Analysis
-
max time kernel
271s -
max time network
275s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
21-09-2022 22:15
Static task
static1
Behavioral task
behavioral1
Sample
24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
Resource
win10-20220901-en
General
-
Target
24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
-
Size
3.3MB
-
MD5
4d05c920040c671e49187a179033c50b
-
SHA1
387a1318539ff16974c21ed6e78fbcbe8e73e3fa
-
SHA256
24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a
-
SHA512
f86f5a2e11ceed5a212ae1c61d1c1f31d125ee09cd007610db0db0720fedc08d874807defa029136e6c063ab1e03f47b67298d25a827ebe45ce7f774e5c79849
-
SSDEEP
49152:Duvjict75qI24MnFmAhxC5fGQRbZtU4axGtOEdzx5onb5EnWcq3jAvKUYgeGc:Duvjict4nFLxafGQNTUNxNMLoVtcWdP
Malware Config
Extracted
eternity
-
payload_urls
http://178.20.44.214/edgedownload.exe
http://178.20.44.214/a.exe
Signatures
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
a.exeOneDrivex.exepid process 5012 a.exe 2232 OneDrivex.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrivex = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrivex.exe" reg.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exea.exeOneDrivex.exepid process 4940 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe 4940 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe 5012 a.exe 5012 a.exe 2232 OneDrivex.exe 2232 OneDrivex.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exeOneDrivex.exedescription pid process target process PID 4940 set thread context of 4232 4940 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe InstallUtil.exe PID 2232 set thread context of 4500 2232 OneDrivex.exe AddInProcess32.exe -
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 1200 PING.EXE 2572 PING.EXE 4600 PING.EXE -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exea.exeOneDrivex.exepid process 4940 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe 4940 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe 4940 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe 5012 a.exe 5012 a.exe 5012 a.exe 5012 a.exe 5012 a.exe 5012 a.exe 5012 a.exe 5012 a.exe 5012 a.exe 5012 a.exe 5012 a.exe 5012 a.exe 5012 a.exe 5012 a.exe 5012 a.exe 5012 a.exe 5012 a.exe 5012 a.exe 2232 OneDrivex.exe 2232 OneDrivex.exe 2232 OneDrivex.exe 2232 OneDrivex.exe 2232 OneDrivex.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exeInstallUtil.exea.exeOneDrivex.exedescription pid process Token: SeDebugPrivilege 4940 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe Token: SeDebugPrivilege 4232 InstallUtil.exe Token: SeDebugPrivilege 5012 a.exe Token: SeDebugPrivilege 2232 OneDrivex.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exeInstallUtil.exea.execmd.execmd.exeOneDrivex.exedescription pid process target process PID 4940 wrote to memory of 4232 4940 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe InstallUtil.exe PID 4940 wrote to memory of 4232 4940 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe InstallUtil.exe PID 4940 wrote to memory of 4232 4940 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe InstallUtil.exe PID 4940 wrote to memory of 4232 4940 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe InstallUtil.exe PID 4940 wrote to memory of 4232 4940 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe InstallUtil.exe PID 4940 wrote to memory of 4232 4940 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe InstallUtil.exe PID 4940 wrote to memory of 4232 4940 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe InstallUtil.exe PID 4940 wrote to memory of 4232 4940 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe InstallUtil.exe PID 4232 wrote to memory of 5012 4232 InstallUtil.exe a.exe PID 4232 wrote to memory of 5012 4232 InstallUtil.exe a.exe PID 4232 wrote to memory of 5012 4232 InstallUtil.exe a.exe PID 5012 wrote to memory of 384 5012 a.exe cmd.exe PID 5012 wrote to memory of 384 5012 a.exe cmd.exe PID 5012 wrote to memory of 384 5012 a.exe cmd.exe PID 384 wrote to memory of 1200 384 cmd.exe PING.EXE PID 384 wrote to memory of 1200 384 cmd.exe PING.EXE PID 384 wrote to memory of 1200 384 cmd.exe PING.EXE PID 5012 wrote to memory of 1352 5012 a.exe cmd.exe PID 5012 wrote to memory of 1352 5012 a.exe cmd.exe PID 5012 wrote to memory of 1352 5012 a.exe cmd.exe PID 1352 wrote to memory of 2572 1352 cmd.exe PING.EXE PID 1352 wrote to memory of 2572 1352 cmd.exe PING.EXE PID 1352 wrote to memory of 2572 1352 cmd.exe PING.EXE PID 384 wrote to memory of 372 384 cmd.exe reg.exe PID 384 wrote to memory of 372 384 cmd.exe reg.exe PID 384 wrote to memory of 372 384 cmd.exe reg.exe PID 1352 wrote to memory of 4600 1352 cmd.exe PING.EXE PID 1352 wrote to memory of 4600 1352 cmd.exe PING.EXE PID 1352 wrote to memory of 4600 1352 cmd.exe PING.EXE PID 1352 wrote to memory of 2232 1352 cmd.exe OneDrivex.exe PID 1352 wrote to memory of 2232 1352 cmd.exe OneDrivex.exe PID 1352 