Analysis
-
max time kernel
144s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 14:39
Static task
static1
Behavioral task
behavioral1
Sample
NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe
Resource
win7-20220812-en
General
-
Target
NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe
-
Size
1022KB
-
MD5
bb240dcac9cb0b5082636d9d98f79459
-
SHA1
2965a18059dc4f5f69d9e48023637ea6984ac595
-
SHA256
aae20c0fbcbb6a459929a9ebf3a27bb72064df5123db3d8a78b4087c0a0648fc
-
SHA512
daa42a06b4cbece9e56590f5b0b47f15fd1518ca44b08e1783fcec5d9ae112ba076e1bad6ee3be199577abc77fd3ac263c1e3327a99a471644b1b44b9403b2e0
-
SSDEEP
24576:+RUr+UZtr4OVMbDmWZyycNj5bj6vpFAtQy4A:BXt9IiykMvpIX
Malware Config
Extracted
asyncrat
0.5.7B
BOYS
asyncat.duckdns.org:6565
AsyncMutex_6SI8OkPnk
-
delay
5
-
install
true
-
install_file
APE.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1224-70-0x0000000000400000-0x000000000043C000-memory.dmp asyncrat behavioral1/memory/1224-72-0x0000000000400000-0x000000000043C000-memory.dmp asyncrat behavioral1/memory/1224-73-0x0000000000400000-0x000000000043C000-memory.dmp asyncrat behavioral1/memory/1224-74-0x000000000040D08E-mapping.dmp asyncrat behavioral1/memory/1224-76-0x0000000000400000-0x000000000043C000-memory.dmp asyncrat behavioral1/memory/1224-78-0x0000000000400000-0x000000000043C000-memory.dmp asyncrat behavioral1/memory/428-113-0x000000000040D08E-mapping.dmp asyncrat -
Executes dropped EXE 2 IoCs
Processes:
APE.exeAPE.exepid process 984 APE.exe 428 APE.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 284 cmd.exe 284 cmd.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
NEW PURCHASE ORDER EXP0028433 SCAN DOC.exeAPE.exedescription pid process target process PID 1976 set thread context of 1224 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe PID 984 set thread context of 428 984 APE.exe APE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1716 schtasks.exe 1144 schtasks.exe 1988 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1532 timeout.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
NEW PURCHASE ORDER EXP0028433 SCAN DOC.exeNEW PURCHASE ORDER EXP0028433 SCAN DOC.exepowershell.exepowershell.exeAPE.exepowershell.exepowershell.exepid process 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe 1224 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe 936 powershell.exe 1032 powershell.exe 984 APE.exe 1736 powershell.exe 1964 powershell.exe 984 APE.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
NEW PURCHASE ORDER EXP0028433 SCAN DOC.exeNEW PURCHASE ORDER EXP0028433 SCAN DOC.exepowershell.exepowershell.exeAPE.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe Token: SeDebugPrivilege 1224 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe Token: SeDebugPrivilege 936 powershell.exe Token: SeDebugPrivilege 1032 powershell.exe Token: SeDebugPrivilege 984 APE.exe Token: SeDebugPrivilege 1736 powershell.exe Token: SeDebugPrivilege 1964 powershell.exe -
Suspicious use of WriteProcessMemory 62 IoCs
Processes:
NEW PURCHASE ORDER EXP0028433 SCAN DOC.exeNEW PURCHASE ORDER EXP0028433 SCAN DOC.execmd.execmd.exeAPE.exedescription pid process target process PID 1976 wrote to memory of 936 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe powershell.exe PID 1976 wrote to memory of 936 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe powershell.exe PID 1976 wrote to memory of 936 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe powershell.exe PID 1976 wrote to memory of 936 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe powershell.exe PID 1976 wrote to memory of 1032 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe powershell.exe PID 1976 wrote to memory of 1032 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe powershell.exe PID 1976 wrote to memory of 1032 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe powershell.exe PID 1976 wrote to memory of 1032 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe powershell.exe PID 1976 wrote to memory of 1716 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe schtasks.exe PID 1976 wrote to memory of 1716 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe schtasks.exe PID 1976 wrote to memory of 1716 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe schtasks.exe PID 1976 wrote to memory of 1716 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe schtasks.exe PID 1976 wrote to memory of 1224 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe PID 1976 wrote to memory of 1224 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe PID 1976 wrote to memory of 1224 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe PID 1976 wrote to memory of 1224 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe PID 1976 wrote to memory of 1224 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe PID 1976 wrote to memory of 1224 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe PID 1976 wrote to memory of 1224 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe PID 1976 wrote to memory of 1224 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe PID 1976 wrote to memory of 1224 1976 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe PID 1224 wrote to memory of 1160 1224 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe cmd.exe PID 1224 wrote to memory of 1160 1224 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe cmd.exe PID 1224 wrote to memory of 1160 1224 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe cmd.exe PID 1224 wrote to memory of 1160 1224 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe cmd.exe PID 1224 wrote to memory of 284 1224 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe cmd.exe PID 1224 wrote to memory of 284 1224 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe cmd.exe PID 1224 wrote to memory of 284 1224 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe cmd.exe PID 1224 wrote to memory of 284 1224 NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe cmd.exe PID 1160 wrote to memory of 1144 1160 cmd.exe schtasks.exe PID 1160 wrote to memory of 1144 1160 cmd.exe schtasks.exe PID 1160 wrote to memory of 1144 1160 cmd.exe schtasks.exe PID 1160 wrote to memory of 1144 1160 cmd.exe schtasks.exe PID 284 wrote to memory of 1532 284 cmd.exe timeout.exe PID 284 wrote to memory of 1532 284 cmd.exe timeout.exe PID 284 wrote to memory of 1532 284 cmd.exe timeout.exe PID 284 wrote to memory of 1532 284 cmd.exe timeout.exe PID 284 wrote to memory of 984 284 cmd.exe APE.exe PID 284 wrote to memory of 984 284 cmd.exe APE.exe PID 284 wrote to memory of 984 284 cmd.exe APE.exe PID 284 wrote to memory of 984 284 cmd.exe APE.exe PID 984 wrote to memory of 1736 984 APE.exe powershell.exe PID 984 wrote to memory of 1736 984 APE.exe powershell.exe PID 984 wrote to memory of 1736 984 APE.exe powershell.exe PID 984 wrote to memory of 1736 984 APE.exe powershell.exe PID 984 wrote to memory of 1964 984 APE.exe powershell.exe PID 984 wrote to memory of 1964 984 APE.exe powershell.exe PID 984 wrote to memory of 1964 984 APE.exe powershell.exe PID 984 wrote to memory of 1964 984 APE.exe powershell.exe PID 984 wrote to memory of 1988 984 APE.exe schtasks.exe PID 984 wrote to memory of 1988 984 APE.exe schtasks.exe PID 984 wrote to memory of 1988 984 APE.exe schtasks.exe PID 984 wrote to memory of 1988 984 APE.exe schtasks.exe PID 984 wrote to memory of 428 984 APE.exe APE.exe PID 984 wrote to memory of 428 984 APE.exe APE.exe PID 984 wrote to memory of 428 984 APE.exe APE.exe PID 984 wrote to memory of 428 984 APE.exe APE.exe PID 984 wrote to memory of 428 984 APE.exe APE.exe PID 984 wrote to memory of 428 984 APE.exe APE.exe PID 984 wrote to memory of 428 984 APE.exe APE.exe PID 984 wrote to memory of 428 984 APE.exe APE.exe PID 984 wrote to memory of 428 984 APE.exe APE.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DcIkTNXwIeBW.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DcIkTNXwIeBW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7984.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER EXP0028433 SCAN DOC.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "APE" /tr '"C:\Users\Admin\AppData\Roaming\APE.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "APE" /tr '"C:\Users\Admin\AppData\Roaming\APE.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpBF89.tmp.bat""3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\APE.exe"C:\Users\Admin\AppData\Roaming\APE.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\APE.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DcIkTNXwIeBW.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DcIkTNXwIeBW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7A30.tmp"5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\APE.exe"C:\Users\Admin\AppData\Roaming\APE.exe"5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp7984.tmpFilesize
1KB
MD50914e09f383d0e80b2e4a0e3c2d34afe
SHA12332093330f84475c8d72d091e748f85f6547aa0
SHA2561dd5ffaacac7750452e008a97e91a3065e6967e0f30b424c84b5244df5a21969
SHA512d97f7f29cb3249a2db6785cb473b77673b7ec17efa32b1d4f1bab560095192c16ae2c8186e238385cc34894536e30e432e988e767110e1941d68249b013e5906
-
C:\Users\Admin\AppData\Local\Temp\tmp7A30.tmpFilesize
1KB
MD50914e09f383d0e80b2e4a0e3c2d34afe
SHA12332093330f84475c8d72d091e748f85f6547aa0
SHA2561dd5ffaacac7750452e008a97e91a3065e6967e0f30b424c84b5244df5a21969
SHA512d97f7f29cb3249a2db6785cb473b77673b7ec17efa32b1d4f1bab560095192c16ae2c8186e238385cc34894536e30e432e988e767110e1941d68249b013e5906
-
C:\Users\Admin\AppData\Local\Temp\tmpBF89.tmp.batFilesize
147B
MD5a40e7e3ffce22fd521e0073beaf7bd92
SHA1becb159e260488abf0d1300b7def619d9ad01efa
SHA256fbf034e021f9d6a9b3b92cd4c60cd85edbcdfcb9a57aab72bdc3aaae5861e981
SHA512a0779ca1724c219812e2dd9dc85c6909e5d8f54fd217edaced460dbf2b3c396fccdc84c41989548a2b76e0dadfd38b315daa25a2fb577dcc9e9570000bcf463d
-
C:\Users\Admin\AppData\Roaming\APE.exeFilesize
1022KB
MD5bb240dcac9cb0b5082636d9d98f79459
SHA12965a18059dc4f5f69d9e48023637ea6984ac595
SHA256aae20c0fbcbb6a459929a9ebf3a27bb72064df5123db3d8a78b4087c0a0648fc
SHA512daa42a06b4cbece9e56590f5b0b47f15fd1518ca44b08e1783fcec5d9ae112ba076e1bad6ee3be199577abc77fd3ac263c1e3327a99a471644b1b44b9403b2e0
-
C:\Users\Admin\AppData\Roaming\APE.exeFilesize
1022KB
MD5bb240dcac9cb0b5082636d9d98f79459
SHA12965a18059dc4f5f69d9e48023637ea6984ac595
SHA256aae20c0fbcbb6a459929a9ebf3a27bb72064df5123db3d8a78b4087c0a0648fc
SHA512daa42a06b4cbece9e56590f5b0b47f15fd1518ca44b08e1783fcec5d9ae112ba076e1bad6ee3be199577abc77fd3ac263c1e3327a99a471644b1b44b9403b2e0
-
C:\Users\Admin\AppData\Roaming\APE.exeFilesize
1022KB
MD5bb240dcac9cb0b5082636d9d98f79459
SHA12965a18059dc4f5f69d9e48023637ea6984ac595
SHA256aae20c0fbcbb6a459929a9ebf3a27bb72064df5123db3d8a78b4087c0a0648fc
SHA512daa42a06b4cbece9e56590f5b0b47f15fd1518ca44b08e1783fcec5d9ae112ba076e1bad6ee3be199577abc77fd3ac263c1e3327a99a471644b1b44b9403b2e0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5eeb5c93e68cd50bcd67322ce92c2605a
SHA15b92d6cd531ca533693baf90c176a2949dbde597
SHA2566bc533c4a7d844b284bc0e980bf3d7907c5e5c46a4f56b6a289f1752da66e63b
