Analysis
-
max time kernel
148s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
04-08-2022 06:46
Behavioral task
behavioral1
Sample
e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe
Resource
win10v2004-20220721-en
General
-
Target
e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe
-
Size
5.9MB
-
MD5
ddbc6e1c57c1cf5eaae63266944f3288
-
SHA1
717f75e8702b47f02b44ef7a6b0e0a91008ee0cb
-
SHA256
e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595
-
SHA512
9ba3e9d8500c220871284c26afdeb60681b5124a239672df48154c2932093bec68e71f2384e1cc5e41f60a2c71e206eef434562518e5a0668c1d833a612bae79
Malware Config
Signatures
-
Gh0st RAT payload 9 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\._cache_e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe family_gh0strat C:\Users\Admin\AppData\Local\Temp\._cache_e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe family_gh0strat C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe family_gh0strat C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe family_gh0strat C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exe family_gh0strat C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exe family_gh0strat C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exe family_gh0strat C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exe family_gh0strat C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exe family_gh0strat -
Executes dropped EXE 6 IoCs
Processes:
._cache_e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exeSynaptics.exe._cache_Synaptics.exeUskagge.exeUskagge.exeUskagge.exepid process 3192 ._cache_e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe 2720 Synaptics.exe 1316 ._cache_Synaptics.exe 1480 Uskagge.exe 2100 Uskagge.exe 4120 Uskagge.exe -
Processes:
resource yara_rule behavioral2/memory/3832-130-0x0000000000400000-0x0000000000E5D000-memory.dmp vmprotect behavioral2/memory/3832-132-0x0000000000400000-0x0000000000E5D000-memory.dmp vmprotect C:\ProgramData\Synaptics\Synaptics.exe vmprotect C:\ProgramData\Synaptics\Synaptics.exe vmprotect behavioral2/memory/3832-139-0x0000000000400000-0x0000000000E5D000-memory.dmp vmprotect behavioral2/memory/2720-140-0x0000000000400000-0x0000000000E5D000-memory.dmp vmprotect behavioral2/memory/2720-142-0x0000000000400000-0x0000000000E5D000-memory.dmp vmprotect behavioral2/memory/2720-143-0x0000000000400000-0x0000000000E5D000-memory.dmp vmprotect behavioral2/memory/2720-154-0x0000000000400000-0x0000000000E5D000-memory.dmp vmprotect -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Synaptics.exee0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe -
Drops file in System32 directory 13 IoCs
Processes:
Uskagge.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft Uskagge.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache Uskagge.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData Uskagge.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C Uskagge.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies Uskagge.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE Uskagge.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 Uskagge.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C Uskagge.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content Uskagge.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_B2FEEE6B08CF6C854CB2A5F3B5EFD61C Uskagge.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_B2FEEE6B08CF6C854CB2A5F3B5EFD61C Uskagge.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\cgi_get_portrait[1].htm Uskagge.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 Uskagge.exe -
Drops file in Program Files directory 3 IoCs
Processes:
._cache_e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe._cache_Synaptics.exedescription ioc process File created C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exe ._cache_e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe File opened for modification C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exe ._cache_e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe File opened for modification C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exe ._cache_Synaptics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4852 1480 WerFault.exe Uskagge.exe -
