Analysis
-
max time kernel
168s -
max time network
183s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
25-06-2022 02:11
Static task
static1
Behavioral task
behavioral1
Sample
e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe
Resource
win10v2004-20220414-en
General
-
Target
e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe
-
Size
1.1MB
-
MD5
6962527d9ac313319bd2b87cd12ab32c
-
SHA1
cd5c57102e56d6af901919edf41dd85d9f012351
-
SHA256
e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a
-
SHA512
048f07a350e08d49e70b3a1a1d017c515f700ad0de2415130efe71c455b81cd656ab820104eff6bf39444d9cae1c2220066715ed8efec0e898602e9ea5ab3532
Malware Config
Signatures
-
Processes:
frm_QANATS.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" frm_QANATS.exe -
Processes:
frm_QANATS.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" frm_QANATS.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\B2H6Y3K0-Y7X5-B5F3-N3W1-K4A558N0M337 = "C:\\Users\\Admin\\AppData\\Roaming\\B2H6Y3K0-Y7X5-B5F3-N3W1-K4A558N0M337\\B2H6Y3K0-Y7X5-B5F3-N3W1-K4A558N0M337.exe" iexplore.exe -
Executes dropped EXE 3 IoCs
Processes:
frm_QANATS.exefrm_QANATS.exefrm_QANATS.exepid process 932 frm_QANATS.exe 652 frm_QANATS.exe 1332 frm_QANATS.exe -
Loads dropped DLL 4 IoCs
Processes:
e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exefrm_QANATS.exefrm_QANATS.exepid process 1064 e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe 1064 e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe 932 frm_QANATS.exe 652 frm_QANATS.exe -
Processes:
frm_QANATS.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" frm_QANATS.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
iexplore.exefrm_QANATS.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\B2H6Y3K0-Y7X5-B5F3-N3W1-K4A558N0M337 = "C:\\Users\\Admin\\AppData\\Roaming\\B2H6Y3K0-Y7X5-B5F3-N3W1-K4A558N0M337\\B2H6Y3K0-Y7X5-B5F3-N3W1-K4A558N0M337.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\B2H6Y3K0-Y7X5-B5F3-N3W1-K4A558N0M337 = "C:\\Users\\Admin\\AppData\\Roaming\\B2H6Y3K0-Y7X5-B5F3-N3W1-K4A558N0M337\\B2H6Y3K0-Y7X5-B5F3-N3W1-K4A558N0M337.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce frm_QANATS.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\frm_Roldan = "wscript \"C:\\Users\\Admin\\AppData\\Local\\Temp\\frm_QANATS.vbs\"" frm_QANATS.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe -
Processes:
frm_QANATS.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" frm_QANATS.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exefrm_QANATS.exefrm_QANATS.exefrm_QANATS.exedescription pid process target process PID 1976 set thread context of 1064 1976 e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe PID 932 set thread context of 652 932 frm_QANATS.exe frm_QANATS.exe PID 652 set thread context of 1332 652 frm_QANATS.exe frm_QANATS.exe PID 1332 set thread context of 1460 1332 frm_QANATS.exe iexplore.exe -
Drops file in Windows directory 4 IoCs
Processes:
e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exee22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exefrm_QANATS.exefrm_QANATS.exedescription ioc process File opened for modification C:\Windows\win.ini e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe File opened for modification C:\Windows\win.ini e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe File opened for modification C:\Windows\win.ini frm_QANATS.exe File opened for modification C:\Windows\win.ini frm_QANATS.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
frm_QANATS.exepid process 1332 frm_QANATS.exe 1332 frm_QANATS.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
iexplore.exedescription pid process Token: SeDebugPrivilege 1460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exee22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exefrm_QANATS.exefrm_QANATS.exefrm_QANATS.exeiexplore.exepid process 1976 e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe 1064 e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe 932 frm_QANATS.exe 652 frm_QANATS.exe 1332 frm_QANATS.exe 1460 iexplore.