Analysis
-
max time kernel
99s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 04:27
Static task
static1
Behavioral task
behavioral1
Sample
549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe
Resource
win10v2004-20220812-en
General
-
Target
549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe
-
Size
1005KB
-
MD5
d84eb15977825d460358b69daa264677
-
SHA1
9bddee35822552ba80d311445913b818f1857d0f
-
SHA256
549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625
-
SHA512
fd4c56a6d4961455d7ddf8cbe17fd872f23c9b8bd7abb1eaf3f914b92583ad25bf07b4e7a65b0c4466800b1d6c20f0981b50cca0121f71fe67a187e9d81feebd
-
SSDEEP
12288:nnAiyMZ8oPEVzTEnUycspBKugd7uDjde1sKcilllPqwHiZEIUbWSDz45ohOk0csk:nAdMZHDp6dge1sKgwHMExe53csPM
Malware Config
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
waterly123
Signatures
-
NirSoft MailPassView 5 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/2732-280-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral2/memory/1060-288-0x0000000000000000-mapping.dmp MailPassView behavioral2/memory/1060-289-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/1060-291-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/1060-294-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 6 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/2732-280-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral2/memory/1688-304-0x0000000000000000-mapping.dmp WebBrowserPassView behavioral2/memory/1688-305-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/1688-307-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/1688-308-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/1688-310-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 10 IoCs
Processes:
resource yara_rule behavioral2/memory/2732-280-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral2/memory/1060-288-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/1060-289-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/1060-291-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/1060-294-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/1688-304-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/1688-305-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/1688-307-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/1688-308-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/1688-310-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\Sample.lnk" 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 12 whatismyipaddress.com 14 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exedescription pid process target process PID 4420 set thread context of 2732 4420 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe PID 2732 set thread context of 1060 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe PID 2732 set thread context of 1688 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe -
Drops file in Windows directory 2 IoCs
Processes:
549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exedescription ioc process File opened for modification C:\Windows\26 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe File opened for modification C:\Windows\28 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exevbc.exepid process 4420 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe 1688 vbc.exe 1688 vbc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exedescription pid process Token: SeDebugPrivilege 4420 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe Token: SeDebugPrivilege 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exepid process 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exedescription pid process target process PID 4420 wrote to memory of 1604 4420 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe CMD.exe PID 4420 wrote to memory of 1604 4420 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe CMD.exe PID 4420 wrote to memory of 1604 4420 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe CMD.exe PID 4420 wrote to memory of 1328 4420 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe CMD.exe PID 4420 wrote to memory of 1328 4420 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe CMD.exe PID 4420 wrote to memory of 1328 4420 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe CMD.exe PID 4420 wrote to memory of 2732 4420 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe PID 4420 wrote to memory of 2732 4420 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe PID 4420 wrote to memory of 2732 4420 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe PID 4420 wrote to memory of 2732 4420 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe PID 4420 wrote to memory of 2732 4420 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe PID 4420 wrote to memory of 2732 4420 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe PID 4420 wrote to memory of 2732 4420 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe PID 4420 wrote to memory of 2732 4420 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe PID 2732 wrote to memory of 1060 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe PID 2732 wrote to memory of 1060 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe PID 2732 wrote to memory of 1060 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe PID 2732 wrote to memory of 1060 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe PID 2732 wrote to memory of 1060 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe PID 2732 wrote to memory of 1060 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe PID 2732 wrote to memory of 1060 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe PID 2732 wrote to memory of 1060 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe PID 2732 wrote to memory of 1060 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe PID 2732 wrote to memory of 1688 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe PID 2732 wrote to memory of 1688 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe PID 2732 wrote to memory of 1688 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe PID 2732 wrote to memory of 1688 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe PID 2732 wrote to memory of 1688 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe PID 2732 wrote to memory of 1688 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe PID 2732 wrote to memory of 1688 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe PID 2732 wrote to memory of 1688 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe PID 2732 wrote to memory of 1688 2732 549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe"C:\Users\Admin\AppData\Local\Temp\549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\CMD.exe"CMD"2⤵
-
C:\Windows\SysWOW64\CMD.exe"CMD"2⤵
-
C:\Users\Admin\AppData\Local\Temp\549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe"C:\Users\Admin\AppData\Local\Temp\549fb298edd559b7d7a06c185fb78daa65a15eb9d30a8886775a1a8827bdf625.exe"2⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
memory/1060-288-0x0000000000000000-mapping.dmp
-
memory/1060-289-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1060-291-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1060-294-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1328-277-0x0000000000000000-mapping.dmp
-
memory/1604-276-0x0000000000000000-mapping.dmp
-
memory/1688-307-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1688-308-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1688-305-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1688-304-0x0000000000000000-mapping.dmp
-
memory/1688-310-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/2732-302-0x00000000747D0000-0x0000000074D81000-memory.dmpFilesize
5.7MB
-
memory/2732-282-0x00000000747D0000-0x0000000074D81000-memory.dmpFilesize
5.7MB
-
memory/2732-280-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/2732-279-0x0000000000000000-mapping.dmp
-
memory/4420-231-0x0000000001711000-0x0000000001713000-memory.dmpFilesize
8KB
-
memory/4420-260-0x000000000170D000-0x000000000170F000-memory.dmpFilesize
8KB
-
memory/4420-145-0x000000000171B000-0x000000000171D000-memory.dmpFilesize
8KB
-
memory/4420-146-0x000000000171E000-0x0000000001721000-memory.dmpFilesize
12KB
-
memory/4420-147-0x000000000170C000-0x000000000170E000-memory.dmpFilesize
8KB
-
memory/4420-148-0x000000000170D000-0x000000000170F000-memory.dmpFilesize
8KB
-
memory/4420-149-0x0000000001720000-0x0000000001722000-memory.dmpFilesize
8KB
-
memory/4420-150-0x000000000172A000-0x000000000172F000-memory.dmpFilesize
20KB
-
memory/4420-151-0x000000000172A000-0x000000000172F000-memory.dmpFilesize
20KB
-
memory/4420-152-0x000000000172A000-0x000000000172F000-memory.dmpFilesize
20KB
-
memory/4420-153-0x000000000172A000-0x000000000172F000-memory.dmpFilesize
20KB
-
memory/4420-154-0x000000000172A000-0x000000000172F000-memory.dmpFilesize
20KB
-
memory/4420-156-0x0000000001721000-0x0000000001723000-memory.dmpFilesize
8KB
-
memory/4420-155-0x0000000001720000-0x0000000001722000-memory.dmpFilesize
8KB
-
memory/4420-157-0x000000000172C000-0x000000000172E000-memory.dmpFilesize
8KB
-
memory/4420-158-0x000000000172B000-0x000000000172D000-memory.dmpFilesize
8KB
-
memory/4420-159-0x000000000172A000-0x000000000172F000-memory.dmpFilesize
20KB
-
memory/4420-160-0x000000000172A000-0x000000000172F000-memory.dmpFilesize
20KB
-
memory/4420-161-0x000000000172A000-0x000000000172F000-memory.dmpFilesize
20KB
-
memory/4420-162-0x000000000172A000-0x000000000172F000-memory.dmpFilesize
20KB
-
memory/4420-168-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-178-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-188-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-198-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-210-0x00000000747D0000-0x0000000074D81000-memory.dmpFilesize
5.7MB
-
memory/4420-211-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-212-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-221-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-143-0x000000000171B000-0x000000000171D000-memory.dmpFilesize
8KB
-
memory/4420-232-0x0000000001715000-0x0000000001717000-memory.dmpFilesize
8KB
-
memory/4420-233-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-235-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-246-0x000000000171B000-0x000000000171D000-memory.dmpFilesize
8KB
-
memory/4420-245-0x0000000001716000-0x0000000001718000-memory.dmpFilesize
8KB
-
memory/4420-247-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-249-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-250-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-144-0x0000000001716000-0x0000000001718000-memory.dmpFilesize
8KB
-
memory/4420-261-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-262-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-271-0x0000000001721000-0x0000000001723000-memory.dmpFilesize
8KB
-
memory/4420-270-0x0000000001720000-0x0000000001722000-memory.dmpFilesize
8KB
-
memory/4420-273-0x000000000172B000-0x000000000172D000-memory.dmpFilesize
8KB
-
memory/4420-274-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-275-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-272-0x000000000172C000-0x000000000172E000-memory.dmpFilesize
8KB
-
memory/4420-278-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-281-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-283-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-284-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-285-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-286-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-287-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-141-0x0000000001711000-0x0000000001713000-memory.dmpFilesize
8KB
-
memory/4420-142-0x0000000001715000-0x0000000001717000-memory.dmpFilesize
8KB
-
memory/4420-140-0x0000000001711000-0x0000000001715000-memory.dmpFilesize
16KB
-
memory/4420-292-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-293-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-139-0x0000000001711000-0x0000000001715000-memory.dmpFilesize
16KB
-
memory/4420-295-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-296-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-297-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-299-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-298-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-300-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-301-0x0000000006C90000-0x0000000006D90000-memory.dmpFilesize
1024KB
-
memory/4420-138-0x0000000001711000-0x0000000001715000-memory.dmpFilesize
16KB
-
memory/4420-303-0x00000000747D0000-0x0000000074D81000-memory.dmpFilesize
5.7MB
-
memory/4420-137-0x0000000001711000-0x0000000001715000-memory.dmpFilesize
16KB
-
memory/4420-136-0x0000000001711000-0x0000000001715000-memory.dmpFilesize
16KB
-
memory/4420-134-0x00000000747D0000-0x0000000074D81000-memory.dmpFilesize
5.7MB
-
memory/4420-135-0x0000000001711000-0x0000000001715000-memory.dmpFilesize
16KB
-
memory/4420-133-0x00000000016EC000-0x00000000016F5000-memory.dmpFilesize
36KB
-
memory/4420-132-0x00000000016EC000-0x00000000016F5000-memory.dmpFilesize
36KB