Analysis
-
max time kernel
64s -
max time network
125s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
17-07-2021 00:02
Static task
static1
Behavioral task
behavioral1
Sample
6EA14E473644F3BEA03782F41D7C5246.exe
Resource
win7v20210410
General
-
Target
6EA14E473644F3BEA03782F41D7C5246.exe
-
Size
696KB
-
MD5
6ea14e473644f3bea03782f41d7c5246
-
SHA1
3be05d9f18b574c5c4eea2f8ab8160c470553aeb
-
SHA256
c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
-
SHA512
7fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
Malware Config
Extracted
pony
http://fuckoff.av.com/gate.php
http://mrson.dan.al/sddob/gate.php
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 608 created 3044 608 WerFault.exe Explorer.EXE -
Executes dropped EXE 3 IoCs
Processes:
lsass.exelsass.exelsass.exepid process 3332 lsass.exe 4048 lsass.exe 60 lsass.exe -
Processes:
resource yara_rule behavioral2/memory/768-117-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/768-129-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
6EA14E473644F3BEA03782F41D7C5246.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe 6EA14E473644F3BEA03782F41D7C5246.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 7 IoCs
Processes:
6EA14E473644F3BEA03782F41D7C5246.exe6EA14E473644F3BEA03782F41D7C5246.exelsass.exelsass.exedescription pid process target process PID 804 set thread context of 768 804 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 768 set thread context of 1984 768 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 804 set thread context of 3620 804 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 3332 set thread context of 4048 3332 lsass.exe lsass.exe PID 4048 set thread context of 60 4048 lsass.exe lsass.exe PID 3332 set thread context of 512 3332 lsass.exe lsass.exe PID 3332 set thread context of 512 3332 lsass.exe lsass.exe -
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2080 804 WerFault.exe 6EA14E473644F3BEA03782F41D7C5246.exe 608 3044 WerFault.exe Explorer.EXE 908 3764 WerFault.exe 2088 3332 WerFault.exe lsass.exe -
Suspicious behavior: EnumeratesProcesses 45 IoCs
Processes:
WerFault.exeExplorer.EXEWerFault.exeWerFault.exepid process 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 3044 Explorer.EXE 3044 Explorer.EXE 908 WerFault.exe 908 WerFault.exe 908 WerFault.exe 908 WerFault.exe 908 WerFault.exe 908 WerFault.exe 908 WerFault.exe 908 WerFault.exe 908 WerFault.exe 908 WerFault.exe 908 WerFault.exe 908 WerFault.exe 908 WerFault.exe 908 WerFault.exe 2088 WerFault.exe 2088 WerFault.exe 2088 WerFault.exe 2088 WerFault.exe 2088 WerFault.exe 2088 WerFault.exe 2088 WerFault.exe 2088 WerFault.exe 2088 WerFault.exe 2088 WerFault.exe 2088 WerFault.exe 2088 WerFault.exe 2088 WerFault.exe 2088 WerFault.exe 2088 WerFault.exe -
Suspicious behavior: MapViewOfSection 14 IoCs
Processes:
lsass.exeexplorer.exeExplorer.EXElsass.exepid process 60 lsass.exe 3776 explorer.exe 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3044 Explorer.EXE 3332 lsass.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
6EA14E473644F3BEA03782F41D7C5246.exe6EA14E473644F3BEA03782F41D7C5246.exeWerFault.exelsass.exeExplorer.EXEWerFault.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1984 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeImpersonatePrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeTcbPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeChangeNotifyPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeCreateTokenPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeBackupPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeRestorePrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeIncreaseQuotaPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeAssignPrimaryTokenPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeRestorePrivilege 2080 WerFault.exe Token: SeBackupPrivilege 2080 WerFault.exe Token: SeDebugPrivilege 2080 WerFault.exe Token: SeImpersonatePrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeTcbPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeChangeNotifyPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeCreateTokenPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeBackupPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeRestorePrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeIncreaseQuotaPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeAssignPrimaryTokenPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeImpersonatePrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeTcbPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeChangeNotifyPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeCreateTokenPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeBackupPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeRestorePrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeIncreaseQuotaPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeAssignPrimaryTokenPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeImpersonatePrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeTcbPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeChangeNotifyPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeCreateTokenPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeBackupPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeRestorePrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeIncreaseQuotaPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeAssignPrimaryTokenPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeImpersonatePrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeTcbPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeChangeNotifyPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeCreateTokenPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeBackupPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeRestorePrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeIncreaseQuotaPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeAssignPrimaryTokenPrivilege 3620 6EA14E473644F3BEA03782F41D7C5246.exe Token: SeDebugPrivilege 60 lsass.exe Token: SeDebugPrivilege 3044 Explorer.EXE Token: SeDebugPrivilege 908 WerFault.exe Token: SeDebugPrivilege 2088 WerFault.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
