Analysis
-
max time kernel
140s -
max time network
114s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
17-07-2021 00:02
Static task
static1
Behavioral task
behavioral1
Sample
6EA14E473644F3BEA03782F41D7C5246.exe
Resource
win7v20210410
General
-
Target
6EA14E473644F3BEA03782F41D7C5246.exe
-
Size
696KB
-
MD5
6ea14e473644f3bea03782f41d7c5246
-
SHA1
3be05d9f18b574c5c4eea2f8ab8160c470553aeb
-
SHA256
c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
-
SHA512
7fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
Malware Config
Extracted
pony
http://fuckoff.av.com/gate.php
http://mrson.dan.al/sddob/gate.php
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
lsass.exelsass.exelsass.exelsass.exepid process 680 lsass.exe 1896 lsass.exe 2024 lsass.exe 1056 lsass.exe -
Processes:
resource yara_rule behavioral1/memory/604-63-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/604-77-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
6EA14E473644F3BEA03782F41D7C5246.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe 6EA14E473644F3BEA03782F41D7C5246.exe -
Loads dropped DLL 2 IoCs
Processes:
6EA14E473644F3BEA03782F41D7C5246.exepid process 336 6EA14E473644F3BEA03782F41D7C5246.exe 336 6EA14E473644F3BEA03782F41D7C5246.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 7 IoCs
Processes:
6EA14E473644F3BEA03782F41D7C5246.exe6EA14E473644F3BEA03782F41D7C5246.exelsass.exelsass.exedescription pid process target process PID 1208 set thread context of 604 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 604 set thread context of 336 604 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1208 set thread context of 640 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 680 set thread context of 1896 680 lsass.exe lsass.exe PID 1896 set thread context of 2024 1896 lsass.exe lsass.exe PID 680 set thread context of 1056 680 lsass.exe lsass.exe PID 680 set thread context of 1056 680 lsass.exe lsass.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
pid process 1272 1272 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1272 -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
lsass.exeexplorer.exelsass.exepid process 2024 lsass.exe 2028 explorer.exe 1272 1272 1272 1272 1272 680 lsass.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
6EA14E473644F3BEA03782F41D7C5246.exe6EA14E473644F3BEA03782F41D7C5246.exelsass.exelsass.exedescription pid process Token: SeDebugPrivilege 336 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeImpersonatePrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeTcbPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeChangeNotifyPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeCreateTokenPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeBackupPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeRestorePrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeIncreaseQuotaPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeAssignPrimaryTokenPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeDebugPrivilege 2024 lsass.exe Token: SeDebugPrivilege 1272 Token: SeImpersonatePrivilege 1056 lsass.exe Token: SeTcbPrivilege 1056 lsass.exe Token: SeChangeNotifyPrivilege 1056 lsass.exe Token: SeCreateTokenPrivilege 1056 lsass.exe Token: SeBackupPrivilege 1056 lsass.exe Token: SeRestorePrivilege 1056 lsass.exe Token: SeIncreaseQuotaPrivilege 1056 lsass.exe Token: SeAssignPrimaryTokenPrivilege 1056 lsass.exe Token: SeImpersonatePrivilege 1056 lsass.exe Token: SeTcbPrivilege 1056 lsass.exe Token: SeChangeNotifyPrivilege 1056 lsass.exe Token: SeCreateTokenPrivilege 1056 lsass.exe Token: SeBackupPrivilege 1056 lsass.exe Token: SeRestorePrivilege 1056 lsass.exe Token: SeIncreaseQuotaPrivilege 1056 lsass.exe Token: SeAssignPrimaryTokenPrivilege 1056 lsass.exe Token: SeImpersonatePrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeTcbPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeChangeNotifyPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeCreateTokenPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeBackupPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeRestorePrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeIncreaseQuotaPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeAssignPrimaryTokenPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeImpersonatePrivilege 1056 lsass.exe Token: SeTcbPrivilege 1056 lsass.exe Token: SeChangeNotifyPrivilege 1056 lsass.exe Token: SeCreateTokenPrivilege 1056 lsass.exe Token: SeBackupPrivilege 1056 lsass.exe Token: SeRestorePrivilege 1056 lsass.exe Token: SeIncreaseQuotaPrivilege 1056 lsass.exe Token: SeAssignPrimaryTokenPrivilege 1056 lsass.exe Token: SeImpersonatePrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeTcbPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeChangeNotifyPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeCreateTokenPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeBackupPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeRestorePrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeIncreaseQuotaPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeAssignPrimaryTokenPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeImpersonatePrivilege 1056 lsass.exe Token: SeTcbPrivilege 1056 lsass.exe Token: SeChangeNotifyPrivilege 1056 lsass.exe Token: SeCreateTokenPrivilege 1056 lsass.exe Token: SeBackupPrivilege 1056 lsass.exe Token: SeRestorePrivilege 1056 lsass.exe Token: SeIncreaseQuotaPrivilege 1056 lsass.exe Token: SeAssignPrimaryTokenPrivilege 1056 lsass.exe Token: SeImpersonatePrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeTcbPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeChangeNotifyPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeCreateTokenPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeBackupPrivilege 640 6EA14E473644F3BEA03782F41D7C5246.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
pid process 1272 1272 1272 1272 -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
pid process 1272 1272 1272 1272 -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
6EA14E473644F3BEA03782F41D7C5246.exe6EA14E473644F3BEA03782F41D7C5246.exelsass.exelsass.exepid process 1208 6EA14E473644F3BEA03782F41D7C5246.exe 604 6EA14E473644F3BEA03782F41D7C5246.exe 680 lsass.exe 1896 lsass.exe -
Suspicious use of WriteProcessMemory 58 IoCs
Processes:
6EA14E473644F3BEA03782F41D7C5246.exe6EA14E473644F3BEA03782F41D7C5246.exe6EA14E473644F3BEA03782F41D7C5246.exelsass.exelsass.exelsass.exedescription pid process target process PID 1208 wrote to memory of 604 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1208 wrote to memory of 604 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1208 wrote to memory of 604 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1208 wrote to memory of 604 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1208 wrote to memory of 604 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1208 wrote to memory of 604 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1208 wrote to memory of 604 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1208 wrote to memory of 604 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1208 wrote to memory of 604 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 604 wrote to memory of 336 604 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 604 wrote to memory of 336 604 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 604 wrote to memory of 336 604 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 604 wrote to memory of 336 604 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 604 wrote to memory of 336 604 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 604 wrote to memory of 336 604 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 604 wrote to memory of 336 604 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 336 wrote to memory of 680 336 6EA14E473644F3BEA03782F41D7C5246.exe lsass.exe PID 336 wrote to memory of 680 336 6EA14E473644F3BEA03782F41D7C5246.exe lsass.exe PID 336 wrote to memory of 680 336 6EA14E473644F3BEA03782F41D7C5246.exe lsass.exe PID 336 wrote to memory of 680 336 6EA14E473644F3BEA03782F41D7C5246.exe lsass.exe PID 1208 wrote to memory of 640 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1208 wrote to memory of 640 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1208 wrote to memory of 640 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1208 wrote to memory of 640 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1208 wrote to memory of 640 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1208 wrote to memory of 640 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1208 wrote to memory of 640 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1208 wrote to memory of 640 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1208 wrote to memory of 640 1208 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 680 wrote to memory of 1896 680 lsass.exe lsass.exe PID 680 wrote to memory of 1896 680 lsass.exe lsass.exe PID 680 wrote to memory of 1896 680 lsass.exe lsass.exe PID 680 wrote to memory of 1896 680 lsass.exe lsass.exe PID 680 wrote to memory of 1896 680 lsass.exe lsass.exe PID 680 wrote to memory of 1896 680 lsass.exe lsass.exe PID 680 wrote to memory of 1896 680 lsass.exe lsass.exe PID 680 wrote to memory of 1896 680 lsass.exe lsass.exe PID 680 wrote to memory of 1896 680 lsass.exe lsass.exe PID 1896 wrote to memory of 2024 1896 lsass.exe lsass.exe PID 1896 wrote to memory of 2024 1896 lsass.exe lsass.exe PID 1896 wrote to memory of 2024 1896 lsass.exe lsass.exe PID 1896 wrote to memory of 2024 1896 lsass.exe lsass.exe PID 1896 wrote to memory of 2024 1896 lsass.exe lsass.exe PID 1896 wrote to memory of 2024 1896 lsass.exe lsass.exe PID 1896 wrote to memory of 2024 1896 lsass.exe lsass.exe PID 2024 wrote to memory of 2028 2024 lsass.exe explorer.exe PID 2024 wrote to memory of 2028 2024 lsass.exe explorer.exe PID 2024 wrote to memory of 2028 2024 lsass.exe explorer.exe PID 2024 wrote to memory of 2028 2024 lsass.exe explorer.exe PID 680 wrote to memory of 1056 680 lsass.exe lsass.exe PID 680 wrote to memory of 1056 680 lsass.exe lsass.exe PID 680 wrote to memory of 1056 680 lsass.exe lsass.exe PID 680 wrote to memory of 1056 680 lsass.exe lsass.exe PID 680 wrote to memory of 1056 680 lsass.exe lsass.exe PID 680 wrote to memory of 1056 680 lsass.exe lsass.exe PID 680 wrote to memory of 1056 680 lsass.exe lsass.exe PID 680 wrote to memory of 1056 680 lsass.exe lsass.exe PID 680 wrote to memory of 1056 680 lsass.exe lsass.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"3⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeC:\Windows\explorer.exe7⤵
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
memory/336-69-0x0000000076281000-0x0000000076283000-memory.dmpFilesize
8KB
-
memory/336-68-0x0000000000401000-mapping.dmp
-
memory/336-67-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/604-77-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/604-64-0x000000000041DE40-mapping.dmp
-
memory/604-63-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/640-79-0x0000000000410028-mapping.dmp
-
memory/640-81-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/640-78-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/680-108-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/680-72-0x0000000000000000-mapping.dmp
-
memory/680-104-0x00000000003E0000-0x00000000003F1000-memory.dmpFilesize
68KB
-
memory/680-103-0x0000000000330000-0x0000000000348000-memory.dmpFilesize
96KB
-
memory/1056-110-0x0000000000350000-0x0000000000351000-memory.dmpFilesize
4KB
-
memory/1056-109-0x00000000001B0000-0x00000000001C8000-memory.dmpFilesize
96KB
-
memory/1056-94-0x00000000001B0000-mapping.dmp
-
memory/1056-105-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1128-101-0x0000000000310000-0x0000000000337000-memory.dmpFilesize
156KB
-
memory/1208-60-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1272-102-0x0000000002A70000-0x0000000002A82000-memory.dmpFilesize
72KB
-
memory/1272-100-0x0000000002960000-0x0000000002987000-memory.dmpFilesize
156KB
-
memory/1272-106-0x0000000002AD0000-0x0000000002AD1000-memory.dmpFilesize
4KB
-
memory/1272-107-0x0000000002C20000-0x0000000002C21000-memory.dmpFilesize
4KB
-
memory/1272-111-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/1896-84-0x000000000041DE40-mapping.dmp
-
memory/2024-97-0x0000000000330000-0x0000000000357000-memory.dmpFilesize
156KB
-
memory/2024-96-0x0000000000360000-0x0000000000361000-memory.dmpFilesize
4KB
-
memory/2024-89-0x0000000000401000-mapping.dmp
-
memory/2028-98-0x0000000000060000-0x0000000000087000-memory.dmpFilesize
156KB
-
memory/2028-92-0x0000000000000000-mapping.dmp