Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
03-08-2022 21:41
Static task
static1
Behavioral task
behavioral1
Sample
INVOICES.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
INVOICES.exe
Resource
win10v2004-20220721-en
General
-
Target
INVOICES.exe
-
Size
996KB
-
MD5
edfc6e2add36e49c8c9e010db0eb0632
-
SHA1
69697675cdc6d2c26db0709339bfd8f42044e7b6
-
SHA256
86871dd03f2da6c6de34710060ddc726fae5907f1f48d37c26d23f4d3d3f9bb8
-
SHA512
61dd86fe6c09ecb2e8e107a0aa6f93d0d44334f873c3fb4b842be5e4da26e72ad53cc65c202fe9aca0ef540021ed4ddbe4f3fa9030886d835ff6ad74c894cac6
Malware Config
Extracted
formbook
4.1
ee27
gasimportsfiles.com
hospitaljobsindia.com
mymortgagecantips.xyz
yourenotalone.world
livethejesuslife.com
sobernv.com
bobgruber.online
badu100.com
id98qq12.com
naturalex.co.uk
metathrillrides.com
blessingstowing.com
juddsbarandgrill.com
qrcodemania.com
haodaculture.com
obot.xyz
soupmortgagemark.xyz
top-road.com
xiaoterv.com
madrstyonline.com
lntmemories.com
codeverse.store
coleadersolutions.com
xn--2i0bs4kuxch7w.com
trumanridgekc.com
urbansummerfest.com
prelistingphotos.com
ncknights.com
demo-box.com
rifinastore.com
costamp.online
growthdigitalstudios.com
mso-4.com
rebeccast.club
mobilebusinessmoneymachine.com
hardmails.com
taylorbeckerhair.com
bradarender.com
urfahaberdar.com
evershinetransportltd.co.uk
perfecttime.club
phch.pro
fccxzb.site
myassetssecured.com
mysticmindpublishingacademy.com
energyharvesting.online
nhckom.com
tomiburkolo.com
uplandshell.com
tabularasa.net.cn
pagosahanger.com
apicemtech.com
doomscene.com
yqxinydz.com
lolmaster.host
massageindenton.uk
95hillerdr.com
paymentwize.com
tamwen.app
4any4all.com
neustabos.com
jedonnadingesforgpboe.com
dabeiw.com
thatpaintlady.com
ndcolledge-traducteur.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4280-207-0x0000000050410000-0x000000005043F000-memory.dmp formbook behavioral2/memory/4484-250-0x0000000050410000-0x000000005043F000-memory.dmp formbook behavioral2/memory/1172-252-0x0000000000B90000-0x0000000000BBF000-memory.dmp formbook behavioral2/memory/1172-257-0x0000000000B90000-0x0000000000BBF000-memory.dmp formbook -
ModiLoader Second Stage 62 IoCs
Processes:
resource yara_rule behavioral2/memory/4280-148-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-161-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-162-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-163-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-164-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-165-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-166-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-167-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-168-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-169-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-170-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-171-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-172-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-173-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-174-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-175-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-176-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-177-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-178-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-179-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-180-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-181-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-182-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-183-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-184-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-185-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-187-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-186-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-188-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-189-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-190-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-191-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-192-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-193-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-194-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-195-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-196-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-197-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-198-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-199-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-200-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-201-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-202-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-203-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-204-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-208-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-209-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-210-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-211-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-212-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-213-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-214-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-215-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-216-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-217-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-218-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-220-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-221-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-223-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-224-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-225-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 behavioral2/memory/4280-226-0x0000000003C30000-0x0000000003CCF000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
INVOICES.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation INVOICES.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
INVOICES.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jnyomk = "C:\\Users\\Public\\Libraries\\kmoynJ.url" INVOICES.exe -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{20B5482C-F0D0-47AA-941A-4E23986FB0EB}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{4DAFE762-FA69-449F-9664-0E84E5564638}.catalogItem svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cmd.exemsiexec.exedescription pid process target process PID 4484 set thread context of 768 4484 cmd.exe Explorer.EXE PID 1172 set thread context of 768 1172 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
