Analysis
-
max time kernel
148s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 05:19
Static task
static1
Behavioral task
behavioral1
Sample
f38ceb5bccd2de5ccf73d79ec5711d40.exe
Resource
win7-20220414-en
General
-
Target
f38ceb5bccd2de5ccf73d79ec5711d40.exe
-
Size
2.1MB
-
MD5
f38ceb5bccd2de5ccf73d79ec5711d40
-
SHA1
72eb623006fad037f57831ebe2a554c3823105d9
-
SHA256
f73282bb29d6711a116656bf12a55c2e7df5eb9a95376b6d1d087309fc37bb14
-
SHA512
199be4590729211be3b144a789ba4455fdc4e23604b36f2a4989bb75a763718abcd058e075236040a8ed51158f7783c2f99f77bbbfd9796426deb3902fae851d
Malware Config
Signatures
-
Gh0st RAT payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1536-9352-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/1612-13655-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/1612-13665-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/1964-18232-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/1964-18233-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/1964-18235-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat -
Executes dropped EXE 3 IoCs
Processes:
Pwtqfef.exePwtqfef.exePwtqfef.exepid process 1536 Pwtqfef.exe 1612 Pwtqfef.exe 1964 Pwtqfef.exe -
Processes:
resource yara_rule behavioral1/memory/1536-9352-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1612-13655-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1612-13665-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1964-18232-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1964-18233-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1964-18235-0x0000000010000000-0x0000000010362000-memory.dmp upx -
Loads dropped DLL 6 IoCs
Processes:
f38ceb5bccd2de5ccf73d79ec5711d40.exeWerFault.exepid process 1380 f38ceb5bccd2de5ccf73d79ec5711d40.exe 1380 f38ceb5bccd2de5ccf73d79ec5711d40.exe 976 WerFault.exe 976 WerFault.exe 976 WerFault.exe 976 WerFault.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Pwtqfef.exedescription ioc process File opened (read-only) \??\O: Pwtqfef.exe File opened (read-only) \??\V: Pwtqfef.exe File opened (read-only) \??\Y: Pwtqfef.exe File opened (read-only) \??\P: Pwtqfef.exe File opened (read-only) \??\Q: Pwtqfef.exe File opened (read-only) \??\R: Pwtqfef.exe File opened (read-only) \??\E: Pwtqfef.exe File opened (read-only) \??\K: Pwtqfef.exe File opened (read-only) \??\L: Pwtqfef.exe File opened (read-only) \??\S: Pwtqfef.exe File opened (read-only) \??\W: Pwtqfef.exe File opened (read-only) \??\X: Pwtqfef.exe File opened (read-only) \??\Z: Pwtqfef.exe File opened (read-only) \??\F: Pwtqfef.exe File opened (read-only) \??\G: Pwtqfef.exe File opened (read-only) \??\N: Pwtqfef.exe File opened (read-only) \??\J: Pwtqfef.exe File opened (read-only) \??\M: Pwtqfef.exe File opened (read-only) \??\T: Pwtqfef.exe File opened (read-only) \??\U: Pwtqfef.exe File opened (read-only) \??\B: Pwtqfef.exe File opened (read-only) \??\H: Pwtqfef.exe File opened (read-only) \??\I: Pwtqfef.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
Processes:
f38ceb5bccd2de5ccf73d79ec5711d40.exePwtqfef.exePwtqfef.exePwtqfef.exepid process 1380 f38ceb5bccd2de5ccf73d79ec5711d40.exe 1380 f38ceb5bccd2de5ccf73d79ec5711d40.exe 1536 Pwtqfef.exe 1536 Pwtqfef.exe 1536 Pwtqfef.exe 1536 Pwtqfef.exe 1536 Pwtqfef.exe 1536 Pwtqfef.exe 1612 Pwtqfef.exe 1612 Pwtqfef.exe 1536 Pwtqfef.exe 1964 Pwtqfef.exe 1964 Pwtqfef.exe 1964 Pwtqfef.exe 1964 Pwtqfef.exe 1964 Pwtqfef.exe 1964 Pwtqfef.exe 1964 Pwtqfef.exe 1964 Pwtqfef.exe 1964 Pwtqfef.exe 1964 Pwtqfef.exe 1964 Pwtqfef.exe 1964 Pwtqfef.exe 1964 Pwtqfef.exe -
Drops file in Program Files directory 2 IoCs
Processes:
f38ceb5bccd2de5ccf73d79ec5711d40.exedescription ioc process File created C:\Program Files (x86)\Pwtqfef.exe f38ceb5bccd2de5ccf73d79ec5711d40.exe File opened for modification C:\Program Files (x86)\Pwtqfef.exe f38ceb5bccd2de5ccf73d79ec5711d40.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 976 1612 WerFault.exe Pwtqfef.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Pwtqfef.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Pwtqfef.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 Pwtqfef.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Pwtqfef.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Pwtqfef.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Pwtqfef.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Pwtqfef.exe -
