Analysis
-
max time kernel
167s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 01:23
Static task
static1
Behavioral task
behavioral1
Sample
3a752b259154857581a356054a0c74743dbfad7c25e91a2918218c5fc769d6dc.exe
Resource
win7-20220812-en
General
-
Target
3a752b259154857581a356054a0c74743dbfad7c25e91a2918218c5fc769d6dc.exe
-
Size
581KB
-
MD5
09679326ff2ea958b59e976aece01bfe
-
SHA1
d12176a639d66423f0bec4a632c6250a2008fc7f
-
SHA256
3a752b259154857581a356054a0c74743dbfad7c25e91a2918218c5fc769d6dc
-
SHA512
a6a76a111fe803c60f0e4738c1e9853eecc84a2861c63cfbfd8daaa3daa6fd7ecd1b344cb3679a5d4ea42b67acc2ba342707951d38190270855f1e3f0084119b
-
SSDEEP
12288:BV+mzuIJp1kfgjdkAUKn0jJxRmL3AZTytmw+6WDaz5Z:B87gjTUK0lXms1AjmU5Z
Malware Config
Extracted
cybergate
2.6
VicTiMe
otmansavana.no-ip.info:82
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
systeme.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
123456
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\systeme.exe" 1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\systeme.exe" 1.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 1.exe -
Executes dropped EXE 10 IoCs
Processes:
1.exe1.exe1.exesysteme.exesysteme.exesysteme.exesysteme.exesysteme.exesysteme.exesysteme.exepid process 4928 1.exe 260 1.exe 3100 1.exe 1900 systeme.exe 4808 systeme.exe 4200 systeme.exe 3968 systeme.exe 3484 systeme.exe 2608 systeme.exe 508 systeme.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
1.exe1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4IFLP8OH-UFIV-N0CC-C183-143O533J1533}\StubPath = "C:\\Windows\\install\\systeme.exe" 1.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{4IFLP8OH-UFIV-N0CC-C183-143O533J1533} 1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4IFLP8OH-UFIV-N0CC-C183-143O533J1533}\StubPath = "C:\\Windows\\install\\systeme.exe Restart" 1.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{4IFLP8OH-UFIV-N0CC-C183-143O533J1533} 1.exe -
Processes:
resource yara_rule behavioral2/memory/260-152-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral2/memory/260-156-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/260-160-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral2/memory/260-167-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral2/memory/3100-170-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral2/memory/3100-173-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral2/memory/4808-201-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/3968-204-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/3968-205-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral2/memory/3968-238-0x0000000024080000-0x00000000240E2000-memory.dmp upx -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3a752b259154857581a356054a0c74743dbfad7c25e91a2918218c5fc769d6dc.exe1.exesysteme.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 3a752b259154857581a356054a0c74743dbfad7c25e91a2918218c5fc769d6dc.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 1.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation systeme.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
1.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\install\\systeme.exe" 1.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run 1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\install\\systeme.exe" 1.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
1.exesysteme.exesysteme.exesysteme.exedescription pid process target process PID 4928 set thread context of 260 4928 1.exe 1.exe PID 1900 set thread context of 4808 1900 systeme.exe systeme.exe PID 4200 set thread context of 2608 4200 systeme.exe systeme.exe PID 3484 set thread context of 508 3484 systeme.exe systeme.exe -
