Analysis
-
max time kernel
168s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 11:51
Static task
static1
Behavioral task
behavioral1
Sample
2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe
Resource
win7-20220812-en
General
-
Target
2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe
-
Size
565KB
-
MD5
b42674ba4f39012a0ee3c88002ebc92c
-
SHA1
1c06d50188a03ac488db25774b7d51a73ba77ca3
-
SHA256
2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6
-
SHA512
a53f74d65a62bfc6d71ca4059c6674f2f2ec33c99bd6b8b60408a388387cafdf373397dfd95a7cf382651cabd2cc4ea8d1aa1f507b2884a5fa964c8499d094d4
-
SSDEEP
12288:XaKoq63D9WtxtIdn5OezP2OwmTjFF1n19vX:X563JUinf23gjnNPP
Malware Config
Signatures
-
Detect Blackmoon payload 11 IoCs
Processes:
resource yara_rule behavioral2/memory/4788-134-0x0000000000400000-0x0000000000668000-memory.dmp family_blackmoon behavioral2/memory/4788-133-0x0000000000400000-0x0000000000668000-memory.dmp family_blackmoon C:\Users\Admin\AppData\Local\Temp\data\UpDate.exe family_blackmoon C:\Users\Admin\AppData\Local\Temp\data\UpDate.exe family_blackmoon behavioral2/memory/3496-182-0x0000000000400000-0x0000000000467000-memory.dmp family_blackmoon behavioral2/memory/4788-183-0x0000000000400000-0x0000000000668000-memory.dmp family_blackmoon behavioral2/memory/3496-186-0x0000000000400000-0x0000000000467000-memory.dmp family_blackmoon behavioral2/memory/4236-187-0x0000000000400000-0x0000000000668000-memory.dmp family_blackmoon behavioral2/memory/4236-188-0x0000000000400000-0x0000000000668000-memory.dmp family_blackmoon behavioral2/memory/4236-205-0x0000000000400000-0x0000000000668000-memory.dmp family_blackmoon behavioral2/memory/4236-235-0x0000000000400000-0x0000000000668000-memory.dmp family_blackmoon -
Executes dropped EXE 2 IoCs
Processes:
UpDate.exe2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exepid process 3496 UpDate.exe 4236 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe -
Processes:
resource yara_rule behavioral2/memory/4788-135-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-136-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-137-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-139-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-141-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-143-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-149-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-147-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-145-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-151-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-153-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-155-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-157-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-161-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-159-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-163-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-165-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-167-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-171-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-169-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-173-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-175-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-177-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4788-178-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4236-189-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4236-192-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4236-191-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4236-194-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4236-196-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4236-198-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4236-200-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4236-202-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4236-207-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4236-204-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4236-234-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
msedge.exepid process 4104 msedge.exe 4104 msedge.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exepid process 4788 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe 4788 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe 4788 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe 4788 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe 4788 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe 4236 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe 4236 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe 4236 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe 4236 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe 4236 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exeUpDate.exe2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exemsedge.exedescription pid process target process PID 4788 wrote to memory of 3496 4788 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe UpDate.exe PID 4788 wrote to memory of 3496 4788 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe UpDate.exe PID 4788 wrote to memory of 3496 4788 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe UpDate.exe PID 3496 wrote to memory of 4236 3496 UpDate.exe 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe PID 3496 wrote to memory of 4236 3496 UpDate.exe 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe PID 3496 wrote to memory of 4236 3496 UpDate.exe 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe PID 4236 wrote to memory of 4064 4236 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe msedge.exe PID 4236 wrote to memory of 4064 4236 2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe msedge.exe PID 4064 wrote to memory of 4624 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4624 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1156 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4104 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4104 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 3444 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 3444 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 3444 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 3444 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 3444 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 3444 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 3444 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 3444 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 3444 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 3444 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 3444 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 3444 4064 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe"C:\Users\Admin\AppData\Local\Temp\2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\UpDate.exeC:\Users\Admin\AppData\Local\Temp\data\UpDate.exe 3.0 %43%3A%5C%55%73%65%72%73%5C%41%64%6D%69%6E%5C%41%70%70%44%61%74%61%5C%4C%6F%63%61%6C%5C%54%65%6D%70%5C%32%61%65%63%36%32%36%34%65%31%64%66%38%64%33%63%66%32%31%61%65%65%64%62%61%38%38%64%36%62%65%34%64%64%38%66%63%32%37%38%61%63%64%31%61%63%34%62%63%38%37%61%32%66%31%35%63%35%33%31%37%65%66%36%2E%65%78%65 ¼Ù http://www.gutou.cc/up/shiyimiaozan.txt2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exeC:\Users\Admin\AppData\Local\Temp\2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exe ÃüÁîÆô¶¯3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gutou.cc/ad/shiyi/dingyue.htm4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a6a046f8,0x7ff8a6a04708,0x7ff8a6a047185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,8679773380222790890,14823763791547310716,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,8679773380222790890,14823763791547310716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,8679773380222790890,14823763791547310716,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:85⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exeFilesize
565KB
MD5ef44ddac0bbb2628e762b1ff652a4570
SHA1ed2bf5e554f55cbd0648fec4e041dc34b833432b
SHA256768a7f22c850dbc96528e53b6bc8667489c3b70d82aca04d881c0f34603d7bab
SHA51219853bedc993e62991117e9811da06caf17be04df74edda8a17b49687837fc0cb4c123f5176f89da7d0ad618df42784abd4b8e845a80916e92dfcd1cc3bd812e
-
C:\Users\Admin\AppData\Local\Temp\2aec6264e1df8d3cf21aeedba88d6be4dd8fc278acd1ac4bc87a2f15c5317ef6.exeFilesize
565KB
MD5ef44ddac0bbb2628e762b1ff652a4570
SHA1ed2bf5e554f55cbd0648fec4e041dc34b833432b
SHA256768a7f22c850dbc96528e53b6bc8667489c3b70d82aca04d881c0f34603d7bab
SHA51219853bedc993e62991117e9811da06caf17be04df74edda8a17b49687837fc0cb4c123f5176f89da7d0ad618df42784abd4b8e845a80916e92dfcd1cc3bd812e
-
C:\Users\Admin\AppData\Local\Temp\data\UpDate.exeFilesize
352KB
MD5bc928b2445cdad55f95bc8605bc06c68
SHA1b3d9aaedf6da81d22e3625e9d8a2256d76937c8e
SHA25646e77e370227077ff0dfc092549a2d063815ec62ce9825aa4f4c7e4877f9f426
SHA512d3bb34eb1f040baac1c9d424356e0ed237237d118916d8f0ca8822e26ad773bcc2c99601903cf6f3ccc48d9d0097cec9a51f563fafc2c5cb25c42b5619319632
-
C:\Users\Admin\AppData\Local\Temp\data\UpDate.exeFilesize
352KB
MD5bc928b2445cdad55f95bc8605bc06c68
SHA1b3d9aaedf6da81d22e3625e9d8a2256d76937c8e
SHA25646e77e370227077ff0dfc092549a2d063815ec62ce9825aa4f4c7e4877f9f426
SHA512d3bb34eb1f040baac1c9d424356e0ed237237d118916d8f0ca8822e26ad773bcc2c99601903cf6f3ccc48d9d0097cec9a51f563fafc2c5cb25c42b5619319632
-
\??\pipe\LOCAL\crashpad_4064_UPUIJQBHLGVMRUFZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1156-239-0x0000000000000000-mapping.dmp
-
memory/3444-243-0x0000000000000000-mapping.dmp
-
memory/3496-179-0x0000000000000000-mapping.dmp
-
memory/3496-186-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/3496-182-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/4064-236-0x0000000000000000-mapping.dmp
-
memory/4104-240-0x0000000000000000-mapping.dmp
-
memory/4236-196-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4236-205-0x0000000000400000-0x0000000000668000-memory.dmpFilesize
2.4MB
-
memory/4236-235-0x0000000000400000-0x0000000000668000-memory.dmpFilesize
2.4MB
-
memory/4236-234-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4236-204-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4236-207-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4236-202-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4236-200-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4236-198-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4236-194-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4236-191-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4236-192-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4236-189-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4236-188-0x0000000000400000-0x0000000000668000-memory.dmpFilesize
2.4MB
-
memory/4236-187-0x0000000000400000-0x0000000000668000-memory.dmpFilesize
2.4MB
-
memory/4236-184-0x0000000000000000-mapping.dmp
-
memory/4624-237-0x0000000000000000-mapping.dmp
-
memory/4788-139-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-135-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-183-0x0000000000400000-0x0000000000668000-memory.dmpFilesize
2.4MB
-
memory/4788-151-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-143-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-141-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-178-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-177-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-175-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-173-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-169-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-171-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-134-0x0000000000400000-0x0000000000668000-memory.dmpFilesize
2.4MB
-
memory/4788-149-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-159-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-165-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-163-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-153-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-167-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-161-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-157-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-155-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-137-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-147-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-136-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-145-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/4788-133-0x0000000000400000-0x0000000000668000-memory.dmpFilesize
2.4MB
-
memory/4788-132-0x0000000000400000-0x0000000000668000-memory.dmpFilesize
2.4MB