Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
09-01-2023 15:58
General
-
Target
SCAN_DT6281.html
-
Size
1.2MB
-
MD5
f0b615c8a648722fcdcc6a1f055c0bc0
-
SHA1
5e6a22b9044c9d684a3392391b23a762182ef5b3
-
SHA256
4efc4cc462a27245945ee90465caef589b71c41b33bf6d24ce2e6f74b75fdbe7
-
SHA512
9a5de209c7eaa3f0766fa0c4448302fd778401da9720347b5a4e5ae10eb6e6a065b7a86391c8dcac1d38f998ed4091b6a21fbcc3ad8f717e1e16737b757e2d75
-
SSDEEP
24576:dcEyMGTCmlO13OxIZGrntxnlvdcA09Xq3RzKJzIcZBENivdcAEYMfvG:qB8eDnt5Bx+AUBDxFMfO
Score
10/10
Malware Config
Extracted
Family
qakbot
Version
404.30
Botnet
azd
Campaign
1670515354
C2
136.35.241.159:443
73.36.196.11:443
12.172.173.82:50001
190.24.45.24:995
193.253.100.236:2222
109.11.175.42:2222
92.8.190.211:2222
50.90.249.161:443
66.180.226.117:2222
201.208.139.250:2222
12.172.173.82:22
75.98.154.19:443
24.142.218.202:443
70.77.116.233:443
90.4.193.117:2222
24.69.87.61:443
98.147.155.235:443
83.213.192.136:443
176.133.4.230:995
71.31.101.183:443
Attributes
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Signatures
-
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies data under HKEY_USERS 2 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
-
Suspicious use of FindShellTrayWindow 34 IoCs
-
Suspicious use of SendNotifyMessage 24 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Users\Admin\AppData\Local\Temp\SCAN_DT6281.html1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd16304f50,0x7ffd16304f60,0x7ffd16304f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1576 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1644 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2336 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2576 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2512 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4024 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4680 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5308 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5096 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5116 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5100 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1668 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5568 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2112 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5468 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3188 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3096 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2140 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1536,14162362500337127370,12705472479773280637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5572 /prefetch:82⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c IncomingPay\Issues.cmd A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 91⤵
- Enumerates connected drives
-
C:\Windows\system32\regsvr32.exeregsvr32 /s newinformation.lc2⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s newinformation.lc3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c IncomingPay\Issues.cmd A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 91⤵
- Enumerates connected drives
-
C:\Windows\system32\regsvr32.exeregsvr32 /s newinformation.lc2⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s newinformation.lc3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\pipe\crashpad_3824_ZMLHUTLFTEATURPWMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1056-284-0x0000000000000000-mapping.dmp
-
memory/1056-308-0x0000000002BA0000-0x0000000002BCA000-memory.dmpFilesize
168KB
-
memory/1056-328-0x0000000002BA0000-0x0000000002BCA000-memory.dmpFilesize
168KB
-
memory/2204-117-0x0000000000000000-mapping.dmp
-
memory/2272-139-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-154-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-121-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-122-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-123-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-124-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-125-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-126-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-127-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-128-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-129-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-131-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-132-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-133-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-134-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-135-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-137-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-138-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-140-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-142-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-144-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-146-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-149-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-151-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-153-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-159-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-155-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-158-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-152-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-150-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-148-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-147-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-145-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-143-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-141-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-119-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-136-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-130-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-118-0x0000000000000000-mapping.dmp
-
memory/2272-120-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-156-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-160-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-161-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-162-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-163-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-164-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-165-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-166-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-167-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/2272-168-0x0000000000850000-0x00000000008FE000-memory.dmpFilesize
696KB
-
memory/2272-169-0x0000000002CD0000-0x0000000002CFA000-memory.dmpFilesize
168KB
-
memory/2272-213-0x0000000000850000-0x0000000000854000-memory.dmpFilesize
16KB
-
memory/2272-215-0x0000000002CD0000-0x0000000002CFA000-memory.dmpFilesize
168KB
-
memory/2272-157-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3952-182-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3952-171-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3952-173-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3952-174-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3952-175-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3952-176-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3952-177-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3952-178-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3952-179-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3952-180-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3952-181-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3952-172-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3952-183-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3952-184-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3952-185-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/3952-207-0x0000000002EA0000-0x0000000002ECA000-memory.dmpFilesize
168KB
-
memory/3952-230-0x0000000002EA0000-0x0000000002ECA000-memory.dmpFilesize
168KB
-
memory/3952-170-0x0000000000000000-mapping.dmp
-
memory/4808-282-0x00000000006A0000-0x00000000007EA000-memory.dmpFilesize
1.3MB
-
memory/4808-232-0x0000000000000000-mapping.dmp
-
memory/4808-327-0x0000000000810000-0x000000000083A000-memory.dmpFilesize
168KB
-
memory/4808-283-0x0000000000810000-0x000000000083A000-memory.dmpFilesize
168KB
-
memory/5040-231-0x0000000000000000-mapping.dmp