376 lsass.exe Token: SeBackupPrivilege 1376 lsass.exe Token: SeRestorePrivilege 1376 lsass.exe Token: SeIncreaseQuotaPrivilege 1376 lsass.exe Token: SeAssignPrimaryTokenPrivilege 1376 lsass.exe Token: SeImpersonatePrivilege 1376 lsass.exe Token: SeTcbPrivilege 1376 lsass.exe Token: SeChangeNotifyPrivilege 1376 lsass.exe Token: SeCreateTokenPrivilege 1376 lsass.exe Token: SeBackupPrivilege 1376 lsass.exe Token: SeRestorePrivilege 1376 lsass.exe Token: SeIncreaseQuotaPrivilege 1376 lsass.exe Token: SeAssignPrimaryTokenPrivilege 1376 lsass.exe Token: SeImpersonatePrivilege 1376 lsass.exe Token: SeTcbPrivilege 1376 lsass.exe Token: SeChangeNotifyPrivilege 1376 lsass.exe Token: SeCreateTokenPrivilege 1376 lsass.exe Token: SeBackupPrivilege 1376 lsass.exe Token: SeRestorePrivilege 1376 lsass.exe Token: SeIncreaseQuotaPrivilege 1376 lsass.exe Token: SeAssignPrimaryTokenPrivilege 1376 lsass.exe Token: SeImpersonatePrivilege 1376 lsass.exe Token: SeTcbPrivilege 1376 lsass.exe Token: SeChangeNotifyPrivilege 1376 lsass.exe Token: SeCreateTokenPrivilege 1376 lsass.exe Token: SeBackupPrivilege 1376 lsass.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
pid process 1244 1244 1244 1244 -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
pid process 1244 1244 1244 1244 -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
6EA14E473644F3BEA03782F41D7C5246.exe6EA14E473644F3BEA03782F41D7C5246.exelsass.exelsass.exepid process 1640 6EA14E473644F3BEA03782F41D7C5246.exe 1672 6EA14E473644F3BEA03782F41D7C5246.exe 1064 lsass.exe 852 lsass.exe -
Suspicious use of WriteProcessMemory 58 IoCs
Processes:
6EA14E473644F3BEA03782F41D7C5246.exe6EA14E473644F3BEA03782F41D7C5246.exe6EA14E473644F3BEA03782F41D7C5246.exelsass.exelsass.exelsass.exedescription pid process target process PID 1640 wrote to memory of 1672 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1640 wrote to memory of 1672 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1640 wrote to memory of 1672 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1640 wrote to memory of 1672 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1640 wrote to memory of 1672 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1640 wrote to memory of 1672 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1640 wrote to memory of 1672 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1640 wrote to memory of 1672 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1640 wrote to memory of 1672 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1672 wrote to memory of 1216 1672 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1672 wrote to memory of 1216 1672 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1672 wrote to memory of 1216 1672 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1672 wrote to memory of 1216 1672 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1672 wrote to memory of 1216 1672 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1672 wrote to memory of 1216 1672 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1672 wrote to memory of 1216 1672 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1216 wrote to memory of 1064 1216 6EA14E473644F3BEA03782F41D7C5246.exe lsass.exe PID 1216 wrote to memory of 1064 1216 6EA14E473644F3BEA03782F41D7C5246.exe lsass.exe PID 1216 wrote to memory of 1064 1216 6EA14E473644F3BEA03782F41D7C5246.exe lsass.exe PID 1216 wrote to memory of 1064 1216 6EA14E473644F3BEA03782F41D7C5246.exe lsass.exe PID 1640 wrote to memory of 1372 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1640 wrote to memory of 1372 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1640 wrote to memory of 1372 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1640 wrote to memory of 1372 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1640 wrote to memory of 1372 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1640 wrote to memory of 1372 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1640 wrote to memory of 1372 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1640 wrote to