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exee22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exefrm_QANATS.exefrm_QANATS.exefrm_QANATS.exedescription pid process target process PID 1976 wrote to memory of 1064 1976 e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe PID 1976 wrote to memory of 1064 1976 e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe PID 1976 wrote to memory of 1064 1976 e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe PID 1976 wrote to memory of 1064 1976 e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe PID 1064 wrote to memory of 932 1064 e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe frm_QANATS.exe PID 1064 wrote to memory of 932 1064 e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe frm_QANATS.exe PID 1064 wrote to memory of 932 1064 e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe frm_QANATS.exe PID 1064 wrote to memory of 932 1064 e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe frm_QANATS.exe PID 932 wrote to memory of 652 932 frm_QANATS.exe frm_QANATS.exe PID 932 wrote to memory of 652 932 frm_QANATS.exe frm_QANATS.exe PID 932 wrote to memory of 652 932 frm_QANATS.exe frm_QANATS.exe PID 932 wrote to memory of 652 932 frm_QANATS.exe frm_QANATS.exe PID 652 wrote to memory of 1332 652 frm_QANATS.exe frm_QANATS.exe PID 652 wrote to memory of 1332 652 frm_QANATS.exe frm_QANATS.exe PID 652 wrote to memory of 1332 652 frm_QANATS.exe frm_QANATS.exe PID 652 wrote to memory of 1332 652 frm_QANATS.exe frm_QANATS.exe PID 652 wrote to memory of 1332 652 frm_QANATS.exe frm_QANATS.exe PID 652 wrote to memory of 1332 652 frm_QANATS.exe frm_QANATS.exe PID 652 wrote to memory of 1332 652 frm_QANATS.exe frm_QANATS.exe PID 652 wrote to memory of 1332 652 frm_QANATS.exe frm_QANATS.exe PID 652 wrote to memory of 1332 652 frm_QANATS.exe frm_QANATS.exe PID 652 wrote to memory of 1332 652 frm_QANATS.exe frm_QANATS.exe PID 1332 wrote to memory of 1460 1332 frm_QANATS.exe iexplore.exe PID 1332 wrote to memory of 1460 1332 frm_QANATS.exe iexplore.exe PID 1332 wrote to memory of 1460 1332 frm_QANATS.exe iexplore.exe PID 1332 wrote to memory of 1460 1332 frm_QANATS.exe iexplore.exe PID 1332 wrote to memory of 1460 1332 frm_QANATS.exe iexplore.exe PID 1332 wrote to memory of 1460 1332 frm_QANATS.exe iexplore.exe PID 1332 wrote to memory of 1460 1332 frm_QANATS.exe iexplore.exe PID 1332 wrote to memory of 1460 1332 frm_QANATS.exe iexplore.exe PID 1332 wrote to memory of 1460 1332 frm_QANATS.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
frm_QANATS.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" frm_QANATS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe"C:\Users\Admin\AppData\Local\Temp\e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe"C:\Users\Admin\AppData\Local\Temp\e22a21011a6e843389fbbe8cab856a3ba7ecc184c779e2767cc91e666fa7b66a.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe"C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe"C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe"C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe"5⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\frm_QANATS.exe6⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exeFilesize
1.1MB
MD572b518574405809b54d8e2d3a4283d50
SHA19429216ebd67da45ac4b9dbc24e5c47a24425e26
SHA2564fde57eb8070711e8e30fe34ab1a1bf785f40a38d2fcb6468c2266f9b6e4cd2e
SHA512a4def1b82fb9d93cadc35c6ffbb65660372962b3a66c1df9ca392055a30beec6cbe2a3f80006b32570efab0b865803e83138cecc3e23679f7946bdcce5bdccff
-
C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exeFilesize
1.1MB
MD572b518574405809b54d8e2d3a4283d50
SHA19429216ebd67da45ac4b9dbc24e5c47a24425e26
SHA2564fde57eb8070711e8e30fe34ab1a1bf785f40a38d2fcb6468c2266f9b6e4cd2e
SHA512a4def1b82fb9d93cadc35c6ffbb65660372962b3a66c1df9ca392055a30beec6cbe2a3f80006b32570efab0b865803e83138cecc3e23679f7946bdcce5bdccff
-
C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exeFilesize
1.1MB
MD572b518574405809b54d8e2d3a4283d50
SHA19429216ebd67da45ac4b9dbc24e5c47a24425e26
SHA2564fde57eb8070711e8e30fe34ab1a1bf785f40a38d2fcb6468c2266f9b6e4cd2e
SHA512a4def1b82fb9d93cadc35c6ffbb65660372962b3a66c1df9ca392055a30beec6cbe2a3f80006b32570efab0b865803e83138cecc3e23679f7946bdcce5bdccff
-
C:\Users\Admin\AppData\Local\Temp\frm_QANATS.exeFilesize
1.1MB
MD572b518574405809b54d8e2d3a4283d50
SHA19429216ebd67da45ac4b9dbc24e5c47a24425e26
SHA2564fde57eb8070711e8e30fe34ab1a1bf785f40a38d2fcb6468c2266f9b6e4cd2e
SHA512a4def1b82fb9d93cadc35c6ffbb65660372962b3a66c1df9ca392055a30beec6cbe2a3f80006b32570efab0b865803e83138cecc3e23679f7946bdcce5bdccff
-
C:\Windows\win.iniFilesize
509B
MD5d2a2412bddba16d60ec63bd9550d933f
SHA1deb3d3bdc9055f0b4909b31d3048446848fae0e1
SHA25679ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a
SHA5128fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31
-
C:\Windows\win.iniFilesize
509B
MD5d2a2412bddba16d60ec63bd9550d933f
SHA1deb3d3bdc9055f0b4909b31d3048446848fae0e1
SHA25679ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a
SHA5128fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31
-
C:\Windows\win.iniFilesize
509B
MD5d2a2412bddba16d60ec63bd9550d933f
SHA1deb3d3bdc9055f0b4909b31d3048446848fae0e1
SHA25679ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a
SHA5128fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31
-
\Users\Admin\AppData\Local\Temp\frm_QANATS.exeFilesize
1.1MB
MD572b518574405809b54d8e2d3a4283d50
SHA19429216ebd67da45ac4b9dbc24e5c47a24425e26
SHA2564fde57eb8070711e8e30fe34ab1a1bf785f40a38d2fcb6468c2266f9b6e4cd2e
SHA512a4def1b82fb9d93cadc35c6ffbb65660372962b3a66c1df9ca392055a30beec6cbe2a3f80006b32570efab0b865803e83138cecc3e23679f7946bdcce5bdccff
-
\Users\Admin\AppData\Local\Temp\frm_QANATS.exeFilesize
1.1MB
MD572b518574405809b54d8e2d3a4283d50
SHA19429216ebd67da45ac4b9dbc24e5c47a24425e26
SHA2564fde57eb8070711e8e30fe34ab1a1bf785f40a38d2fcb6468c2266f9b6e4cd2e
SHA512a4def1b82fb9d93cadc35c6ffbb65660372962b3a66c1df9ca392055a30beec6cbe2a3f80006b32570efab0b865803e83138cecc3e23679f7946bdcce5bdccff
-
\Users\Admin\AppData\Local\Temp\frm_QANATS.exeFilesize
1.1MB
MD572b518574405809b54d8e2d3a4283d50
SHA19429216ebd67da45ac4b9dbc24e5c47a24425e26
SHA2564fde57eb8070711e8e30fe34ab1a1bf785f40a38d2fcb6468c2266f9b6e4cd2e
SHA512a4def1b82fb9d93cadc35c6ffbb65660372962b3a66c1df9ca392055a30beec6cbe2a3f80006b32570efab0b865803e83138cecc3e23679f7946bdcce5bdccff
-
\Users\Admin\AppData\Local\Temp\frm_QANATS.exeFilesize
1.1MB
MD572b518574405809b54d8e2d3a4283d50
SHA19429216ebd67da45ac4b9dbc24e5c47a24425e26
SHA2564fde57eb8070711e8e30fe34ab1a1bf785f40a38d2fcb6468c2266f9b6e4cd2e
SHA512a4def1b82fb9d93cadc35c6ffbb65660372962b3a66c1df9ca392055a30beec6cbe2a3f80006b32570efab0b865803e83138cecc3e23679f7946bdcce5bdccff
-
memory/652-88-0x0000000000000000-mapping.dmp
-
memory/652-118-0x0000000077C50000-0x0000000077DF9000-memory.dmpFilesize
1.7MB
-
memory/932-109-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/932-112-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/932-120-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/932-119-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/932-115-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/932-113-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/932-108-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/932-80-0x0000000000000000-mapping.dmp
-
memory/932-107-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/932-106-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/932-105-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/932-104-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/932-103-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/932-101-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/932-99-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/932-92-0x00000000026C0000-0x000000000281C000-memory.dmpFilesize
1.4MB
-
memory/932-93-0x0000000077C50000-0x0000000077DF9000-memory.dmpFilesize
1.7MB
-
memory/932-94-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/932-95-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/932-96-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/932-97-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/932-98-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/1064-75-0x0000000002680000-0x00000000027DC000-memory.dmpFilesize
1.4MB
-
memory/1064-76-0x0000000077C50000-0x0000000077DF9000-memory.dmpFilesize
1.7MB
-
memory/1064-57-0x0000000000000000-mapping.dmp
-
memory/1064-77-0x0000000077E40000-0x0000000077F16000-memory.dmpFilesize
856KB
-
memory/1332-111-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1332-124-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1332-123-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1332-114-0x00000000004010B8-mapping.dmp
-
memory/1976-70-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/1976-62-0x0000000077C50000-0x0000000077DF9000-memory.dmpFilesize
1.7MB
-
memory/1976-71-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/1976-63-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/1976-72-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/1976-56-0x0000000076851000-0x0000000076853000-memory.dmpFilesize
8KB
-
memory/1976-69-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/1976-73-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/1976-65-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/1976-68-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/1976-67-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/1976-74-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/1976-66-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB
-
memory/1976-64-0x0000000077E30000-0x0000000077FB0000-memory.dmpFilesize
1.5MB