Analysis
-
max time kernel
164s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 14:15
Static task
static1
Behavioral task
behavioral1
Sample
9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exe
Resource
win10v2004-20220812-en
General
-
Target
9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exe
-
Size
3.0MB
-
MD5
1f940e2f51ca26ed781279ef62c15ed6
-
SHA1
0128493a43ce13652709628437f7142abe60b16b
-
SHA256
9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78
-
SHA512
3850bf301d8b925e9fb6c687c552af6d1e81931a9b2a365da0c701fae604457ef9dd287c5648c825e4e2fb522a0f280484c8ff5af745c446a82eaa360ae0f690
-
SSDEEP
49152:bXz+O50P0qdjy98BXzqPmb07DWkUdbnMxPucadyh5yLAd2TJwWpCRJltFhjW78Qx:bXz+UQxxyqBj4JDWkURi2caobCwWATir
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Executes dropped EXE 4 IoCs
Processes:
svchost.exeupdate_elf.exesvchost.exeupdate_elf.exepid process 1352 svchost.exe 4768 update_elf.exe 4416 svchost.exe 4308 update_elf.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
update_elf.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion update_elf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate update_elf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exe -
Drops startup file 1 IoCs
Processes:
9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\íå ðàññòðàèâàéñÿ.txt 9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winrar = "C:\\Users\\Admin\\AppData\\Local\\winrar.exe" svchost.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 2 IoCs
Processes:
9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exedescription ioc process File opened for modification C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\svchost.exe 9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exe File opened for modification C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\update_elf.exe 9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3396 4308 WerFault.exe update_elf.exe -
Modifies registry class 17 IoCs
Processes:
update_elf.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30695FD4-3069-5FD4-3069-5FD430695FD4}\InprocServer32\ = "C:\\Windows\\SysWOW64\\IME\\IMEJP\\imjpapi.dll" update_elf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30695FD4-3069-5FD4-3069-5FD430695FD4}\ProgID\ = "MSIME.Japan.FEDict.15" update_elf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30695FD4-3069-5FD4-3069-5FD430695FD4}\VersionIndependentProgID update_elf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30695FD4-3069-5FD4-3069-5FD430695FD4}\ = "Microsoft IME (Japanese) IFEDict" update_elf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30695FD4-3069-5FD4-3069-5FD430695FD4}\VersionIndependentProgID\ = "MSIME.Japan.FEDict" update_elf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30695FD4-3069-5FD4-3069-5FD430695FD4}\ = "Microsoft IME (Japanese) IFEDict" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30695FD4-3069-5FD4-3069-5FD430695FD4}\InprocServer32 svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30695FD4-3069-5FD4-3069-5FD430695FD4}\InprocServer32\ = "C:\\Windows\\SysWOW64\\IME\\IMEJP\\imjpapi.dll" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30695FD4-3069-5FD4-3069-5FD430695FD4}\ProgID svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30695FD4-3069-5FD4-3069-5FD430695FD4}\VersionIndependentProgID svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30695FD4-3069-5FD4-3069-5FD430695FD4}\InprocServer32\ThreadingModel = "Apartment" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30695FD4-3069-5FD4-3069-5FD430695FD4}\InprocServer32 update_elf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30695FD4-3069-5FD4-3069-5FD430695FD4}\InprocServer32\ThreadingModel = "Apartment" update_elf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30695FD4-3069-5FD4-3069-5FD430695FD4} update_elf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30695FD4-3069-5FD4-3069-5FD430695FD4}\ProgID\ = "MSIME.Japan.FEDict.15" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30695FD4-3069-5FD4-3069-5FD430695FD4}\VersionIndependentProgID\ = "MSIME.Japan.FEDict" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30695FD4-3069-5FD4-3069-5FD430695FD4}\ProgID update_elf.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
update_elf.exesvchost.exedescription pid process Token: 33 4308 update_elf.exe Token: SeIncBasePriorityPrivilege 4308 update_elf.exe Token: 33 4308 update_elf.exe Token: SeIncBasePriorityPrivilege 4308 update_elf.exe Token: 33 4416 svchost.exe Token: SeIncBasePriorityPrivilege 4416 svchost.exe Token: 33 4416 svchost.exe Token: SeIncBasePriorityPrivilege 4416 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exesvchost.exeupdate_elf.exedescription pid process target process PID 4088 wrote to memory of 1352 4088 9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exe svchost.exe PID 4088 wrote to memory of 1352 4088 9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exe svchost.exe PID 4088 wrote to memory of 1352 4088 9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exe svchost.exe PID 4088 wrote to memory of 4768 4088 9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exe update_elf.exe PID 4088 wrote to memory of 4768 4088 9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exe update_elf.exe PID 4088 wrote to memory of 4768 4088 9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exe update_elf.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 4768 wrote to memory of 4308 4768 update_elf.exe update_elf.exe PID 4768 wrote to memory of 4308 4768 update_elf.exe update_elf.exe PID 4768 wrote to memory of 4308 4768 update_elf.exe update_elf.exe PID 4768 wrote to memory of 4308 4768 update_elf.exe update_elf.exe PID 4768 wrote to memory of 4308 4768 update_elf.exe update_elf.exe PID 4768 wrote to memory of 4308 4768 update_elf.exe update_elf.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe PID 1352 wrote to memory of 4416 1352 svchost.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exe"C:\Users\Admin\AppData\Local\Temp\9e160d32d727b4b12519156e8ba8d8ef0f4b697343644bea02bfe87bfa0f5e78.exe"1⤵
- Checks computer location settings
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\svchost.exe"C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\svchost.exe"C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\svchost.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\update_elf.exe"C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\update_elf.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\update_elf.exe"C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\update_elf.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 12244⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4308 -ip 43081⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\svchost.exeFilesize
2.2MB
MD5f3822f3fdb660560c329de615a934d91
SHA119c41447d19ffaf4642838ab54c562c7519020cf
SHA25600bb37849fa4b011d473bc503ad10392baf1787bbb3570f1f72010e04816f7fd
SHA512a1990e97fca5377ee26ce88ed360d05456b3d8a0685c6bfaf7d54cc41d8cb7eaf7fd115bb063ecee5c562819826bb2a18019644e35025530dabf40b03b71e3b1
-
C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\svchost.exeFilesize
2.2MB
MD5f3822f3fdb660560c329de615a934d91
SHA119c41447d19ffaf4642838ab54c562c7519020cf
SHA25600bb37849fa4b011d473bc503ad10392baf1787bbb3570f1f72010e04816f7fd
SHA512a1990e97fca5377ee26ce88ed360d05456b3d8a0685c6bfaf7d54cc41d8cb7eaf7fd115bb063ecee5c562819826bb2a18019644e35025530dabf40b03b71e3b1
-
C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\svchost.exeFilesize
2.2MB
MD5f3822f3fdb660560c329de615a934d91
SHA119c41447d19ffaf4642838ab54c562c7519020cf
SHA25600bb37849fa4b011d473bc503ad10392baf1787bbb3570f1f72010e04816f7fd
SHA512a1990e97fca5377ee26ce88ed360d05456b3d8a0685c6bfaf7d54cc41d8cb7eaf7fd115bb063ecee5c562819826bb2a18019644e35025530dabf40b03b71e3b1
-
C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\update_elf.exeFilesize
1.8MB
MD5b389dbde8adc6b322ace14563fb1df65
SHA140a571cd08005336290165d8c90a9fa020bb8ba5
SHA256b653e0cdd78c9ab82cc09f6a9b5329b1d485e5b89b433b27d0ab5b4721d570d7
SHA512d74f929a45fbd8573afaa6a802eacaa20a4d16abce528526f124c708345a180fcfe98cbb34b010fa1cf9e542c87356911222650ae2a63c5074e8382a5aa95600
-
C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\update_elf.exeFilesize
1.8MB
MD5b389dbde8adc6b322ace14563fb1df65
SHA140a571cd08005336290165d8c90a9fa020bb8ba5
SHA256b653e0cdd78c9ab82cc09f6a9b5329b1d485e5b89b433b27d0ab5b4721d570d7
SHA512d74f929a45fbd8573afaa6a802eacaa20a4d16abce528526f124c708345a180fcfe98cbb34b010fa1cf9e542c87356911222650ae2a63c5074e8382a5aa95600
-
C:\Program Files (x86)\Èíôîðìàöèîííûå Ðåøåíèÿ\Ñïðàâî÷íàÿ èíôîðìàöèÿ!\update_elf.exeFilesize
1.8MB
MD5b389dbde8adc6b322ace14563fb1df65
SHA140a571cd08005336290165d8c90a9fa020bb8ba5
SHA256b653e0cdd78c9ab82cc09f6a9b5329b1d485e5b89b433b27d0ab5b4721d570d7
SHA512d74f929a45fbd8573afaa6a802eacaa20a4d16abce528526f124c708345a180fcfe98cbb34b010fa1cf9e542c87356911222650ae2a63c5074e8382a5aa95600
-
C:\ProgramData\TEMP\RAIDTestFilesize
4B
MD5959dedb23f3421e58d16c60eff6a367b
SHA17bdb5d6220d393c9020ba05bedeedb7fbb31b6ab
SHA256205549d84f02f8d00a6547a0259b5ce7728d3af0a248cac8a6d3fcda2b287ce0
SHA512c8151442fb6e2f0437550eb3e99f696f9fbd41230ee47d5de41223e2ad62e23bc1e7a05afb05d4a978b147f313fc9220282619d9b0dee594644573be22fbb491
-
memory/1352-132-0x0000000000000000-mapping.dmp
-
memory/1352-542-0x0000000000400000-0x00000000006CA000-memory.dmpFilesize
2.8MB
-
memory/1352-135-0x0000000000400000-0x00000000006CA000-memory.dmpFilesize
2.8MB
-
memory/4308-144-0x0000000000000000-mapping.dmp
-
memory/4308-151-0x0000000003400000-0x0000000003604000-memory.dmpFilesize
2.0MB
-
memory/4308-171-0x0000000003400000-0x0000000003604000-memory.dmpFilesize
2.0MB
-
memory/4308-169-0x0000000000400000-0x000000000064A000-memory.dmpFilesize
2.3MB
-
memory/4308-168-0x000000000040E000-0x000000000040F000-memory.dmpFilesize
4KB
-
memory/4308-160-0x0000000000400000-0x000000000064A000-memory.dmpFilesize
2.3MB
-
memory/4308-167-0x0000000000400000-0x000000000064A000-memory.dmpFilesize
2.3MB
-
memory/4308-163-0x0000000003400000-0x0000000003604000-memory.dmpFilesize
2.0MB
-
memory/4308-166-0x0000000000400000-0x000000000064A000-memory.dmpFilesize
2.3MB
-
memory/4308-165-0x0000000000400000-0x000000000064A000-memory.dmpFilesize
2.3MB
-
memory/4416-190-0x000000000040E000-0x000000000040F000-memory.dmpFilesize
4KB
-
memory/4416-201-0x000000000041E000-0x000000000041F000-memory.dmpFilesize
4KB
-
memory/4416-158-0x0000000000400000-0x00000000006CA000-memory.dmpFilesize
2.8MB
-
memory/4416-543-0x0000000000400000-0x00000000006CA000-memory.dmpFilesize
2.8MB
-
memory/4416-145-0x0000000002E00000-0x0000000003004000-memory.dmpFilesize
2.0MB
-
memory/4416-226-0x000000000043C000-0x000000000043D000-memory.dmpFilesize
4KB
-
memory/4416-172-0x0000000000400000-0x00000000006CA000-memory.dmpFilesize
2.8MB
-
memory/4416-174-0x0000000000400000-0x00000000006CA000-memory.dmpFilesize
2.8MB
-
memory/4416-173-0x0000000000400000-0x00000000006CA000-memory.dmpFilesize
2.8MB
-
memory/4416-176-0x0000000002E00000-0x0000000003004000-memory.dmpFilesize