memory of 1372 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1640 wrote to memory of 1372 1640 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1064 wrote to memory of 852 1064 lsass.exe lsass.exe PID 1064 wrote to memory of 852 1064 lsass.exe lsass.exe PID 1064 wrote to memory of 852 1064 lsass.exe lsass.exe PID 1064 wrote to memory of 852 1064 lsass.exe lsass.exe PID 1064 wrote to memory of 852 1064 lsass.exe lsass.exe PID 1064 wrote to memory of 852 1064 lsass.exe lsass.exe PID 1064 wrote to memory of 852 1064 lsass.exe lsass.exe PID 1064 wrote to memory of 852 1064 lsass.exe lsass.exe PID 1064 wrote to memory of 852 1064 lsass.exe lsass.exe PID 852 wrote to memory of 1540 852 lsass.exe lsass.exe PID 852 wrote to memory of 1540 852 lsass.exe lsass.exe PID 852 wrote to memory of 1540 852 lsass.exe lsass.exe PID 852 wrote to memory of 1540 852 lsass.exe lsass.exe PID 852 wrote to memory of 1540 852 lsass.exe lsass.exe PID 852 wrote to memory of 1540 852 lsass.exe lsass.exe PID 852 wrote to memory of 1540 852 lsass.exe lsass.exe PID 1540 wrote to memory of 1352 1540 lsass.exe explorer.exe PID 1540 wrote to memory of 1352 1540 lsass.exe explorer.exe PID 1540 wrote to memory of 1352 1540 lsass.exe explorer.exe PID 1540 wrote to memory of 1352 1540 lsass.exe explorer.exe PID 1064 wrote to memory of 1376 1064 lsass.exe lsass.exe PID 1064 wrote to memory of 1376 1064 lsass.exe lsass.exe PID 1064 wrote to memory of 1376 1064 lsass.exe lsass.exe PID 1064 wrote to memory of 1376 1064 lsass.exe lsass.exe PID 1064 wrote to memory of 1376 1064 lsass.exe lsass.exe PID 1064 wrote to memory of 1376 1064 lsass.exe lsass.exe PID 1064 wrote to memory of 1376 1064 lsass.exe lsass.exe PID 1064 wrote to memory of 1376 1064 lsass.exe lsass.exe PID 1064 wrote to memory of 1376 1064 lsass.exe lsass.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"3⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeC:\Windows\explorer.exe7⤵
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
memory/852-84-0x000000000041DE40-mapping.dmp
-
memory/1064-101-0x00000000004F0000-0x0000000000501000-memory.dmpFilesize
68KB
-
memory/1064-72-0x0000000000000000-mapping.dmp
-
memory/1064-98-0x0000000000280000-0x0000000000298000-memory.dmpFilesize
96KB
-
memory/1120-99-0x0000000001B50000-0x0000000001B77000-memory.dmpFilesize
156KB
-
memory/1216-67-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1216-68-0x0000000000401000-mapping.dmp
-
memory/1216-69-0x0000000075041000-0x0000000075043000-memory.dmpFilesize
8KB
-
memory/1244-96-0x0000000002C50000-0x0000000002C77000-memory.dmpFilesize
156KB
-
memory/1244-97-0x0000000002B40000-0x0000000002B52000-memory.dmpFilesize
72KB
-
memory/1244-112-0x0000000002BF0000-0x0000000002BF1000-memory.dmpFilesize
4KB
-
memory/1244-102-0x0000000002DB0000-0x0000000002DB1000-memory.dmpFilesize
4KB
-
memory/1244-109-0x0000000002C90000-0x0000000002C91000-memory.dmpFilesize
4KB
-
memory/1352-95-0x0000000000060000-0x0000000000087000-memory.dmpFilesize
156KB
-
memory/1352-92-0x0000000000000000-mapping.dmp
-
memory/1372-105-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1372-81-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1372-79-0x0000000000410028-mapping.dmp
-
memory/1372-78-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1372-110-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/1376-103-0x00000000001B0000-mapping.dmp
-
memory/1376-106-0x00000000001B0000-0x00000000001C8000-memory.dmpFilesize
96KB
-
memory/1376-107-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1376-111-0x0000000000360000-0x0000000000361000-memory.dmpFilesize
4KB
-
memory/1540-94-0x00000000002B0000-0x00000000002D7000-memory.dmpFilesize
156KB
-
memory/1540-93-0x00000000002E0000-0x00000000002E1000-memory.dmpFilesize
4KB
-
memory/1540-89-0x0000000000401000-mapping.dmp
-
memory/1640-60-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1672-64-0x000000000041DE40-mapping.dmp
-
memory/1672-63-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1672-77-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB