Analysis
-
max time kernel
144s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 17:47
Behavioral task
behavioral1
Sample
6747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71.exe
Resource
win10v2004-20220812-en
General
-
Target
6747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71.exe
-
Size
114KB
-
MD5
919b78ba094eb8f98f41165b5173468b
-
SHA1
174f1bee60add9f9a1b24e954f35ce855fde3032
-
SHA256
6747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71
-
SHA512
0eca71bd8240fe484e89d70d95ce45b22b266c409f5c23013e266e3bc6f87c250b36292e63f04b9891f85949e6978507d98a73570884073418e42fd99f40b0d8
-
SSDEEP
1536:Ir7Q2d8CSCc2zcM6Gtu7juJpeus/ol6MgPiABllwJYR8D+2Ec18cKjALJJJ9TkV7:Ifd9PlEXu3s/GgKKsK8JEpsTTw
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 6 IoCs
Processes:
winupdateloader.exewinupdateloader.exewinupdateloader.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\winupdateloader.exe" winupdateloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\winupdateloader.exe" winupdateloader.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\winupdateloader.exe" winupdateloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\winupdateloader.exe" winupdateloader.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\winupdateloader.exe" winupdateloader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\winupdateloader.exe" winupdateloader.exe -
Executes dropped EXE 8 IoCs
Processes:
winupdateloader.exewinupdateloader.exesmss.exewinupdateloader.exewinupdateloader.exesmss.exewinupdateloader.exewinupdateloader.exepid process 3636 winupdateloader.exe 3244 winupdateloader.exe 1056 smss.exe 3804 winupdateloader.exe 4364 winupdateloader.exe 4808 smss.exe 4568 winupdateloader.exe 4652 winupdateloader.exe -
Processes:
resource yara_rule behavioral2/memory/3244-141-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3244-142-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3244-143-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3244-146-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3244-148-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3244-149-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3244-152-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4364-169-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4364-171-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4364-173-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4364-177-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4652-195-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4652-194-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4652-197-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71.exesmss.exesmss.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 6747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation smss.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation smss.exe -
Obfuscated with Agile.Net obfuscator 13 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\winupdateloader.exe agile_net C:\Users\Admin\AppData\Roaming\winupdateloader.exe agile_net C:\Users\Admin\AppData\Roaming\winupdateloader.exe agile_net C:\Users\Admin\AppData\Roaming\System\Oracle\smss.exe agile_net C:\Users\Admin\AppData\Roaming\System\Oracle\smss.exe agile_net C:\Users\Admin\AppData\Roaming\winupdateloader.exe agile_net C:\Users\Admin\AppData\Roaming\winupdateloader.exe agile_net C:\Users\Admin\AppData\Roaming\winupdateloader.exe agile_net C:\Users\Admin\AppData\Roaming\System\Oracle\smss.exe agile_net C:\Users\Admin\AppData\Roaming\System\Oracle\smss.exe agile_net C:\Users\Admin\AppData\Roaming\winupdateloader.exe agile_net C:\Users\Admin\AppData\Roaming\winupdateloader.exe agile_net C:\Users\Admin\AppData\Roaming\winupdateloader.exe agile_net -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
winupdateloader.exewinupdateloader.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\System\\Oracle\\smss.exe" winupdateloader.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run winupdateloader.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\System\\Oracle\\smss.exe" winupdateloader.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run winupdateloader.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