2.0MB
-
memory/4416-182-0x0000000000411000-0x0000000000412000-memory.dmpFilesize
4KB
-
memory/4416-183-0x0000000000407000-0x0000000000408000-memory.dmpFilesize
4KB
-
memory/4416-184-0x000000000040D000-0x000000000040E000-memory.dmpFilesize
4KB
-
memory/4416-185-0x0000000000404000-0x0000000000405000-memory.dmpFilesize
4KB
-
memory/4416-186-0x0000000000402000-0x0000000000403000-memory.dmpFilesize
4KB
-
memory/4416-187-0x000000000040C000-0x000000000040D000-memory.dmpFilesize
4KB
-
memory/4416-188-0x000000000040B000-0x000000000040C000-memory.dmpFilesize
4KB
-
memory/4416-189-0x0000000000408000-0x0000000000409000-memory.dmpFilesize
4KB
-
memory/4416-138-0x0000000000000000-mapping.dmp
-
memory/4416-191-0x0000000000410000-0x0000000000411000-memory.dmpFilesize
4KB
-
memory/4416-192-0x000000000041A000-0x000000000041B000-memory.dmpFilesize
4KB
-
memory/4416-193-0x0000000000419000-0x000000000041A000-memory.dmpFilesize
4KB
-
memory/4416-194-0x0000000000412000-0x0000000000413000-memory.dmpFilesize
4KB
-
memory/4416-195-0x0000000000413000-0x0000000000414000-memory.dmpFilesize
4KB
-
memory/4416-196-0x0000000000414000-0x0000000000415000-memory.dmpFilesize
4KB
-
memory/4416-197-0x0000000000424000-0x0000000000425000-memory.dmpFilesize
4KB
-
memory/4416-198-0x0000000000425000-0x0000000000426000-memory.dmpFilesize
4KB
-
memory/4416-199-0x000000000041B000-0x000000000041C000-memory.dmpFilesize
4KB
-
memory/4416-200-0x0000000000423000-0x0000000000424000-memory.dmpFilesize
4KB
-
memory/4416-162-0x0000000002E00000-0x0000000003004000-memory.dmpFilesize
2.0MB
-
memory/4416-202-0x000000000041C000-0x000000000041D000-memory.dmpFilesize
4KB
-
memory/4416-203-0x0000000000443000-0x0000000000444000-memory.dmpFilesize
4KB
-
memory/4416-204-0x0000000000449000-0x000000000044A000-memory.dmpFilesize
4KB
-
memory/4416-205-0x0000000000430000-0x0000000000431000-memory.dmpFilesize
4KB
-
memory/4416-206-0x0000000000415000-0x0000000000416000-memory.dmpFilesize
4KB
-
memory/4416-207-0x0000000000444000-0x0000000000445000-memory.dmpFilesize
4KB
-
memory/4416-208-0x0000000000426000-0x0000000000427000-memory.dmpFilesize
4KB
-
memory/4416-209-0x0000000000429000-0x000000000042A000-memory.dmpFilesize
4KB
-
memory/4416-210-0x000000000042E000-0x000000000042F000-memory.dmpFilesize
4KB
-
memory/4416-211-0x0000000000428000-0x0000000000429000-memory.dmpFilesize
4KB
-
memory/4416-212-0x0000000000427000-0x0000000000428000-memory.dmpFilesize
4KB
-
memory/4416-213-0x0000000000409000-0x000000000040A000-memory.dmpFilesize
4KB
-
memory/4416-214-0x000000000042F000-0x0000000000430000-memory.dmpFilesize
4KB
-
memory/4416-215-0x000000000042A000-0x000000000042B000-memory.dmpFilesize
4KB
-
memory/4416-216-0x0000000000440000-0x0000000000441000-memory.dmpFilesize
4KB
-
memory/4416-217-0x0000000000431000-0x0000000000432000-memory.dmpFilesize
4KB
-
memory/4416-218-0x000000000044B000-0x000000000044C000-memory.dmpFilesize
4KB
-
memory/4416-219-0x0000000000452000-0x0000000000453000-memory.dmpFilesize
4KB
-
memory/4416-220-0x000000000044E000-0x000000000044F000-memory.dmpFilesize
4KB
-
memory/4416-223-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/4416-222-0x000000000041F000-0x0000000000420000-memory.dmpFilesize
4KB
-
memory/4416-221-0x0000000000453000-0x0000000000454000-memory.dmpFilesize
4KB
-
memory/4416-224-0x0000000000454000-0x0000000000455000-memory.dmpFilesize
4KB
-
memory/4416-225-0x0000000000455000-0x0000000000456000-memory.dmpFilesize
4KB
-
memory/4768-137-0x0000000000000000-mapping.dmp
-
memory/4768-170-0x0000000000400000-0x000000000064A000-memory.dmpFilesize
2.3MB
-
memory/4768-156-0x0000000000400000-0x000000000064A000-memory.dmpFilesize
2.3MB