Analysis
-
max time kernel
169s -
max time network
75s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
14-10-2022 09:16
Static task
static1
Behavioral task
behavioral1
Sample
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
Resource
win10v2004-20220812-en
General
-
Target
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
-
Size
855KB
-
MD5
6aa1e096f657f2d549e67579d7edb490
-
SHA1
fe36a9211ef9b8c35697c97addccc94a47223d7c
-
SHA256
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250
-
SHA512
746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc
-
SSDEEP
3072:15oQcAV8NrucfhvH8GLx99NhCHBd0vqV7S1zWnyzYmLZds2qHhHTYYzy6aWeTaAF:1uW
Malware Config
Extracted
njrat
0.6.4
HacKed
mochakis.no-ip.biz:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
Trojan.exeTrojan.exeTrojan.exeTrojan.exepid process 1916 Trojan.exe 964 Trojan.exe 1576 Trojan.exe 652 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
Trojan.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe -
Loads dropped DLL 4 IoCs
Processes:
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exeTrojan.exeTrojan.exeTrojan.exepid process 780 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 1916 Trojan.exe 964 Trojan.exe 1576 Trojan.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exeTrojan.exeTrojan.exeTrojan.exedescription pid process target process PID 912 set thread context of 960 912 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 960 set thread context of 852 960 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 852 set thread context of 780 852 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 1916 set thread context of 964 1916 Trojan.exe Trojan.exe PID 964 set thread context of 1576 964 Trojan.exe Trojan.exe PID 1576 set thread context of 652 1576 Trojan.exe Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exeTrojan.exeTrojan.exeTrojan.exepid process 852 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 912 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 852 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 912 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 912 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 852 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 1916 Trojan.exe 1916 Trojan.exe 1916 Trojan.exe 1576 Trojan.exe 1576 Trojan.exe 1576 Trojan.exe 652 Trojan.exe 652 Trojan.exe 652 Trojan.exe 652 Trojan.exe 652 Trojan.exe 652 Trojan.exe 652 Trojan.exe 652 Trojan.exe 652 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exeTrojan.exeTrojan.exeTrojan.exedescription pid process Token: SeDebugPrivilege 912 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe Token: SeDebugPrivilege 852 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe Token: SeDebugPrivilege 1916 Trojan.exe Token: SeDebugPrivilege 1576 Trojan.exe Token: SeDebugPrivilege 652 Trojan.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exeTrojan.exeTrojan.exeTrojan.exeTrojan.exedescription pid process target process PID 912 wrote to memory of 960 912 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 912 wrote to memory of 960 912 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 912 wrote to memory of 960 912 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 912 wrote to memory of 960 912 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 912 wrote to memory of 960 912 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 912 wrote to memory of 960 912 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 960 wrote to memory of 852 960 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 960 wrote to memory of 852 960 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 960 wrote to memory of 852 960 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 960 wrote to memory of 852 960 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 960 wrote to memory of 852 960 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 960 wrote to memory of 852 960 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 852 wrote to memory of 780 852 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 852 wrote to memory of 780 852 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 852 wrote to memory of 780 852 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 852 wrote to memory of 780 852 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 852 wrote to memory of 780 852 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 852 wrote to memory of 780 852 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe PID 780 wrote to memory of 1916 780 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe Trojan.exe PID 780 wrote to memory of 1916 780 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe Trojan.exe PID 780 wrote to memory of 1916 780 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe Trojan.exe PID 780 wrote to memory of 1916 780 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe Trojan.exe PID 1916 wrote to memory of 964 1916 Trojan.exe Trojan.exe PID 1916 wrote to memory of 964 1916 Trojan.exe Trojan.exe PID 1916 wrote to memory of 964 1916 Trojan.exe Trojan.exe PID 1916 wrote to memory of 964 1916 Trojan.exe Trojan.exe PID 1916 wrote to memory of 964 1916 Trojan.exe Trojan.exe PID 1916 wrote to memory of 964 1916 Trojan.exe Trojan.exe PID 964 wrote to memory of 1576 964 Trojan.exe Trojan.exe PID 964 wrote to memory of 1576 964 Trojan.exe Trojan.exe PID 964 wrote to memory of 1576 964 Trojan.exe Trojan.exe PID 964 wrote to memory of 1576 964 Trojan.exe Trojan.exe PID 964 wrote to memory of 1576 964 Trojan.exe Trojan.exe PID 964 wrote to memory of 1576 964 Trojan.exe Trojan.exe PID 1576 wrote to memory of 652 1576 Trojan.exe Trojan.exe