Analysis
-
max time kernel
151s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 03:46
Static task
static1
Behavioral task
behavioral1
Sample
6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe
Resource
win7-20220812-en
General
-
Target
6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe
-
Size
649KB
-
MD5
28eb2401c10f2877daab62a6e749f6b0
-
SHA1
64f0e58afc44b1ef387df1d885678a287090a616
-
SHA256
6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d
-
SHA512
8671d339192ef77cc3a981ae8efed4d49480bfe2dce4efe4adf1fbda3551e59100aefe2e859d6b3c9fa9c60ff0857ce5c424046a7457e3e50c6d7b164f5a38fb
-
SSDEEP
6144:gCttNye+9aj4mOfaLzg89Vo/FGR0E7hMI4RJDNN2aXH16aaI6iul9FYLwHeNlllq:b9ROiLisxNMblHEaarFYL2euIzjsUAV
Malware Config
Extracted
cybergate
2.6
hack
ze-hack3r.zapto.org:81
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
true
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
Updater
-
install_file
Patch.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
This program is corrupted. Please verify all files and retry.
-
message_box_title
ERROR
-
password
123456
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
csc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run csc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Updater\\Patch.exe" csc.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run csc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Updater\\Patch.exe" csc.exe -
Executes dropped EXE 1 IoCs
Processes:
Patch.exepid process 1472 Patch.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
csc.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{1AIO6QTQ-88UI-2SFP-4V3R-T2T38L253QXS} csc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1AIO6QTQ-88UI-2SFP-4V3R-T2T38L253QXS}\StubPath = "C:\\Windows\\system32\\Updater\\Patch.exe Restart" csc.exe -
Processes:
resource yara_rule behavioral1/memory/1132-78-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/1132-84-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/524-89-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/524-96-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/524-99-0x0000000024080000-0x00000000240E2000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
csc.exepid process 524 csc.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
csc.exeWScript.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\Updater\\Patch.exe" csc.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run csc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\Updater\\Patch.exe" csc.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ecran = "C:\\Users\\Admin\\AppData\\Roaming\\ecran.exe" WScript.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run csc.exe -
Drops file in System32 directory 4 IoCs
Processes:
csc.execsc.exedescription ioc process File created C:\Windows\SysWOW64\Updater\Patch.exe csc.exe File opened for modification C:\Windows\SysWOW64\Updater\Patch.exe csc.exe File opened for modification C:\Windows\SysWOW64\Updater\Patch.exe csc.exe File opened for modification C:\Windows\SysWOW64\Updater\ csc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exedescription pid process target process PID 1556 set thread context of 1132 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe csc.exe PID 1556 set thread context of 1596 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe csc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.execsc.execsc.exepid process 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1132 csc.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe 1596 csc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
csc.exepid process 524 csc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.execsc.exedescription pid process Token: SeDebugPrivilege 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe Token: SeDebugPrivilege 524 csc.exe Token: SeDebugPrivilege 524 csc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.execsc.exedescription pid process target process PID 1556 wrote to memory of 616 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe cmd.exe PID 1556 wrote to memory of 616 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe cmd.exe PID 1556 wrote to memory of 616 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe cmd.exe PID 1556 wrote to memory of 616 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe cmd.exe PID 1556 wrote to memory of 1744 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe WScript.exe PID 1556 wrote to memory of 1744 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe WScript.exe PID 1556 wrote to memory of 1744 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe WScript.exe PID 1556 wrote to memory of 1744 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe WScript.exe PID 1556 wrote to memory of 1132 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe csc.exe PID 1556 wrote to memory of 1132 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe csc.exe PID 1556 wrote to memory of 1132 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe csc.exe PID 1556 wrote to memory of 1132 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe csc.exe PID 1556 wrote to memory of 1132 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe csc.exe PID 1556 wrote to memory of 1132 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe csc.exe PID 1556 wrote to memory of 1132 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe csc.exe PID 1556 wrote to memory of 1132 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe csc.exe PID 1556 wrote to memory of 1132 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe csc.exe PID 1556 wrote to memory of 1132 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe csc.exe PID 1556 wrote to memory of 1132 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe csc.exe PID 1556 wrote to memory of 1132 1556 6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe csc.