Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21-03-2023 14:32
Static task
static1
Behavioral task
behavioral1
Sample
11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe
Resource
win7-20230220-en
General
-
Target
11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe
-
Size
3.8MB
-
MD5
86000b0a976dc4a377b2e5192fe30445
-
SHA1
ad29b138883d7906f8d6e75f2e5f60e5285d4a56
-
SHA256
11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
-
SHA512
4d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
SSDEEP
98304:nUyJF2oYGCLxnJ7rzdIzYsuvqqW07LslsPTU:nUbn5zSzYhqqW0ns8U
Malware Config
Extracted
bitrat
1.38
74.201.28.92:3569
-
communication_password
148b191cf4e80b549e1b1a4444f2bdf6
-
tor_process
tor
Signatures
-
Executes dropped EXE 5 IoCs
Processes:
wbnh.exewbnh.exewbnh.exewbnh.exewbnh.exepid process 436 wbnh.exe 1932 wbnh.exe 1912 wbnh.exe 2024 wbnh.exe 920 wbnh.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exewbnh.exepid process 2012 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 2012 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 2012 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 2012 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 2012 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 1932 wbnh.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exewbnh.exewbnh.exedescription pid process target process PID 2044 set thread context of 2012 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe PID 436 set thread context of 1932 436 wbnh.exe wbnh.exe PID 1912 set thread context of 2024 1912 wbnh.exe wbnh.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 580 schtasks.exe 884 schtasks.exe 1076 schtasks.exe 772 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exewbnh.exedescription pid process Token: SeDebugPrivilege 2012 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe Token: SeShutdownPrivilege 2012 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe Token: SeDebugPrivilege 1932 wbnh.exe Token: SeShutdownPrivilege 1932 wbnh.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exepid process 2012 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 2012 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.execmd.exetaskeng.exewbnh.execmd.exedescription pid process target process PID 2044 wrote to memory of 2012 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe PID 2044 wrote to memory of 2012 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe PID 2044 wrote to memory of 2012 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe PID 2044 wrote to memory of 2012 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe PID 2044 wrote to memory of 2012 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe PID 2044 wrote to memory of 2012 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe PID 2044 wrote to memory of 2012 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe PID 2044 wrote to memory of 2012 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe PID 2044 wrote to memory of 2012 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe PID 2044 wrote to memory of 2012 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe PID 2044 wrote to memory of 2012 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe PID 2044 wrote to memory of 2012 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe PID 2044 wrote to memory of 676 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe cmd.exe PID 2044 wrote to memory of 676 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe cmd.exe PID 2044 wrote to memory of 676 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe cmd.exe PID 2044 wrote to memory of 676 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe cmd.exe PID 2044 wrote to memory of 524 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe cmd.exe PID 2044 wrote to memory of 524 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe cmd.exe PID 2044 wrote to memory of 524 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe cmd.exe PID 2044 wrote to memory of 524 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe cmd.exe PID 2044 wrote to memory of 368 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe cmd.exe PID 2044 wrote to memory of 368 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe cmd.exe PID 2044 wrote to memory of 368 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe cmd.exe PID 2044 wrote to memory of 368 2044 11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe cmd.exe PID 524 wrote to memory of 580 524 cmd.exe schtasks.exe PID 524 wrote to memory of 580 524 cmd.exe schtasks.exe PID 524 wrote to memory of 580 524 cmd.exe schtasks.exe PID 524 wrote to memory of 580 524 cmd.exe schtasks.exe PID 1412 wrote to memory of 436 1412 taskeng.exe wbnh.exe PID 1412 wrote to memory of 436 1412 taskeng.exe wbnh.exe PID 1412 wrote to memory of 436 1412 taskeng.exe wbnh.exe PID 1412 wrote to memory of 436 1412 taskeng.exe wbnh.exe PID 436 wrote to memory of 1932 436 wbnh.exe wbnh.exe PID 436 wrote to memory of 1932 436 wbnh.exe wbnh.exe PID 436 wrote to memory of 1932 436 wbnh.exe wbnh.exe PID 436 wrote to memory of 1932 436 wbnh.exe wbnh.exe PID 436 wrote to memory of 1932 436 wbnh.exe wbnh.exe PID 436 wrote to memory of 1932 436 wbnh.exe wbnh.exe PID 436 wrote to memory of 1932 436 wbnh.exe wbnh.exe PID 436 wrote to memory of 1932 436 wbnh.exe wbnh.exe PID 436 wrote to memory of 1932 436 wbnh.exe wbnh.exe PID 436 wrote to memory of 1932 436 wbnh.exe wbnh.exe PID 436 wrote to memory of 1932 436 wbnh.exe wbnh.exe PID 436 wrote to memory of 1932 436 wbnh.exe wbnh.exe PID 436 wrote to memory of 1352 436 wbnh.exe cmd.exe PID 436 wrote to memory of 1352 436 wbnh.exe cmd.exe PID 436 wrote to memory of 1352 436 wbnh.exe cmd.exe PID 436 wrote to memory of 1352 436 