wrote to memory of 2232 1352 cmd.exe OneDrivex.exe PID 2232 wrote to memory of 4484 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4484 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4484 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4484 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4484 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4484 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4484 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4484 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4484 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4484 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4500 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4500 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4500 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4500 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4500 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4500 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4500 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4500 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4500 2232 OneDrivex.exe AddInProcess32.exe PID 2232 wrote to memory of 4500 2232 OneDrivex.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe"C:\Users\Admin\AppData\Local\Temp\24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a.exe"C:\Users\Admin\AppData\Local\Temp\a.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 17 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "OneDrivex" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\OneDrivex.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 175⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "OneDrivex" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\OneDrivex.exe"5⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 20 > nul && copy "C:\Users\Admin\AppData\Local\Temp\a.exe" "C:\Users\Admin\AppData\Local\Microsoft\OneDrivex.exe" && ping 127.0.0.1 -n 20 > nul && "C:\Users\Admin\AppData\Local\Microsoft\OneDrivex.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 205⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 205⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrivex.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrivex.exe"5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrivex.exeFilesize
1.9MB
MD56ed2820a8cb483cf87846d4252ebb7f8
SHA19aa1b510dbf7e156b2ba47eea214172bd771ef47
SHA256fdf9b44f84e948dcdbfcaaee755d2a8e3768ffc2dbb23fe9352b1d92cf0891f1
SHA512e977e4955a2551600bef095d7c06701d87472e08f6812f51c83e5213060c7dfadae16c13cca7a1bf08d4dd1b87da1aa6a6a154c6384e4ec842902d25037c2b74
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrivex.exeFilesize
1.9MB
MD56ed2820a8cb483cf87846d4252ebb7f8
SHA19aa1b510dbf7e156b2ba47eea214172bd771ef47
SHA256fdf9b44f84e948dcdbfcaaee755d2a8e3768ffc2dbb23fe9352b1d92cf0891f1
SHA512e977e4955a2551600bef095d7c06701d87472e08f6812f51c83e5213060c7dfadae16c13cca7a1bf08d4dd1b87da1aa6a6a154c6384e4ec842902d25037c2b74
-
C:\Users\Admin\AppData\Local\Temp\a.exeFilesize
1.9MB
MD56ed2820a8cb483cf87846d4252ebb7f8
SHA19aa1b510dbf7e156b2ba47eea214172bd771ef47
SHA256fdf9b44f84e948dcdbfcaaee755d2a8e3768ffc2dbb23fe9352b1d92cf0891f1
SHA512e977e4955a2551600bef095d7c06701d87472e08f6812f51c83e5213060c7dfadae16c13cca7a1bf08d4dd1b87da1aa6a6a154c6384e4ec842902d25037c2b74
-
C:\Users\Admin\AppData\Local\Temp\a.exeFilesize
1.9MB
MD56ed2820a8cb483cf87846d4252ebb7f8
SHA19aa1b510dbf7e156b2ba47eea214172bd771ef47
SHA256fdf9b44f84e948dcdbfcaaee755d2a8e3768ffc2dbb23fe9352b1d92cf0891f1
SHA512e977e4955a2551600bef095d7c06701d87472e08f6812f51c83e5213060c7dfadae16c13cca7a1bf08d4dd1b87da1aa6a6a154c6384e4ec842902d25037c2b74
-
memory/372-461-0x0000000000000000-mapping.dmp
-
memory/384-391-0x0000000000000000-mapping.dmp
-
memory/1200-398-0x0000000000000000-mapping.dmp
-
memory/1352-432-0x0000000000000000-mapping.dmp
-
memory/2232-575-0x0000000005890000-0x0000000005BE0000-memory.dmpFilesize
3.3MB
-
memory/2232-545-0x0000000001390000-0x000000000166A000-memory.dmpFilesize
2.9MB
-
memory/2232-508-0x0000000000000000-mapping.dmp
-
memory/2572-439-0x0000000000000000-mapping.dmp
-
memory/4232-427-0x0000000006450000-0x00000000064CA000-memory.dmpFilesize
488KB
-
memory/4232-425-0x0000000006280000-0x000000000629A000-memory.dmpFilesize
104KB
-
memory/4232-424-0x0000000006150000-0x0000000006272000-memory.dmpFilesize
1.1MB
-
memory/4232-423-0x0000000007A40000-0x0000000007B8A000-memory.dmpFilesize
1.3MB
-
memory/4232-417-0x0000000007980000-0x00000000079D0000-memory.dmpFilesize
320KB
-
memory/4232-222-0x000000000054C1BE-mapping.dmp
-
memory/4232-254-0x0000000000400000-0x0000000000552000-memory.dmpFilesize
1.3MB
-
memory/4500-604-0x0000000000414500-mapping.dmp
-
memory/4500-653-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4600-485-0x0000000000000000-mapping.dmp
-
memory/4940-145-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-183-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-144-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-120-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-146-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-147-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-148-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-149-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-150-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-151-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-152-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-153-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-154-0x0000000001210000-0x00000000019DC000-memory.dmpFilesize
7.8MB
-
memory/4940-155-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-156-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-157-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-160-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-161-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-162-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-163-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-164-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-165-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-166-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-167-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-168-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-169-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-170-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-171-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-172-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-173-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-174-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-175-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-176-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-177-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-178-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-179-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-180-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-181-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-182-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-143-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-184-0x00000000051C0000-0x000000000525C000-memory.dmpFilesize
624KB
-
memory/4940-186-0x0000000005260000-0x00000000052F2000-memory.dmpFilesize
584KB
-
memory/4940-185-0x0000000005760000-0x0000000005C5E000-memory.dmpFilesize
5.0MB
-
memory/4940-188-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-187-0x0000000005300000-0x0000000005650000-memory.dmpFilesize
3.3MB
-
memory/4940-189-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-190-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-208-0x00000000063D0000-0x00000000065EE000-memory.dmpFilesize
2.1MB
-
memory/4940-209-0x00000000011D0000-0x0000000001204000-memory.dmpFilesize
208KB
-
memory/4940-212-0x0000000005740000-0x000000000574A000-memory.dmpFilesize
40KB
-
memory/4940-216-0x0000000007120000-0x0000000007138000-memory.dmpFilesize
96KB
-
memory/4940-219-0x00000000075D0000-0x00000000075EA000-memory.dmpFilesize
104KB
-
memory/4940-220-0x0000000008AB0000-0x0000000008AB6000-memory.dmpFilesize
24KB
-
memory/4940-142-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-141-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-121-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-140-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-139-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-122-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-123-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-124-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-125-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-138-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-137-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-136-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-135-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-134-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-133-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-132-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-131-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-130-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-129-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-128-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-127-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/4940-126-0x0000000077D50000-0x0000000077EDE000-memory.dmpFilesize
1.6MB
-
memory/5012-384-0x0000000006940000-0x0000000006974000-memory.dmpFilesize
208KB
-
memory/5012-383-0x00000000068E0000-0x000000000693C000-memory.dmpFilesize
368KB
-
memory/5012-362-0x0000000005620000-0x0000000005970000-memory.dmpFilesize
3.3MB
-
memory/5012-332-0x0000000000A00000-0x0000000000CDA000-memory.dmpFilesize
2.9MB
-
memory/5012-295-0x0000000000000000-mapping.dmp