Analysis
-
max time kernel
38s -
max time network
87s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 09:51
Static task
static1
Behavioral task
behavioral1
Sample
Transferencias Copiar.jar
Resource
win7-20220414-en
General
-
Target
Transferencias Copiar.jar
-
Size
287KB
-
MD5
513cc3544b4a0523218326b30e99b46b
-
SHA1
0927ad5ab4a30014fe0125793729ca9f8a74d95a
-
SHA256
d021841d4a25bbe872ac7f71427e5731e441a9f6150f6ebb208c664d6ba48acd
-
SHA512
fe435151e2d374858426777b95c18fb5590ab745815a43e58ad6ae4d6c19610895750d6cebcfc7341cedf6b3ed78c46db06b8d2b74ba889618a54222326a7ecf
Malware Config
Extracted
asyncrat
0.5.7B
Default
franmhort.duia.ro:8153
Mutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
win.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat behavioral2/memory/2740-161-0x0000000000ED0000-0x0000000000EE2000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat -
Executes dropped EXE 2 IoCs
Processes:
AsyncClient.exewin.exepid process 2740 AsyncClient.exe 4232 win.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exeWScript.exeAsyncClient.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation AsyncClient.exe -
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wszkgmhon.txt java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wszkgmhon = "\"C:\\Users\\Admin\\AppData\\Roaming\\wszkgmhon.txt\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wszkgmhon = "\"C:\\Users\\Admin\\AppData\\Roaming\\wszkgmhon.txt\"" java.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1936 schtasks.exe 4876 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4632 timeout.exe -
Modifies registry class 1 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings wscript.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
AsyncClient.exepid process 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe 2740 AsyncClient.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AsyncClient.exedescription pid process Token: SeDebugPrivilege 2740 AsyncClient.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
java.exewscript.exeWScript.exejavaw.exeAsyncClient.execmd.execmd.exejava.execmd.exedescription pid process target process PID 2668 wrote to memory of 964 2668 java.exe wscript.exe PID 2668 wrote to memory of 964 2668 java.exe wscript.exe PID 964 wrote to memory of 3004 964 wscript.exe WScript.exe PID 964 wrote to memory of 3004 964 wscript.exe WScript.exe PID 964 wrote to memory of 1172 964 wscript.exe javaw.exe PID 964 wrote to memory of 1172 964 wscript.exe javaw.exe PID 3004 wrote to memory of 2740 3004 WScript.exe AsyncClient.exe PID 3004 wrote to memory of 2740 3004 WScript.exe AsyncClient.exe PID 3004 wrote to memory of 2740 3004 WScript.exe AsyncClient.exe PID 1172 wrote to memory of 844 1172 javaw.exe java.exe PID 1172 wrote to memory of 844 1172 javaw.exe java.exe PID 2740 wrote to memory of 2096 2740 AsyncClient.exe cmd.exe PID 2740 wrote to memory of 2096 2740 AsyncClient.exe cmd.exe PID 2740 wrote to memory of 2096 2740 AsyncClient.exe cmd.exe PID 2740 wrote to memory of 4200 2740 AsyncClient.exe cmd.exe PID 2740 wrote to memory of 4200 2740 AsyncClient.exe cmd.exe PID 2740 wrote to memory of 4200 2740 AsyncClient.exe cmd.exe PID 2096 wrote to memory of 1936 2096 cmd.exe schtasks.exe PID 2096 wrote to memory of 1936 2096 cmd.exe schtasks.exe PID 2096 wrote to memory of 1936 2096 cmd.exe schtasks.exe PID 4200 wrote to memory of 4632 4200 cmd.exe timeout.exe PID 4200 wrote to memory of 4632 4200 cmd.exe timeout.exe PID 4200 wrote to memory of 4632 4200 cmd.exe timeout.exe PID 844 wrote to memory of 2088 844 java.exe cmd.exe PID 844 wrote to memory of 2088 844 java.exe cmd.exe PID 844 wrote to memory of 4660 844 java.exe java.exe PID 844 wrote to memory of 4660 844 java.exe java.exe PID 2088 wrote to memory of 4876 2088 cmd.exe schtasks.exe PID 2088 wrote to memory of 4876 2088 cmd.exe schtasks.exe PID 4200 wrote to memory of 4232 4200 cmd.exe win.exe PID 4200 wrote to memory of 4232 4200 cmd.exe win.exe PID 4200 wrote to memory of 4232 4200 cmd.exe win.exe
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Transferencias Copiar.jar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\wscript.exewscript C:\Users\Admin\mjjrsmctby.js2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\dHqmoqeAFb.js"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exe"C:\Users\Admin\AppData\Roaming\AsyncClient.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"' & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"'6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF5FD.tmp.bat""5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 36⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\win.exe"C:\Users\Admin\AppData\Roaming\win.exe"6⤵
- Executes dropped EXE
-
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\wszkgmhon.txt"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\wszkgmhon.txt"4⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\wszkgmhon.txt"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\wszkgmhon.txt"6⤵
- Creates scheduled task(s)
-
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\wszkgmhon.txt"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestampFilesize
50B
MD5dec8f8e1e08ae69cb89f86b6e6050595
SHA13d1004bc91245ac7043ab751d663f646fe89495e
SHA256d0c2f44d4eee63615c362223b366f8a3c4611e67796c2f2bbb65a6aa797aa884
SHA5126bee4fc74c9652da67d0deff17cac9562fb8839393bd4fa916bd876d7537335197c36991f4a9c55c84d31fc36e99be1e27274d3a64df3dcb0301304902c2afca
-
C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestampFilesize
50B
MD5a75e00fa1302dfa206033dd153d13d02
SHA17aa3f32deb56555c44ec6dc4b323ec92fd6bd985
SHA25649c3adcc8673fa2f2a7733b7a93a36845615ced2a2e530f1932226177015d708
SHA51269cf7d107a96ebc7af1851e39a373b7822562ddaf8e05609852cf0df68a5a7badbd8e1beed16cd01c396ddd75382b1de11263933044db7d8635314e96c536020
-
C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestampFilesize
50B
MD5d60a904fd3050a1940e6b453ff9d0f9c
SHA18adc9087ea5f451fdb7283a7ac170a9737e6d252
SHA2567191de26179d09b0f4cefaa2499a3feeaa0ec5313648074c09535306f019830e
SHA512e4743589e2ab123a741906a7f887b78485792fe22b01ef894f15ffa8d1cd8e8f56908a85d3a473e0fe3c08714d142ab5d7576ca1a50b5e3601c2d2df332bd958
-
C:\Users\Admin\AppData\Local\Temp\tmpF5FD.tmp.batFilesize
147B
MD5ae874927b6269a8591303e53574e5b1f
SHA151d8ef9a79a632b145d6746ca02b43a4312cea91
SHA256aaf9bde33c52441e40abb411a80c90ae7d4daf3449bb7afcd4db488063bdebd6
SHA5126e663b20154fd23238b4d2434b6f600f3517e1cfa2dfee20d190493f40e72d3f4e0beb684a7e32073ff36281de7572eb6f4d3b6b9acec00d24ec7fa8890ff838
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\dHqmoqeAFb.jsFilesize
88KB
MD510431f8891bb9c5109b16fa0b113c3d5
SHA1d88238c36eaf99364cb4839e16c2c50162e906c1
SHA256726f9c6ad061a7f316ecfff034ef9e1916443d64d79007435a1e1bf101958994
SHA512b3376e7f7d82125e031bc9a3f1b7a74add2591b5b6f8a1e3084775793fa548b20c1629e39b2a6b750eeac3cab668f0acd41671320e025e0c26c573d5ce63924e
-
C:\Users\Admin\AppData\Roaming\lib\jna-5.5.0.jarFilesize
1.4MB
MD5acfb5b5fd9ee10bf69497792fd469f85
SHA10e0845217c4907822403912ad6828d8e0b256208
SHA256b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e
SHA512e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa
-
C:\Users\Admin\AppData\Roaming\lib\jna-platform-5.5.0.jarFilesize
2.6MB
MD52f4a99c2758e72ee2b59a73586a2322f
SHA1af38e7c4d0fc73c23ecd785443705bfdee5b90bf
SHA25624d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5
SHA512b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494
-
C:\Users\Admin\AppData\Roaming\lib\sqlite-jdbc-3.14.2.1.jarFilesize
4.1MB
MD5b33387e15ab150a7bf560abdc73c3bec
SHA166b8075784131f578ef893fd7674273f709b9a4c
SHA2562eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491
SHA51225cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279
-
C:\Users\Admin\AppData\Roaming\lib\system-hook-3.5.jarFilesize
772KB
MD5e1aa38a1e78a76a6de73efae136cdb3a
SHA1c463da71871f780b2e2e5dba115d43953b537daf
SHA2562ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609
SHA512fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\wszkgmhon.txtFilesize
164KB
MD5f304dd37262f9ca635119593a2de3294
SHA125814c89b64922fdb5c5b1bdef0c2c79a855f1f6
SHA256dc52c513cb3ededc96b362e314067a51b29cd848ed174361dce17a96e3f7bd3c
SHA51271d9cbbde5c5e9d1bbb0e6244c5e7bb2bbb7e31062469ddf19ce5cf54806103af827bd76e99c8ce75f14b8189f6595511fb1a2c6166e2666360dcbe29e1fa287