winupdateloader.exewinupdateloader.exewinupdateloader.exedescription pid process target process PID 3636 set thread context of 3244 3636 winupdateloader.exe winupdateloader.exe PID 3804 set thread context of 4364 3804 winupdateloader.exe winupdateloader.exe PID 4568 set thread context of 4652 4568 winupdateloader.exe winupdateloader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
6747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71.exewinupdateloader.exewinupdateloader.exesmss.exewinupdateloader.exewinupdateloader.exesmss.exewinupdateloader.exedescription pid process target process PID 2420 wrote to memory of 3636 2420 6747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71.exe winupdateloader.exe PID 2420 wrote to memory of 3636 2420 6747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71.exe winupdateloader.exe PID 2420 wrote to memory of 3636 2420 6747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71.exe winupdateloader.exe PID 3636 wrote to memory of 3244 3636 winupdateloader.exe winupdateloader.exe PID 3636 wrote to memory of 3244 3636 winupdateloader.exe winupdateloader.exe PID 3636 wrote to memory of 3244 3636 winupdateloader.exe winupdateloader.exe PID 3636 wrote to memory of 3244 3636 winupdateloader.exe winupdateloader.exe PID 3636 wrote to memory of 3244 3636 winupdateloader.exe winupdateloader.exe PID 3636 wrote to memory of 3244 3636 winupdateloader.exe winupdateloader.exe PID 3636 wrote to memory of 3244 3636 winupdateloader.exe winupdateloader.exe PID 3636 wrote to memory of 3244 3636 winupdateloader.exe winupdateloader.exe PID 3244 wrote to memory of 1056 3244 winupdateloader.exe smss.exe PID 3244 wrote to memory of 1056 3244 winupdateloader.exe smss.exe PID 3244 wrote to memory of 1056 3244 winupdateloader.exe smss.exe PID 1056 wrote to memory of 3804 1056 smss.exe winupdateloader.exe PID 1056 wrote to memory of 3804 1056 smss.exe winupdateloader.exe PID 1056 wrote to memory of 3804 1056 smss.exe winupdateloader.exe PID 3804 wrote to memory of 4364 3804 winupdateloader.exe winupdateloader.exe PID 3804 wrote to memory of 4364 3804 winupdateloader.exe winupdateloader.exe PID 3804 wrote to memory of 4364 3804 winupdateloader.exe winupdateloader.exe PID 3804 wrote to memory of 4364 3804 winupdateloader.exe winupdateloader.exe PID 3804 wrote to memory of 4364 3804 winupdateloader.exe winupdateloader.exe PID 3804 wrote to memory of 4364 3804 winupdateloader.exe winupdateloader.exe PID 3804 wrote to memory of 4364 3804 winupdateloader.exe winupdateloader.exe PID 3804 wrote to memory of 4364 3804 winupdateloader.exe winupdateloader.exe PID 4364 wrote to memory of 4808 4364 winupdateloader.exe smss.exe PID 4364 wrote to memory of 4808 4364 winupdateloader.exe smss.exe PID 4364 wrote to memory of 4808 4364 winupdateloader.exe smss.exe PID 4808 wrote to memory of 4568 4808 smss.exe winupdateloader.exe PID 4808 wrote to memory of 4568 4808 smss.exe winupdateloader.exe PID 4808 wrote to memory of 4568 4808 smss.exe winupdateloader.exe PID 4568 wrote to memory of 4652 4568 winupdateloader.exe winupdateloader.exe PID 4568 wrote to memory of 4652 4568 winupdateloader.exe winupdateloader.exe PID 4568 wrote to memory of 4652 4568 winupdateloader.exe winupdateloader.exe PID 4568 wrote to memory of 4652 4568 winupdateloader.exe winupdateloader.exe PID 4568 wrote to memory of 4652 4568 winupdateloader.exe winupdateloader.exe PID 4568 wrote to memory of 4652 4568 winupdateloader.exe winupdateloader.exe PID 4568 wrote to memory of 4652 4568 winupdateloader.exe winupdateloader.exe PID 4568 wrote to memory of 4652 4568 winupdateloader.exe winupdateloader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71.exe"C:\Users\Admin\AppData\Local\Temp\6747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\winupdateloader.exe"C:\Users\Admin\AppData\Roaming\winupdateloader.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\winupdateloader.exe"C:\Users\Admin\AppData\Roaming\winupdateloader.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System\Oracle\smss.exe"C:\Users\Admin\AppData\Roaming\System\Oracle\smss.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\winupdateloader.exe"C:\Users\Admin\AppData\Roaming\winupdateloader.exe"5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\winupdateloader.exe"C:\Users\Admin\AppData\Roaming\winupdateloader.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System\Oracle\smss.exe"C:\Users\Admin\AppData\Roaming\System\Oracle\smss.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\winupdateloader.exe"C:\Users\Admin\AppData\Roaming\winupdateloader.exe"8⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\winupdateloader.exe"C:\Users\Admin\AppData\Roaming\winupdateloader.exe"9⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\smss.exe.logFilesize
312B
MD59cde1b33892f16d131b7a3d41c285e1b
SHA1fd97fcde96259b3d78187cfcd697c60c3111abc6
SHA256d053e3cb7642f1c46c3d572f30691c7779e6d299dd4008148f391886fa529d9c
SHA5124e4d70c70060c7f68b99626939d6d6bfd455825d4df639ce0597fc3278691194acb2938718fad4c73551712ee84cc11880b53bce75ca31a1ef4972a7b5487d2c
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\winupdateloader.exe.logFilesize
312B
MD59cde1b33892f16d131b7a3d41c285e1b
SHA1fd97fcde96259b3d78187cfcd697c60c3111abc6
SHA256d053e3cb7642f1c46c3d572f30691c7779e6d299dd4008148f391886fa529d9c
SHA5124e4d70c70060c7f68b99626939d6d6bfd455825d4df639ce0597fc3278691194acb2938718fad4c73551712ee84cc11880b53bce75ca31a1ef4972a7b5487d2c
-
C:\Users\Admin\AppData\Roaming\System\Oracle\azioklmpx\hzid\hzid.txtFilesize
23B
MD589b4c36041ec96c465d1cb3fea33cbe4
SHA1ee17a5972a4f23ea68bc63cddadb29b6b10e7b8e
SHA2561957b90a29db77305b560cc8ef70efd639d9aaebd2e608d8d16b3945c16f8c9f
SHA512061247beb55c57830cfabd0bb2e1e600a7fcfcdb2bfc4cc4bb3fa4411e5ebd2eeaf83eb34ce2c3eb084290bf6dbe13ae7b9b33a304a3c90c81e1738a5ffbbea3
-
C:\Users\Admin\AppData\Roaming\System\Oracle\smss.exeFilesize
114KB
MD5919b78ba094eb8f98f41165b5173468b
SHA1174f1bee60add9f9a1b24e954f35ce855fde3032
SHA2566747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71
SHA5120eca71bd8240fe484e89d70d95ce45b22b266c409f5c23013e266e3bc6f87c250b36292e63f04b9891f85949e6978507d98a73570884073418e42fd99f40b0d8
-
C:\Users\Admin\AppData\Roaming\System\Oracle\smss.exeFilesize
114KB
MD5919b78ba094eb8f98f41165b5173468b
SHA1174f1bee60add9f9a1b24e954f35ce855fde3032
SHA2566747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71
SHA5120eca71bd8240fe484e89d70d95ce45b22b266c409f5c23013e266e3bc6f87c250b36292e63f04b9891f85949e6978507d98a73570884073418e42fd99f40b0d8
-
C:\Users\Admin\AppData\Roaming\System\Oracle\smss.exeFilesize
114KB
MD5919b78ba094eb8f98f41165b5173468b
SHA1174f1bee60add9f9a1b24e954f35ce855fde3032
SHA2566747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71
SHA5120eca71bd8240fe484e89d70d95ce45b22b266c409f5c23013e266e3bc6f87c250b36292e63f04b9891f85949e6978507d98a73570884073418e42fd99f40b0d8
-
C:\Users\Admin\AppData\Roaming\System\Oracle\smss.exeFilesize
114KB
MD5919b78ba094eb8f98f41165b5173468b
SHA1174f1bee60add9f9a1b24e954f35ce855fde3032
SHA2566747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71
SHA5120eca71bd8240fe484e89d70d95ce45b22b266c409f5c23013e266e3bc6f87c250b36292e63f04b9891f85949e6978507d98a73570884073418e42fd99f40b0d8
-
C:\Users\Admin\AppData\Roaming\winupdateloader.exeFilesize
114KB
MD5919b78ba094eb8f98f41165b5173468b
SHA1174f1bee60add9f9a1b24e954f35ce855fde3032
SHA2566747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71
SHA5120eca71bd8240fe484e89d70d95ce45b22b266c409f5c23013e266e3bc6f87c250b36292e63f04b9891f85949e6978507d98a73570884073418e42fd99f40b0d8
-
C:\Users\Admin\AppData\Roaming\winupdateloader.exeFilesize
114KB
MD5919b78ba094eb8f98f41165b5173468b
SHA1174f1bee60add9f9a1b24e954f35ce855fde3032
SHA2566747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71
SHA5120eca71bd8240fe484e89d70d95ce45b22b266c409f5c23013e266e3bc6f87c250b36292e63f04b9891f85949e6978507d98a73570884073418e42fd99f40b0d8
-
C:\Users\Admin\AppData\Roaming\winupdateloader.exeFilesize
114KB
MD5919b78ba094eb8f98f41165b5173468b
SHA1174f1bee60add9f9a1b24e954f35ce855fde3032
SHA2566747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71
SHA5120eca71bd8240fe484e89d70d95ce45b22b266c409f5c23013e266e3bc6f87c250b36292e63f04b9891f85949e6978507d98a73570884073418e42fd99f40b0d8
-
C:\Users\Admin\AppData\Roaming\winupdateloader.exeFilesize
114KB
MD5919b78ba094eb8f98f41165b5173468b
SHA1174f1bee60add9f9a1b24e954f35ce855fde3032
SHA2566747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71
SHA5120eca71bd8240fe484e89d70d95ce45b22b266c409f5c23013e266e3bc6f87c250b36292e63f04b9891f85949e6978507d98a73570884073418e42fd99f40b0d8
-
C:\Users\Admin\AppData\Roaming\winupdateloader.exeFilesize
114KB
MD5919b78ba094eb8f98f41165b5173468b
SHA1174f1bee60add9f9a1b24e954f35ce855fde3032
SHA2566747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71
SHA5120eca71bd8240fe484e89d70d95ce45b22b266c409f5c23013e266e3bc6f87c250b36292e63f04b9891f85949e6978507d98a73570884073418e42fd99f40b0d8
-
C:\Users\Admin\AppData\Roaming\winupdateloader.exeFilesize
114KB
MD5919b78ba094eb8f98f41165b5173468b
SHA1174f1bee60add9f9a1b24e954f35ce855fde3032
SHA2566747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71
SHA5120eca71bd8240fe484e89d70d95ce45b22b266c409f5c23013e266e3bc6f87c250b36292e63f04b9891f85949e6978507d98a73570884073418e42fd99f40b0d8
-
C:\Users\Admin\AppData\Roaming\winupdateloader.exeFilesize
114KB
MD5919b78ba094eb8f98f41165b5173468b
SHA1174f1bee60add9f9a1b24e954f35ce855fde3032
SHA2566747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71
SHA5120eca71bd8240fe484e89d70d95ce45b22b266c409f5c23013e266e3bc6f87c250b36292e63f04b9891f85949e6978507d98a73570884073418e42fd99f40b0d8
-
C:\Users\Admin\AppData\Roaming\winupdateloader.exeFilesize
114KB
MD5919b78ba094eb8f98f41165b5173468b
SHA1174f1bee60add9f9a1b24e954f35ce855fde3032
SHA2566747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71
SHA5120eca71bd8240fe484e89d70d95ce45b22b266c409f5c23013e266e3bc6f87c250b36292e63f04b9891f85949e6978507d98a73570884073418e42fd99f40b0d8
-
C:\Users\Admin\AppData\Roaming\winupdateloader.exeFilesize
114KB
MD5919b78ba094eb8f98f41165b5173468b
SHA1174f1bee60add9f9a1b24e954f35ce855fde3032
SHA2566747a2a27e10336a97cf9c606aca001ae8c464bfd0300de6b6ee56c3158b5b71
SHA5120eca71bd8240fe484e89d70d95ce45b22b266c409f5c23013e266e3bc6f87c250b36292e63f04b9891f85949e6978507d98a73570884073418e42fd99f40b0d8
-
memory/1056-161-0x0000000074E70000-0x0000000075421000-memory.dmpFilesize
5.7MB
-
memory/1056-150-0x0000000000000000-mapping.dmp
-
memory/1056-154-0x0000000074E70000-0x0000000075421000-memory.dmpFilesize
5.7MB
-
memory/1056-155-0x0000000074E70000-0x0000000075421000-memory.dmpFilesize
5.7MB
-
memory/2420-133-0x0000000074F20000-0x00000000754D1000-memory.dmpFilesize
5.7MB
-
memory/2420-132-0x0000000074F20000-0x00000000754D1000-memory.dmpFilesize
5.7MB
-
memory/2420-138-0x0000000074F20000-0x00000000754D1000-memory.dmpFilesize
5.7MB
-
memory/3244-140-0x0000000000000000-mapping.dmp
-
memory/3244-152-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3244-149-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3244-148-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3244-146-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3244-143-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3244-142-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3244-141-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3636-147-0x0000000074F20000-0x00000000754D1000-memory.dmpFilesize
5.7MB
-
memory/3636-139-0x0000000074F20000-0x00000000754D1000-memory.dmpFilesize
5.7MB
-
memory/3636-137-0x0000000074F20000-0x00000000754D1000-memory.dmpFilesize
5.7MB
-
memory/3636-134-0x0000000000000000-mapping.dmp
-
memory/3804-160-0x0000000074E70000-0x0000000075421000-memory.dmpFilesize
5.7MB
-
memory/3804-156-0x0000000000000000-mapping.dmp
-
memory/3804-162-0x0000000074E70000-0x0000000075421000-memory.dmpFilesize
5.7MB
-
memory/3804-172-0x0000000074E70000-0x0000000075421000-memory.dmpFilesize
5.7MB
-
memory/4364-163-0x0000000000000000-mapping.dmp
-
memory/4364-169-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4364-177-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4364-173-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4364-171-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4568-186-0x0000000074EF0000-0x00000000754A1000-memory.dmpFilesize
5.7MB
-
memory/4568-182-0x0000000000000000-mapping.dmp
-
memory/4568-196-0x0000000074EF0000-0x00000000754A1000-memory.dmpFilesize
5.7MB
-
memory/4568-187-0x0000000074EF0000-0x00000000754A1000-memory.dmpFilesize
5.7MB
-
memory/4652-194-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4652-195-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4652-188-0x0000000000000000-mapping.dmp
-
memory/4652-197-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4808-181-0x0000000074EF0000-0x00000000754A1000-memory.dmpFilesize
5.7MB
-
memory/4808-185-0x0000000074EF0000-0x00000000754A1000-memory.dmpFilesize
5.7MB
-
memory/4808-175-0x0000000000000000-mapping.dmp
-
memory/4808-180-0x0000000074EF0000-0x00000000754A1000-memory.dmpFilesize
5.7MB