Analysis
-
max time kernel
563s -
max time network
604s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
09-09-2022 19:57
Static task
static1
Behavioral task
behavioral1
Sample
MAJSUKDOLR-COPY.exe
Resource
win7-20220812-en
General
-
Target
MAJSUKDOLR-COPY.exe
-
Size
500.0MB
-
MD5
65401fd8ceadff6d78f5484255fa1b35
-
SHA1
df03cee3ff44dbef34f470aeb5118195c731324c
-
SHA256
45c33bd71b10c7b6ccc4ea712eac64993e3b5fb907fe210d4ebacd3c2e320ac1
-
SHA512
3b5760bfb04cf1e3b3ddfc07aeef3dde53bf849601958d8d42b49edf88eaa09c106e47c691d71f31743b33f0067cd2296c38edfbaaef3c548ec6f3dacfeb73b2
-
SSDEEP
6144:zzR0netQObEM9xDoHUfz/Wm071uBuS+E7nH/v9xuEcPvZBvYZE:zzRceDbtWAz/W5aL/v9wEW
Malware Config
Extracted
nanocore
1.2.2.0
nano8100.duckdns.org:8100
ea2df3dd-6f75-4cfc-bf5b-706727f74cdd
-
activate_away_mode
true
-
backup_connection_host
nano8100.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-02-15T20:53:01.763064736Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
8100
-
default_group
may 8100
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
ea2df3dd-6f75-4cfc-bf5b-706727f74cdd
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
nano8100.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Executes dropped EXE 5 IoCs
Processes:
hhkh.exehhkh.exehhkh.exehhkh.exehhkh.exepid process 4988 hhkh.exe 4072 hhkh.exe 2776 hhkh.exe 3512 hhkh.exe 1988 hhkh.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
MAJSUKDOLR-COPY.exehhkh.exehhkh.exehhkh.exehhkh.exedescription pid process target process PID 2704 set thread context of 4664 2704 MAJSUKDOLR-COPY.exe RegAsm.exe PID 4988 set thread context of 860 4988 hhkh.exe RegAsm.exe PID 4072 set thread context of 4788 4072 hhkh.exe RegAsm.exe PID 2776 set thread context of 3220 2776 hhkh.exe RegAsm.exe PID 3512 set thread context of 756 3512 hhkh.exe RegAsm.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 940 schtasks.exe 1380 schtasks.exe 4824 schtasks.exe 60 schtasks.exe 1812 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
RegAsm.exepid process 4664 RegAsm.exe 4664 RegAsm.exe 4664 RegAsm.exe 4664 RegAsm.exe 4664 RegAsm.exe 4664 RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 4664 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 4664 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
MAJSUKDOLR-COPY.execmd.exehhkh.execmd.exehhkh.execmd.exehhkh.exedescription pid process target process PID 2704 wrote to memory of 4704 2704 MAJSUKDOLR-COPY.exe cmd.exe PID 2704 wrote to memory of 4704 2704 MAJSUKDOLR-COPY.exe cmd.exe PID 2704 wrote to memory of 4704 2704 MAJSUKDOLR-COPY.exe cmd.exe PID 2704 wrote to memory of 4764 2704 MAJSUKDOLR-COPY.exe cmd.exe PID 2704 wrote to memory of 4764 2704 MAJSUKDOLR-COPY.exe cmd.exe PID 2704 wrote to memory of 4764 2704 MAJSUKDOLR-COPY.exe cmd.exe PID 2704 wrote to memory of 4664 2704 MAJSUKDOLR-COPY.exe RegAsm.exe PID 2704 wrote to memory of 4664 2704 MAJSUKDOLR-COPY.exe RegAsm.exe PID 2704 wrote to memory of 4664 2704 MAJSUKDOLR-COPY.exe RegAsm.exe PID 2704 wrote to memory of 4664 2704 MAJSUKDOLR-COPY.exe RegAsm.exe PID 2704 wrote to memory of 4664 2704 MAJSUKDOLR-COPY.exe RegAsm.exe PID 2704 wrote to memory of 4664 2704 MAJSUKDOLR-COPY.exe RegAsm.exe PID 2704 wrote to memory of 4664 2704 MAJSUKDOLR-COPY.exe RegAsm.exe PID 2704 wrote to memory of 4664 2704 MAJSUKDOLR-COPY.exe RegAsm.exe PID 4704 wrote to memory of 940 4704 cmd.exe schtasks.exe PID 4704 wrote to memory of 940 4704 cmd.exe schtasks.exe PID 4704 wrote to memory of 940 4704 cmd.exe schtasks.exe PID 4988 wrote to memory of 4416 4988 hhkh.exe cmd.exe PID 4988 wrote to memory of 4416 4988 hhkh.exe cmd.exe PID 4988 wrote to memory of 4416 4988 hhkh.exe cmd.exe PID 4988 wrote to memory of 4600 4988 hhkh.exe cmd.exe PID 4988 wrote to memory of 4600 4988 hhkh.exe cmd.exe PID 4988 wrote to memory of 4600 4988 hhkh.exe cmd.exe PID 4988 wrote to memory of 860 4988 hhkh.exe RegAsm.exe PID 4988 wrote to memory of 860 4988 hhkh.exe RegAsm.exe PID 4988 wrote to memory of 860 4988 hhkh.exe RegAsm.exe PID 4988 wrote to memory of 860 4988 hhkh.exe RegAsm.exe PID 4988 wrote to memory of 860 4988 hhkh.exe RegAsm.exe PID 4988 wrote to memory of 860 4988 hhkh.exe RegAsm.exe PID 4988 wrote to memory of 860 4988 hhkh.exe RegAsm.exe PID 4988 wrote to memory of 860 4988 hhkh.exe RegAsm.exe PID 4416 wrote