Analysis
-
max time kernel
129s -
max time network
111s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:37
Static task
static1
Behavioral task
behavioral1
Sample
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe
Resource
win10v2004-20220812-en
General
-
Target
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe
-
Size
5.7MB
-
MD5
f55559f66229a8cfb591e0bcaa54c109
-
SHA1
17006709ee364b356e564a01fd70107c69691573
-
SHA256
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8
-
SHA512
2ae90705029c37b3cead09d64cfd18bffb5507cd7def80b4a87a4f8759f205b4b9cbb86bfea090a71b98948b638c0ea35026da3925a5a5be082087791c3089de
-
SSDEEP
98304:J2llez/udrnJll4dP5aSGie4udyO4Okjsstz8V8bHxLcIm:J2lUzYIoSGz4ud11/qiupm
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ÄæսĩÈÕ¸¨Öú.exepid process 1108 ÄæսĩÈÕ¸¨Öú.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
Processes:
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exepid process 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe -
Drops file in Windows directory 1 IoCs
Processes:
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exedescription ioc process File created C:\WINDOWS\ÄæսĩÈÕ¸¨Öú.exe 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe -
Processes:
iexplore.exeIEXPLORE.EXEÄæսĩÈÕ¸¨Öú.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ead09e6da184174490e31fea1de4728d000000000200000000001066000000010000200000001ae30061d24cced83d2c5e287ab3f234f69f7d2b1759748b38b7fbfc9ac1a92c000000000e80000000020000200000005d71a7c3dc8c6606739b2dc196b4d2b5354e734785a83d74866064128cd73a949000000022ba2ea7d9a7bb3ae984c9ce3514d66bead240c0bb086c43e3f7faa86e63ab403654f77974dac96c512938d32c86c5248a6abac0efbc8144fd8e444c0172d1f7791ab35454fb7fbf300936a3046958b2da17c4e404bc6f893a47e4d57a324e744b907881568d4f7697e8cb1e0dae69716cb188e5a02eeb47f10ef0a3f945bd115533a2dbaf42da9bbc8c1f864af6abd440000000295c19dbe5fb3ff838156701ca75efdb864e3c965cba4699829e60d216cdf4f656920565fb2a00d90a68215405bccc906fa8d11ee4dc3602cc60eaeedea36dc8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ead09e6da184174490e31fea1de4728d0000000002000000000010660000000100002000000090ef52e55239c1b2f837a9a457a046e16a82f8830d4d825056e0e5e68f63356b000000000e8000000002000020000000ce625d2e2f69421df6e59ee6e37877e9400b455aa3706bb4e1c6182017619b6e200000001cb997c2866ab3aae895c27e5da2351325077e2222a22128f2f84af534ffd65f400000005ffbd8840e0b9d06e1a80509184f9c55fdb15ed1925dcbe657d3492bb7aa528e77eca31c94cf5880e728a0d94473578ea019aa9e43cb6aa5e80c6dec0c73a2e0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F19B641-6D49-11ED-8C25-6AB3F8C7EA51} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main ÄæսĩÈÕ¸¨Öú.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b014907d5601d901 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exedescription pid process Token: 33 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe Token: SeIncBasePriorityPrivilege 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1800 iexplore.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exeÄæսĩÈÕ¸¨Öú.exeiexplore.exeIEXPLORE.EXEpid process 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe 1108 ÄæսĩÈÕ¸¨Öú.exe 1108 ÄæսĩÈÕ¸¨Öú.exe 1108 ÄæսĩÈÕ¸¨Öú.exe 1108 ÄæսĩÈÕ¸¨Öú.exe 1108 ÄæսĩÈÕ¸¨Öú.exe 1800 iexplore.exe 1800 iexplore.exe 1228 IEXPLORE.EXE 1228 IEXPLORE.EXE 1228 IEXPLORE.EXE 1228 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exeÄæսĩÈÕ¸¨Öú.exeiexplore.exedescription pid process target process PID 1116 wrote to memory of 1108 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe ÄæսĩÈÕ¸¨Öú.exe PID 1116 wrote to memory of 1108 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe ÄæսĩÈÕ¸¨Öú.exe PID 1116 wrote to memory of 1108 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe ÄæսĩÈÕ¸¨Öú.exe PID 1116 wrote to memory of 1108 1116 2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe ÄæսĩÈÕ¸¨Öú.exe PID 1108 wrote to memory of 1800 1108 ÄæսĩÈÕ¸¨Öú.exe iexplore.exe PID 1108 wrote to memory of 1800 1108 ÄæսĩÈÕ¸¨Öú.exe iexplore.exe PID 1108 wrote to memory of 1800 1108 ÄæսĩÈÕ¸¨Öú.exe iexplore.exe PID 1108 wrote to memory of 1800 1108 ÄæսĩÈÕ¸¨Öú.exe iexplore.exe PID 1800 wrote to memory of 1228 1800 iexplore.exe IEXPLORE.EXE PID 1800 wrote to memory of 1228 1800 iexplore.exe IEXPLORE.EXE PID 1800 wrote to memory of 1228 1800 iexplore.exe IEXPLORE.EXE PID 1800 wrote to memory of 1228 1800 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe"C:\Users\Admin\AppData\Local\Temp\2b873cb1b8eec5536a74c5ddab0472eff68cebf61757cbc317870b7192454ca8.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\WINDOWS\ÄæսĩÈÕ¸¨Öú.exeC:\WINDOWS\ÄæսĩÈÕ¸¨Öú.exe2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.moriwg.net3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1800 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1228
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\WINDOWS\ÄæսĩÈÕ¸¨Öú.exeFilesize
1.5MB
MD591c1583ee24aa5791e4cf2a54cf802d7
SHA1b54d05d7be32a5595aa1fb1941cc77e3712a3013
SHA256c30acd06f8aa69501b9ef174dd7ba0f32fde4f48a94a7b21e998a133280797d7
