Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
19-09-2022 08:59
Static task
static1
Behavioral task
behavioral1
Sample
492bfe8d2b1105ec4045f96913d38f98e30fe349ea50cc4aaa425ca289af2852.exe
Resource
win10-20220901-en
General
-
Target
492bfe8d2b1105ec4045f96913d38f98e30fe349ea50cc4aaa425ca289af2852.exe
-
Size
967KB
-
MD5
37840d4e937db0385b820d4019071540
-
SHA1
a1f7670cd7da7e331db2d69f0855858985819873
-
SHA256
492bfe8d2b1105ec4045f96913d38f98e30fe349ea50cc4aaa425ca289af2852
-
SHA512
4a77875a5f9b9066ca6f88ad1ea7c259bb690e3b2c240a3de61081c01f06d87a1cae261b236c7a8b0c7261399a06e1ff3cbbdeb1ca1ee5b732350143eafb51a6
-
SSDEEP
12288:8HbINWvoTEQYJGl/iUfkcogKuqAJA+1z48qDo5ynuzFl2LUv0eMqnexYA1l/X:6b6ZeGBiAkcogKOi+1zSo5ynRxYA7/X
Malware Config
Extracted
formbook
od65
oMDl7+9m1JtQ+KJ//bSZYk7C
0nQRVuikEsWM9KcRhRk=
VXATJsbZt/OyEi6Z0Y9m9O4=
C8ZitXuEXIk613jZWQ==
4IIRKYI2mygmEr7EUhOuiEZ1ux4c
x3mNjz4y4M20lnKM1I9m9O4=
UGB//3QuqmDHeDQ=
2H5k5/UwHEwPv2G+Sg==
xHh+uLvyCnZdPo0YXdyEe+ZowQ==
MMGT27gl8VFJ
pLA/Ve3++kcn1lhn6dDmhI2KGzfKNYU=
Ic/vJ/dG0uDhkYblI6XXFL0SN8cDrZP5
MfKDkw/woqFDCabB0YIs
IsDCzc1GuJOGdqX4CgCAPA==
bROVz2hP/wgV9/eGkw4=
cyM+htBboyUeyj0qbuqNTrhX9gJF/6fx
Q+MDF9cCCn8pkyU5y7fmPwYagMMGB7jx
Ve57nDZMRqeXP+V+0IMu
vmJrjeIXWfXWuZbB0YIs
5qVAfUZyi/sC13jZWQ==
NmiU4T7nYX0x6fJ17a7PmWhcKMo=
kK5LUcCAJDHshaFEyMHsNeY=
lEpmo6kl8VFJ
6ATMHDa/DINAdiQK
jz5XhZL2PduGNO3G1I9m9O4=
mSNB1J9zci/VNA==
kFbzCVDrQfnCIJ3B0YIs
rEbD53hwVJVAdiQK
1/CK163mEa121kAkZ+uepxeS2A==
+7Pf7bMl8VFJ
Yoo5bumqT1JkTAfX7WBW4dS1HxOyQI8=
QvYSNwovL5GCLJ/B0YIs
DbvE7/JDRHtDtMho964n8K+G9kJWDw==
fpYkThtoqmVaQFSr9reCuWNcKMo=
ypArNtTty9bVr5iDvT/krGDY9kJWDw==
oFxwvv960JOOdHdKhgQ=
OekWK+T36z8KvvNYc96ZYk7C
ROzyNHcCYAatZ3dKhgQ=
cAilwxjge2RVMvbdayeziEd1ux4c
c5pFdQLkm5KCMzKO49KFe+ZowQ==
LuQJSmTNDa1hy15zb+1raE/K
bxgjYmy721xxWu/EFcdnbnHY9kJWDw==
SuTqDReY670tjxIYK5+sMOUCacI=
ikDS/oh6ci/VNA==
APP7L4APbAOuA6cRhRk=
LtQACYFEwW7ukPnIHwY=
D0VpdXnS6WYQzOOBlUqz6ug=
9g+Y3/JjpTAsDKrB0YIs
/axBa+KWIAOmGivACgCAPA==
UBIsXW3MBoBAdiQK
JMsqt8+XMzPjTjN/hgCSk0jds3MDrZP5
fDKszl1ICyHbOCiN0Y9m9O4=
bngDHcvMrfbGNBW18oQ7
aAoYNzuo+6ZRAfeGkw4=
Rf0SWbRc1Icx4Zl0jA1CikZ1ux4c
43KMu4R9ci/VNA==
lMRjo4rXA5deyks2gPZiM/dxds4DrZP5
x2nqBJyXVVxmFhevNe14e+ZowQ==
LNJ8gpABQ9bxzxCc6KeZYk7C
IbZEawkiHmMnmHva+XQW2pMWZojCvPsrJw==
i7hBQNDFgYWGOjfCCgCAPA==
7pQtM3QdlFocB6OSRA==
WWV4rPrDeouLe0TUUw==
fgckl1Utr2DHeDQ=
astrobudka.net
Extracted
xloader
3.8
od65
oMDl7+9m1JtQ+KJ//bSZYk7C
0nQRVuikEsWM9KcRhRk=
VXATJsbZt/OyEi6Z0Y9m9O4=
C8ZitXuEXIk613jZWQ==
4IIRKYI2mygmEr7EUhOuiEZ1ux4c
x3mNjz4y4M20lnKM1I9m9O4=
UGB//3QuqmDHeDQ=
2H5k5/UwHEwPv2G+Sg==
xHh+uLvyCnZdPo0YXdyEe+ZowQ==
MMGT27gl8VFJ
pLA/Ve3++kcn1lhn6dDmhI2KGzfKNYU=
Ic/vJ/dG0uDhkYblI6XXFL0SN8cDrZP5
MfKDkw/woqFDCabB0YIs
IsDCzc1GuJOGdqX4CgCAPA==
bROVz2hP/wgV9/eGkw4=
cyM+htBboyUeyj0qbuqNTrhX9gJF/6fx
Q+MDF9cCCn8pkyU5y7fmPwYagMMGB7jx
Ve57nDZMRqeXP+V+0IMu
vmJrjeIXWfXWuZbB0YIs
5qVAfUZyi/sC13jZWQ==
NmiU4T7nYX0x6fJ17a7PmWhcKMo=
kK5LUcCAJDHshaFEyMHsNeY=
lEpmo6kl8VFJ
6ATMHDa/DINAdiQK
jz5XhZL2PduGNO3G1I9m9O4=
mSNB1J9zci/VNA==
kFbzCVDrQfnCIJ3B0YIs
rEbD53hwVJVAdiQK
1/CK163mEa121kAkZ+uepxeS2A==
+7Pf7bMl8VFJ
Yoo5bumqT1JkTAfX7WBW4dS1HxOyQI8=
QvYSNwovL5GCLJ/B0YIs
DbvE7/JDRHtDtMho964n8K+G9kJWDw==
fpYkThtoqmVaQFSr9reCuWNcKMo=
ypArNtTty9bVr5iDvT/krGDY9kJWDw==
oFxwvv960JOOdHdKhgQ=
OekWK+T36z8KvvNYc96ZYk7C
ROzyNHcCYAatZ3dKhgQ=
cAilwxjge2RVMvbdayeziEd1ux4c
c5pFdQLkm5KCMzKO49KFe+ZowQ==
LuQJSmTNDa1hy15zb+1raE/K
bxgjYmy721xxWu/EFcdnbnHY9kJWDw==
SuTqDReY670tjxIYK5+sMOUCacI=
ikDS/oh6ci/VNA==
APP7L4APbAOuA6cRhRk=
LtQACYFEwW7ukPnIHwY=
D0VpdXnS6WYQzOOBlUqz6ug=
9g+Y3/JjpTAsDKrB0YIs
/axBa+KWIAOmGivACgCAPA==
UBIsXW3MBoBAdiQK
JMsqt8+XMzPjTjN/hgCSk0jds3MDrZP5
fDKszl1ICyHbOCiN0Y9m9O4=
bngDHcvMrfbGNBW18oQ7
aAoYNzuo+6ZRAfeGkw4=
Rf0SWbRc1Icx4Zl0jA1CikZ1ux4c
43KMu4R9ci/VNA==
lMRjo4rXA5deyks2gPZiM/dxds4DrZP5
x2nqBJyXVVxmFhevNe14e+ZowQ==
LNJ8gpABQ9bxzxCc6KeZYk7C
IbZEawkiHmMnmHva+XQW2pMWZojCvPsrJw==
i7hBQNDFgYWGOjfCCgCAPA==
7pQtM3QdlFocB6OSRA==
WWV4rPrDeouLe0TUUw==
fgckl1Utr2DHeDQ=
astrobudka.net
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
492bfe8d2b1105ec4045f96913d38f98e30fe349ea50cc4aaa425ca289af2852.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\Luomrsrj = "C:\\Users\\Public\\Libraries\\jrsrmouL.url" 492bfe8d2b1105ec4045f96913d38f98e30fe349ea50cc4aaa425ca289af2852.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
iexpress.exenetsh.exedescription pid process target process PID 3408 set thread context of 2108 3408 iexpress.exe Explorer.EXE PID 432 set thread context of 2108 432 netsh.exe Explorer.EXE -
Processes:
netsh.exedescription ioc process Key created \Registry\User\S-1-5-21-2368682536-4045190062-1465778271-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 netsh.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
iexpress.exenetsh.exepid process 3408 iexpress.exe 3408 iexpress.exe 3408 iexpress.exe 3408 iexpress.exe 3408 iexpress.exe 3408 iexpress.exe 3408 iexpress.exe 3408 iexpress.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2108 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
iexpress.exenetsh.exepid process 3408 iexpress.exe 3408 iexpress.exe 3408 iexpress.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe 432 netsh.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
iexpress.exeExplorer.EXEnetsh.exedescription pid process Token: SeDebugPrivilege 3408 iexpress.exe Token: SeShutdownPrivilege 2108 Explorer.EXE Token: SeCreatePagefilePrivilege 2108 Explorer.EXE Token: SeShutdownPrivilege 2108 Explorer.EXE Token: SeCreatePagefilePrivilege 2108 Explorer.EXE Token: SeDebugPrivilege 432 netsh.exe Token: SeShutdownPrivilege 2108 Explorer.EXE Token: SeCreatePagefilePrivilege 2108 Explorer.EXE Token: SeShutdownPrivilege 2108 Explorer.EXE Token: SeCreatePagefilePrivilege 2108 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
492bfe8d2b1105ec4045f96913d38f98e30fe349ea50cc4aaa425ca289af2852.exeExplorer.EXEnetsh.exedescription pid process target process PID 2744 wrote to memory of 3408 2744 492bfe8d2b1105ec4045f96913d38f98e30fe349ea50cc4aaa425ca289af2852.exe iexpress.exe PID 2744 wrote to memory of 3408 2744 492bfe8d2b1105ec4045f96913d38f98e30fe349ea50cc4aaa425ca289af2852.exe iexpress.exe PID 2744 wrote to memory of 3408 2744 492bfe8d2b1105ec4045f96913d38f98e30fe349ea50cc4aaa425ca289af2852.exe iexpress.exe PID 2744 wrote to memory of 3408 2744 492bfe8d2b1105ec4045f96913d38f98e30fe349ea50cc4aaa425ca289af2852.exe iexpress.exe PID 2744 wrote to memory of 3408 2744 492bfe8d2b1105ec4045f96913d38f98e30fe349ea50cc4aaa425ca289af2852.exe iexpress.exe PID 2744 wrote to memory of 3408 2744 492bfe8d2b1105ec4045f96913d38f98e30fe349ea50cc4aaa425ca289af2852.exe iexpress.exe PID 2108 wrote to memory of 432 2108 Explorer.EXE netsh.exe PID 2108 wrote to memory of 432 2108 Explorer.EXE netsh.exe PID 2108 wrote to memory of 432 2108 Explorer.EXE netsh.exe PID 432 wrote to memory of 4556 432 netsh.exe Firefox.exe PID 432 wrote to memory of 4556 432 netsh.exe Firefox.exe PID 432 wrote to memory of 4556 432 netsh.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\492bfe8d2b1105ec4045f96913d38f98e30fe349ea50cc4aaa425ca289af2852.exe"C:\Users\Admin\AppData\Local\Temp\492bfe8d2b1105ec4045f96913d38f98e30fe349ea50cc4aaa425ca289af2852.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\iexpress.exe"C:\Windows\System32\iexpress.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/432-999-0x0000000000900000-0x000000000092D000-memory.dmpFilesize