6EA14E473644F3BEA03782F41D7C5246.exe6EA14E473644F3BEA03782F41D7C5246.exelsass.exelsass.exepid process 804 6EA14E473644F3BEA03782F41D7C5246.exe 768 6EA14E473644F3BEA03782F41D7C5246.exe 3332 lsass.exe 4048 lsass.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
6EA14E473644F3BEA03782F41D7C5246.exe6EA14E473644F3BEA03782F41D7C5246.exe6EA14E473644F3BEA03782F41D7C5246.exelsass.exelsass.exelsass.exedescription pid process target process PID 804 wrote to memory of 768 804 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 804 wrote to memory of 768 804 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 804 wrote to memory of 768 804 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 804 wrote to memory of 768 804 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 804 wrote to memory of 768 804 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 804 wrote to memory of 768 804 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 804 wrote to memory of 768 804 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 804 wrote to memory of 768 804 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 768 wrote to memory of 1984 768 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 768 wrote to memory of 1984 768 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 768 wrote to memory of 1984 768 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 768 wrote to memory of 1984 768 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 768 wrote to memory of 1984 768 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 768 wrote to memory of 1984 768 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 1984 wrote to memory of 3332 1984 6EA14E473644F3BEA03782F41D7C5246.exe lsass.exe PID 1984 wrote to memory of 3332 1984 6EA14E473644F3BEA03782F41D7C5246.exe lsass.exe PID 1984 wrote to memory of 3332 1984 6EA14E473644F3BEA03782F41D7C5246.exe lsass.exe PID 804 wrote to memory of 3620 804 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 804 wrote to memory of 3620 804 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 804 wrote to memory of 3620 804 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 804 wrote to memory of 3620 804 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 804 wrote to memory of 3620 804 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 804 wrote to memory of 3620 804 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 804 wrote to memory of 3620 804 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 804 wrote to memory of 3620 804 6EA14E473644F3BEA03782F41D7C5246.exe 6EA14E473644F3BEA03782F41D7C5246.exe PID 3332 wrote to memory of 4048 3332 lsass.exe lsass.exe PID 3332 wrote to memory of 4048 3332 lsass.exe lsass.exe PID 3332 wrote to memory of 4048 3332 lsass.exe lsass.exe PID 3332 wrote to memory of 4048 3332 lsass.exe lsass.exe PID 3332 wrote to memory of 4048 3332 lsass.exe lsass.exe PID 3332 wrote to memory of 4048 3332 lsass.exe lsass.exe PID 3332 wrote to memory of 4048 3332 lsass.exe lsass.exe PID 3332 wrote to memory of 4048 3332 lsass.exe lsass.exe PID 4048 wrote to memory of 60 4048 lsass.exe lsass.exe PID 4048 wrote to memory of 60 4048 lsass.exe lsass.exe PID 4048 wrote to memory of 60 4048 lsass.exe lsass.exe PID 4048 wrote to memory of 60 4048 lsass.exe lsass.exe PID 4048 wrote to memory of 60 4048 lsass.exe lsass.exe PID 4048 wrote to memory of 60 4048 lsass.exe lsass.exe PID 60 wrote to memory of 3776 60 lsass.exe explorer.exe PID 60 wrote to memory of 3776 60 lsass.exe explorer.exe PID 3332 wrote to memory of 512 3332 lsass.exe lsass.exe PID 3332 wrote to memory of 512 3332 lsass.exe lsass.exe PID 3332 wrote to memory of 512 3332 lsass.exe lsass.exe PID 3332 wrote to memory of 512 3332 lsass.exe lsass.exe PID 3332 wrote to memory of 512 3332 lsass.exe lsass.exe PID 3332 wrote to memory of 512 3332 lsass.exe lsass.exe PID 3332 wrote to memory of 512 3332 lsass.exe lsass.exe PID 3332 wrote to memory of 512 3332 lsass.exe lsass.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"4⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeC:\Windows\explorer.exe8⤵
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 5406⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"C:\Users\Admin\AppData\Local\Temp\6EA14E473644F3BEA03782F41D7C5246.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 4563⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3044 -s 29602⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3764 -s 8961⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
memory/60-143-0x0000000000420000-0x000000000056A000-memory.dmpFilesize
1.3MB
-
memory/60-142-0x0000000000420000-0x000000000056A000-memory.dmpFilesize
1.3MB
-
memory/60-139-0x0000000000401000-mapping.dmp
-
memory/768-118-0x000000000041DE40-mapping.dmp
-
memory/768-117-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/768-129-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/804-114-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1984-121-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1984-122-0x0000000000401000-mapping.dmp
-
memory/2080-149-0x00000000068A0000-0x00000000068B1000-memory.dmpFilesize
68KB
-
memory/2080-148-0x0000000006800000-0x0000000006818000-memory.dmpFilesize
96KB
-
memory/2348-147-0x0000022088F40000-0x0000022088F67000-memory.dmpFilesize
156KB
-
memory/3044-145-0x00000000012D0000-0x00000000012F7000-memory.dmpFilesize
156KB
-
memory/3044-153-0x0000000002CD0000-0x0000000002CD1000-memory.dmpFilesize
4KB
-
memory/3044-146-0x0000000001300000-0x0000000001312000-memory.dmpFilesize
72KB
-
memory/3332-151-0x0000000000600000-0x000000000074A000-memory.dmpFilesize
1.3MB
-
memory/3332-152-0x00000000007F0000-0x00000000007F1000-memory.dmpFilesize
4KB
-
memory/3332-123-0x0000000000000000-mapping.dmp
-
memory/3620-130-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/3620-132-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/3620-131-0x0000000000410028-mapping.dmp
-
memory/3776-144-0x00000000012B0000-0x00000000012D7000-memory.dmpFilesize
156KB
-
memory/3776-141-0x0000000000000000-mapping.dmp
-
memory/4048-134-0x000000000041DE40-mapping.dmp