SHA5127f9a46dab0fcf7deaeabef50689d834dacd650d83bcc6cbacb3e3b398c352d9499858e736f0342b2acae1ace6adcf7d9cd8624d4643930ec8d4d4eccbc778f77
-
C:\Windows\ÄæսĩÈÕ¸¨Öú.exeFilesize
1.5MB
MD591c1583ee24aa5791e4cf2a54cf802d7
SHA1b54d05d7be32a5595aa1fb1941cc77e3712a3013
SHA256c30acd06f8aa69501b9ef174dd7ba0f32fde4f48a94a7b21e998a133280797d7
SHA5127f9a46dab0fcf7deaeabef50689d834dacd650d83bcc6cbacb3e3b398c352d9499858e736f0342b2acae1ace6adcf7d9cd8624d4643930ec8d4d4eccbc778f77
-
memory/1108-5082-0x0000000000000000-mapping.dmp
-
memory/1116-54-0x0000000076681000-0x0000000076683000-memory.dmpFilesize
8KB
-
memory/1116-55-0x0000000000400000-0x00000000009B5000-memory.dmpFilesize
5.7MB
-
memory/1116-57-0x00000000761F0000-0x0000000076237000-memory.dmpFilesize
284KB
-
memory/1116-464-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-467-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-468-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-469-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-465-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-466-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-470-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-471-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-472-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-474-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-475-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-473-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-476-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-477-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-479-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-478-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-481-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-480-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-525-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-524-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-523-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-522-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-521-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-520-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-519-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-518-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-517-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-516-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-515-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-514-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-513-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-512-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-511-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-510-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-509-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-508-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-507-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-506-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-505-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-504-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-503-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-502-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-501-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-500-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-499-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-498-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-497-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-496-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-495-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-494-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-493-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-492-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-491-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-490-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-489-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-488-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-487-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-486-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-485-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-484-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-483-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-482-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-1494-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-1496-0x0000000002470000-0x00000000025F1000-memory.dmpFilesize
1.5MB
-
memory/1116-3283-0x0000000002727000-0x0000000002729000-memory.dmpFilesize
8KB
-
memory/1116-4025-0x0000000002270000-0x0000000002370000-memory.dmpFilesize
1024KB
-
memory/1116-4517-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB
-
memory/1116-5080-0x0000000002840000-0x0000000002941000-memory.dmpFilesize
1.0MB
-
memory/1116-5081-0x0000000002600000-0x00000000026A1000-memory.dmpFilesize
644KB
-
memory/1116-5085-0x0000000002727000-0x0000000002729000-memory.dmpFilesize
8KB
-
memory/1116-5086-0x0000000000400000-0x00000000009B5000-memory.dmpFilesize
5.7MB
-
memory/1116-5087-0x0000000002720000-0x0000000002831000-memory.dmpFilesize
1.1MB