Drops file in Windows directory 8 IoCs
Processes:
3a752b259154857581a356054a0c74743dbfad7c25e91a2918218c5fc769d6dc.exe1.exesysteme.exedescription ioc process File created C:\Windows\2.jpg 3a752b259154857581a356054a0c74743dbfad7c25e91a2918218c5fc769d6dc.exe File opened for modification C:\Windows\2.jpg 3a752b259154857581a356054a0c74743dbfad7c25e91a2918218c5fc769d6dc.exe File created C:\Windows\install\systeme.exe 1.exe File opened for modification C:\Windows\install\systeme.exe 1.exe File opened for modification C:\Windows\install\systeme.exe systeme.exe File created C:\Windows\__tmp_rar_sfx_access_check_240582609 3a752b259154857581a356054a0c74743dbfad7c25e91a2918218c5fc769d6dc.exe File created C:\Windows\1.exe 3a752b259154857581a356054a0c74743dbfad7c25e91a2918218c5fc769d6dc.exe File opened for modification C:\Windows\1.exe 3a752b259154857581a356054a0c74743dbfad7c25e91a2918218c5fc769d6dc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
1.exesysteme.exesysteme.exesysteme.exepid process 260 1.exe 260 1.exe 4808 systeme.exe 4808 systeme.exe 2608 systeme.exe 2608 systeme.exe 508 systeme.exe 508 systeme.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
systeme.exepid process 3968 systeme.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
systeme.exedescription pid process Token: SeDebugPrivilege 3968 systeme.exe Token: SeDebugPrivilege 3968 systeme.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
1.exepid process 260 1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3a752b259154857581a356054a0c74743dbfad7c25e91a2918218c5fc769d6dc.exe1.exe1.exedescription pid process target process PID 2448 wrote to memory of 4928 2448 3a752b259154857581a356054a0c74743dbfad7c25e91a2918218c5fc769d6dc.exe 1.exe PID 2448 wrote to memory of 4928 2448 3a752b259154857581a356054a0c74743dbfad7c25e91a2918218c5fc769d6dc.exe 1.exe PID 2448 wrote to memory of 4928 2448 3a752b259154857581a356054a0c74743dbfad7c25e91a2918218c5fc769d6dc.exe 1.exe PID 4928 wrote to memory of 260 4928 1.exe 1.exe PID 4928 wrote to memory of 260 4928 1.exe 1.exe PID 4928 wrote to memory of 260 4928 1.exe 1.exe PID 4928 wrote to memory of 260 4928 1.exe 1.exe PID 4928 wrote to memory of 260 4928 1.exe 1.exe PID 4928 wrote to memory of 260 4928 1.exe 1.exe PID 4928 wrote to memory of 260 4928 1.exe 1.exe PID 4928 wrote to memory of 260 4928 1.exe 1.exe PID 4928 wrote to memory of 260 4928 1.exe 1.exe PID 4928 wrote to memory of 260 4928 1.exe 1.exe PID 4928 wrote to memory of 260 4928 1.exe 1.exe PID 4928 wrote to memory of 260 4928 1.exe 1.exe PID 4928 wrote to memory of 260 4928 1.exe 1.exe PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE PID 260 wrote to memory of 2376 260 1.exe Explorer.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a752b259154857581a356054a0c74743dbfad7c25e91a2918218c5fc769d6dc.exe"C:\Users\Admin\AppData\Local\Temp\3a752b259154857581a356054a0c74743dbfad7c25e91a2918218c5fc769d6dc.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\1.exe"C:\WINDOWS\1.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\1.exeC:\WINDOWS\1.exe3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\explorer.exeexplorer.exe4⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
C:\WINDOWS\1.exe"C:\WINDOWS\1.exe"4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Checks computer location settings
-
C:\Windows\install\systeme.exe"C:\Windows\install\systeme.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\install\systeme.exeC:\Windows\install\systeme.exe6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵
-
C:\Windows\install\systeme.exe"C:\Windows\install\systeme.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\install\systeme.exe"C:\Windows\install\systeme.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\install\systeme.exeC:\Windows\install\systeme.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\install\systeme.exe"C:\Windows\install\systeme.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\install\systeme.exeC:\Windows\install\systeme.exe6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
229KB
MD5233ff210c270a732cd32bfed47df52e7
SHA1b8260e247d77339df8e9b1a6be2c2993a54b94a0
SHA2560ccfa3cfea0fb9ecbe727b17256cfc6b0995be185c938cf8c2ac48db9255bf90
SHA512bc300e7d730c9aeb0f891335a99ec52ed15e35d5c98b64b5ea25b2f239723c8fd655f65bec429e40155f34eaf5a5b35e172af58b0379972bcf3fd53f56ca9c91
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
229KB
MD501be094f48dbd03c5238dfb1e602d968
SHA106b10dc00d9fc7e0b750efc93a973f0dc0786c48
SHA256b63e23b4c413ca67432a8cf8f59b38fb71c7a81199dc466120f2486671c70cb5
SHA512be65d311e697b0574447cea007746a8ebddd06f31389033112a265889e99bbf4eb7454f344a56bb70df9493476de833d41f89650b17d18b6f19aea21c4c3d6f6
-
C:\WINDOWS\1.exeFilesize
274KB
MD55b9d20a91e352414cca0b455fc4d652f
SHA107a9f124fab2b5322ca5bb3f904bce75ff3e0ad2
SHA25690cc1b8a49544568f59b00b9632ce084a26f0cb64797a581bc296c8f998f6e1a
SHA5122727d28c3f2ea7f40f6eba8a75f674986925274a4fb668945262f4251d7a86b6b263403cb58e8b767548aa17585a10f9813a28b2eeeebbf8ae59aa1af4536331
-
C:\Windows\1.exeFilesize
274KB
MD55b9d20a91e352414cca0b455fc4d652f
SHA107a9f124fab2b5322ca5bb3f904bce75ff3e0ad2
SHA25690cc1b8a49544568f59b00b9632ce084a26f0cb64797a581bc296c8f998f6e1a
SHA5122727d28c3f2ea7f40f6eba8a75f674986925274a4fb668945262f4251d7a86b6b263403cb58e8b767548aa17585a10f9813a28b2eeeebbf8ae59aa1af4536331
-
C:\Windows\1.exeFilesize
274KB
MD55b9d20a91e352414cca0b455fc4d652f
SHA107a9f124fab2b5322ca5bb3f904bce75ff3e0ad2
SHA25690cc1b8a49544568f59b00b9632ce084a26f0cb64797a581bc296c8f998f6e1a
SHA5122727d28c3f2ea7f40f6eba8a75f674986925274a4fb668945262f4251d7a86b6b263403cb58e8b767548aa17585a10f9813a28b2eeeebbf8ae59aa1af4536331
-
C:\Windows\1.exeFilesize
274KB
MD55b9d20a91e352414cca0b455fc4d652f
SHA107a9f124fab2b5322ca5bb3f904bce75ff3e0ad2
SHA25690cc1b8a49544568f59b00b9632ce084a26f0cb64797a581bc296c8f998f6e1a
SHA5122727d28c3f2ea7f40f6eba8a75f674986925274a4fb668945262f4251d7a86b6b263403cb58e8b767548aa17585a10f9813a28b2eeeebbf8ae59aa1af4536331
-
C:\Windows\install\systeme.exeFilesize
274KB
MD55b9d20a91e352414cca0b455fc4d652f
SHA107a9f124fab2b5322ca5bb3f904bce75ff3e0ad2
SHA25690cc1b8a49544568f59b00b9632ce084a26f0cb64797a581bc296c8f998f6e1a
SHA5122727d28c3f2ea7f40f6eba8a75f674986925274a4fb668945262f4251d7a86b6b263403cb58e8b767548aa17585a10f9813a28b2eeeebbf8ae59aa1af4536331
-
C:\Windows\install\systeme.exeFilesize
274KB
MD55b9d20a91e352414cca0b455fc4d652f
SHA107a9f124fab2b5322ca5bb3f904bce75ff3e0ad2
SHA25690cc1b8a49544568f59b00b9632ce084a26f0cb64797a581bc296c8f998f6e1a
SHA5122727d28c3f2ea7f40f6eba8a75f674986925274a4fb668945262f4251d7a86b6b263403cb58e8b767548aa17585a10f9813a28b2eeeebbf8ae59aa1af4536331
-
C:\Windows\install\systeme.exeFilesize
274KB
MD55b9d20a91e352414cca0b455fc4d652f
SHA107a9f124fab2b5322ca5bb3f904bce75ff3e0ad2
SHA25690cc1b8a49544568f59b00b9632ce084a26f0cb64797a581bc296c8f998f6e1a
SHA5122727d28c3f2ea7f40f6eba8a75f674986925274a4fb668945262f4251d7a86b6b263403cb58e8b767548aa17585a10f9813a28b2eeeebbf8ae59aa1af4536331
-
C:\Windows\install\systeme.exeFilesize
274KB
MD55b9d20a91e352414cca0b455fc4d652f
SHA107a9f124fab2b5322ca5bb3f904bce75ff3e0ad2
SHA25690cc1b8a49544568f59b00b9632ce084a26f0cb64797a581bc296c8f998f6e1a
SHA5122727d28c3f2ea7f40f6eba8a75f674986925274a4fb668945262f4251d7a86b6b263403cb58e8b767548aa17585a10f9813a28b2eeeebbf8ae59aa1af4536331
-
C:\Windows\install\systeme.exeFilesize
274KB
MD55b9d20a91e352414cca0b455fc4d652f
SHA107a9f124fab2b5322ca5bb3f904bce75ff3e0ad2
SHA25690cc1b8a49544568f59b00b9632ce084a26f0cb64797a581bc296c8f998f6e1a
SHA5122727d28c3f2ea7f40f6eba8a75f674986925274a4fb668945262f4251d7a86b6b263403cb58e8b767548aa17585a10f9813a28b2eeeebbf8ae59aa1af4536331
-
C:\Windows\install\systeme.exeFilesize
274KB
MD55b9d20a91e352414cca0b455fc4d652f
SHA107a9f124fab2b5322ca5bb3f904bce75ff3e0ad2
SHA25690cc1b8a49544568f59b00b9632ce084a26f0cb64797a581bc296c8f998f6e1a
SHA5122727d28c3f2ea7f40f6eba8a75f674986925274a4fb668945262f4251d7a86b6b263403cb58e8b767548aa17585a10f9813a28b2eeeebbf8ae59aa1af4536331
-
C:\Windows\install\systeme.exeFilesize
274KB
MD55b9d20a91e352414cca0b455fc4d652f
SHA107a9f124fab2b5322ca5bb3f904bce75ff3e0ad2
SHA25690cc1b8a49544568f59b00b9632ce084a26f0cb64797a581bc296c8f998f6e1a
SHA5122727d28c3f2ea7f40f6eba8a75f674986925274a4fb668945262f4251d7a86b6b263403cb58e8b767548aa17585a10f9813a28b2eeeebbf8ae59aa1af4536331
-
C:\Windows\install\systeme.exeFilesize
274KB
MD55b9d20a91e352414cca0b455fc4d652f
SHA107a9f124fab2b5322ca5bb3f904bce75ff3e0ad2
SHA25690cc1b8a49544568f59b00b9632ce084a26f0cb64797a581bc296c8f998f6e1a
SHA5122727d28c3f2ea7f40f6eba8a75f674986925274a4fb668945262f4251d7a86b6b263403cb58e8b767548aa17585a10f9813a28b2eeeebbf8ae59aa1af4536331
-
memory/260-148-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/260-139-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/260-152-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/260-156-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/260-160-0x00000000240F0000-0x0000000024152000-memory.dmpFilesize
392KB
-
memory/260-136-0x0000000000000000-mapping.dmp
-
memory/260-138-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/260-144-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/260-167-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/260-141-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/260-150-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/260-145-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/260-143-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/508-224-0x0000000000000000-mapping.dmp
-
memory/1900-176-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/1900-174-0x0000000000000000-mapping.dmp
-
memory/1900-188-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/2608-210-0x0000000000000000-mapping.dmp
-
memory/3100-164-0x0000000000000000-mapping.dmp
-
memory/3100-173-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/3100-170-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/3100-166-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/3484-235-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/3484-209-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/3484-207-0x0000000000000000-mapping.dmp
-
memory/3968-199-0x0000000000000000-mapping.dmp
-
memory/3968-204-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/3968-205-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/3968-238-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/4200-222-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/4200-196-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/4200-191-0x0000000000000000-mapping.dmp
-
memory/4808-190-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/4808-201-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/4808-177-0x0000000000000000-mapping.dmp
-
memory/4928-137-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/4928-132-0x0000000000000000-mapping.dmp
-
memory/4928-135-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/4928-149-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB