Analysis
-
max time kernel
199s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 15:40
Static task
static1
Behavioral task
behavioral1
Sample
1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe
Resource
win7-20220812-en
General
-
Target
1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe
-
Size
931KB
-
MD5
ebeefe34d85cc36dff078ee50c3ed82b
-
SHA1
2516399edee81f906aa1750ffe2b34f36c4b6348
-
SHA256
1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f
-
SHA512
6d9692c7edd72a100a519647fcdb8446a154d77cdc775c2e7703157ee6f1a1188aae02861e2490800ce104a7d1880e0cdc73c79e6cfbd6775f1ae77fb5c9015c
-
SSDEEP
24576:hYMrMImtsYgc0FgjGli6Zx7ZBvV+LLmDLwhe/9YmaDn6rr/qKoS:hT1mtsYr0VZBvgYLhYmaDnoqKoS
Malware Config
Extracted
cybergate
v1.07.5
Clients
abapaul.ddns.net:3450
MQ17T531JROJ0H
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
MUI
-
install_file
svchost.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
12345678A
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
tmp.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\MUI\\svchost.exe" tmp.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run tmp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\MUI\\svchost.exe" tmp.exe -
Executes dropped EXE 4 IoCs
Processes:
tmp.exetmp.exesvchost.exenotepad .exepid process 5116 tmp.exe 4960 tmp.exe 5012 svchost.exe 4548 notepad .exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
tmp.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y7FF2K65-1JOS-88G4-BTS0-7F8W7KP24522} tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y7FF2K65-1JOS-88G4-BTS0-7F8W7KP24522}\StubPath = "C:\\Windows\\MUI\\svchost.exe Restart" tmp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y7FF2K65-1JOS-88G4-BTS0-7F8W7KP24522} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y7FF2K65-1JOS-88G4-BTS0-7F8W7KP24522}\StubPath = "C:\\Windows\\MUI\\svchost.exe" explorer.exe -
Processes:
resource yara_rule behavioral2/memory/5116-139-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral2/memory/5116-144-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral2/memory/5100-147-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral2/memory/5100-150-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral2/memory/5116-152-0x00000000104F0000-0x0000000010555000-memory.dmp upx behavioral2/memory/5116-158-0x0000000010560000-0x00000000105C5000-memory.dmp upx behavioral2/memory/4960-161-0x0000000010560000-0x00000000105C5000-memory.dmp upx behavioral2/memory/4960-162-0x0000000010560000-0x00000000105C5000-memory.dmp upx behavioral2/memory/4960-166-0x0000000010560000-0x00000000105C5000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exetmp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation tmp.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
tmp.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\MUI\\svchost.exe" tmp.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run tmp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\MUI\\svchost.exe" tmp.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exedescription pid process target process PID 3728 set thread context of 4548 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe notepad .exe -
Drops file in Windows directory 4 IoCs
Processes:
tmp.exetmp.exedescription ioc process File created C:\Windows\MUI\svchost.exe tmp.exe File opened for modification C:\Windows\MUI\svchost.exe tmp.exe File opened for modification C:\Windows\MUI\svchost.exe tmp.exe File opened for modification C:\Windows\MUI\ tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3568 5012 WerFault.exe svchost.exe -
Modifies registry class 1 IoCs
Processes:
tmp.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ tmp.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exepid process 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
tmp.exepid process 4960 tmp.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exeexplorer.exetmp.exedescription pid process Token: SeDebugPrivilege 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe Token: 33 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe Token: SeIncBasePriorityPrivilege 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe Token: SeBackupPrivilege 5100 explorer.exe Token: SeRestorePrivilege 5100 explorer.exe Token: SeBackupPrivilege 4960 tmp.exe Token: SeRestorePrivilege 4960 tmp.exe Token: SeDebugPrivilege 4960 tmp.exe Token: SeDebugPrivilege 4960 tmp.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
tmp.exepid process 5116 tmp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exetmp.exedescription pid process target process PID 3728 wrote to memory of 5116 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe tmp.exe PID 3728 wrote to memory of 5116 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe tmp.exe PID 3728 wrote to memory of 5116 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe tmp.exe PID 3728 wrote to memory of 4548 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe notepad .exe PID 3728 wrote to memory of 4548 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe notepad .exe PID 3728 wrote to memory of 4548 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe notepad .exe PID 3728 wrote to memory of 4548 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe notepad .exe PID 3728 wrote to memory of 4548 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe notepad .exe PID 3728 wrote to memory of 4548 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe notepad .exe PID 3728 wrote to memory of 4548 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe notepad .exe PID 3728 wrote to memory of 4548 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe notepad .exe PID 3728 wrote to memory of 4548 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe notepad .exe PID 3728 wrote to memory of 4548 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe notepad .exe PID 3728 wrote to memory of 4548 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe notepad .exe PID 3728 wrote to memory of 4548 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe notepad .exe PID 3728 wrote to memory of 4548 3728 1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe notepad .exe PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE PID 5116 wrote to memory of 2648 5116 tmp.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe"C:\Users\Admin\AppData\Local\Temp\1ffeb2424534a4512c7494113f4ff3c33c30da42cc9a614c7ffbfa1e0146632f.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Roaming\tmp.exe"C:\Users\Admin\AppData\Roaming\tmp.exe"3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
PID:5100 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵PID:4240
-
C:\Users\Admin\AppData\Roaming\tmp.exe"C:\Users\Admin\AppData\Roaming\tmp.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4960 -
C:\Windows\MUI\svchost.exe"C:\Windows\MUI\svchost.exe"5⤵
- Executes dropped EXE
PID:5012 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 5926⤵
- Program crash
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\#folder#\notepad .exe"C:\Users\Admin\AppData\Local\Temp\#folder#\notepad .exe"3⤵
- Executes dropped EXE
PID:4548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 5012 -ip 50121⤵PID:2976
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\#folder#\notepad .exeFilesize
57KB
MD5454501a66ad6e85175a6757573d79f8b
SHA18ca96c61f26a640a5b1b1152d055260b9d43e308
SHA2567fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8
SHA5129dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7
-
C:\Users\Admin\AppData\Local\Temp\#folder#\notepad .exeFilesize
57KB
MD5454501a66ad6e85175a6757573d79f8b
SHA18ca96c61f26a640a5b1b1152d055260b9d43e308
SHA2567fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8
SHA5129dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7
-
C:\Users\Admin\AppData\Local\Temp\Admin2.txtFilesize
224KB
MD5253682f5e6f8e6d2731f167d2ecd36f1
SHA1db6bdbda1a19498fb458f428ee98c7237e4624f3
SHA256020a6a58906e8798e4503d1d039be815711cc091f49e7dadb8f31bf08d399e81
SHA5125ab903bb87f2ccb3a351eedc3abb111fb73ea7effa0a3d78a2e1f269a7698b61e638f7d2d5adc597f97fb941eccf265e9b541da0da605a0ee9433c37fe72c657
-
C:\Users\Admin\AppData\Roaming\tmp.exeFilesize
289KB
MD5f3bf34fbcc5d4d8238c81080feba57c1
SHA10c9c5500054b5e8c90f1e781730a8eee69fc6fb3
SHA25695f8ed76dee24539a80d5e7bc1c16b3cb553e4eff97bf7aeb265e507edbf36ca
SHA512b3142958210017056f06e10db8f32840aff12a2aa36068735614cf818cf6fde7cb0c4a2f67d73996605672467058b064a2b4532acdc1e77020078075e2ea59b3
-
C:\Users\Admin\AppData\Roaming\tmp.exeFilesize
289KB
MD5f3bf34fbcc5d4d8238c81080feba57c1
SHA10c9c5500054b5e8c90f1e781730a8eee69fc6fb3
SHA25695f8ed76dee24539a80d5e7bc1c16b3cb553e4eff97bf7aeb265e507edbf36ca
SHA512b3142958210017056f06e10db8f32840aff12a2aa36068735614cf818cf6fde7cb0c4a2f67d73996605672467058b064a2b4532acdc1e77020078075e2ea59b3
-
C:\Users\Admin\AppData\Roaming\tmp.exeFilesize
289KB
MD5f3bf34fbcc5d4d8238c81080feba57c1
SHA10c9c5500054b5e8c90f1e781730a8eee69fc6fb3
SHA25695f8ed76dee24539a80d5e7bc1c16b3cb553e4eff97bf7aeb265e507edbf36ca
SHA512b3142958210017056f06e10db8f32840aff12a2aa36068735614cf818cf6fde7cb0c4a2f67d73996605672467058b064a2b4532acdc1e77020078075e2ea59b3
-
C:\Windows\MUI\svchost.exeFilesize
289KB
MD5f3bf34fbcc5d4d8238c81080feba57c1
SHA10c9c5500054b5e8c90f1e781730a8eee69fc6fb3
SHA25695f8ed76dee24539a80d5e7bc1c16b3cb553e4eff97bf7aeb265e507edbf36ca
SHA512b3142958210017056f06e10db8f32840aff12a2aa36068735614cf818cf6fde7cb0c4a2f67d73996605672467058b064a2b4532acdc1e77020078075e2ea59b3
-
C:\Windows\MUI\svchost.exeFilesize
289KB
MD5f3bf34fbcc5d4d8238c81080feba57c1
SHA10c9c5500054b5e8c90f1e781730a8eee69fc6fb3
SHA25695f8ed76dee24539a80d5e7bc1c16b3cb553e4eff97bf7aeb265e507edbf36ca
SHA512b3142958210017056f06e10db8f32840aff12a2aa36068735614cf818cf6fde7cb0c4a2f67d73996605672467058b064a2b4532acdc1e77020078075e2ea59b3
-
memory/3728-171-0x0000000075160000-0x0000000075711000-memory.dmpFilesize
5.7MB
-
memory/3728-133-0x0000000075160000-0x0000000075711000-memory.dmpFilesize
5.7MB
-
memory/3728-132-0x0000000075160000-0x0000000075711000-memory.dmpFilesize
5.7MB
-
memory/4548-137-0x0000000000000000-mapping.dmp
-
memory/4548-170-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4548-169-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4548-165-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4960-156-0x0000000000000000-mapping.dmp
-
memory/4960-161-0x0000000010560000-0x00000000105C5000-memory.dmpFilesize
404KB
-
memory/4960-162-0x0000000010560000-0x00000000105C5000-memory.dmpFilesize
404KB
-
memory/4960-166-0x0000000010560000-0x00000000105C5000-memory.dmpFilesize
404KB
-
memory/5012-163-0x0000000000000000-mapping.dmp
-
memory/5100-150-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/5100-147-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/5100-143-0x0000000000000000-mapping.dmp
-
memory/5116-158-0x0000000010560000-0x00000000105C5000-memory.dmpFilesize
404KB
-
memory/5116-152-0x00000000104F0000-0x0000000010555000-memory.dmpFilesize
404KB
-
memory/5116-144-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/5116-139-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/5116-134-0x0000000000000000-mapping.dmp