Analysis
-
max time kernel
151s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
15-02-2023 16:37
Static task
static1
Behavioral task
behavioral1
Sample
928b339a13c0dcfbaae8b9fc1d0489de4795a0f6c21b6d94832b30c31bf10907.exe
Resource
win10v2004-20220812-en
General
-
Target
928b339a13c0dcfbaae8b9fc1d0489de4795a0f6c21b6d94832b30c31bf10907.exe
-
Size
189KB
-
MD5
04b1711beba9284f46e355b5d22eed54
-
SHA1
a81642aec480505036852d22d5b8ee2bd76e604f
-
SHA256
928b339a13c0dcfbaae8b9fc1d0489de4795a0f6c21b6d94832b30c31bf10907
-
SHA512
d9c09a5761fa8637853c705e3bb5489f43bea5a36092712e7021e701bd2ca10edb9531653c8c58e5014afef243231d17ded7dac820e3225886ea57c1be8a90f9
-
SSDEEP
3072:d/ipHQ6o8/MXs3pTtKSKg4XTZLNJjgn1ZiYqRr7xW:JoHU8/MXs3pBqT9zjmWRr
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1544-133-0x00000000022A0000-0x00000000022A9000-memory.dmp family_smokeloader -
Panda Stealer payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1316-145-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer behavioral1/memory/1316-146-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer behavioral1/memory/1316-147-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer behavioral1/memory/1316-148-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
82BD.exe8A20.exe932A.exetwuihgdpid process 3204 82BD.exe 4708 8A20.exe 2064 932A.exe 1776 twuihgd -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{33E0FF4A-8D7A-453D-9637-8D342AFD96EB}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{29F82376-ECF3-421B-8501-FF69D876C6A9}.catalogItem svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8A20.exedescription pid process target process PID 4708 set thread context of 1316 4708 8A20.exe InstallUtil.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2332 2064 WerFault.exe 932A.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
twuihgd928b339a13c0dcfbaae8b9fc1d0489de4795a0f6c21b6d94832b30c31bf10907.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI twuihgd Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI twuihgd Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 928b339a13c0dcfbaae8b9fc1d0489de4795a0f6c21b6d94832b30c31bf10907.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 928b339a13c0dcfbaae8b9fc1d0489de4795a0f6c21b6d94832b30c31bf10907.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 928b339a13c0dcfbaae8b9fc1d0489de4795a0f6c21b6d94832b30c31bf10907.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI twuihgd -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
928b339a13c0dcfbaae8b9fc1d0489de4795a0f6c21b6d94832b30c31bf10907.exepid process 1544 928b339a13c0dcfbaae8b9fc1d0489de4795a0f6c21b6d94832b30c31bf10907.exe 1544 928b339a13c0dcfbaae8b9fc1d0489de4795a0f6c21b6d94832b30c31bf10907.exe 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3004 -
Suspicious behavior: MapViewOfSection 20 IoCs
Processes:
928b339a13c0dcfbaae8b9fc1d0489de4795a0f6c21b6d94832b30c31bf10907.exetwuihgdpid process 1544 928b339a13c0dcfbaae8b9fc1d0489de4795a0f6c21b6d94832b30c31bf10907.exe 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 1776 twuihgd -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
932A.exedescription pid process Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeDebugPrivilege 2064 932A.exe Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
pid process 3004 3004 3004 -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
pid process 3004 3004 3004 3004 3004 3004 -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
