Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
24-03-2022 02:08
Static task
static1
Behavioral task
behavioral1
Sample
8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe
Resource
win10v2004-en-20220113
General
-
Target
8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe
-
Size
760KB
-
MD5
2c4b3dd8eb91365645b88f763fa962f4
-
SHA1
17330e2274533cee442669dadbd0be43beb3887a
-
SHA256
8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611
-
SHA512
98a99702a528724136ef60a331e5741e0ccccdba86f20801a0c898104c3156bf0852097786cdbff481a9d924dd7711a8bf4c3d5012d76cf3864fa8b6363546a5
Malware Config
Extracted
raccoon
125d9f8ed76e486f6563be097a710bd4cba7f7f2
-
url4cnc
http://5.252.178.180/brikitiki
https://t.me/brikitiki
Extracted
arkei
Default
http://62.204.41.69/p8jG9WvgbE.php
Extracted
azorult
http://195.245.112.115/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
-
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M13
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M13
-
suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
memers.exememers.exeazne.exepm.exepid process 1392 memers.exe 3028 memers.exe 4044 azne.exe 4348 pm.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
pm.exeazne.exe8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exememers.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation pm.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation azne.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation memers.exe -
Loads dropped DLL 7 IoCs
Processes:
memers.exeMSBuild.exepid process 3028 memers.exe 3028 memers.exe 1776 MSBuild.exe 1776 MSBuild.exe 1776 MSBuild.exe 1776 MSBuild.exe 1776 MSBuild.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
pm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jbdvaxa = "\"C:\\Users\\Admin\\AppData\\Roaming\\Pmgcski\\Jbdvaxa.exe\"" pm.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
memers.exe8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exeazne.exedescription pid process target process PID 1392 set thread context of 3028 1392 memers.exe memers.exe PID 408 set thread context of 3276 408 8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe 8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe PID 4044 set thread context of 1776 4044 azne.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
memers.exeMSBuild.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 memers.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString memers.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MSBuild.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSBuild.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3564 timeout.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
powershell.exepowershell.exeazne.exeMSBuild.exepm.exepid process 1176 powershell.exe 1176 powershell.exe 1468 powershell.exe 1468 powershell.exe 4044 azne.exe 4044 azne.exe 1776 MSBuild.exe 1776 MSBuild.exe 4348 pm.exe 4348 pm.exe 4348 pm.exe 4348 pm.exe 4348 pm.exe 4348 pm.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
memers.exe8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exepid process 1392 memers.exe 408 8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