SHA5129d5e78d06f30e0c74f26fa271edd50316c85c705aa9794b63411f4f6a4b07c47b44d46067957973a65e77cc855c52227f5260b3b1e503d04446d8354569312c7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5eeb5c93e68cd50bcd67322ce92c2605a
SHA15b92d6cd531ca533693baf90c176a2949dbde597
SHA2566bc533c4a7d844b284bc0e980bf3d7907c5e5c46a4f56b6a289f1752da66e63b
SHA5129d5e78d06f30e0c74f26fa271edd50316c85c705aa9794b63411f4f6a4b07c47b44d46067957973a65e77cc855c52227f5260b3b1e503d04446d8354569312c7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5eeb5c93e68cd50bcd67322ce92c2605a
SHA15b92d6cd531ca533693baf90c176a2949dbde597
SHA2566bc533c4a7d844b284bc0e980bf3d7907c5e5c46a4f56b6a289f1752da66e63b
SHA5129d5e78d06f30e0c74f26fa271edd50316c85c705aa9794b63411f4f6a4b07c47b44d46067957973a65e77cc855c52227f5260b3b1e503d04446d8354569312c7
-
\Users\Admin\AppData\Roaming\APE.exeFilesize
1022KB
MD5bb240dcac9cb0b5082636d9d98f79459
SHA12965a18059dc4f5f69d9e48023637ea6984ac595
SHA256aae20c0fbcbb6a459929a9ebf3a27bb72064df5123db3d8a78b4087c0a0648fc
SHA512daa42a06b4cbece9e56590f5b0b47f15fd1518ca44b08e1783fcec5d9ae112ba076e1bad6ee3be199577abc77fd3ac263c1e3327a99a471644b1b44b9403b2e0
-
\Users\Admin\AppData\Roaming\APE.exeFilesize
1022KB
MD5bb240dcac9cb0b5082636d9d98f79459
SHA12965a18059dc4f5f69d9e48023637ea6984ac595
SHA256aae20c0fbcbb6a459929a9ebf3a27bb72064df5123db3d8a78b4087c0a0648fc
SHA512daa42a06b4cbece9e56590f5b0b47f15fd1518ca44b08e1783fcec5d9ae112ba076e1bad6ee3be199577abc77fd3ac263c1e3327a99a471644b1b44b9403b2e0
-
memory/284-83-0x0000000000000000-mapping.dmp
-
memory/428-113-0x000000000040D08E-mapping.dmp
-
memory/936-95-0x000000006EE70000-0x000000006F41B000-memory.dmpFilesize
5.7MB
-
memory/936-59-0x0000000000000000-mapping.dmp
-
memory/936-96-0x000000006EE70000-0x000000006F41B000-memory.dmpFilesize
5.7MB
-
memory/936-80-0x000000006EE70000-0x000000006F41B000-memory.dmpFilesize
5.7MB
-
memory/984-90-0x0000000000000000-mapping.dmp
-
memory/984-92-0x00000000001F0000-0x00000000002F4000-memory.dmpFilesize
1.0MB
-
memory/1032-97-0x000000006EE70000-0x000000006F41B000-memory.dmpFilesize
5.7MB
-
memory/1032-94-0x000000006EE70000-0x000000006F41B000-memory.dmpFilesize
5.7MB
-
memory/1032-79-0x000000006EE70000-0x000000006F41B000-memory.dmpFilesize
5.7MB
-
memory/1032-61-0x0000000000000000-mapping.dmp
-
memory/1144-84-0x0000000000000000-mapping.dmp
-
memory/1160-82-0x0000000000000000-mapping.dmp
-
memory/1224-70-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1224-74-0x000000000040D08E-mapping.dmp
-
memory/1224-73-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1224-68-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1224-72-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1224-78-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1224-67-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1224-76-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1532-86-0x0000000000000000-mapping.dmp
-
memory/1716-63-0x0000000000000000-mapping.dmp
-
memory/1736-98-0x0000000000000000-mapping.dmp
-
memory/1736-120-0x0000000070FB0000-0x000000007155B000-memory.dmpFilesize
5.7MB
-
memory/1964-99-0x0000000000000000-mapping.dmp
-
memory/1964-117-0x0000000070FB0000-0x000000007155B000-memory.dmpFilesize
5.7MB
-
memory/1976-54-0x00000000011F0000-0x00000000012F4000-memory.dmpFilesize
1.0MB
-
memory/1976-66-0x0000000001010000-0x000000000104E000-memory.dmpFilesize
248KB
-
memory/1976-58-0x0000000005130000-0x00000000051BA000-memory.dmpFilesize
552KB
-
memory/1976-57-0x00000000005C0000-0x00000000005CC000-memory.dmpFilesize
48KB
-
memory/1976-56-0x0000000000460000-0x000000000047A000-memory.dmpFilesize
104KB
-
memory/1976-55-0x00000000754E1000-0x00000000754E3000-memory.dmpFilesize
8KB
-
memory/1988-100-0x0000000000000000-mapping.dmp