Modifies data under HKEY_USERS 9 IoCs
Processes:
Uskagge.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Uskagge.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Uskagge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Uskagge.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" Uskagge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Uskagge.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Uskagge.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" Uskagge.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" Uskagge.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" Uskagge.exe -
Modifies registry class 2 IoCs
Processes:
e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exeSynaptics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exeSynaptics.exe._cache_e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe._cache_Synaptics.exepid process 3832 e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe 3832 e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe 3832 e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe 3832 e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe 2720 Synaptics.exe 2720 Synaptics.exe 2720 Synaptics.exe 2720 Synaptics.exe 3192 ._cache_e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe 3192 ._cache_e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe 1316 ._cache_Synaptics.exe 1316 ._cache_Synaptics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Uskagge.exedescription pid process Token: SeDebugPrivilege 1480 Uskagge.exe Token: SeDebugPrivilege 1480 Uskagge.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exeSynaptics.exeUskagge.exedescription pid process target process PID 3832 wrote to memory of 3192 3832 e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe ._cache_e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe PID 3832 wrote to memory of 3192 3832 e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe ._cache_e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe PID 3832 wrote to memory of 3192 3832 e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe ._cache_e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe PID 3832 wrote to memory of 2720 3832 e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe Synaptics.exe PID 3832 wrote to memory of 2720 3832 e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe Synaptics.exe PID 3832 wrote to memory of 2720 3832 e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe Synaptics.exe PID 2720 wrote to memory of 1316 2720 Synaptics.exe ._cache_Synaptics.exe PID 2720 wrote to memory of 1316 2720 Synaptics.exe ._cache_Synaptics.exe PID 2720 wrote to memory of 1316 2720 Synaptics.exe ._cache_Synaptics.exe PID 1480 wrote to memory of 2100 1480 Uskagge.exe Uskagge.exe PID 1480 wrote to memory of 2100 1480 Uskagge.exe Uskagge.exe PID 1480 wrote to memory of 2100 1480 Uskagge.exe Uskagge.exe PID 1480 wrote to memory of 4120 1480 Uskagge.exe Uskagge.exe PID 1480 wrote to memory of 4120 1480 Uskagge.exe Uskagge.exe PID 1480 wrote to memory of 4120 1480 Uskagge.exe Uskagge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe"C:\Users\Admin\AppData\Local\Temp\e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe"C:\Users\Admin\AppData\Local\Temp\._cache_e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exe"C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exe"C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exe" Win72⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exe"C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exe" Win72⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 6362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1480 -ip 14801⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exeFilesize
1.7MB
MD5e36d0b655e6742b3f487cf51f70a72b9
SHA1335d9a76b730755e3f2a44e536eb8d8a88f7c6e1
SHA256d307d7a74228548afb2074d1fe32cc8b766658cc606018eba50f3b643c145e47
SHA5127906817f6be0d0d36bd6ef128951c8950fe8cd1fd869c36eb5a1d7a50edbfe5b54e65bd3cf4a833a7477cb86b496a979c08a4994b582b1e434aad4a193d5a355
-
C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exeFilesize
1.7MB
MD5e36d0b655e6742b3f487cf51f70a72b9
SHA1335d9a76b730755e3f2a44e536eb8d8a88f7c6e1
SHA256d307d7a74228548afb2074d1fe32cc8b766658cc606018eba50f3b643c145e47