pm.exeazne.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4348 pm.exe Token: SeDebugPrivilege 4044 azne.exe Token: SeDebugPrivilege 1176 powershell.exe Token: SeDebugPrivilege 1468 powershell.exe Token: SeDebugPrivilege 4348 pm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exememers.exepid process 408 8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe 1392 memers.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exememers.exememers.execmd.exepm.exeazne.exedescription pid process target process PID 408 wrote to memory of 1392 408 8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe memers.exe PID 408 wrote to memory of 1392 408 8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe memers.exe PID 408 wrote to memory of 1392 408 8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe memers.exe PID 1392 wrote to memory of 3028 1392 memers.exe memers.exe PID 1392 wrote to memory of 3028 1392 memers.exe memers.exe PID 1392 wrote to memory of 3028 1392 memers.exe memers.exe PID 1392 wrote to memory of 3028 1392 memers.exe memers.exe PID 408 wrote to memory of 3276 408 8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe 8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe PID 408 wrote to memory of 3276 408 8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe 8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe PID 408 wrote to memory of 3276 408 8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe 8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe PID 408 wrote to memory of 3276 408 8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe 8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe PID 3028 wrote to memory of 4044 3028 memers.exe azne.exe PID 3028 wrote to memory of 4044 3028 memers.exe azne.exe PID 3028 wrote to memory of 4044 3028 memers.exe azne.exe PID 3028 wrote to memory of 4348 3028 memers.exe pm.exe PID 3028 wrote to memory of 4348 3028 memers.exe pm.exe PID 3028 wrote to memory of 3408 3028 memers.exe cmd.exe PID 3028 wrote to memory of 3408 3028 memers.exe cmd.exe PID 3028 wrote to memory of 3408 3028 memers.exe cmd.exe PID 3408 wrote to memory of 3564 3408 cmd.exe timeout.exe PID 3408 wrote to memory of 3564 3408 cmd.exe timeout.exe PID 3408 wrote to memory of 3564 3408 cmd.exe timeout.exe PID 4348 wrote to memory of 1176 4348 pm.exe powershell.exe PID 4348 wrote to memory of 1176 4348 pm.exe powershell.exe PID 4044 wrote to memory of 1468 4044 azne.exe powershell.exe PID 4044 wrote to memory of 1468 4044 azne.exe powershell.exe PID 4044 wrote to memory of 1468 4044 azne.exe powershell.exe PID 4044 wrote to memory of 1776 4044 azne.exe MSBuild.exe PID 4044 wrote to memory of 1776 4044 azne.exe MSBuild.exe PID 4044 wrote to memory of 1776 4044 azne.exe MSBuild.exe PID 4044 wrote to memory of 1776 4044 azne.exe MSBuild.exe PID 4044 wrote to memory of 1776 4044 azne.exe MSBuild.exe PID 4044 wrote to memory of 1776 4044 azne.exe MSBuild.exe PID 4044 wrote to memory of 1776 4044 azne.exe MSBuild.exe PID 4044 wrote to memory of 1776 4044 azne.exe MSBuild.exe PID 4044 wrote to memory of 1776 4044 azne.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe"C:\Users\Admin\AppData\Local\Temp\8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\memers.exe"C:\Users\Admin\AppData\Roaming\memers.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\memers.exe"C:\Users\Admin\AppData\Roaming\memers.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\azne.exe"C:\Users\Admin\AppData\Roaming\azne.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA2AA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe5⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\pm.exe"C:\Users\Admin\AppData\Roaming\pm.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA2AA==5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Roaming\memers.exe" & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 55⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe"C:\Users\Admin\AppData\Local\Temp\8181e5485c8c252628092084f37bd275eddc66d86d03bb07d149203be5e8a611.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\mozglue.dllMD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
