Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
02-09-2022 11:35
Static task
static1
General
-
Target
1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe
-
Size
4.3MB
-
MD5
0f436d1b40cc8da71989b597951ae61c
-
SHA1
eb697a163bf73ee475c93e916bfaf90de40dd422
-
SHA256
1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa
-
SHA512
489c4b07fbf28921d22adfe6429e56fb70b8503ad9cde21991923bc54ee5ec78675c94185773bbabc166221b731f1e9335f59ce92113769e9d0f4becc800516e
-
SSDEEP
98304:tmlSoZ5WrocGLpYHgyRWSJfSD8xipKbgo9PIs4qSoNMLmUzv:IlR5jcG+AyRWSJNceeLlT
Malware Config
Extracted
bitrat
1.38
163.123.143.143:3569
-
communication_password
ce952068942604a6d6df06ed5002fad6
-
tor_process
tor
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Unknown.dll acprotect \Users\Admin\AppData\Local\Temp\Unknown.dll acprotect -
Processes:
resource yara_rule behavioral1/memory/4668-323-0x0000000000400000-0x00000000008DC000-memory.dmp upx behavioral1/memory/4668-416-0x0000000000400000-0x00000000008DC000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exepid process 5032 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exepid process 4008 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 4008 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 4008 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 4008 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 4008 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exedescription pid process target process PID 388 set thread context of 4008 388 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 4008 set thread context of 4668 4008 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 4668 set thread context of 5032 4668 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exepid process 5032 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 5032 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exedescription pid process Token: SeShutdownPrivilege 4008 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe Token: SeDebugPrivilege 5032 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exepid process 388 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 4008 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 4008 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exedescription pid process target process PID 388 wrote to memory of 4008 388 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 388 wrote to memory of 4008 388 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 388 wrote to memory of 4008 388 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 388 wrote to memory of 4008 388 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 388 wrote to memory of 4008 388 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 388 wrote to memory of 4008 388 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 388 wrote to memory of 4008 388 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 388 wrote to memory of 4008 388 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 388 wrote to memory of 4008 388 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 388 wrote to memory of 4008 388 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 388 wrote to memory of 4008 388 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 4008 wrote to memory of 4668 4008 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 4008 wrote to memory of 4668 4008 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 4008 wrote to memory of 4668 4008 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 4008 wrote to memory of 4668 4008 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 4008 wrote to memory of 4668 4008 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 4008 wrote to memory of 4668 4008 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 4008 wrote to memory of 4668 4008 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 4008 wrote to memory of 4668 4008 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 4668 wrote to memory of 5032 4668 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 4668 wrote to memory of 5032 4668 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 4668 wrote to memory of 5032 4668 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 4668 wrote to memory of 5032 4668 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 4668 wrote to memory of 5032 4668 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 4668 wrote to memory of 5032 4668 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 4668 wrote to memory of 5032 4668 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe PID 4668 wrote to memory of 5032 4668 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe 1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe"C:\Users\Admin\AppData\Local\Temp\1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe"C:\Users\Admin\AppData\Local\Temp\1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe-a "C:\Users\Admin\AppData\Local\5bdee7b8\plg\nPXRDTLA.json"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1bbf7521bd43cc4fd418b052fe950ab71b66e7dbef9b0d4816939a5019aecaaa.exe-a "C:\Users\Admin\AppData\Local\Temp\unk.xml"4⤵
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\5bdee7b8\plg\nPXRDTLA.jsonFilesize
1KB
MD577e6621fd939338d3f19f3dd948ecf43
SHA153df8b3a76c5d6c35a99aa7759ff3bd7ec46588c
SHA2569cb90c1d5c31396519b1f6c73899c062b6ccbd9a8cfc7c0bb054fe88c7825867
SHA5126e812be4c3b958f0497f91e0eb2e8b77d4a13e2b7af750a30ec9bff3dde09a233b5510ee6333a9ab3182c11ab6c3d38789921d517449c6a03164e216cee43c4f
-
C:\Users\Admin\AppData\Local\Temp\License.XenArmorFilesize
104B
MD54f3bde9212e17ef18226866d6ac739b6
SHA1732733bec8314beb81437e60876ffa75e72ae6cd
SHA256212173a405c78d70f90e8ec0699a60ed2f4a9f3a8070de62eabd666c268fb174
SHA51210b7cdae0b9a7b0f8e1bfc66a60675fa9b25c523864d5ae3da243f4e6e4c5194f3bd92af57ac956157442f66414bdd3393d0a1e5ba4ef0f192561e8524d4e744
-
C:\Users\Admin\AppData\Local\Temp\License.XenArmorFilesize
104B
MD5bf5da170f7c9a8eae88d1cb1a191ff80
