Analysis
-
max time kernel
125s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 09:10
Static task
static1
Behavioral task
behavioral1
Sample
Approved purchase order number PO2022070012.exe
Resource
win7-20220718-en
General
-
Target
Approved purchase order number PO2022070012.exe
-
Size
592KB
-
MD5
e06695c163531f7089ca1b243ee8873f
-
SHA1
aa90d5f607fcdf8bce905a5f1ba8e2de4765fdf3
-
SHA256
6e69038d76d420bc65eedac8eb5c5b727303efdff971bb7ad8b8f3b4deee8a45
-
SHA512
7be6f6bb944a17898efaee35c56337437d0399fccefe13bd1649fbb58a68ba4bd847b22849599b90708b64e51c8963952d79cb001910268c23bdf6e58fe7a890
Malware Config
Extracted
lokibot
http://sempersim.su/gi15/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Processes:
Approved purchase order number PO2022070012.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Approved purchase order number PO2022070012.exe -
Processes:
Approved purchase order number PO2022070012.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths Approved purchase order number PO2022070012.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Approved purchase order number PO2022070012.exe = "0" Approved purchase order number PO2022070012.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions Approved purchase order number PO2022070012.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "1" Approved purchase order number PO2022070012.exe -
suricata: ET MALWARE LokiBot Checkin
suricata: ET MALWARE LokiBot Checkin
-
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
suricata: ET MALWARE LokiBot User-Agent (Charon/Inferno)
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
Approved purchase order number PO2022070012.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions Approved purchase order number PO2022070012.exe -
Nirsoft 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\42f72a62-6a64-4125-92a1-7063dd998af5\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\42f72a62-6a64-4125-92a1-7063dd998af5\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\42f72a62-6a64-4125-92a1-7063dd998af5\AdvancedRun.exe Nirsoft -
Executes dropped EXE 3 IoCs
Processes:
1be81505-c4b8-440a-acfb-ffbeeb89d451.exeAdvancedRun.exeAdvancedRun.exepid process 1488 1be81505-c4b8-440a-acfb-ffbeeb89d451.exe 1976 AdvancedRun.exe 2268 AdvancedRun.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
Approved purchase order number PO2022070012.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools Approved purchase order number PO2022070012.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Approved purchase order number PO2022070012.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Approved purchase order number PO2022070012.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Approved purchase order number PO2022070012.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Approved purchase order number PO2022070012.exeAdvancedRun.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation Approved purchase order number PO2022070012.exe Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation AdvancedRun.exe -
Processes:
Approved purchase order number PO2022070012.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths Approved purchase order number PO2022070012.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions Approved purchase order number PO2022070012.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Approved purchase order number PO2022070012.exe = "0" Approved purchase order number PO2022070012.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions Approved purchase order number PO2022070012.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "1" Approved purchase order number PO2022070012.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
logagent.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook logagent.exe Key opened \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook logagent.exe Key opened \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook logagent.exe -