to memory of 1380 4416 cmd.exe schtasks.exe PID 4416 wrote to memory of 1380 4416 cmd.exe schtasks.exe PID 4416 wrote to memory of 1380 4416 cmd.exe schtasks.exe PID 4072 wrote to memory of 1364 4072 hhkh.exe cmd.exe PID 4072 wrote to memory of 1364 4072 hhkh.exe cmd.exe PID 4072 wrote to memory of 1364 4072 hhkh.exe cmd.exe PID 4072 wrote to memory of 1180 4072 hhkh.exe cmd.exe PID 4072 wrote to memory of 1180 4072 hhkh.exe cmd.exe PID 4072 wrote to memory of 1180 4072 hhkh.exe cmd.exe PID 4072 wrote to memory of 4788 4072 hhkh.exe RegAsm.exe PID 4072 wrote to memory of 4788 4072 hhkh.exe RegAsm.exe PID 4072 wrote to memory of 4788 4072 hhkh.exe RegAsm.exe PID 4072 wrote to memory of 4788 4072 hhkh.exe RegAsm.exe PID 4072 wrote to memory of 4788 4072 hhkh.exe RegAsm.exe PID 4072 wrote to memory of 4788 4072 hhkh.exe RegAsm.exe PID 4072 wrote to memory of 4788 4072 hhkh.exe RegAsm.exe PID 4072 wrote to memory of 4788 4072 hhkh.exe RegAsm.exe PID 1364 wrote to memory of 4824 1364 cmd.exe schtasks.exe PID 1364 wrote to memory of 4824 1364 cmd.exe schtasks.exe PID 1364 wrote to memory of 4824 1364 cmd.exe schtasks.exe PID 2776 wrote to memory of 2948 2776 hhkh.exe cmd.exe PID 2776 wrote to memory of 2948 2776 hhkh.exe cmd.exe PID 2776 wrote to memory of 2948 2776 hhkh.exe cmd.exe PID 2776 wrote to memory of 4604 2776 hhkh.exe cmd.exe PID 2776 wrote to memory of 4604 2776 hhkh.exe cmd.exe PID 2776 wrote to memory of 4604 2776 hhkh.exe cmd.exe PID 2776 wrote to memory of 3220 2776 hhkh.exe RegAsm.exe PID 2776 wrote to memory of 3220 2776 hhkh.exe RegAsm.exe PID 2776 wrote to memory of 3220 2776 hhkh.exe RegAsm.exe PID 2776 wrote to memory of 3220 2776 hhkh.exe RegAsm.exe PID 2776 wrote to memory of 3220 2776 hhkh.exe RegAsm.exe PID 2776 wrote to memory of 3220 2776 hhkh.exe RegAsm.exe PID 2776 wrote to memory of 3220 2776 hhkh.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MAJSUKDOLR-COPY.exe"C:\Users\Admin\AppData\Local\Temp\MAJSUKDOLR-COPY.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\hhkh.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\hhkh.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\MAJSUKDOLR-COPY.exe" "C:\Users\Admin\AppData\Roaming\hhkh.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\hhkh.exeC:\Users\Admin\AppData\Roaming\hhkh.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\hhkh.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\hhkh.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\hhkh.exe" "C:\Users\Admin\AppData\Roaming\hhkh.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\hhkh.exeC:\Users\Admin\AppData\Roaming\hhkh.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\hhkh.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\hhkh.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\hhkh.exe" "C:\Users\Admin\AppData\Roaming\hhkh.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\hhkh.exeC:\Users\Admin\AppData\Roaming\hhkh.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\hhkh.exe'" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\hhkh.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\hhkh.exe" "C:\Users\Admin\AppData\Roaming\hhkh.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\hhkh.exeC:\Users\Admin\AppData\Roaming\hhkh.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\hhkh.exe'" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\hhkh.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\hhkh.exe" "C:\Users\Admin\AppData\Roaming\hhkh.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\hhkh.exeC:\Users\Admin\AppData\Roaming\hhkh.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.logFilesize
1KB
MD5c3cc52ccca9ff2b6fa8d267fc350ca6b
SHA1a68d4028333296d222e4afd75dea36fdc98d05f3
SHA2563125b6071e2d78f575a06ed7ac32a83d9262ae64d1fa81ac43e8bfc1ef157c0e
SHA512b0c7b2501b1a2c559795a9d178c0bbda0e03cbdbaaa2c4330ac1202a55373fe1b742078adcfa915bd6e805565a2daa6d35d64ef7a14ffcd09069f9ea6a691cc7
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hhkh.exe.logFilesize
612B
MD54f9330dcb7e8730af9341cfdf0d8030f
SHA167daaf17560b15fe1d861139bce85a3ff6dbed23
SHA2561c25f424605d0e3ccf1ec077c36b3d2c89aa628521d10df851c2ff7689ad4617
SHA512e3becfad18409be0797d172e8b1364775726f9d33d8f125c87656a829b0c0c86fcec433db4446371e68530c0d7cb594fdcf28bb75e1f5d4fba64fe38329d9a40
-
C:\Users\Admin\AppData\Roaming\hhkh.exeFilesize
500.0MB
MD565401fd8ceadff6d78f5484255fa1b35
SHA1df03cee3ff44dbef34f470aeb5118195c731324c
SHA25645c33bd71b10c7b6ccc4ea712eac64993e3b5fb907fe210d4ebacd3c2e320ac1
SHA5123b5760bfb04cf1e3b3ddfc07aeef3dde53bf849601958d8d42b49edf88eaa09c106e47c691d71f31743b33f0067cd2296c38edfbaaef3c548ec6f3dacfeb73b2
-
C:\Users\Admin\AppData\Roaming\hhkh.exeFilesize
500.0MB
MD565401fd8ceadff6d78f5484255fa1b35
SHA1df03cee3ff44dbef34f470aeb5118195c731324c
SHA25645c33bd71b10c7b6ccc4ea712eac64993e3b5fb907fe210d4ebacd3c2e320ac1
SHA5123b5760bfb04cf1e3b3ddfc07aeef3dde53bf849601958d8d42b49edf88eaa09c106e47c691d71f31743b33f0067cd2296c38edfbaaef3c548ec6f3dacfeb73b2
-
C:\Users\Admin\AppData\Roaming\hhkh.exeFilesize
500.0MB
MD565401fd8ceadff6d78f5484255fa1b35
SHA1df03cee3ff44dbef34f470aeb5118195c731324c
SHA25645c33bd71b10c7b6ccc4ea712eac64993e3b5fb907fe210d4ebacd3c2e320ac1
SHA5123b5760bfb04cf1e3b3ddfc07aeef3dde53bf849601958d8d42b49edf88eaa09c106e47c691d71f31743b33f0067cd2296c38edfbaaef3c548ec6f3dacfeb73b2
-
C:\Users\Admin\AppData\Roaming\hhkh.exeFilesize
500.0MB
MD565401fd8ceadff6d78f5484255fa1b35
SHA1df03cee3ff44dbef34f470aeb5118195c731324c
SHA25645c33bd71b10c7b6ccc4ea712eac64993e3b5fb907fe210d4ebacd3c2e320ac1
SHA5123b5760bfb04cf1e3b3ddfc07aeef3dde53bf849601958d8d42b49edf88eaa09c106e47c691d71f31743b33f0067cd2296c38edfbaaef3c548ec6f3dacfeb73b2
-
C:\Users\Admin\AppData\Roaming\hhkh.exeFilesize
500.0MB
MD565401fd8ceadff6d78f5484255fa1b35
SHA1df03cee3ff44dbef34f470aeb5118195c731324c
SHA25645c33bd71b10c7b6ccc4ea712eac64993e3b5fb907fe210d4ebacd3c2e320ac1
SHA5123b5760bfb04cf1e3b3ddfc07aeef3dde53bf849601958d8d42b49edf88eaa09c106e47c691d71f31743b33f0067cd2296c38edfbaaef3c548ec6f3dacfeb73b2
-
C:\Users\Admin\AppData\Roaming\hhkh.exeFilesize
500.0MB
MD565401fd8ceadff6d78f5484255fa1b35
SHA1df03cee3ff44dbef34f470aeb5118195c731324c
SHA25645c33bd71b10c7b6ccc4ea712eac64993e3b5fb907fe210d4ebacd3c2e320ac1
SHA5123b5760bfb04cf1e3b3ddfc07aeef3dde53bf849601958d8d42b49edf88eaa09c106e47c691d71f31743b33f0067cd2296c38edfbaaef3c548ec6f3dacfeb73b2
-
memory/60-682-0x0000000000000000-mapping.dmp
-
memory/756-855-0x000000000041E792-mapping.dmp
-
memory/860-397-0x000000000041E792-mapping.dmp
-
memory/940-180-0x0000000000000000-mapping.dmp
-
memory/940-184-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/940-182-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1180-517-0x0000000000000000-mapping.dmp
-
memory/1364-516-0x0000000000000000-mapping.dmp
-
memory/1380-377-0x0000000000000000-mapping.dmp
-
memory/1740-823-0x0000000000000000-mapping.dmp
-
memory/1812-835-0x0000000000000000-mapping.dmp
-
memory/2704-152-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-162-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-137-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-138-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-139-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-140-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-141-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-142-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-143-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-144-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-145-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-146-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-147-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-148-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-149-0x00000000001B0000-0x0000000000202000-memory.dmpFilesize
328KB
-
memory/2704-150-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-151-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-116-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-153-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-154-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-155-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-156-0x0000000004A00000-0x0000000004A66000-memory.dmpFilesize
408KB
-
memory/2704-157-0x00000000051B0000-0x00000000056AE000-memory.dmpFilesize
5.0MB
-
memory/2704-158-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-159-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-160-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-161-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-136-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-163-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-135-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-134-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-133-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-132-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-117-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-131-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-170-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-118-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-130-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-119-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-120-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-129-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-128-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-127-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-126-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-125-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-124-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-123-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-122-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2704-121-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2896-821-0x0000000000000000-mapping.dmp
-
memory/2948-669-0x0000000000000000-mapping.dmp
-
memory/3220-703-0x000000000041E792-mapping.dmp
-
memory/4416-364-0x0000000000000000-mapping.dmp
-
memory/4600-365-0x0000000000000000-mapping.dmp
-
memory/4604-671-0x0000000000000000-mapping.dmp
-
memory/4664-298-0x00000000068F0000-0x00000000068FE000-memory.dmpFilesize
56KB
-
memory/4664-302-0x0000000006940000-0x000000000694E000-memory.dmpFilesize
56KB
-
memory/4664-284-0x0000000005FE0000-0x0000000005FFE000-memory.dmpFilesize
120KB
-
memory/4664-286-0x0000000006210000-0x000000000621A000-memory.dmpFilesize
40KB
-
memory/4664-293-0x0000000006870000-0x000000000687C000-memory.dmpFilesize
48KB
-
memory/4664-294-0x0000000006880000-0x000000000689A000-memory.dmpFilesize
104KB
-
memory/4664-295-0x00000000068B0000-0x00000000068BE000-memory.dmpFilesize
56KB
-
memory/4664-296-0x00000000068D0000-0x00000000068E2000-memory.dmpFilesize
72KB
-
memory/4664-297-0x00000000068E0000-0x00000000068EC000-memory.dmpFilesize
48KB
-
memory/4664-299-0x0000000006900000-0x0000000006914000-memory.dmpFilesize
80KB
-
memory/4664-275-0x0000000005340000-0x000000000534A000-memory.dmpFilesize
40KB
-
memory/4664-300-0x0000000006910000-0x0000000006920000-memory.dmpFilesize
64KB
-
memory/4664-301-0x0000000006920000-0x0000000006934000-memory.dmpFilesize
80KB
-
memory/4664-191-0x000000000041E792-mapping.dmp
-
memory/4664-303-0x0000000006950000-0x000000000697E000-memory.dmpFilesize
184KB
-
memory/4664-304-0x0000000006990000-0x00000000069A4000-memory.dmpFilesize
80KB
-
memory/4664-267-0x0000000005410000-0x00000000054AC000-memory.dmpFilesize
624KB
-
memory/4664-265-0x0000000005370000-0x0000000005402000-memory.dmpFilesize
584KB
-
memory/4664-263-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4664-282-0x0000000005850000-0x000000000585A000-memory.dmpFilesize
40KB
-
memory/4704-164-0x0000000000000000-mapping.dmp
-
memory/4704-173-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4704-165-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4704-171-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4704-168-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4704-175-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4764-169-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4764-185-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4764-178-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4764-177-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4764-176-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4764-179-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4764-174-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4764-172-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4764-167-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4764-183-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4764-181-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/4764-166-0x0000000000000000-mapping.dmp
-
memory/4788-550-0x000000000041E792-mapping.dmp
-
memory/4824-529-0x0000000000000000-mapping.dmp