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe PID 1132 wrote to memory of 2016 1132 csc.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe"C:\Users\Admin\AppData\Local\Temp\6778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C cd C:\Users\Admin\AppData\Roaming\ &&ren *.zgy *.exe && exit2⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MTemp104.vbs"2⤵
- Adds Run key to start application
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Updater\Patch.exe"C:\Windows\system32\Updater\Patch.exe"4⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MTemp104.vbsFilesize
248B
MD5226a406fb0187ed8966dbcefcf582d03
SHA13a2b8c28bfc6332f05458bcc251a2850e76ff949
SHA256db40e76b6a109be060619d0dd7103d3fe3eeafcabef02a4b47bc4ebfd287b2ff
SHA512dcf416c3575f6161f2f5362e8ab2bcf05d618d14c61f9e03a5b866bd9cf1064246285797850faee9db9ab08c97af02106fa517fdab883152e360b07a09793e1d
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
229KB
MD5c88b3d4e3ad00f13043fb033f7579403
SHA1ff5fa3819535dc91234d55aa7fd72f5b78d3b704
SHA256dd1e1492169070d11bd53144c60d0dc71633f6c2e81b41caa0b4d46baedfb126
SHA5126df35852874673a84c8614aea823bf5b59bc71192e2cdc98e97e6f29c6ca403ae81304ac91aa14599aeb593920b174fa6b04dbc64a5775555a25312c2ce83523
-
C:\Users\Admin\AppData\Roaming\ecran.zgyFilesize
649KB
MD528eb2401c10f2877daab62a6e749f6b0
SHA164f0e58afc44b1ef387df1d885678a287090a616
SHA2566778ccbc9de5d0a1403fc466e0d4ba7943056bbe7c5f1b1a1bdc6cc52073439d
SHA5128671d339192ef77cc3a981ae8efed4d49480bfe2dce4efe4adf1fbda3551e59100aefe2e859d6b3c9fa9c60ff0857ce5c424046a7457e3e50c6d7b164f5a38fb
-
C:\Windows\SysWOW64\Updater\Patch.exeFilesize
75KB
MD53d7d2e825c63ff501e896cf008c70d75
SHA124e1e56df2c1e85b224b4360235513e79f03d3fc
SHA256037fc52b8fc6089338eb456f2b45638ed36c42a4dca7ace391d166b2329838a1
SHA51257d06b2226221162e0b54eeea3de13af6386bd632d16f6ec0666da81e8e177157a778caf0e3df0fe6368ea0b0fd93dae92cbe3cbb8c484f9e1107ba371301f21
-
C:\Windows\SysWOW64\Updater\Patch.exeFilesize
75KB
MD53d7d2e825c63ff501e896cf008c70d75
SHA124e1e56df2c1e85b224b4360235513e79f03d3fc
SHA256037fc52b8fc6089338eb456f2b45638ed36c42a4dca7ace391d166b2329838a1
SHA51257d06b2226221162e0b54eeea3de13af6386bd632d16f6ec0666da81e8e177157a778caf0e3df0fe6368ea0b0fd93dae92cbe3cbb8c484f9e1107ba371301f21
-
\Windows\SysWOW64\Updater\Patch.exeFilesize
75KB
MD53d7d2e825c63ff501e896cf008c70d75
SHA124e1e56df2c1e85b224b4360235513e79f03d3fc
SHA256037fc52b8fc6089338eb456f2b45638ed36c42a4dca7ace391d166b2329838a1
SHA51257d06b2226221162e0b54eeea3de13af6386bd632d16f6ec0666da81e8e177157a778caf0e3df0fe6368ea0b0fd93dae92cbe3cbb8c484f9e1107ba371301f21
-
memory/524-96-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/524-82-0x0000000000000000-mapping.dmp
-
memory/524-99-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/524-89-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/524-87-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/616-55-0x0000000000000000-mapping.dmp
-
memory/1132-90-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1132-61-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1132-70-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1132-72-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1132-74-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1132-64-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1132-76-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1132-78-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/1132-68-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1132-84-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1132-67-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1132-62-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1132-66-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1132-71-0x000000000040BBF4-mapping.dmp
-
memory/1132-65-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1472-94-0x0000000000000000-mapping.dmp
-
memory/1556-75-0x0000000000425000-0x0000000000436000-memory.dmpFilesize
68KB
-
memory/1556-59-0x0000000075040000-0x00000000755EB000-memory.dmpFilesize
5.7MB
-
memory/1556-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmpFilesize
8KB
-
memory/1556-97-0x0000000075040000-0x00000000755EB000-memory.dmpFilesize
5.7MB
-
memory/1556-98-0x0000000000425000-0x0000000000436000-memory.dmpFilesize
68KB
-
memory/1556-113-0x0000000075040000-0x00000000755EB000-memory.dmpFilesize
5.7MB
-
memory/1556-114-0x0000000000425000-0x0000000000436000-memory.dmpFilesize
68KB
-
memory/1596-110-0x000000000040BBF4-mapping.dmp
-
memory/1596-115-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1596-116-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1596-117-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1744-57-0x0000000000000000-mapping.dmp