Processes:
Approved purchase order number PO2022070012.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Approved purchase order number PO2022070012.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Approved purchase order number PO2022070012.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Approved purchase order number PO2022070012.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Approved purchase order number PO2022070012.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Approved purchase order number PO2022070012.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Approved purchase order number PO2022070012.exedescription pid process target process PID 4272 set thread context of 828 4272 Approved purchase order number PO2022070012.exe logagent.exe -
Drops file in Windows directory 1 IoCs
Processes:
Approved purchase order number PO2022070012.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\possessattorneyeventP.raw Approved purchase order number PO2022070012.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
Approved purchase order number PO2022070012.exeAdvancedRun.exepowershell.exepowershell.exeAdvancedRun.exepowershell.exepid process 4272 Approved purchase order number PO2022070012.exe 4272 Approved purchase order number PO2022070012.exe 4272 Approved purchase order number PO2022070012.exe 4272 Approved purchase order number PO2022070012.exe 1976 AdvancedRun.exe 1976 AdvancedRun.exe 1976 AdvancedRun.exe 1976 AdvancedRun.exe 4272 Approved purchase order number PO2022070012.exe 4272 Approved purchase order number PO2022070012.exe 4272 Approved purchase order number PO2022070012.exe 4272 Approved purchase order number PO2022070012.exe 2388 powershell.exe 4320 powershell.exe 2268 AdvancedRun.exe 2268 AdvancedRun.exe 2332 powershell.exe 2268 AdvancedRun.exe 2268 AdvancedRun.exe 2388 powershell.exe 2332 powershell.exe 4320 powershell.exe 4272 Approved purchase order number PO2022070012.exe 4272 Approved purchase order number PO2022070012.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
Approved purchase order number PO2022070012.exeAdvancedRun.exepowershell.exepowershell.exepowershell.exeAdvancedRun.exe1be81505-c4b8-440a-acfb-ffbeeb89d451.exelogagent.exedescription pid process Token: SeDebugPrivilege 4272 Approved purchase order number PO2022070012.exe Token: SeDebugPrivilege 1976 AdvancedRun.exe Token: SeImpersonatePrivilege 1976 AdvancedRun.exe Token: SeDebugPrivilege 2332 powershell.exe Token: SeDebugPrivilege 2388 powershell.exe Token: SeDebugPrivilege 4320 powershell.exe Token: SeDebugPrivilege 2268 AdvancedRun.exe Token: SeImpersonatePrivilege 2268 AdvancedRun.exe Token: SeTakeOwnershipPrivilege 1488 1be81505-c4b8-440a-acfb-ffbeeb89d451.exe Token: SeDebugPrivilege 828 logagent.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
Approved purchase order number PO2022070012.exeAdvancedRun.exedescription pid process target process PID 4272 wrote to memory of 2388 4272 Approved purchase order number PO2022070012.exe powershell.exe PID 4272 wrote to memory of 2388 4272 Approved purchase order number PO2022070012.exe powershell.exe PID 4272 wrote to memory of 2388 4272 Approved purchase order number PO2022070012.exe powershell.exe PID 4272 wrote to memory of 1488 4272 Approved purchase order number PO2022070012.exe 1be81505-c4b8-440a-acfb-ffbeeb89d451.exe PID 4272 wrote to memory of 1488 4272 Approved purchase order number PO2022070012.exe 1be81505-c4b8-440a-acfb-ffbeeb89d451.exe PID 4272 wrote to memory of 1976 4272 Approved purchase order number PO2022070012.exe AdvancedRun.exe PID 4272 wrote to memory of 1976 4272 Approved purchase order number PO2022070012.exe AdvancedRun.exe PID 4272 wrote to memory of 1976 4272 Approved purchase order number PO2022070012.exe AdvancedRun.exe PID 4272 wrote to memory of 2332 4272 Approved purchase order number PO2022070012.exe powershell.exe PID 4272 wrote to memory of 2332 4272 Approved purchase