SHA5127906817f6be0d0d36bd6ef128951c8950fe8cd1fd869c36eb5a1d7a50edbfe5b54e65bd3cf4a833a7477cb86b496a979c08a4994b582b1e434aad4a193d5a355
-
C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exeFilesize
1.7MB
MD5e36d0b655e6742b3f487cf51f70a72b9
SHA1335d9a76b730755e3f2a44e536eb8d8a88f7c6e1
SHA256d307d7a74228548afb2074d1fe32cc8b766658cc606018eba50f3b643c145e47
SHA5127906817f6be0d0d36bd6ef128951c8950fe8cd1fd869c36eb5a1d7a50edbfe5b54e65bd3cf4a833a7477cb86b496a979c08a4994b582b1e434aad4a193d5a355
-
C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exeFilesize
1.7MB
MD5e36d0b655e6742b3f487cf51f70a72b9
SHA1335d9a76b730755e3f2a44e536eb8d8a88f7c6e1
SHA256d307d7a74228548afb2074d1fe32cc8b766658cc606018eba50f3b643c145e47
SHA5127906817f6be0d0d36bd6ef128951c8950fe8cd1fd869c36eb5a1d7a50edbfe5b54e65bd3cf4a833a7477cb86b496a979c08a4994b582b1e434aad4a193d5a355
-
C:\Program Files (x86)\Microsoft Ugsugc\Uskagge.exeFilesize
1.7MB
MD5e36d0b655e6742b3f487cf51f70a72b9
SHA1335d9a76b730755e3f2a44e536eb8d8a88f7c6e1
SHA256d307d7a74228548afb2074d1fe32cc8b766658cc606018eba50f3b643c145e47
SHA5127906817f6be0d0d36bd6ef128951c8950fe8cd1fd869c36eb5a1d7a50edbfe5b54e65bd3cf4a833a7477cb86b496a979c08a4994b582b1e434aad4a193d5a355
-
C:\ProgramData\Synaptics\Synaptics.exeFilesize
5.9MB
MD5ddbc6e1c57c1cf5eaae63266944f3288
SHA1717f75e8702b47f02b44ef7a6b0e0a91008ee0cb
SHA256e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595
SHA5129ba3e9d8500c220871284c26afdeb60681b5124a239672df48154c2932093bec68e71f2384e1cc5e41f60a2c71e206eef434562518e5a0668c1d833a612bae79
-
C:\ProgramData\Synaptics\Synaptics.exeFilesize
5.9MB
MD5ddbc6e1c57c1cf5eaae63266944f3288
SHA1717f75e8702b47f02b44ef7a6b0e0a91008ee0cb
SHA256e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595
SHA5129ba3e9d8500c220871284c26afdeb60681b5124a239672df48154c2932093bec68e71f2384e1cc5e41f60a2c71e206eef434562518e5a0668c1d833a612bae79
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
672KB
MD55dd99a105d42ea8aaac1ea4c52da8761
SHA1e4b44de5e67e8d9bef6b8a1366fe439c6e658634
SHA2561ef32709396ab995d96376ef86bcce13f351139cca4c63506cc4112f69e45e6d
SHA512c3fe8066088e02f79c389f46b8b1e66643af3cff1a98165799f631ae3a09bcc50b95af2ab42ba7962fea8047c461a6ed04e05ffbc3cff956c276c9a8996ad25d
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeFilesize
672KB
MD55dd99a105d42ea8aaac1ea4c52da8761
SHA1e4b44de5e67e8d9bef6b8a1366fe439c6e658634
SHA2561ef32709396ab995d96376ef86bcce13f351139cca4c63506cc4112f69e45e6d
SHA512c3fe8066088e02f79c389f46b8b1e66643af3cff1a98165799f631ae3a09bcc50b95af2ab42ba7962fea8047c461a6ed04e05ffbc3cff956c276c9a8996ad25d
-
C:\Users\Admin\AppData\Local\Temp\._cache_e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exeFilesize
672KB
MD55dd99a105d42ea8aaac1ea4c52da8761
SHA1e4b44de5e67e8d9bef6b8a1366fe439c6e658634
SHA2561ef32709396ab995d96376ef86bcce13f351139cca4c63506cc4112f69e45e6d
SHA512c3fe8066088e02f79c389f46b8b1e66643af3cff1a98165799f631ae3a09bcc50b95af2ab42ba7962fea8047c461a6ed04e05ffbc3cff956c276c9a8996ad25d
-
C:\Users\Admin\AppData\Local\Temp\._cache_e0fbae552f8e58e68130950bfb350c4619ca471d1e586713eae6ab41b8d3a595.exeFilesize
672KB
MD55dd99a105d42ea8aaac1ea4c52da8761
SHA1e4b44de5e67e8d9bef6b8a1366fe439c6e658634
SHA2561ef32709396ab995d96376ef86bcce13f351139cca4c63506cc4112f69e45e6d
SHA512c3fe8066088e02f79c389f46b8b1e66643af3cff1a98165799f631ae3a09bcc50b95af2ab42ba7962fea8047c461a6ed04e05ffbc3cff956c276c9a8996ad25d
-
memory/1316-144-0x0000000000000000-mapping.dmp
-
memory/2100-150-0x0000000000000000-mapping.dmp
-
memory/2720-136-0x0000000000000000-mapping.dmp
-
memory/2720-143-0x0000000000400000-0x0000000000E5D000-memory.dmpFilesize
10.4MB
-
memory/2720-142-0x0000000000400000-0x0000000000E5D000-memory.dmpFilesize
10.4MB
-
memory/2720-140-0x0000000000400000-0x0000000000E5D000-memory.dmpFilesize
10.4MB
-
memory/2720-154-0x0000000000400000-0x0000000000E5D000-memory.dmpFilesize
10.4MB
-
memory/3192-133-0x0000000000000000-mapping.dmp
-
memory/3832-139-0x0000000000400000-0x0000000000E5D000-memory.dmpFilesize
10.4MB
-
memory/3832-130-0x0000000000400000-0x0000000000E5D000-memory.dmpFilesize
10.4MB
-
memory/3832-132-0x0000000000400000-0x0000000000E5D000-memory.dmpFilesize
10.4MB
-
memory/4120-151-0x0000000000000000-mapping.dmp