180KB
-
memory/432-966-0x0000000000000000-mapping.dmp
-
memory/432-984-0x0000000000E80000-0x0000000000E9E000-memory.dmpFilesize
120KB
-
memory/432-985-0x00000000032D0000-0x00000000035F0000-memory.dmpFilesize
3.1MB
-
memory/432-986-0x0000000000900000-0x000000000092D000-memory.dmpFilesize
180KB
-
memory/432-994-0x0000000002EA0000-0x0000000002F2F000-memory.dmpFilesize
572KB
-
memory/2108-1064-0x0000000002E20000-0x0000000002E30000-memory.dmpFilesize
64KB
-
memory/2108-995-0x0000000003350000-0x000000000343E000-memory.dmpFilesize
952KB
-
memory/2108-1063-0x0000000002E20000-0x0000000002E30000-memory.dmpFilesize
64KB
-
memory/2108-1062-0x0000000001530000-0x0000000001540000-memory.dmpFilesize
64KB
-
memory/2108-1061-0x00000000014E0000-0x00000000014F0000-memory.dmpFilesize
64KB
-
memory/2108-1000-0x0000000003350000-0x000000000343E000-memory.dmpFilesize
952KB
-
memory/2108-1065-0x0000000002E20000-0x0000000002E30000-memory.dmpFilesize
64KB
-
memory/2108-998-0x0000000002E20000-0x0000000002E30000-memory.dmpFilesize
64KB
-
memory/2108-997-0x0000000002E20000-0x0000000002E30000-memory.dmpFilesize
64KB
-
memory/2108-996-0x0000000002E20000-0x0000000002E30000-memory.dmpFilesize
64KB
-
memory/2108-1066-0x0000000002E20000-0x0000000002E30000-memory.dmpFilesize
64KB
-
memory/2108-930-0x0000000001560000-0x0000000001622000-memory.dmpFilesize
776KB
-
memory/2108-1067-0x0000000002E20000-0x0000000002E30000-memory.dmpFilesize
64KB
-
memory/2108-1068-0x0000000002E20000-0x0000000002E30000-memory.dmpFilesize
64KB
-
memory/2108-1069-0x0000000002E20000-0x0000000002E30000-memory.dmpFilesize
64KB
-
memory/2108-1070-0x0000000002E20000-0x0000000002E30000-memory.dmpFilesize
64KB
-
memory/2108-965-0x0000000002E20000-0x0000000002E30000-memory.dmpFilesize
64KB
-
memory/2108-964-0x0000000002E20000-0x0000000002E30000-memory.dmpFilesize
64KB
-
memory/2108-963-0x0000000002E20000-0x0000000002E30000-memory.dmpFilesize
64KB
-
memory/2108-962-0x0000000001630000-0x0000000001640000-memory.dmpFilesize
64KB
-
memory/2108-961-0x0000000001530000-0x0000000001540000-memory.dmpFilesize
64KB
-
memory/2108-960-0x00000000014E0000-0x00000000014F0000-memory.dmpFilesize
64KB
-
memory/2744-144-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-183-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-150-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-151-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-152-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-153-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-154-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-156-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-155-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-157-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-158-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-159-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-160-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-161-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-162-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-163-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-164-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-165-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-166-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-167-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-168-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-169-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-171-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-170-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-172-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-173-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-174-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-175-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-176-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-177-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-178-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-179-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-180-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-182-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-181-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-149-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-121-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-122-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-123-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-124-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-125-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-148-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-147-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-146-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-145-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-120-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-143-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-142-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-141-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-126-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-127-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-140-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-139-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-138-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-137-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-135-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-136-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-134-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-133-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-132-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-131-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-130-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-129-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-128-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/3408-982-0x0000000010411000-0x000000001043F000-memory.dmpFilesize
184KB
-
memory/3408-981-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/3408-929-0x0000000003030000-0x000000000317A000-memory.dmpFilesize
1.3MB
-
memory/3408-927-0x0000000004DB0000-0x00000000050D0000-memory.dmpFilesize
3.1MB
-
memory/3408-926-0x0000000010411000-0x000000001043F000-memory.dmpFilesize
184KB
-
memory/3408-925-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/3408-797-0x0000000000000000-mapping.dmp