Modifies data under HKEY_USERS 6 IoCs
Processes:
Pwtqfef.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" Pwtqfef.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Pwtqfef.exe Key created \REGISTRY\USER\.DEFAULT\Software Pwtqfef.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft Pwtqfef.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie Pwtqfef.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum Pwtqfef.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Pwtqfef.exepid process 1964 Pwtqfef.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
f38ceb5bccd2de5ccf73d79ec5711d40.exePwtqfef.exePwtqfef.exePwtqfef.exedescription pid process Token: SeDebugPrivilege 1380 f38ceb5bccd2de5ccf73d79ec5711d40.exe Token: SeDebugPrivilege 1536 Pwtqfef.exe Token: SeDebugPrivilege 1612 Pwtqfef.exe Token: SeDebugPrivilege 1612 Pwtqfef.exe Token: SeDebugPrivilege 1964 Pwtqfef.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
f38ceb5bccd2de5ccf73d79ec5711d40.exePwtqfef.exedescription pid process target process PID 1380 wrote to memory of 1536 1380 f38ceb5bccd2de5ccf73d79ec5711d40.exe Pwtqfef.exe PID 1380 wrote to memory of 1536 1380 f38ceb5bccd2de5ccf73d79ec5711d40.exe Pwtqfef.exe PID 1380 wrote to memory of 1536 1380 f38ceb5bccd2de5ccf73d79ec5711d40.exe Pwtqfef.exe PID 1380 wrote to memory of 1536 1380 f38ceb5bccd2de5ccf73d79ec5711d40.exe Pwtqfef.exe PID 1612 wrote to memory of 1964 1612 Pwtqfef.exe Pwtqfef.exe PID 1612 wrote to memory of 1964 1612 Pwtqfef.exe Pwtqfef.exe PID 1612 wrote to memory of 1964 1612 Pwtqfef.exe Pwtqfef.exe PID 1612 wrote to memory of 1964 1612 Pwtqfef.exe Pwtqfef.exe PID 1612 wrote to memory of 976 1612 Pwtqfef.exe WerFault.exe PID 1612 wrote to memory of 976 1612 Pwtqfef.exe WerFault.exe PID 1612 wrote to memory of 976 1612 Pwtqfef.exe WerFault.exe PID 1612 wrote to memory of 976 1612 Pwtqfef.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f38ceb5bccd2de5ccf73d79ec5711d40.exe"C:\Users\Admin\AppData\Local\Temp\f38ceb5bccd2de5ccf73d79ec5711d40.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Pwtqfef.exe"C:\Program Files (x86)\Pwtqfef.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Pwtqfef.exe"C:\Program Files (x86)\Pwtqfef.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Pwtqfef.exe"C:\Program Files (x86)\Pwtqfef.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 3722⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Pwtqfef.exeFilesize
2.1MB
MD5f38ceb5bccd2de5ccf73d79ec5711d40
SHA172eb623006fad037f57831ebe2a554c3823105d9
SHA256f73282bb29d6711a116656bf12a55c2e7df5eb9a95376b6d1d087309fc37bb14
SHA512199be4590729211be3b144a789ba4455fdc4e23604b36f2a4989bb75a763718abcd058e075236040a8ed51158f7783c2f99f77bbbfd9796426deb3902fae851d
-
C:\Program Files (x86)\Pwtqfef.exeFilesize
2.1MB
MD5f38ceb5bccd2de5ccf73d79ec5711d40
SHA172eb623006fad037f57831ebe2a554c3823105d9
SHA256f73282bb29d6711a116656bf12a55c2e7df5eb9a95376b6d1d087309fc37bb14
SHA512199be4590729211be3b144a789ba4455fdc4e23604b36f2a4989bb75a763718abcd058e075236040a8ed51158f7783c2f99f77bbbfd9796426deb3902fae851d
-
C:\Program Files (x86)\Pwtqfef.exeFilesize
2.1MB
MD5f38ceb5bccd2de5ccf73d79ec5711d40
SHA172eb623006fad037f57831ebe2a554c3823105d9
SHA256f73282bb29d6711a116656bf12a55c2e7df5eb9a95376b6d1d087309fc37bb14
SHA512199be4590729211be3b144a789ba4455fdc4e23604b36f2a4989bb75a763718abcd058e075236040a8ed51158f7783c2f99f77bbbfd9796426deb3902fae851d
-
C:\Program Files (x86)\Pwtqfef.exeFilesize
2.1MB
MD5f38ceb5bccd2de5ccf73d79ec5711d40
SHA172eb623006fad037f57831ebe2a554c3823105d9
SHA256f73282bb29d6711a116656bf12a55c2e7df5eb9a95376b6d1d087309fc37bb14
SHA512199be4590729211be3b144a789ba4455fdc4e23604b36f2a4989bb75a763718abcd058e075236040a8ed51158f7783c2f99f77bbbfd9796426deb3902fae851d
-
\Program Files (x86)\Pwtqfef.exeFilesize
2.1MB
MD5f38ceb5bccd2de5ccf73d79ec5711d40
SHA172eb623006fad037f57831ebe2a554c3823105d9
SHA256f73282bb29d6711a116656bf12a55c2e7df5eb9a95376b6d1d087309fc37bb14
SHA512199be4590729211be3b144a789ba4455fdc4e23604b36f2a4989bb75a763718abcd058e075236040a8ed51158f7783c2f99f77bbbfd9796426deb3902fae851d
-
\Program Files (x86)\Pwtqfef.exeFilesize
2.1MB
MD5f38ceb5bccd2de5ccf73d79ec5711d40
SHA172eb623006fad037f57831ebe2a554c3823105d9
SHA256f73282bb29d6711a116656bf12a55c2e7df5eb9a95376b6d1d087309fc37bb14
SHA512199be4590729211be3b144a789ba4455fdc4e23604b36f2a4989bb75a763718abcd058e075236040a8ed51158f7783c2f99f77bbbfd9796426deb3902fae851d
-
\Program Files (x86)\Pwtqfef.exeFilesize
2.1MB
MD5f38ceb5bccd2de5ccf73d79ec5711d40
SHA172eb623006fad037f57831ebe2a554c3823105d9
SHA256f73282bb29d6711a116656bf12a55c2e7df5eb9a95376b6d1d087309fc37bb14
SHA512199be4590729211be3b144a789ba4455fdc4e23604b36f2a4989bb75a763718abcd058e075236040a8ed51158f7783c2f99f77bbbfd9796426deb3902fae851d
-
\Program Files (x86)\Pwtqfef.exeFilesize
2.1MB
MD5f38ceb5bccd2de5ccf73d79ec5711d40
SHA172eb623006fad037f57831ebe2a554c3823105d9
SHA256f73282bb29d6711a116656bf12a55c2e7df5eb9a95376b6d1d087309fc37bb14
SHA512199be4590729211be3b144a789ba4455fdc4e23604b36f2a4989bb75a763718abcd058e075236040a8ed51158f7783c2f99f77bbbfd9796426deb3902fae851d
-
\Program Files (x86)\Pwtqfef.exeFilesize
2.1MB
MD5f38ceb5bccd2de5ccf73d79ec5711d40
SHA172eb623006fad037f57831ebe2a554c3823105d9
SHA256f73282bb29d6711a116656bf12a55c2e7df5eb9a95376b6d1d087309fc37bb14
SHA512199be4590729211be3b144a789ba4455fdc4e23604b36f2a4989bb75a763718abcd058e075236040a8ed51158f7783c2f99f77bbbfd9796426deb3902fae851d
-
\Program Files (x86)\Pwtqfef.exeFilesize
2.1MB
MD5f38ceb5bccd2de5ccf73d79ec5711d40
SHA172eb623006fad037f57831ebe2a554c3823105d9
SHA256f73282bb29d6711a116656bf12a55c2e7df5eb9a95376b6d1d087309fc37bb14
SHA512199be4590729211be3b144a789ba4455fdc4e23604b36f2a4989bb75a763718abcd058e075236040a8ed51158f7783c2f99f77bbbfd9796426deb3902fae851d
-
memory/976-13660-0x0000000000000000-mapping.dmp
-
memory/1380-518-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-478-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-469-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-472-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-471-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-474-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-473-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-476-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-524-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-475-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-479-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-522-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-483-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-482-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-480-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-481-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-488-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-489-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-487-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-486-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-485-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-484-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-490-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-491-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-492-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-493-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-496-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-497-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-495-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-494-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-499-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-500-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-498-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-505-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-506-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-504-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-507-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-508