Analysis
-
max time kernel
99s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
30-05-2022 02:00
Static task
static1
Behavioral task
behavioral1
Sample
0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe
Resource
win10v2004-20220414-en
General
-
Target
0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe
-
Size
802KB
-
MD5
8fe92e8677b751678f35eae1aac22e58
-
SHA1
7c05f6f2c4403fbffc9195ad644652e890508de2
-
SHA256
0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a
-
SHA512
95274780845cd8bc0beeb65349352b662240bccb2e7b0d21618a476e70c21e597efe1db1a80925869a7878d1029ea25e645910f3385450f79cc5bc6ba00a0d8d
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
Processes:
388E2.exe61EE9.exe9E18J.exe917GK.exe5IFA0.exe8ALH6BGAJ374G5E.exepid process 4960 388E2.exe 3024 61EE9.exe 5096 9E18J.exe 2060 917GK.exe 4892 5IFA0.exe 612 8ALH6BGAJ374G5E.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5IFA0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 5IFA0.exe -
Loads dropped DLL 5 IoCs
Processes:
61EE9.exerundll32.exepid process 3024 61EE9.exe 3024 61EE9.exe 3024 61EE9.exe 3640 rundll32.exe 3640 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
917GK.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA\\dllhost.exe" 917GK.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exepid process 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2152 4960 WerFault.exe 388E2.exe 4200 2060 WerFault.exe 917GK.exe 1824 5096 WerFault.exe 9E18J.exe -
Processes:
8ALH6BGAJ374G5E.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 8ALH6BGAJ374G5E.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 8ALH6BGAJ374G5E.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\IESettingSync 8ALH6BGAJ374G5E.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" 8ALH6BGAJ374G5E.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe388E2.exe9E18J.exepid process 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 4960 388E2.exe 4960 388E2.exe 5096 9E18J.exe 5096 9E18J.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
388E2.exe9E18J.exe917GK.exedescription pid process Token: SeDebugPrivilege 4960 388E2.exe Token: SeDebugPrivilege 5096 9E18J.exe Token: SeDebugPrivilege 2060 917GK.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8ALH6BGAJ374G5E.exepid process 612 8ALH6BGAJ374G5E.exe 612 8ALH6BGAJ374G5E.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe5IFA0.execontrol.exedescription pid process target process PID 2128 wrote to memory of 4960 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 388E2.exe PID 2128 wrote to memory of 4960 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 388E2.exe PID 2128 wrote to memory of 4960 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 388E2.exe PID 2128 wrote to memory of 3024 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 61EE9.exe PID 2128 wrote to memory of 3024 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 61EE9.exe PID 2128 wrote to memory of 3024 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 61EE9.exe PID 2128 wrote to memory of 5096 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 9E18J.exe PID 2128 wrote to memory of 5096 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 9E18J.exe PID 2128 wrote to memory of 5096 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 9E18J.exe PID 2128 wrote to memory of 2060 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 917GK.exe PID 2128 wrote to memory of 2060 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 917GK.exe PID 2128 wrote to memory of 2060 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 917GK.exe PID 2128 wrote to memory of 4892 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 5IFA0.exe PID 2128 wrote to memory of 4892 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 5IFA0.exe PID 2128 wrote