Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 12:06
Static task
static1
Behavioral task
behavioral1
Sample
fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exe
Resource
win10v2004-20230220-en
General
-
Target
fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exe
-
Size
884KB
-
MD5
083de0a909532eb3348578a7beb95bca
-
SHA1
29e83783b3fe5a4e483dec157141f066a6af7026
-
SHA256
fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828
-
SHA512
5c599d3d780886f2b259fd457c976833a6fb3b48e870fda1a58271637cfeda6cbaeae5a2fbb6308496477d6e6fffd9e6f910860b6dda8e7f44c880fd97a3a932
-
SSDEEP
12288:Cb8A+lyMML0gN55kXFyqf0bGBvGoE3IhAf1nAhglR:C4ZzML0gN5WXFaK9GoEHf1nAhglR
Malware Config
Extracted
xloader
2.5
euv4
anniebapartments.com
hagenbicycles.com
herbalist101.com
southerncorrosion.net
kuechenpruefer.com
tajniezdrzi.quest
segurofunerarioar.com
boardsandbeamsdecor.com
alifdanismanlik.com
pkem.top
mddc.clinic
handejqr.com
crux-at.com
awp.email
hugsforbubbs.com
cielotherepy.com
turkcuyuz.com
teamidc.com
lankasirinspa.com
68135.online
oprimanumerodos.com
launchclik.com
customapronsnow.com
thecuratedpour.com
20dzwww.com
encludemedia.com
kreativevisibility.net
mehfeels.com
oecmgroup.com
alert78.info
1207rossmoyne.com
spbutoto.com
t1uba.com
protection-onepa.com
byausorsm26-plala.xyz
bestpleasure4u.com
allmnlenem.quest
mobilpartes.com
fabio.tools
bubu3cin.com
nathanmartinez.digital
shristiprintingplaces.com
silkyflawless.com
berylgrote.top
laidbackfurniture.store
leatherman-neal.com
uschargeport.com
the-pumps.com
deepootech.com
drimev.com
seo-art.agency
jasabacklinkweb20.com
tracynicolalamond.com
dandtglaziers.com
vulacils.com
bendyourtongue.com
gulfund.com
ahmadfaizlajis.com
595531.com
metavillagehub.com
librairie-adrienne.com
77777.store
gongwenbo.com
game2plays.com
rematedeldia.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1164-134-0x0000000002450000-0x000000000247C000-memory.dmp modiloader_stage2 -
Xloader payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1164-184-0x0000000010410000-0x0000000010439000-memory.dmp xloader behavioral2/memory/3688-191-0x0000000010410000-0x0000000010439000-memory.dmp xloader behavioral2/memory/3688-197-0x0000000010410000-0x0000000010439000-memory.dmp xloader behavioral2/memory/736-198-0x0000000000FD0000-0x0000000000FF9000-memory.dmp xloader behavioral2/memory/736-200-0x0000000000FD0000-0x0000000000FF9000-memory.dmp xloader -
Executes dropped EXE 1 IoCs
Processes:
easinvoker.exepid process 228 easinvoker.exe -
Loads dropped DLL 1 IoCs
Processes:
easinvoker.exepid process 228 easinvoker.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Itfzmikw = "C:\\Users\\Public\\Libraries\\wkimzftI.url" fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
iexpress.exechkdsk.exedescription pid process target process PID 3688 set thread context of 1968 3688 iexpress.exe Explorer.EXE PID 3688 set thread context of 1968 3688 iexpress.exe Explorer.EXE PID 736 set thread context of 1968 736 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
xcopy.exexcopy.exexcopy.exechkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
powershell.exefdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exeiexpress.exechkdsk.exepid process 860 powershell.exe 860 powershell.exe 1164 fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exe 1164 fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exe 3688 iexpress.exe 3688 iexpress.exe 3688 iexpress.exe 3688 iexpress.exe 3688 iexpress.exe 3688 iexpress.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe 736 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1968 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
iexpress.exechkdsk.exepid process 3688 iexpress.exe 3688 iexpress.exe 3688 iexpress.exe 3688 iexpress.exe 736 chkdsk.exe 736 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
powershell.exeiexpress.exeExplorer.EXEchkdsk.exedescription pid process Token: SeDebugPrivilege 860 powershell.exe Token: SeDebugPrivilege 3688 iexpress.exe Token: SeShutdownPrivilege 1968 Explorer.EXE Token: SeCreatePagefilePrivilege 1968 Explorer.EXE Token: SeShutdownPrivilege 1968 Explorer.EXE Token: SeCreatePagefilePrivilege 1968 Explorer.EXE Token: SeDebugPrivilege 736 chkdsk.exe Token: SeShutdownPrivilege 1968 Explorer.EXE Token: SeCreatePagefilePrivilege 1968 Explorer.EXE Token: SeShutdownPrivilege 1968 Explorer.EXE Token: SeCreatePagefilePrivilege 1968 Explorer.EXE Token: SeShutdownPrivilege 1968 Explorer.EXE Token: SeCreatePagefilePrivilege 1968 Explorer.EXE Token: SeShutdownPrivilege 1968 Explorer.EXE Token: SeCreatePagefilePrivilege 1968 Explorer.EXE -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.execmd.exeeasinvoker.execmd.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1164 wrote to memory of 496 1164 fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exe cmd.exe PID 1164 wrote to memory of 496 1164 fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exe cmd.exe PID 1164 wrote to memory of 496 1164 fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exe cmd.exe PID 496 wrote to memory of 1896 496 cmd.exe cmd.exe PID 496 wrote to memory of 1896 496 cmd.exe cmd.exe PID 496 wrote to memory of 1896 496 cmd.exe cmd.exe PID 496 wrote to memory of 2804 496 cmd.exe xcopy.exe PID 496 wrote to memory of 2804 496 cmd.exe xcopy.exe PID 496 wrote to memory of 2804 496 cmd.exe xcopy.exe PID 496 wrote to memory of 1996 496 cmd.exe cmd.exe PID 496 wrote to memory of 1996 496 cmd.exe cmd.exe PID 496 wrote to memory of 1996 496 cmd.exe cmd.exe PID 496 wrote to memory of 560 496 cmd.exe xcopy.exe PID 496 wrote to memory of 560 496 cmd.exe xcopy.exe PID 496 wrote to memory of 560 496 cmd.exe xcopy.exe PID 496 wrote to memory of 3360 496 cmd.exe cmd.exe PID 496 wrote to memory of 3360 496 cmd.exe cmd.exe PID 496 wrote to memory of 3360 496 cmd.exe cmd.exe PID 496 wrote to memory of 1400 496 cmd.exe xcopy.exe PID 496 wrote to memory of 1400 496 cmd.exe xcopy.exe PID 496 wrote to memory of 1400 496 cmd.exe xcopy.exe PID 496 wrote to memory of 228 496 cmd.exe easinvoker.exe PID 496 wrote to memory of 228 496 cmd.exe easinvoker.exe PID 228 wrote to memory of 4148 228 easinvoker.exe cmd.exe PID 228 wrote to memory of 4148 228 easinvoker.exe cmd.exe PID 496 wrote to memory of 1972 496 cmd.exe PING.EXE PID 496 wrote to memory of 1972 496 cmd.exe PING.EXE PID 496 wrote to memory of 1972 496 cmd.exe PING.EXE PID 4148 wrote to memory of 860 4148 cmd.exe powershell.exe PID 4148 wrote to memory of 860 4148 cmd.exe powershell.exe PID 1164 wrote to memory of 3688 1164 fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exe iexpress.exe PID 1164 wrote to memory of 3688 1164 fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exe iexpress.exe PID 1164 wrote to memory of 3688 1164 fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exe iexpress.exe PID 1164 wrote to memory of 3688 1164 fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exe iexpress.exe PID 1164 wrote to memory of 3688 1164 fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exe iexpress.exe PID 1164 wrote to memory of 3688 1164 fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exe iexpress.exe PID 1968 wrote to memory of 736 1968 Explorer.EXE chkdsk.exe PID 1968 wrote to memory of 736 1968 Explorer.EXE chkdsk.exe PID 1968 wrote to memory of 736 1968 Explorer.EXE chkdsk.exe PID 736 wrote to memory of 4296 736 chkdsk.exe cmd.exe PID 736 wrote to memory of 4296 736 chkdsk.exe cmd.exe PID 736 wrote to memory of 4296 736 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exe"C:\Users\Admin\AppData\Local\Temp\fdff6b98ec2be3abdd05531d36bc50d514d449dc6f753fb6aa8d4657e5669828.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\ItfzmikwO.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO F"4⤵
-
C:\Windows\SysWOW64\xcopy.exexcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y4⤵
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO F"4⤵
-
C:\Windows\SysWOW64\xcopy.exexcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y4⤵
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO F"4⤵
-
C:\Windows\SysWOW64\xcopy.exexcopy "KDECO.bat" "C:\Windows \System32\" /K /D /H /Y4⤵
- Enumerates system info in registry
-
C:\Windows \System32\easinvoker.exe"C:\Windows \System32\easinvoker.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 64⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\iexpress.exeC:\Windows\System32\iexpress.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\iexpress.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2xnajz23.5mt.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Public\Libraries\ItfzmikwO.batFilesize
411B
MD555aba243e88f6a6813c117ffe1fa5979
SHA1210b9b028a4b798c837a182321dbf2e50d112816
SHA2565a11c5641c476891aa30e7ecfa57c2639f6827d8640061f73e9afec0adbbd7d2
SHA51268009c4c9bbea75a3bfa9f79945d30957a95691ea405d031b4ca7f1cb47504bbc768fcae59173885743ad4d6cfdd2313c3fe0acb515e34e5c809ecdc7f45e307
-
C:\Users\Public\Libraries\KDECO.batFilesize
155B
MD5213c60adf1c9ef88dc3c9b2d579959d2
SHA1e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021
SHA25637c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e
SHA512fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7
-
C:\Users\Public\Libraries\easinvoker.exeFilesize
128KB
MD5231ce1e1d7d98b44371ffff407d68b59
SHA125510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA25630951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612
-
C:\Users\Public\Libraries\netutils.dllFilesize
110KB
MD5b375e74a145c45d07190212e9157e5f8
SHA159d3de7748e1090ce95523601224ce5ab6cc4a3a
SHA2566ec341496722bfdde504d430a7ece494701a9369b1fa5376ec488a77ab3c1744
SHA512859737afb6108f131c0ac35560878359505c4f7fdd01ce468c04b15848df71f70987552a831a43ce948a37c9b1d6a434ff7f6fb5946f3730049b924d5b462ef0
-
C:\Windows \System32\easinvoker.exeFilesize
128KB
MD5231ce1e1d7d98b44371ffff407d68b59
SHA125510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA25630951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612
-
C:\Windows \System32\easinvoker.exeFilesize
128KB
MD5231ce1e1d7d98b44371ffff407d68b59
SHA125510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA25630951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612
-
C:\Windows \System32\netutils.dllFilesize
110KB
MD5b375e74a145c45d07190212e9157e5f8
SHA159d3de7748e1090ce95523601224ce5ab6cc4a3a
SHA2566ec341496722bfdde504d430a7ece494701a9369b1fa5376ec488a77ab3c1744
SHA512859737afb6108f131c0ac35560878359505c4f7fdd01ce468c04b15848df71f70987552a831a43ce948a37c9b1d6a434ff7f6fb5946f3730049b924d5b462ef0
-
C:\Windows \System32\netutils.dllFilesize
110KB
MD5b375e74a145c45d07190212e9157e5f8
SHA159d3de7748e1090ce95523601224ce5ab6cc4a3a
SHA2566ec341496722bfdde504d430a7ece494701a9369b1fa5376ec488a77ab3c1744
SHA512859737afb6108f131c0ac35560878359505c4f7fdd01ce468c04b15848df71f70987552a831a43ce948a37c9b1d6a434ff7f6fb5946f3730049b924d5b462ef0
-
C:\windows \system32\KDECO.batFilesize
155B
MD5213c60adf1c9ef88dc3c9b2d579959d2
SHA1e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021
SHA25637c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e
SHA512fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7
-
memory/228-166-0x00000000613C0000-0x00000000613E2000-memory.dmpFilesize
136KB
-
memory/736-196-0x0000000000390000-0x000000000039A000-memory.dmpFilesize
40KB
-
memory/736-202-0x0000000001720000-0x00000000017B0000-memory.dmpFilesize
576KB
-
memory/736-200-0x0000000000FD0000-0x0000000000FF9000-memory.dmpFilesize
164KB
-
memory/736-199-0x0000000001890000-0x0000000001BDA000-memory.dmpFilesize
3.3MB
-
memory/736-198-0x0000000000FD0000-0x0000000000FF9000-memory.dmpFilesize
164KB
-
memory/736-195-0x0000000000390000-0x000000000039A000-memory.dmpFilesize
40KB
-
memory/860-175-0x000002184E830000-0x000002184E852000-memory.dmpFilesize
136KB
-
memory/1164-133-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1164-134-0x0000000002450000-0x000000000247C000-memory.dmpFilesize
176KB
-
memory/1164-136-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB
-
memory/1164-183-0x0000000010410000-0x0000000010439000-memory.dmpFilesize
164KB
-
memory/1164-184-0x0000000010410000-0x0000000010439000-memory.dmpFilesize
164KB
-
memory/1968-204-0x00000000094C0000-0x00000000095AB000-memory.dmpFilesize
940KB
-
memory/1968-220-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-193-0x00000000092C0000-0x000000000938C000-memory.dmpFilesize
816KB
-
memory/1968-248-0x0000000001470000-0x0000000001472000-memory.dmpFilesize
8KB
-
memory/1968-247-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-246-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-190-0x0000000009160000-0x00000000092BB000-memory.dmpFilesize
1.4MB
-
memory/1968-245-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-203-0x00000000094C0000-0x00000000095AB000-memory.dmpFilesize
940KB
-
memory/1968-244-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-209-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-210-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-211-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-212-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-213-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-214-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-215-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-216-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-218-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-217-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-219-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-243-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-221-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-222-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-223-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-224-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-225-0x0000000003340000-0x0000000003342000-memory.dmpFilesize
8KB
-
memory/1968-232-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-233-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-234-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-235-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-236-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-237-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-238-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-239-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-240-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-241-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/1968-242-0x0000000003440000-0x0000000003450000-memory.dmpFilesize
64KB
-
memory/3688-197-0x0000000010410000-0x0000000010439000-memory.dmpFilesize
164KB
-
memory/3688-185-0x0000000000F60000-0x0000000000F61000-memory.dmpFilesize
4KB
-
memory/3688-189-0x0000000002990000-0x00000000029A1000-memory.dmpFilesize
68KB
-
memory/3688-188-0x0000000003D40000-0x000000000408A000-memory.dmpFilesize
3.3MB
-
memory/3688-191-0x0000000010410000-0x0000000010439000-memory.dmpFilesize
164KB
-
memory/3688-192-0x00000000029D0000-0x00000000029E1000-memory.dmpFilesize
68KB