order number PO2022070012.exe powershell.exe PID 4272 wrote to memory of 2332 4272 Approved purchase order number PO2022070012.exe powershell.exe PID 4272 wrote to memory of 4320 4272 Approved purchase order number PO2022070012.exe powershell.exe PID 4272 wrote to memory of 4320 4272 Approved purchase order number PO2022070012.exe powershell.exe PID 4272 wrote to memory of 4320 4272 Approved purchase order number PO2022070012.exe powershell.exe PID 4272 wrote to memory of 828 4272 Approved purchase order number PO2022070012.exe logagent.exe PID 4272 wrote to memory of 828 4272 Approved purchase order number PO2022070012.exe logagent.exe PID 4272 wrote to memory of 828 4272 Approved purchase order number PO2022070012.exe logagent.exe PID 4272 wrote to memory of 828 4272 Approved purchase order number PO2022070012.exe logagent.exe PID 4272 wrote to memory of 828 4272 Approved purchase order number PO2022070012.exe logagent.exe PID 4272 wrote to memory of 828 4272 Approved purchase order number PO2022070012.exe logagent.exe PID 4272 wrote to memory of 828 4272 Approved purchase order number PO2022070012.exe logagent.exe PID 4272 wrote to memory of 828 4272 Approved purchase order number PO2022070012.exe logagent.exe PID 4272 wrote to memory of 828 4272 Approved purchase order number PO2022070012.exe logagent.exe PID 4272 wrote to memory of 828 4272 Approved purchase order number PO2022070012.exe logagent.exe PID 1976 wrote to memory of 2268 1976 AdvancedRun.exe AdvancedRun.exe PID 1976 wrote to memory of 2268 1976 AdvancedRun.exe AdvancedRun.exe PID 1976 wrote to memory of 2268 1976 AdvancedRun.exe AdvancedRun.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
Approved purchase order number PO2022070012.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Approved purchase order number PO2022070012.exe -
outlook_office_path 1 IoCs
Processes:
logagent.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook logagent.exe -
outlook_win_path 1 IoCs
Processes:
logagent.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook logagent.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Approved purchase order number PO2022070012.exe"C:\Users\Admin\AppData\Local\Temp\Approved purchase order number PO2022070012.exe"1⤵
- UAC bypass
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Approved purchase order number PO2022070012.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\42f72a62-6a64-4125-92a1-7063dd998af5\1be81505-c4b8-440a-acfb-ffbeeb89d451.exe"C:\Users\Admin\AppData\Local\Temp\42f72a62-6a64-4125-92a1-7063dd998af5\1be81505-c4b8-440a-acfb-ffbeeb89d451.exe" /o /c "Windows-Defender" /r2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\42f72a62-6a64-4125-92a1-7063dd998af5\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\42f72a62-6a64-4125-92a1-7063dd998af5\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\42f72a62-6a64-4125-92a1-7063dd998af5\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\42f72a62-6a64-4125-92a1-7063dd998af5\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\42f72a62-6a64-4125-92a1-7063dd998af5\AdvancedRun.exe" /SpecialRun 4101d8 19763⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension "exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Approved purchase order number PO2022070012.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\logagent.exe"C:\Windows\SysWOW64\logagent.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5b596fed013271eeeb7bbbb7e692eb6c9
SHA1017333481f1f1be74c5f7c798bd05d3b89b8fb07
SHA2569a6e1b2bc56b2af5f24982c534f6dda97c056ba0c969700ccb2297b5bcf0944e
SHA512639d02884f7f2c6afccc1929d65841ac0ec09a486ce8d370f69b66fcbba900c4b74761257078fd07900f7519b5f8cc4a521bfae77a3ab1a4a887e211bdb641d1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD514b21a680888e9fc3af4e7ffd5c7d93b
SHA17f0a74ec71adf9b04c9301f1188bcffc1ed585a0
SHA2562ea4c07c30425bb3d9b83fae78e06e8ca41710a109f7f65f45d6e8b829ff051c