C:\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
4c4184d3454890c87b54c2e5ab992e34
SHA191430044140ec65d67f9d0ae7aa5bbe42a4b088b
SHA256e0fc292d3fb4631c387f17408267485725f42fcb1a906563d4ccdda7e282f913
SHA5123cbc70ed58c3680207544a844d04234dc1922dee80b9a1e75393ace57b76d6887dccbe21c9b2205711dc0b8617839903b0c047ab5ed564558cd9ba00bdd1b718
-
C:\Users\Admin\AppData\Local\Temp\9B5325BF\mozglue.dllMD5
9e682f1eb98a9d41468fc3e50f907635
SHA185e0ceca36f657ddf6547aa0744f0855a27527ee
SHA256830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d
SHA512230230722d61ac1089fabf3f2decfa04f9296498f8e2a2a49b1527797dca67b5a11ab8656f04087acadf873fa8976400d57c77c404eba4aff89d92b9986f32ed
-
C:\Users\Admin\AppData\Local\Temp\9B5325BF\msvcp140.dllMD5
109f0f02fd37c84bfc7508d4227d7ed5
SHA1ef7420141bb15ac334d3964082361a460bfdb975
SHA256334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SHA51246eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
-
C:\Users\Admin\AppData\Local\Temp\9B5325BF\nss3.dllMD5
556ea09421a0f74d31c4c0a89a70dc23
SHA1f739ba9b548ee64b13eb434a3130406d23f836e3
SHA256f0e6210d4a0d48c7908d8d1c270449c91eb4523e312a61256833bfeaf699abfb
SHA5122481fc80dffa8922569552c3c3ebaef8d0341b80427447a14b291ec39ea62ab9c05a75e85eef5ea7f857488cab1463c18586f9b076e2958c5a314e459045ede2
-
C:\Users\Admin\AppData\Local\Temp\9B5325BF\vcruntime140.dllMD5
7587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
C:\Users\Admin\AppData\Local\Temp\9B5325BF\vcruntime140.dllMD5
7587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
C:\Users\Admin\AppData\Roaming\azne.exeMD5
7380e6393cb0fd25559d2ec9b7a845a1
SHA105794f53f5da768852f705a766affe01d84df24f
SHA256c4e9506ae32db057b0283fe9fd7f0d4b482395866ac0d023c5d289c8bdf434fb
SHA512806bd1c3a52b1d7fece20883c2ef73cb0739cbaf73134b101ec97504b941b71c73993ae32dce13523df3ea26290e2abfd1af9173cddc75ee775cc84b91749bc3
-
C:\Users\Admin\AppData\Roaming\azne.exeMD5
7380e6393cb0fd25559d2ec9b7a845a1
SHA105794f53f5da768852f705a766affe01d84df24f
SHA256c4e9506ae32db057b0283fe9fd7f0d4b482395866ac0d023c5d289c8bdf434fb
SHA512806bd1c3a52b1d7fece20883c2ef73cb0739cbaf73134b101ec97504b941b71c73993ae32dce13523df3ea26290e2abfd1af9173cddc75ee775cc84b91749bc3
-
C:\Users\Admin\AppData\Roaming\memers.exeMD5
a789f8825dca1cf639f136f72e2ee6c2
SHA1705cf8371a72530cffdc8816fc51a70412ed4046
SHA25699beb03c48f91fa0c58f5616002fc25dcc60638f20bb2879825a16298eb8d4c2
SHA512988b8f0b66251588316adc3a6c2d1d8c1a25929f6d273767766084e2a789da7a980fa39908ae8bdf718cbc4a9e7a0cfa0deae0d535492b5e84af8dc59a00c3d1
-
C:\Users\Admin\AppData\Roaming\memers.exeMD5
a789f8825dca1cf639f136f72e2ee6c2
SHA1705cf8371a72530cffdc8816fc51a70412ed4046
SHA25699beb03c48f91fa0c58f5616002fc25dcc60638f20bb2879825a16298eb8d4c2
SHA512988b8f0b66251588316adc3a6c2d1d8c1a25929f6d273767766084e2a789da7a980fa39908ae8bdf718cbc4a9e7a0cfa0deae0d535492b5e84af8dc59a00c3d1
-
C:\Users\Admin\AppData\Roaming\memers.exeMD5
a789f8825dca1cf639f136f72e2ee6c2
SHA1705cf8371a72530cffdc8816fc51a70412ed4046
SHA25699beb03c48f91fa0c58f5616002fc25dcc60638f20bb2879825a16298eb8d4c2
SHA512988b8f0b66251588316adc3a6c2d1d8c1a25929f6d273767766084e2a789da7a980fa39908ae8bdf718cbc4a9e7a0cfa0deae0d535492b5e84af8dc59a00c3d1
-
C:\Users\Admin\AppData\Roaming\pm.exeMD5
9d4733290705c28e45c8e52d00126979
SHA1553b6d4f953f6b71be176d45917d093a4fb320b9
SHA256f016ff324df6fdcf11c3de424eaed30945e90b86d24cfa3ae2fca9be940d86e7
SHA512c3cc7f885ab770d50e4eef56e8b9b770fa4aee19bf7db29e713d8429bc56fc3a2d0955be7b750cf9be901eb7ce421079961b8723dfb08c885a7cb164ebd106c0
-
C:\Users\Admin\AppData\Roaming\pm.exeMD5
9d4733290705c28e45c8e52d00126979
SHA1553b6d4f953f6b71be176d45917d093a4fb320b9
SHA256f016ff324df6fdcf11c3de424eaed30945e90b86d24cfa3ae2fca9be940d86e7
SHA512c3cc7f885ab770d50e4eef56e8b9b770fa4aee19bf7db29e713d8429bc56fc3a2d0955be7b750cf9be901eb7ce421079961b8723dfb08c885a7cb164ebd106c0
-
memory/1176-179-0x000001FF5DC10000-0x000001FF5DC32000-memory.dmpFilesize
136KB
-
memory/1176-176-0x0000000000000000-mapping.dmp
-
memory/1176-187-0x000001FF5DB06000-0x000001FF5DB08000-memory.dmpFilesize
8KB
-
memory/1176-183-0x000001FF5DB03000-0x000001FF5DB05000-memory.dmpFilesize
8KB
-
memory/1176-182-0x000001FF5DB00000-0x000001FF5DB02000-memory.dmpFilesize
8KB
-
memory/1176-181-0x00007FFCFF380000-0x00007FFCFFE41000-memory.dmpFilesize
10.8MB
-
memory/1392-139-0x0000000000610000-0x0000000000617000-memory.dmpFilesize
28KB
-
memory/1392-132-0x0000000000000000-mapping.dmp
-
memory/1468-186-0x00000000055F0000-0x0000000005656000-memory.dmpFilesize
408KB
-
memory/1468-185-0x0000000004E90000-0x0000000004EF6000-memory.dmpFilesize
408KB
-
memory/1468-177-0x0000000000000000-mapping.dmp
-
memory/1468-178-0x00000000025E0000-0x0000000002616000-memory.dmpFilesize
216KB
-
memory/1468-191-0x00000000060C0000-0x00000000060DA000-memory.dmpFilesize
104KB
-
memory/1468-180-0x0000000004F50000-0x0000000005578000-memory.dmpFilesize
6.2MB
-
memory/1468-190-0x00000000071F0000-0x000000000786A000-memory.dmpFilesize
6.5MB
-
memory/1468-189-0x0000000002685000-0x0000000002687000-memory.dmpFilesize
8KB
-
memory/1468-188-0x0000000005BB0000-0x0000000005BCE000-memory.dmpFilesize
120KB
-
memory/1468-184-0x0000000004CF0000-0x0000000004D12000-memory.dmpFilesize
136KB
-
memory/1776-198-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1776-195-0x0000000000000000-mapping.dmp
-
memory/1776-196-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3028-142-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3028-137-0x0000000000000000-mapping.dmp
-
memory/3028-143-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/3276-140-0x0000000000000000-mapping.dmp
-
memory/3276-141-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/3408-171-0x0000000000000000-mapping.dmp
-
memory/3564-173-0x0000000000000000-mapping.dmp
-
memory/4044-164-0x0000000000000000-mapping.dmp
-
memory/4044-170-0x0000000000090000-0x000000000009A000-memory.dmpFilesize
40KB
-
memory/4348-193-0x0000000001253000-0x0000000001255000-memory.dmpFilesize
8KB
-
memory/4348-167-0x0000000000000000-mapping.dmp
-
memory/4348-192-0x000000001DE50000-0x000000001DEDC000-memory.dmpFilesize
560KB
-
memory/4348-175-0x0000000001250000-0x0000000001252000-memory.dmpFilesize
8KB
-
memory/4348-172-0x0000000000CC0000-0x0000000000CCA000-memory.dmpFilesize
40KB
-
memory/4348-174-0x00007FFCFF380000-0x00007FFCFFE41000-memory.dmpFilesize
10.8MB
-
memory/4348-204-0x0000000001258000-0x000000000125A000-memory.dmpFilesize
8KB
-
memory/4348-205-0x000000000125A000-0x000000000125F000-memory.dmpFilesize
20KB