-
C:\Users\Admin\AppData\Roaming\wszkgmhon.txtFilesize
164KB
MD5f304dd37262f9ca635119593a2de3294
SHA125814c89b64922fdb5c5b1bdef0c2c79a855f1f6
SHA256dc52c513cb3ededc96b362e314067a51b29cd848ed174361dce17a96e3f7bd3c
SHA51271d9cbbde5c5e9d1bbb0e6244c5e7bb2bbb7e31062469ddf19ce5cf54806103af827bd76e99c8ce75f14b8189f6595511fb1a2c6166e2666360dcbe29e1fa287
-
C:\Users\Admin\lib\jna-5.5.0.jarFilesize
1.4MB
MD5acfb5b5fd9ee10bf69497792fd469f85
SHA10e0845217c4907822403912ad6828d8e0b256208
SHA256b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e
SHA512e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa
-
C:\Users\Admin\lib\jna-platform-5.5.0.jarFilesize
2.6MB
MD52f4a99c2758e72ee2b59a73586a2322f
SHA1af38e7c4d0fc73c23ecd785443705bfdee5b90bf
SHA25624d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5
SHA512b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494
-
C:\Users\Admin\lib\sqlite-jdbc-3.14.2.1.jarFilesize
4.1MB
MD5b33387e15ab150a7bf560abdc73c3bec
SHA166b8075784131f578ef893fd7674273f709b9a4c
SHA2562eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491
SHA51225cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279
-
C:\Users\Admin\lib\system-hook-3.5.jarFilesize
772KB
MD5e1aa38a1e78a76a6de73efae136cdb3a
SHA1c463da71871f780b2e2e5dba115d43953b537daf
SHA2562ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609
SHA512fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d
-
C:\Users\Admin\mjjrsmctby.jsFilesize
480KB
MD5db0c97c4781ea7c7f09de49fc0d7aa6b
SHA1f36740c3b50cd17e7d679fd5386eb60e2505288e
SHA256a58951a7f9087e40b330ee667c84fc12e884ad609c60450fd6a34e4db16ea559
SHA5126f00a0ec3df2dd6ee0c501d5617b9237cf689753ec06003305ec7f097b9be01bfce86bff949eaab9cdd45e6edaceb37aff1cf3b0dbeeb30b61c04b2f3d7f7349
-
C:\Users\Admin\wszkgmhon.txtFilesize
164KB
MD5f304dd37262f9ca635119593a2de3294
SHA125814c89b64922fdb5c5b1bdef0c2c79a855f1f6
SHA256dc52c513cb3ededc96b362e314067a51b29cd848ed174361dce17a96e3f7bd3c
SHA51271d9cbbde5c5e9d1bbb0e6244c5e7bb2bbb7e31062469ddf19ce5cf54806103af827bd76e99c8ce75f14b8189f6595511fb1a2c6166e2666360dcbe29e1fa287
-
memory/844-212-0x0000000003240000-0x0000000004240000-memory.dmpFilesize
16.0MB
-
memory/844-190-0x0000000000000000-mapping.dmp
-
memory/964-140-0x0000000000000000-mapping.dmp
-
memory/1172-189-0x0000000002790000-0x0000000003790000-memory.dmpFilesize
16.0MB
-
memory/1172-200-0x0000000002790000-0x0000000003790000-memory.dmpFilesize
16.0MB
-
memory/1172-188-0x0000000002790000-0x0000000003790000-memory.dmpFilesize
16.0MB
-
memory/1172-186-0x0000000002790000-0x0000000003790000-memory.dmpFilesize
16.0MB
-
memory/1172-195-0x0000000002790000-0x0000000003790000-memory.dmpFilesize
16.0MB
-
memory/1172-191-0x0000000002790000-0x0000000003790000-memory.dmpFilesize
16.0MB
-
memory/1172-145-0x0000000000000000-mapping.dmp
-
memory/1172-151-0x0000000002790000-0x0000000003790000-memory.dmpFilesize
16.0MB
-
memory/1172-187-0x0000000002790000-0x0000000003790000-memory.dmpFilesize
16.0MB
-
memory/1936-214-0x0000000000000000-mapping.dmp
-
memory/2088-216-0x0000000000000000-mapping.dmp
-
memory/2096-210-0x0000000000000000-mapping.dmp
-
memory/2668-139-0x0000000002940000-0x0000000003940000-memory.dmpFilesize
16.0MB
-
memory/2740-161-0x0000000000ED0000-0x0000000000EE2000-memory.dmpFilesize
72KB
-
memory/2740-152-0x0000000000000000-mapping.dmp
-
memory/2740-198-0x0000000005810000-0x00000000058AC000-memory.dmpFilesize
624KB
-
memory/3004-143-0x0000000000000000-mapping.dmp
-
memory/4200-211-0x0000000000000000-mapping.dmp
-
memory/4232-235-0x0000000000000000-mapping.dmp
-
memory/4632-215-0x0000000000000000-mapping.dmp
-
memory/4660-217-0x0000000000000000-mapping.dmp
-
memory/4660-229-0x0000000003130000-0x0000000004130000-memory.dmpFilesize
16.0MB
-
memory/4660-241-0x0000000003130000-0x0000000004130000-memory.dmpFilesize
16.0MB
-
memory/4660-242-0x0000000003130000-0x0000000004130000-memory.dmpFilesize
16.0MB
-
memory/4660-247-0x0000000003130000-0x0000000004130000-memory.dmpFilesize
16.0MB
-
memory/4660-248-0x0000000003130000-0x0000000004130000-memory.dmpFilesize
16.0MB
-
memory/4876-223-0x0000000000000000-mapping.dmp