PID 1576 wrote to memory of 652 1576 Trojan.exe Trojan.exe PID 1576 wrote to memory of 652 1576 Trojan.exe Trojan.exe PID 1576 wrote to memory of 652 1576 Trojan.exe Trojan.exe PID 1576 wrote to memory of 652 1576 Trojan.exe Trojan.exe PID 1576 wrote to memory of 652 1576 Trojan.exe Trojan.exe PID 652 wrote to memory of 2028 652 Trojan.exe netsh.exe PID 652 wrote to memory of 2028 652 Trojan.exe netsh.exe PID 652 wrote to memory of 2028 652 Trojan.exe netsh.exe PID 652 wrote to memory of 2028 652 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe"C:\Users\Admin\AppData\Local\Temp\48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exeC:\Users\Admin\AppData\Local\Temp\48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exeC:\Users\Admin\AppData\Local\Temp\48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exeC:\Users\Admin\AppData\Local\Temp\48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exeC:\Users\Admin\AppData\Local\Temp\Trojan.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exeC:\Users\Admin\AppData\Local\Temp\Trojan.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exeC:\Users\Admin\AppData\Local\Temp\Trojan.exe8⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE9⤵
- Modifies Windows Firewall
PID:2028
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
855KB
MD56aa1e096f657f2d549e67579d7edb490
SHA1fe36a9211ef9b8c35697c97addccc94a47223d7c
SHA25648a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250
SHA512746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
855KB
MD56aa1e096f657f2d549e67579d7edb490
SHA1fe36a9211ef9b8c35697c97addccc94a47223d7c
SHA25648a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250
SHA512746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
855KB
MD56aa1e096f657f2d549e67579d7edb490
SHA1fe36a9211ef9b8c35697c97addccc94a47223d7c
SHA25648a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250
SHA512746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
855KB
MD56aa1e096f657f2d549e67579d7edb490
SHA1fe36a9211ef9b8c35697c97addccc94a47223d7c
SHA25648a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250
SHA512746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
855KB
MD56aa1e096f657f2d549e67579d7edb490
SHA1fe36a9211ef9b8c35697c97addccc94a47223d7c
SHA25648a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250
SHA512746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc
-
\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
855KB
MD56aa1e096f657f2d549e67579d7edb490
SHA1fe36a9211ef9b8c35697c97addccc94a47223d7c
SHA25648a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250
SHA512746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc
-
\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
855KB
MD56aa1e096f657f2d549e67579d7edb490
SHA1fe36a9211ef9b8c35697c97addccc94a47223d7c
SHA25648a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250
SHA512746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc
-
\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
855KB
MD56aa1e096f657f2d549e67579d7edb490
SHA1fe36a9211ef9b8c35697c97addccc94a47223d7c
SHA25648a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250
SHA512746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc
-
\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
855KB
MD56aa1e096f657f2d549e67579d7edb490
SHA1fe36a9211ef9b8c35697c97addccc94a47223d7c
SHA25648a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250
SHA512746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc
-
memory/652-104-0x0000000000408B0E-mapping.dmp
-
memory/652-121-0x0000000004575000-0x0000000004586000-memory.dmpFilesize
68KB
-
memory/652-122-0x0000000004575000-0x0000000004586000-memory.dmpFilesize
68KB
-
memory/780-71-0x0000000000408B0E-mapping.dmp
-
memory/780-70-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/780-73-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/780-75-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/852-115-0x0000000004A25000-0x0000000004A36000-memory.dmpFilesize
68KB
-
memory/852-79-0x0000000004A25000-0x0000000004A36000-memory.dmpFilesize
68KB
-
memory/852-63-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/852-113-0x0000000004A25000-0x0000000004A36000-memory.dmpFilesize
68KB
-
memory/852-68-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/852-66-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/852-64-0x000000000044818E-mapping.dmp
-
memory/912-116-0x0000000004AA5000-0x0000000004AB6000-memory.dmpFilesize
68KB
-
memory/912-78-0x0000000004AA5000-0x0000000004AB6000-memory.dmpFilesize
68KB
-
memory/912-56-0x0000000000410000-0x000000000041A000-memory.dmpFilesize
40KB
-
memory/912-112-0x0000000004AA5000-0x0000000004AB6000-memory.dmpFilesize
68KB
-
memory/912-55-0x0000000075661000-0x0000000075663000-memory.dmpFilesize
8KB
-
memory/912-54-0x00000000011B0000-0x000000000128C000-memory.dmpFilesize
880KB
-
memory/960-62-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/960-57-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/960-58-0x000000000040BA82-mapping.dmp
-
memory/960-60-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/964-87-0x000000000040BA82-mapping.dmp
-
memory/1576-95-0x000000000044818E-mapping.dmp
-
memory/1576-111-0x00000000050A5000-0x00000000050B6000-memory.dmpFilesize
68KB
-
memory/1576-114-0x00000000050A5000-0x00000000050B6000-memory.dmpFilesize
68KB
-
memory/1916-110-0x0000000004DB5000-0x0000000004DC6000-memory.dmpFilesize
68KB
-
memory/1916-83-0x0000000000EA0000-0x0000000000F7C000-memory.dmpFilesize
880KB
-
memory/1916-80-0x0000000000000000-mapping.dmp
-
memory/1916-117-0x0000000004DB5000-0x0000000004DC6000-memory.dmpFilesize
68KB
-
memory/2028-118-0x0000000000000000-mapping.dmp