INVOICES.execmd.exemsiexec.exepid process 4280 INVOICES.exe 4280 INVOICES.exe 4484 cmd.exe 4484 cmd.exe 4484 cmd.exe 4484 cmd.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe 1172 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 768 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
cmd.exemsiexec.exepid process 4484 cmd.exe 4484 cmd.exe 4484 cmd.exe 1172 msiexec.exe 1172 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
cmd.exeExplorer.EXEmsiexec.exedescription pid process Token: SeDebugPrivilege 4484 cmd.exe Token: SeShutdownPrivilege 768 Explorer.EXE Token: SeCreatePagefilePrivilege 768 Explorer.EXE Token: SeShutdownPrivilege 768 Explorer.EXE Token: SeCreatePagefilePrivilege 768 Explorer.EXE Token: SeDebugPrivilege 1172 msiexec.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
INVOICES.exeExplorer.EXEmsiexec.exedescription pid process target process PID 4280 wrote to memory of 4484 4280 INVOICES.exe cmd.exe PID 4280 wrote to memory of 4484 4280 INVOICES.exe cmd.exe PID 4280 wrote to memory of 4484 4280 INVOICES.exe cmd.exe PID 4280 wrote to memory of 4484 4280 INVOICES.exe cmd.exe PID 4280 wrote to memory of 4484 4280 INVOICES.exe cmd.exe PID 4280 wrote to memory of 4484 4280 INVOICES.exe cmd.exe PID 768 wrote to memory of 1172 768 Explorer.EXE msiexec.exe PID 768 wrote to memory of 1172 768 Explorer.EXE msiexec.exe PID 768 wrote to memory of 1172 768 Explorer.EXE msiexec.exe PID 1172 wrote to memory of 4704 1172 msiexec.exe cmd.exe PID 1172 wrote to memory of 4704 1172 msiexec.exe cmd.exe PID 1172 wrote to memory of 4704 1172 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INVOICES.exe"C:\Users\Admin\AppData\Local\Temp\INVOICES.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/768-248-0x0000000008230000-0x0000000008349000-memory.dmpFilesize
1.1MB
-
memory/768-258-0x00000000084C0000-0x00000000085B9000-memory.dmpFilesize
996KB
-
memory/768-256-0x00000000084C0000-0x00000000085B9000-memory.dmpFilesize
996KB
-
memory/1172-257-0x0000000000B90000-0x0000000000BBF000-memory.dmpFilesize
188KB
-
memory/1172-255-0x0000000002AD0000-0x0000000002B63000-memory.dmpFilesize
588KB
-
memory/1172-254-0x0000000002C30000-0x0000000002F7A000-memory.dmpFilesize
3.3MB
-
memory/1172-252-0x0000000000B90000-0x0000000000BBF000-memory.dmpFilesize
188KB
-
memory/1172-251-0x0000000000850000-0x0000000000862000-memory.dmpFilesize
72KB
-
memory/1172-249-0x0000000000000000-mapping.dmp
-
memory/4280-198-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-202-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-171-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-172-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-173-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-174-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-175-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-176-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-177-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-178-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-179-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-180-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-181-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-182-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-183-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-184-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-185-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-187-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-186-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-188-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-189-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-190-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-191-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-192-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-193-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-194-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-195-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-196-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-197-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-148-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-199-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-200-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-201-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-170-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-203-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-204-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-161-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-207-0x0000000050410000-0x000000005043F000-memory.dmpFilesize
188KB
-
memory/4280-208-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-209-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-210-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-211-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-212-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-213-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-214-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-215-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-216-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-217-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-162-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-218-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-220-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-221-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-223-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-224-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-225-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-226-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-163-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-169-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-168-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-164-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-167-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-166-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4280-165-0x0000000003C30000-0x0000000003CCF000-memory.dmpFilesize
636KB
-
memory/4484-250-0x0000000050410000-0x000000005043F000-memory.dmpFilesize
188KB
-
memory/4484-247-0x00000000012E0000-0x00000000012F4000-memory.dmpFilesize
80KB
-
memory/4484-219-0x00000000013E0000-0x000000000172A000-memory.dmpFilesize
3.3MB
-
memory/4484-205-0x0000000000000000-mapping.dmp
-
memory/4704-253-0x0000000000000000-mapping.dmp