to memory of 4892 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 5IFA0.exe PID 2128 wrote to memory of 612 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 8ALH6BGAJ374G5E.exe PID 2128 wrote to memory of 612 2128 0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe 8ALH6BGAJ374G5E.exe PID 4892 wrote to memory of 3044 4892 5IFA0.exe control.exe PID 4892 wrote to memory of 3044 4892 5IFA0.exe control.exe PID 4892 wrote to memory of 3044 4892 5IFA0.exe control.exe PID 3044 wrote to memory of 3640 3044 control.exe rundll32.exe PID 3044 wrote to memory of 3640 3044 control.exe rundll32.exe PID 3044 wrote to memory of 3640 3044 control.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe"C:\Users\Admin\AppData\Local\Temp\0bcbc25c88e5b636deb9b0bac8a2d28aed3e7d5c668fee75089711caa2a8147a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\388E2.exe"C:\Users\Admin\AppData\Local\Temp\388E2.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 19323⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\61EE9.exe"C:\Users\Admin\AppData\Local\Temp\61EE9.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\9E18J.exe"C:\Users\Admin\AppData\Local\Temp\9E18J.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 16723⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\917GK.exe"C:\Users\Admin\AppData\Local\Temp\917GK.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 17643⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\5IFA0.exe"C:\Users\Admin\AppData\Local\Temp\5IFA0.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" .\NSi5EP.DZG3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\NSi5EP.DZG4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\8ALH6BGAJ374G5E.exehttps://iplogger.org/1OAvJ2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4960 -ip 49601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2060 -ip 20601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5096 -ip 50961⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\mozglue.dllFilesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
C:\Users\Admin\AppData\LocalLow\nss3.dllFilesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
C:\Users\Admin\AppData\LocalLow\sqlite3.dllFilesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
C:\Users\Admin\AppData\Local\Temp\388E2.exeFilesize
334KB
MD5e01e4ebdceade8f7f9e29a3c8bceb7a9
SHA1f531072ea44f2ddbff5670b9c47030a235aaa97b
SHA25687a643f05a4a942da305e22222193770bee9ecee4f7f0442408445336bf1c8ef
SHA5124f4d3b40c3efe5eebd5c472f15df0ec3f340b132b22f982085d5c617071f3548871f349268ba7c7c9584c37456aa54c8104ecc8c9d4aa45c7f535f64b6815170
-
C:\Users\Admin\AppData\Local\Temp\388E2.exeFilesize
334KB
MD5e01e4ebdceade8f7f9e29a3c8bceb7a9
SHA1f531072ea44f2ddbff5670b9c47030a235aaa97b
SHA25687a643f05a4a942da305e22222193770bee9ecee4f7f0442408445336bf1c8ef
SHA5124f4d3b40c3efe5eebd5c472f15df0ec3f340b132b22f982085d5c617071f3548871f349268ba7c7c9584c37456aa54c8104ecc8c9d4aa45c7f535f64b6815170
-
C:\Users\Admin\AppData\Local\Temp\5IFA0.exeFilesize
2.1MB
MD5a7de88903e8b3b53a29be54928bd54de
SHA1c3730db450736a6b486477a5c7dbf6cb8cc55b30
SHA2568b8a2c6f45c74c244bf57d9013f08141139b516d3b5a2066625e91f7878785f6
SHA5128fbfb1438d2d1a629f98ab94db47356724ac313b0f5308d6d7e7bfb27c8f5baeb16e13e7e45f92c8fe23804871a8f403a58e489173ec07b8e948d0e540412cd4
-
C:\Users\Admin\AppData\Local\Temp\5IFA0.exeFilesize
2.1MB
MD5a7de88903e8b3b53a29be54928bd54de
SHA1c3730db450736a6b486477a5c7dbf6cb8cc55b30
SHA2568b8a2c6f45c74c244bf57d9013f08141139b516d3b5a2066625e91f7878785f6
SHA5128fbfb1438d2d1a629f98ab94db47356724ac313b0f5308d6d7e7bfb27c8f5baeb16e13e7e45f92c8fe23804871a8f403a58e489173ec07b8e948d0e540412cd4
-
C:\Users\Admin\AppData\Local\Temp\61EE9.exeFilesize
55KB
MD5d28ba705f24c9e51564c46aefab26754
SHA10c6bb0d8f2611775b495a019c63f95b1377f2054