wbnh.exe cmd.exe PID 436 wrote to memory of 1092 436 wbnh.exe cmd.exe PID 436 wrote to memory of 1092 436 wbnh.exe cmd.exe PID 436 wrote to memory of 1092 436 wbnh.exe cmd.exe PID 436 wrote to memory of 1092 436 wbnh.exe cmd.exe PID 436 wrote to memory of 920 436 wbnh.exe cmd.exe PID 436 wrote to memory of 920 436 wbnh.exe cmd.exe PID 436 wrote to memory of 920 436 wbnh.exe cmd.exe PID 436 wrote to memory of 920 436 wbnh.exe cmd.exe PID 1092 wrote to memory of 884 1092 cmd.exe schtasks.exe PID 1092 wrote to memory of 884 1092 cmd.exe schtasks.exe PID 1092 wrote to memory of 884 1092 cmd.exe schtasks.exe PID 1092 wrote to memory of 884 1092 cmd.exe schtasks.exe PID 1412 wrote to memory of 1912 1412 taskeng.exe wbnh.exe PID 1412 wrote to memory of 1912 1412 taskeng.exe wbnh.exe PID 1412 wrote to memory of 1912 1412 taskeng.exe wbnh.exe PID 1412 wrote to memory of 1912 1412 taskeng.exe wbnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe"C:\Users\Admin\AppData\Local\Temp\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe"C:\Users\Admin\AppData\Local\Temp\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wbnh"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\11fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e.exe" "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {C31435EE-2383-4FF0-B1C9-1B8DE7437474} S-1-5-21-1563773381-2037468142-1146002597-1000:YBHADZIG\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeC:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wbnh"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe" "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeC:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wbnh"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe" "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeC:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\wbnh"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe" "C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exe'" /f1⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
1.1MB
MD5d038d6ef09538870691d998d23b466f0
SHA1b58c50edf74be3c6c9c8a9e53def75dd6cc62b81
SHA256dfc933bfc23bba730103748c85fa208a63427abfb4d945f0743ca1ada6db54d2
SHA5122848cd225a60d9da14de0e2f75506b6038a2b7667939b6062e21467c2a649d7ba62451c8a5c8e53859e2d500c687341bd6dfffa912ffdb8b4710e4791dfb600b
-
C:\Users\Admin\AppData\Roaming\wbnh\wbnh.exeFilesize
3.8MB
MD586000b0a976dc4a377b2e5192fe30445
SHA1ad29b138883d7906f8d6e75f2e5f60e5285d4a56
SHA25611fa27c4961acea6b79c28ccdc896bb94276ba6e3edf2e1d33539952abb1c25e
SHA5124d0be7661db756cee78c7fbbb91705574b5bb82552230277d59b14a2225f84209597473c165243594ef7d335b3f48475d92b48af21092d04320e91ac452e9c19
-
memory/436-101-0x0000000000920000-0x0000000000CF6000-memory.dmpFilesize
3.8MB
-
memory/920-173-0x00000000046C0000-0x0000000004700000-memory.dmpFilesize
256KB
-
memory/920-170-0x00000000001F0000-0x00000000005C6000-memory.dmpFilesize
3.8MB
-
memory/1912-138-0x00000000001F0000-0x00000000005C6000-memory.dmpFilesize
3.8MB
-
memory/1932-109-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1932-114-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1932-118-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-72-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-97-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-74-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-76-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-77-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-78-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-79-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-80-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-82-0x0000000000090000-0x000000000009A000-memory.dmpFilesize
40KB
-
memory/2012-81-0x0000000000090000-0x000000000009A000-memory.dmpFilesize
40KB
-
memory/2012-83-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-86-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-85-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-87-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-88-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-89-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-91-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-93-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-94-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-96-0x0000000000090000-0x000000000009A000-memory.dmpFilesize
40KB
-
memory/2012-95-0x0000000000090000-0x000000000009A000-memory.dmpFilesize
40KB
-
memory/2012-73-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-55-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-71-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-69-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-66-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-64-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2012-115-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-62-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-119-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-121-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-123-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-125-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-127-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-129-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-131-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-61-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-60-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-59-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-56-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2012-58-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2044-57-0x0000000004DA0000-0x0000000004DE0000-memory.dmpFilesize
256KB
-
memory/2044-54-0x0000000000B90000-0x0000000000F66000-memory.dmpFilesize
3.8MB