8A20.exedescription pid process target process PID 3004 wrote to memory of 3204 3004 82BD.exe PID 3004 wrote to memory of 3204 3004 82BD.exe PID 3004 wrote to memory of 4708 3004 8A20.exe PID 3004 wrote to memory of 4708 3004 8A20.exe PID 3004 wrote to memory of 4708 3004 8A20.exe PID 4708 wrote to memory of 1316 4708 8A20.exe InstallUtil.exe PID 4708 wrote to memory of 1316 4708 8A20.exe InstallUtil.exe PID 4708 wrote to memory of 1316 4708 8A20.exe InstallUtil.exe PID 4708 wrote to memory of 1316 4708 8A20.exe InstallUtil.exe PID 4708 wrote to memory of 1316 4708 8A20.exe InstallUtil.exe PID 4708 wrote to memory of 1316 4708 8A20.exe InstallUtil.exe PID 4708 wrote to memory of 1316 4708 8A20.exe InstallUtil.exe PID 4708 wrote to memory of 1316 4708 8A20.exe InstallUtil.exe PID 4708 wrote to memory of 1316 4708 8A20.exe InstallUtil.exe PID 4708 wrote to memory of 1316 4708 8A20.exe InstallUtil.exe PID 3004 wrote to memory of 2064 3004 932A.exe PID 3004 wrote to memory of 2064 3004 932A.exe PID 3004 wrote to memory of 2064 3004 932A.exe PID 3004 wrote to memory of 392 3004 explorer.exe PID 3004 wrote to memory of 392 3004 explorer.exe PID 3004 wrote to memory of 392 3004 explorer.exe PID 3004 wrote to memory of 392 3004 explorer.exe PID 3004 wrote to memory of 4572 3004 explorer.exe PID 3004 wrote to memory of 4572 3004 explorer.exe PID 3004 wrote to memory of 4572 3004 explorer.exe PID 3004 wrote to memory of 588 3004 explorer.exe PID 3004 wrote to memory of 588 3004 explorer.exe PID 3004 wrote to memory of 588 3004 explorer.exe PID 3004 wrote to memory of 588 3004 explorer.exe PID 3004 wrote to memory of 2640 3004 explorer.exe PID 3004 wrote to memory of 2640 3004 explorer.exe PID 3004 wrote to memory of 2640 3004 explorer.exe PID 3004 wrote to memory of 4604 3004 explorer.exe PID 3004 wrote to memory of 4604 3004 explorer.exe PID 3004 wrote to memory of 4604 3004 explorer.exe PID 3004 wrote to memory of 4604 3004 explorer.exe PID 3004 wrote to memory of 308 3004 explorer.exe PID 3004 wrote to memory of 308 3004 explorer.exe PID 3004 wrote to memory of 308 3004 explorer.exe PID 3004 wrote to memory of 308 3004 explorer.exe PID 3004 wrote to memory of 212 3004 explorer.exe PID 3004 wrote to memory of 212 3004 explorer.exe PID 3004 wrote to memory of 212 3004 explorer.exe PID 3004 wrote to memory of 212 3004 explorer.exe PID 3004 wrote to memory of 3804 3004 explorer.exe PID 3004 wrote to memory of 3804 3004 explorer.exe PID 3004 wrote to memory of 3804 3004 explorer.exe PID 3004 wrote to memory of 1896 3004 explorer.exe PID 3004 wrote to memory of 1896 3004 explorer.exe PID 3004 wrote to memory of 1896 3004 explorer.exe PID 3004 wrote to memory of 1896 3004 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\928b339a13c0dcfbaae8b9fc1d0489de4795a0f6c21b6d94832b30c31bf10907.exe"C:\Users\Admin\AppData\Local\Temp\928b339a13c0dcfbaae8b9fc1d0489de4795a0f6c21b6d94832b30c31bf10907.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\82BD.exeC:\Users\Admin\AppData\Local\Temp\82BD.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\8A20.exeC:\Users\Admin\AppData\Local\Temp\8A20.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\932A.exeC:\Users\Admin\AppData\Local\Temp\932A.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 12202⤵
- Program crash
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 2064 -ip 20641⤵
-
C:\Users\Admin\AppData\Roaming\twuihgdC:\Users\Admin\AppData\Roaming\twuihgd1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\82BD.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\82BD.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\8A20.exeFilesize
3.1MB