SHA2560c722728ca1a996bbb83455332fa27018158cef21ad35dc057191a0353960256
SHA512441ea8ded89e2bc7630134e9da3a5cd25835133f2c869ff7f6540041225cf3486e380bc2e001a2359adcca0723fb8b80b349ff4b905dbb686c354783c4c68d4a
-
C:\Users\Admin\AppData\Local\Temp\61EE9.exeFilesize
55KB
MD5d28ba705f24c9e51564c46aefab26754
SHA10c6bb0d8f2611775b495a019c63f95b1377f2054
SHA2560c722728ca1a996bbb83455332fa27018158cef21ad35dc057191a0353960256
SHA512441ea8ded89e2bc7630134e9da3a5cd25835133f2c869ff7f6540041225cf3486e380bc2e001a2359adcca0723fb8b80b349ff4b905dbb686c354783c4c68d4a
-
C:\Users\Admin\AppData\Local\Temp\8ALH6BGAJ374G5E.exeFilesize
8KB
MD58719ce641e7c777ac1b0eaec7b5fa7c7
SHA1c04de52cb511480cc7d00d67f1d9e17b02d6406b
SHA2566283ac6ecbf4c4038cf44896dd221c7c11152bac77273709330409032c3e72ea
SHA5127be5bd6d2342dd02818f1979e7e74a6376658711ac82a59b2af1a67207cfd3c7416b657af01216473b15132e4aa5c6675f0eb8ee6343192c7dfc4a5249ccaa97
-
C:\Users\Admin\AppData\Local\Temp\8ALH6BGAJ374G5E.exeFilesize
8KB
MD58719ce641e7c777ac1b0eaec7b5fa7c7
SHA1c04de52cb511480cc7d00d67f1d9e17b02d6406b
SHA2566283ac6ecbf4c4038cf44896dd221c7c11152bac77273709330409032c3e72ea
SHA5127be5bd6d2342dd02818f1979e7e74a6376658711ac82a59b2af1a67207cfd3c7416b657af01216473b15132e4aa5c6675f0eb8ee6343192c7dfc4a5249ccaa97
-
C:\Users\Admin\AppData\Local\Temp\917GK.exeFilesize
375KB
MD5c1a9d4018b69245d3c2ac4c013505239
SHA1782d2666aba1ed0cf31f61921260e0e1bfa20f5f
SHA256be6799c041af7c7ce8529b5ed33d1bff739924f63d4bfc754bc11813978c770b
SHA5124ee7903f3e205f6ba08f8653d36734d8032fa2769469ac49698311dabf87b9a6ebde273c497ac7cee69b5545bc1b9e1712ec9972fa99a149c80132d3290d8106
-
C:\Users\Admin\AppData\Local\Temp\917GK.exeFilesize
375KB
MD5c1a9d4018b69245d3c2ac4c013505239
SHA1782d2666aba1ed0cf31f61921260e0e1bfa20f5f
SHA256be6799c041af7c7ce8529b5ed33d1bff739924f63d4bfc754bc11813978c770b
SHA5124ee7903f3e205f6ba08f8653d36734d8032fa2769469ac49698311dabf87b9a6ebde273c497ac7cee69b5545bc1b9e1712ec9972fa99a149c80132d3290d8106
-
C:\Users\Admin\AppData\Local\Temp\9E18J.exeFilesize
412KB
MD5c1ac3b7fecac16675c22779c126bb3e1
SHA11434ca796e15399c98c72bdb82e2cb7e33148192
SHA25647bda68d36eca9ff1b290906a48d2ba00ae64f7387d32b488f2bc89a22b5bd29
SHA512495140241193478236c3b88c4f1afea564062546c145c6919c699ad52a288b59888fd6c8693ff611ad4678cf44d06274d9dfe208469bdd35cb36b385e78fac78
-
C:\Users\Admin\AppData\Local\Temp\9E18J.exeFilesize
412KB
MD5c1ac3b7fecac16675c22779c126bb3e1
SHA11434ca796e15399c98c72bdb82e2cb7e33148192
SHA25647bda68d36eca9ff1b290906a48d2ba00ae64f7387d32b488f2bc89a22b5bd29
SHA512495140241193478236c3b88c4f1afea564062546c145c6919c699ad52a288b59888fd6c8693ff611ad4678cf44d06274d9dfe208469bdd35cb36b385e78fac78
-
C:\Users\Admin\AppData\Local\Temp\NSi5EP.DZGFilesize
555.4MB
MD53c28fc3d2566aa90808ef238b45e2243
SHA103516bd906bfd4566f26b0c24933184673daff21
SHA25647d4ed567a8c6aa727e3555474166d8f0aed970f63a66c889d7d59cdcbaf614a
SHA512899ffec3701114b4cb2041de9bd06ab00ed21afa7af0dc6d491fa622afb54d9179cc75b58fa3736e165e627d77363d16638cdb493745a1e136f3c979a6ef96fd
-
C:\Users\Admin\AppData\Local\Temp\NSi5ep.DzgFilesize
559.2MB
MD5a63ccf7e05dc752fe59c1f18c002e0a7
SHA168a85f11385b5ffd917082ee1900680bfd3975e4
SHA25659469eb6c339bd9454944682d3125e9ccd5096badcbf6df29f6b90ac0f29c2ff
SHA5122cc633fad0684eadef4ccee65e5def68e1c031fcd47ef17822493912ab0264b733a6833bcab4f31639f5969faef655a8aeca4797e8f1325cd828cbce23e50767
-
C:\Users\Admin\AppData\Local\Temp\NSi5ep.DzgFilesize
566.9MB
MD51712022a72139e788f75db0c7ad68b32
SHA18ff8208ec90fc95bfdd569b09c29951ac0a40108
SHA256bcb64047156434d12af1640bbea90bb9ba85838852116bee7ee386a8d8d6de4b
SHA51247bd9fa6c1d88bd4d8e53a76aa9c5e37f97a55a803ae94c2d215f6b944c8e3bb65f9c3230f6f4d52c23b52821f109dc1ee21709a7a2965adecb49cab445aa90e
-
memory/612-198-0x00007FFBC2480000-0x00007FFBC2F41000-memory.dmpFilesize
10.8MB
-
memory/612-190-0x00007FFBC2480000-0x00007FFBC2F41000-memory.dmpFilesize