SHA512820080474034253663e9fdf8d54a609ecb4dd7e6daa40db2a2972e9d5d51a5530b9ad5d98275008b52722420361c86c75ece0b9e47cb1cac9572b6de14ebd45a
-
C:\Users\Admin\AppData\Local\Temp\42f72a62-6a64-4125-92a1-7063dd998af5\1be81505-c4b8-440a-acfb-ffbeeb89d451.exeFilesize
25KB
MD55951b52c9b4d11ca7f4f33e5a3fb2c31
SHA10bc54fd699fff7b93e5c447a141c0d904924ab0d
SHA25670b785e5cb5b2e61c0f5da4a71ab0bbd14d9a0849387f037e0d75cc1ffe0a082
SHA51230b3b1eed05ba724d9a19d0d301b6ffb45222a47cc5476cc7f61ae565ddea4deea669f6fc3f38a1c5f24396eb4d3d6a7a8b58992fdfe2fac57dbcc2fa5b9b1d8
-
C:\Users\Admin\AppData\Local\Temp\42f72a62-6a64-4125-92a1-7063dd998af5\1be81505-c4b8-440a-acfb-ffbeeb89d451.exeFilesize
25KB
MD55951b52c9b4d11ca7f4f33e5a3fb2c31
SHA10bc54fd699fff7b93e5c447a141c0d904924ab0d
SHA25670b785e5cb5b2e61c0f5da4a71ab0bbd14d9a0849387f037e0d75cc1ffe0a082
SHA51230b3b1eed05ba724d9a19d0d301b6ffb45222a47cc5476cc7f61ae565ddea4deea669f6fc3f38a1c5f24396eb4d3d6a7a8b58992fdfe2fac57dbcc2fa5b9b1d8
-
C:\Users\Admin\AppData\Local\Temp\42f72a62-6a64-4125-92a1-7063dd998af5\AdvancedRun.exeFilesize
88KB
MD517fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\42f72a62-6a64-4125-92a1-7063dd998af5\AdvancedRun.exeFilesize
88KB
MD517fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\42f72a62-6a64-4125-92a1-7063dd998af5\AdvancedRun.exeFilesize
88KB
MD517fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
memory/828-146-0x0000000000000000-mapping.dmp
-
memory/828-156-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/828-164-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/828-148-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/828-150-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/1488-158-0x00007FF867DE0000-0x00007FF8688A1000-memory.dmpFilesize
10.8MB
-
memory/1488-136-0x0000000000000000-mapping.dmp
-
memory/1488-143-0x0000015FC7AE0000-0x0000015FC7AEC000-memory.dmpFilesize
48KB
-
memory/1488-151-0x00007FF867DE0000-0x00007FF8688A1000-memory.dmpFilesize
10.8MB
-
memory/1976-137-0x0000000000000000-mapping.dmp
-
memory/2268-153-0x0000000000000000-mapping.dmp
-
memory/2332-167-0x00000000070A0000-0x00000000070AA000-memory.dmpFilesize
40KB
-
memory/2332-162-0x00000000710E0000-0x000000007112C000-memory.dmpFilesize
304KB
-
memory/2332-166-0x0000000007030000-0x000000000704A000-memory.dmpFilesize
104KB
-
memory/2332-159-0x0000000006CA0000-0x0000000006CD2000-memory.dmpFilesize
200KB
-
memory/2332-171-0x0000000007350000-0x0000000007358000-memory.dmpFilesize
32KB
-
memory/2332-140-0x0000000000000000-mapping.dmp
-
memory/2388-152-0x0000000005790000-0x00000000057B2000-memory.dmpFilesize
136KB
-
memory/2388-169-0x0000000007C70000-0x0000000007C7E000-memory.dmpFilesize
56KB
-
memory/2388-155-0x0000000006070000-0x00000000060D6000-memory.dmpFilesize
408KB
-
memory/2388-157-0x0000000006740000-0x000000000675E000-memory.dmpFilesize
120KB
-
memory/2388-160-0x00000000710E0000-0x000000007112C000-memory.dmpFilesize
304KB
-
memory/2388-168-0x0000000007CC0000-0x0000000007D56000-memory.dmpFilesize
600KB
-
memory/2388-145-0x0000000005810000-0x0000000005E38000-memory.dmpFilesize
6.2MB
-
memory/2388-144-0x0000000005160000-0x0000000005196000-memory.dmpFilesize
216KB
-
memory/2388-135-0x0000000000000000-mapping.dmp
-
memory/2388-165-0x0000000008090000-0x000000000870A000-memory.dmpFilesize
6.5MB
-
memory/4272-130-0x0000000000A40000-0x0000000000ADA000-memory.dmpFilesize
616KB
-
memory/4272-134-0x00000000096A0000-0x0000000009C44000-memory.dmpFilesize
5.6MB
-
memory/4272-133-0x0000000008D00000-0x0000000008D66000-memory.dmpFilesize
408KB
-
memory/4272-132-0x00000000054A0000-0x00000000054BE000-memory.dmpFilesize
120KB
-
memory/4272-131-0x00000000053E0000-0x0000000005456000-memory.dmpFilesize
472KB
-
memory/4320-142-0x0000000000000000-mapping.dmp
-
memory/4320-161-0x00000000710E0000-0x000000007112C000-memory.dmpFilesize
304KB
-
memory/4320-163-0x0000000006B60000-0x0000000006B7E000-memory.dmpFilesize
120KB
-
memory/4320-170-0x0000000007BD0000-0x0000000007BEA000-memory.dmpFilesize
104KB