MD59be366e3eead805c905977cf03900368
SHA12b54c4b41e4cf54beb888bad6b795d9bc0179554
SHA2561ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847
SHA512d8adccf92392248f5674cc1b69c9533add0913b0307194d41ba78d81b533f57ec4b39e225bd0656441f70214a01cf0a9d64adcf307e06548f0b2f138bc68871f
-
C:\Users\Admin\AppData\Local\Temp\8A20.exeFilesize
3.1MB
MD59be366e3eead805c905977cf03900368
SHA12b54c4b41e4cf54beb888bad6b795d9bc0179554
SHA2561ab08663f123eceac52565a05cf46d5eacabf57c02ac401cbfb6258f6b099847
SHA512d8adccf92392248f5674cc1b69c9533add0913b0307194d41ba78d81b533f57ec4b39e225bd0656441f70214a01cf0a9d64adcf307e06548f0b2f138bc68871f
-
C:\Users\Admin\AppData\Local\Temp\932A.exeFilesize
299KB
MD54044277808862af81c94098f33ef040d
SHA1d249a425325fb6cf3ff431450492e5e8467cfe07
SHA25600f8d989336d2e4e3a4544f8bdb5ae97500f16e3d0dc262a78d7e75f9abe3288
SHA512cc88af60599447479d49b0ffe2ef78a211a4b597d7171ab8105595f4809c0e363e5dba66b5f0cf3b2957fc5df1b9589e730d10235af0dff5bdbd957686435039
-
C:\Users\Admin\AppData\Local\Temp\932A.exeFilesize
299KB
MD54044277808862af81c94098f33ef040d
SHA1d249a425325fb6cf3ff431450492e5e8467cfe07
SHA25600f8d989336d2e4e3a4544f8bdb5ae97500f16e3d0dc262a78d7e75f9abe3288
SHA512cc88af60599447479d49b0ffe2ef78a211a4b597d7171ab8105595f4809c0e363e5dba66b5f0cf3b2957fc5df1b9589e730d10235af0dff5bdbd957686435039
-
C:\Users\Admin\AppData\Roaming\twuihgdFilesize
189KB
MD504b1711beba9284f46e355b5d22eed54
SHA1a81642aec480505036852d22d5b8ee2bd76e604f
SHA256928b339a13c0dcfbaae8b9fc1d0489de4795a0f6c21b6d94832b30c31bf10907
SHA512d9c09a5761fa8637853c705e3bb5489f43bea5a36092712e7021e701bd2ca10edb9531653c8c58e5014afef243231d17ded7dac820e3225886ea57c1be8a90f9
-
C:\Users\Admin\AppData\Roaming\twuihgdFilesize
189KB
MD504b1711beba9284f46e355b5d22eed54
SHA1a81642aec480505036852d22d5b8ee2bd76e604f
SHA256928b339a13c0dcfbaae8b9fc1d0489de4795a0f6c21b6d94832b30c31bf10907
SHA512d9c09a5761fa8637853c705e3bb5489f43bea5a36092712e7021e701bd2ca10edb9531653c8c58e5014afef243231d17ded7dac820e3225886ea57c1be8a90f9
-
memory/212-171-0x0000000000A60000-0x0000000000A66000-memory.dmpFilesize
24KB
-
memory/212-172-0x0000000000A50000-0x0000000000A5B000-memory.dmpFilesize
44KB
-
memory/212-197-0x0000000000A60000-0x0000000000A66000-memory.dmpFilesize
24KB
-
memory/212-170-0x0000000000000000-mapping.dmp
-
memory/308-167-0x0000000000000000-mapping.dmp
-
memory/308-169-0x00000000012F0000-0x00000000012F9000-memory.dmpFilesize
36KB
-
memory/308-193-0x0000000001300000-0x0000000001305000-memory.dmpFilesize
20KB
-
memory/308-168-0x0000000001300000-0x0000000001305000-memory.dmpFilesize
20KB
-
memory/392-183-0x0000000000AF0000-0x0000000000AF7000-memory.dmpFilesize
28KB
-
memory/392-152-0x0000000000000000-mapping.dmp
-
memory/392-155-0x0000000000AE0000-0x0000000000AEB000-memory.dmpFilesize
44KB
-
memory/392-154-0x0000000000AF0000-0x0000000000AF7000-memory.dmpFilesize
28KB
-
memory/588-188-0x0000000001300000-0x0000000001305000-memory.dmpFilesize
20KB
-
memory/588-157-0x0000000000000000-mapping.dmp
-
memory/588-160-0x00000000012F0000-0x00000000012F9000-memory.dmpFilesize
36KB
-
memory/588-159-0x0000000001300000-0x0000000001305000-memory.dmpFilesize
20KB
-
memory/1316-145-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/1316-147-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/1316-148-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/1316-146-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/1316-144-0x0000000000000000-mapping.dmp
-
memory/1544-134-0x0000000000400000-0x0000000000561000-memory.dmpFilesize
1.4MB
-
memory/1544-132-0x0000000000788000-0x000000000079B000-memory.dmpFilesize
76KB
-
memory/1544-135-0x0000000000400000-0x0000000000561000-memory.dmpFilesize
1.4MB
-
memory/1544-133-0x00000000022A0000-0x00000000022A9000-memory.dmpFilesize
36KB
-
memory/1776-207-0x0000000000828000-0x000000000083B000-memory.dmpFilesize
76KB
-
memory/1776-208-0x0000000000400000-0x0000000000561000-memory.dmpFilesize
1.4MB
-
memory/1776-209-0x0000000000400000-0x0000000000561000-memory.dmpFilesize
1.4MB
-
memory/1896-203-0x0000000000B70000-0x0000000000B78000-memory.dmpFilesize
32KB
-
memory/1896-181-0x0000000000B60000-0x0000000000B6B000-memory.dmpFilesize
44KB
-
memory/1896-180-0x0000000000B70000-0x0000000000B78000-memory.dmpFilesize
32KB
-
memory/1896-178-0x0000000000000000-mapping.dmp
-
memory/2064-184-0x0000000005620000-0x0000000005C38000-memory.dmpFilesize
6.1MB
-
memory/2064-201-0x0000000000669000-0x0000000000696000-memory.dmpFilesize
180KB
-
memory/2064-204-0x0000000000400000-0x000000000057D000-memory.dmpFilesize
1.5MB
-
memory/2064-202-0x00000000020C0000-0x0000000002122000-memory.dmpFilesize
392KB
-
memory/2064-199-0x0000000006F60000-0x0000000006F7E000-memory.dmpFilesize
120KB
-
memory/2064-177-0x00000000020C0000-0x0000000002122000-memory.dmpFilesize
392KB
-
memory/2064-149-0x0000000000000000-mapping.dmp
-
memory/2064-179-0x0000000000400000-0x000000000057D000-memory.dmpFilesize
1.5MB
-
memory/2064-176-0x0000000000669000-0x0000000000696000-memory.dmpFilesize
180KB
-
memory/2064-198-0x0000000006910000-0x0000000006E3C000-memory.dmpFilesize
5.2MB
-
memory/2064-182-0x0000000005070000-0x0000000005614000-memory.dmpFilesize
5.6MB
-
memory/2064-196-0x0000000006730000-0x00000000068F2000-memory.dmpFilesize
1.8MB
-
memory/2064-195-0x0000000006650000-0x00000000066C6000-memory.dmpFilesize
472KB
-
memory/2064-185-0x0000000002A70000-0x0000000002A82000-memory.dmpFilesize
72KB
-
memory/2064-186-0x0000000004E70000-0x0000000004F7A000-memory.dmpFilesize
1.0MB
-
memory/2064-194-0x00000000064A0000-0x0000000006532000-memory.dmpFilesize
584KB
-
memory/2064-192-0x0000000005DD0000-0x0000000005E36000-memory.dmpFilesize
408KB
-
memory/2064-189-0x0000000002A90000-0x0000000002ACC000-memory.dmpFilesize
240KB
-
memory/2640-161-0x0000000000000000-mapping.dmp
-
memory/2640-162-0x0000000000890000-0x0000000000896000-memory.dmpFilesize
24KB
-
memory/2640-163-0x0000000000880000-0x000000000088C000-memory.dmpFilesize
48KB
-
memory/2640-190-0x0000000000890000-0x0000000000896000-memory.dmpFilesize
24KB
-
memory/3204-140-0x00007FFD6C980000-0x00007FFD6D441000-memory.dmpFilesize
10.8MB
-
memory/3204-139-0x0000000000DA0000-0x0000000000DA8000-memory.dmpFilesize
32KB
-
memory/3204-136-0x0000000000000000-mapping.dmp
-
memory/3804-173-0x0000000000000000-mapping.dmp
-
memory/3804-175-0x0000000000A00000-0x0000000000A0D000-memory.dmpFilesize
52KB
-
memory/3804-200-0x0000000000A10000-0x0000000000A17000-memory.dmpFilesize
28KB
-
memory/3804-174-0x0000000000A10000-0x0000000000A17000-memory.dmpFilesize
28KB
-
memory/4572-156-0x0000000000B80000-0x0000000000B8F000-memory.dmpFilesize
60KB
-
memory/4572-187-0x0000000000B90000-0x0000000000B99000-memory.dmpFilesize
36KB
-
memory/4572-153-0x0000000000000000-mapping.dmp
-
memory/4572-158-0x0000000000B90000-0x0000000000B99000-memory.dmpFilesize
36KB
-
memory/4604-166-0x00000000012F0000-0x0000000001317000-memory.dmpFilesize
156KB
-
memory/4604-164-0x0000000000000000-mapping.dmp
-
memory/4604-165-0x0000000001320000-0x0000000001342000-memory.dmpFilesize
136KB
-
memory/4604-191-0x0000000001320000-0x0000000001342000-memory.dmpFilesize
136KB
-
memory/4708-141-0x0000000000000000-mapping.dmp