10.8MB
-
memory/612-183-0x0000000000000000-mapping.dmp
-
memory/612-193-0x0000015C33B70000-0x0000015C34316000-memory.dmpFilesize
7.6MB
-
memory/612-189-0x0000015415530000-0x0000015415536000-memory.dmpFilesize
24KB
-
memory/2060-170-0x0000000000000000-mapping.dmp
-
memory/2060-179-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/2060-175-0x0000000000553000-0x0000000000574000-memory.dmpFilesize
132KB
-
memory/2060-178-0x0000000000553000-0x0000000000574000-memory.dmpFilesize
132KB
-
memory/2060-176-0x0000000000640000-0x000000000066E000-memory.dmpFilesize
184KB
-
memory/2060-177-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/2128-132-0x0000000075E20000-0x0000000076035000-memory.dmpFilesize
2.1MB
-
memory/2128-135-0x00000000007B0000-0x00000000009AA000-memory.dmpFilesize
2.0MB
-
memory/2128-188-0x0000000002DE0000-0x0000000002E28000-memory.dmpFilesize
288KB
-
memory/2128-156-0x00000000007B0000-0x00000000009AA000-memory.dmpFilesize
2.0MB
-
memory/2128-133-0x00000000007B0000-0x00000000009AA000-memory.dmpFilesize
2.0MB
-
memory/2128-187-0x00000000007B0000-0x00000000009AA000-memory.dmpFilesize
2.0MB
-
memory/2128-134-0x0000000002DE0000-0x0000000002E28000-memory.dmpFilesize
288KB
-
memory/2128-144-0x0000000002DE0000-0x0000000002E28000-memory.dmpFilesize
288KB
-
memory/2128-136-0x00000000007B0000-0x00000000009AA000-memory.dmpFilesize
2.0MB
-
memory/2128-143-0x00000000007B0000-0x00000000009AA000-memory.dmpFilesize
2.0MB
-
memory/2128-131-0x00000000007B0000-0x00000000009AA000-memory.dmpFilesize
2.0MB
-
memory/2128-130-0x00000000007B0000-0x00000000009AA000-memory.dmpFilesize
2.0MB
-
memory/3024-140-0x0000000000000000-mapping.dmp
-
memory/3044-192-0x0000000000000000-mapping.dmp
-
memory/3640-201-0x000000002D360000-0x000000002D41B000-memory.dmpFilesize
748KB
-
memory/3640-200-0x000000002D270000-0x000000002D351000-memory.dmpFilesize
900KB
-
memory/3640-199-0x00000000025F0000-0x00000000035F0000-memory.dmpFilesize
16.0MB
-
memory/3640-194-0x0000000000000000-mapping.dmp
-
memory/4892-180-0x0000000000000000-mapping.dmp
-
memory/4960-147-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/4960-151-0x00000000055C0000-0x00000000056CA000-memory.dmpFilesize
1.0MB
-
memory/4960-173-0x0000000000400000-0x000000000091C000-memory.dmpFilesize
5.1MB
-
memory/4960-169-0x0000000000BD9000-0x0000000000C03000-memory.dmpFilesize
168KB
-
memory/4960-137-0x0000000000000000-mapping.dmp
-
memory/4960-145-0x0000000000BD9000-0x0000000000C03000-memory.dmpFilesize
168KB
-
memory/4960-146-0x0000000002570000-0x00000000025A7000-memory.dmpFilesize
220KB
-
memory/4960-165-0x00000000077C0000-0x0000000007CEC000-memory.dmpFilesize
5.2MB
-
memory/4960-148-0x0000000005010000-0x00000000055B4000-memory.dmpFilesize
5.6MB
-
memory/4960-164-0x00000000075F0000-0x00000000077B2000-memory.dmpFilesize
1.8MB
-
memory/4960-149-0x0000000005BE0000-0x00000000061F8000-memory.dmpFilesize
6.1MB
-
memory/4960-160-0x0000000006E40000-0x0000000006EA6000-memory.dmpFilesize
408KB
-
memory/4960-159-0x0000000006CB0000-0x0000000006CCE000-memory.dmpFilesize
120KB
-
memory/4960-158-0x0000000006B90000-0x0000000006C06000-memory.dmpFilesize
472KB
-
memory/4960-157-0x0000000006AD0000-0x0000000006B62000-memory.dmpFilesize
584KB
-
memory/4960-152-0x0000000004FA0000-0x0000000004FDC000-memory.dmpFilesize
240KB
-
memory/4960-150-0x0000000004F80000-0x0000000004F92000-memory.dmpFilesize
72KB
-
memory/5096-174-0x0000000007240000-0x0000000007290000-memory.dmpFilesize
320KB
-
memory/5096-161-0x0000000000000000-mapping.dmp
-
memory/5096-186-0x0000000000400000-0x00000000004AD000-memory.dmpFilesize
692KB
-
memory/5096-166-0x00000000006F3000-0x000000000071D000-memory.dmpFilesize
168KB
-
memory/5096-167-0x0000000000610000-0x0000000000647000-memory.dmpFilesize
220KB
-
memory/5096-168-0x0000000000400000-0x00000000004AD000-memory.dmpFilesize
692KB