SHA1dd1b991a1b03587a5d1edc94e919a2070e325610
SHA256e5d5110feb21939d82d962981aeaaafc4643b40a9b87cbed800ace82135d57cd
SHA5129e32247d8556fd6efffbf7b6b9c325652d8c4b223b0fa38020879171476a49ab1f64d8897b5d8d92b79c5484fd9d5899be26ca5f664ee1f9c2acb0857084121e
-
C:\Users\Admin\AppData\Local\Temp\Unknown.dllFilesize
793KB
MD586114faba7e1ec4a667d2bcb2e23f024
SHA1670df6e1ba1dc6bece046e8b2e573dd36748245e
SHA256568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d
SHA512d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f
-
C:\Users\Admin\AppData\Local\Temp\unk.xmlFilesize
1KB
MD577e6621fd939338d3f19f3dd948ecf43
SHA153df8b3a76c5d6c35a99aa7759ff3bd7ec46588c
SHA2569cb90c1d5c31396519b1f6c73899c062b6ccbd9a8cfc7c0bb054fe88c7825867
SHA5126e812be4c3b958f0497f91e0eb2e8b77d4a13e2b7af750a30ec9bff3dde09a233b5510ee6333a9ab3182c11ab6c3d38789921d517449c6a03164e216cee43c4f
-
\Users\Admin\AppData\Local\Temp\Unknown.dllFilesize
793KB
MD586114faba7e1ec4a667d2bcb2e23f024
SHA1670df6e1ba1dc6bece046e8b2e573dd36748245e
SHA256568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d
SHA512d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f
-
memory/388-159-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-161-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-123-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-124-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-125-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-126-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-127-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-128-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-129-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-131-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-132-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-133-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-130-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-134-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-135-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-136-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-137-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-138-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-139-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-140-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-141-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-142-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-143-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-144-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-145-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-146-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-147-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-149-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-150-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-152-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-153-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-154-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-155-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-156-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-157-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-158-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-121-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-160-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-167-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-120-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-122-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-164-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-165-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-166-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-163-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-168-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-169-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-170-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-171-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-172-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-173-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-174-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-175-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-176-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-177-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-178-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-179-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-180-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-181-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-182-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-183-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-184-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-185-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/388-162-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4008-293-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4008-193-0x000000000068A488-mapping.dmp
-
memory/4008-292-0x0000000073770000-0x00000000737AA000-memory.dmpFilesize
232KB
-
memory/4008-419-0x0000000073770000-0x00000000737AA000-memory.dmpFilesize
232KB
-
memory/4008-224-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4008-418-0x00000000737A0000-0x00000000737DA000-memory.dmpFilesize
232KB
-
memory/4008-241-0x00000000737A0000-0x00000000737DA000-memory.dmpFilesize
232KB
-
memory/4668-416-0x0000000000400000-0x00000000008DC000-memory.dmpFilesize
4.9MB
-
memory/4668-295-0x00000000008D9FE0-mapping.dmp
-
memory/4668-323-0x0000000000400000-0x00000000008DC000-memory.dmpFilesize
4.9MB
-
memory/5032-403-0x0000000010000000-0x0000000010227000-memory.dmpFilesize
2.2MB
-
memory/5032-330-0x00000000006FC1D0-mapping.dmp
-
memory/5032-359-0x0000000000400000-0x00000000006FE000-memory.dmpFilesize
3.0MB
-
memory/5032-402-0x0000000000400000-0x00000000006FE000-memory.dmpFilesize
3.0MB
-
memory/5032-412-0x0000000000400000-0x00000000006FE000-memory.dmpFilesize
3.0MB
-
memory/5032-413-0x0000000010000000-0x0000000010227000-memory.dmpFilesize
2.2MB