-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-503-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-502-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-501-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-509-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-513-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-464-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-519-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-521-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-523-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-525-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-477-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-470-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/1380-520-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-517-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-516-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-515-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-514-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-512-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-511-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-510-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-1333-0x0000000000600000-0x0000000000700000-memory.dmpFilesize
1024KB
-
memory/1380-1336-0x0000000002170000-0x00000000022F1000-memory.dmpFilesize
1.5MB
-
memory/1380-4433-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/1380-4434-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-4435-0x0000000002420000-0x0000000002521000-memory.dmpFilesize
1.0MB
-
memory/1380-54-0x0000000076C81000-0x0000000076C83000-memory.dmpFilesize
8KB
-
memory/1380-56-0x0000000076360000-0x00000000763A7000-memory.dmpFilesize
284KB
-
memory/1380-463-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-467-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-468-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-465-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1380-466-0x0000000002300000-0x0000000002411000-memory.dmpFilesize
1.1MB
-
memory/1536-5759-0x0000000001F90000-0x0000000002090000-memory.dmpFilesize
1024KB
-
memory/1536-8875-0x0000000002380000-0x0000000002491000-memory.dmpFilesize
1.1MB
-
memory/1536-4430-0x0000000000000000-mapping.dmp
-
memory/1536-5761-0x00000000020D0000-0x0000000002251000-memory.dmpFilesize
1.5MB
-
memory/1536-4436-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/1536-13657-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/1536-9569-0x0000000001F90000-0x0000000002090000-memory.dmpFilesize
1024KB
-
memory/1536-9350-0x00000000024A0000-0x00000000025A1000-memory.dmpFilesize
1.0MB
-
memory/1536-9352-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1536-9348-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/1612-13653-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/1612-13665-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1612-13655-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1612-13654-0x0000000002410000-0x0000000002511000-memory.dmpFilesize
1.0MB
-
memory/1612-13652-0x00000000022F0000-0x0000000002401000-memory.dmpFilesize
1.1MB
-
memory/1612-10435-0x0000000002040000-0x00000000021C1000-memory.dmpFilesize
1.5MB
-
memory/1612-10433-0x0000000001EB0000-0x0000000001FB0000-memory.dmpFilesize
1024KB
-
memory/1612-9354-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/1964-15014-0x0000000001F70000-0x0000000002070000-memory.dmpFilesize
1024KB
-
memory/1964-13656-0x0000000000000000-mapping.dmp
-
memory/1964-15016-0x00000000020B0000-0x0000000002231000-memory.dmpFilesize
1.5MB
-
memory/1964-18229-0x0000000002360000-0x0000000002471000-memory.dmpFilesize
1.1MB
-
memory/1964-18230-0x0000000000400000-0x00000000005F1000-memory.dmpFilesize
1.9MB
-
memory/1964-18231-0x0000000002480000-0x0000000002581000-memory.dmpFilesize
1.0MB
-
memory/1964-18232-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1964-18233-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1964-18234-0x0000000001F70000-0x0000000002070000-memory.dmpFilesize
1024KB
-
memory/1964-18235-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB