Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
22-03-2023 19:01
Static task
static1
Behavioral task
behavioral1
Sample
elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
Resource
win7-20230220-en
General
-
Target
elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe
-
Size
797KB
-
MD5
2803989c03d0d864c20efb1317b157af
-
SHA1
85899fc6132aeedba1eae771a3f74a641b741cf0
-
SHA256
c5963a1865a79e63cf6c451a27db54911fe38cfda287fbf537eb15878666db89
-
SHA512
706dbf3a3d984f929b131d987f2b83fed5719b5365a43aa82534f2e6ef63134f2170b3e40135df1870593a309b78c0be765754d4c8f6df7844f813761d1cf0c5
-
SSDEEP
12288:KnXTcAmWc6pl3i3fkuzxrB3VqJLPo6e1OrsxVRGyTWBwLN6aAsI++HVeRjLwbYW:goAE24jNBEkKsjIDDsM1Jc
Malware Config
Extracted
formbook
4.1
jr22
941zhe.com
lunarportal.space
xn--osmaniyeiek-t9ab.online
trejoscar.com
nrnursery.com
quizcannot.cfd
seedstockersthailand.com
watsonwindow.com
wjfholdings.com
weziclondon.com
naruot.xyz
yeji.plus
classicmenstore.com
oharatravel.com
therapyplankits.com
keviegreshonpt.com
qdlyner.com
seithupaarungal.com
casinorates.online
8ug4as.icu
foamyfallscarwash.com
padelfaculty.com
theenergysavingcentre.com
dorpp.com
scoresendirect.online
yuqintw.com
erenortopedi.com
skymagickey.com
infinitepuremind.com
watchtamilmovie.com
southplainsinsurance.net
intentionaldating.app
certaproarkansas.com
blidai.com
thehoneybeeworks.com
followplace.com
sipsterbyananeke.com
37300.uk
bluebirdbuyers.com
composewithme.com
moneymundo.com
daftarakun.xyz
samsonm.com
nurse-jobs-in-us-35896.com
cancerbloodspecialistsga.net
feelfeminineagain.com
residentialcaretraining.com
allprocleanouts.com
englishsongs.online
bookkeepingdeerfield.com
bendcollegeadvisor.com
boaiqixian.com
vixensgolfcarts.com
igarrido.net
rsconstructiontrading.com
lakewayturf.com
carelesstees.com
silviaheni.xyz
iaqieqq.com
campingspiel.com
diacute.com
thaigeneratortg.com
autoreenter.com
meclishaber.xyz
airbnbtransfers.com
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4872-164-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4872-176-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4328-215-0x00000000010C0000-0x00000000010EF000-memory.dmp formbook behavioral2/memory/4328-222-0x00000000010C0000-0x00000000010EF000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exeelektronik odeme kaniti Swift mesaji_20230322_TL8755450.exesvchost.exedescription pid process target process PID 4324 set thread context of 4872 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe PID 4872 set thread context of 3128 4872 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe Explorer.EXE PID 4328 set thread context of 3128 4328 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
powershell.exepowershell.exeelektronik odeme kaniti Swift mesaji_20230322_TL8755450.exeelektronik odeme kaniti Swift mesaji_20230322_TL8755450.exesvchost.exepid process 2164 powershell.exe 2164 powershell.exe 836 powershell.exe 836 powershell.exe 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe 2164 powershell.exe 4872 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe 4872 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe 4872 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe 4872 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe 836 powershell.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3128 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exesvchost.exepid process 4872 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe 4872 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe 4872 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe 4328 svchost.exe 4328 svchost.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
powershell.exepowershell.exeelektronik odeme kaniti Swift mesaji_20230322_TL8755450.exeelektronik odeme kaniti Swift mesaji_20230322_TL8755450.exesvchost.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2164 powershell.exe Token: SeDebugPrivilege 836 powershell.exe Token: SeDebugPrivilege 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe Token: SeDebugPrivilege 4872 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe Token: SeDebugPrivilege 4328 svchost.exe Token: SeShutdownPrivilege 3128 Explorer.EXE Token: SeCreatePagefilePrivilege 3128 Explorer.EXE Token: SeShutdownPrivilege 3128 Explorer.EXE Token: SeCreatePagefilePrivilege 3128 Explorer.EXE Token: SeShutdownPrivilege 3128 Explorer.EXE Token: SeCreatePagefilePrivilege 3128 Explorer.EXE Token: SeShutdownPrivilege 3128 Explorer.EXE Token: SeCreatePagefilePrivilege 3128 Explorer.EXE Token: SeShutdownPrivilege 3128 Explorer.EXE Token: SeCreatePagefilePrivilege 3128 Explorer.EXE Token: SeShutdownPrivilege 3128 Explorer.EXE Token: SeCreatePagefilePrivilege 3128 Explorer.EXE Token: SeShutdownPrivilege 3128 Explorer.EXE Token: SeCreatePagefilePrivilege 3128 Explorer.EXE Token: SeShutdownPrivilege 3128 Explorer.EXE Token: SeCreatePagefilePrivilege 3128 Explorer.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exeExplorer.EXEsvchost.exedescription pid process target process PID 4324 wrote to memory of 2164 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe powershell.exe PID 4324 wrote to memory of 2164 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe powershell.exe PID 4324 wrote to memory of 2164 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe powershell.exe PID 4324 wrote to memory of 836 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe powershell.exe PID 4324 wrote to memory of 836 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe powershell.exe PID 4324 wrote to memory of 836 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe powershell.exe PID 4324 wrote to memory of 816 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe schtasks.exe PID 4324 wrote to memory of 816 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe schtasks.exe PID 4324 wrote to memory of 816 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe schtasks.exe PID 4324 wrote to memory of 3840 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe PID 4324 wrote to memory of 3840 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe PID 4324 wrote to memory of 3840 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe PID 4324 wrote to memory of 4948 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe PID 4324 wrote to memory of 4948 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe PID 4324 wrote to memory of 4948 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe PID 4324 wrote to memory of 4872 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe PID 4324 wrote to memory of 4872 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe PID 4324 wrote to memory of 4872 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe PID 4324 wrote to memory of 4872 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe PID 4324 wrote to memory of 4872 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe PID 4324 wrote to memory of 4872 4324 elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe PID 3128 wrote to memory of 4328 3128 Explorer.EXE svchost.exe PID 3128 wrote to memory of 4328 3128 Explorer.EXE svchost.exe PID 3128 wrote to memory of 4328 3128 Explorer.EXE svchost.exe PID 4328 wrote to memory of 4656 4328 svchost.exe cmd.exe PID 4328 wrote to memory of 4656 4328 svchost.exe cmd.exe PID 4328 wrote to memory of 4656 4328 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe"C:\Users\Admin\AppData\Local\Temp\elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PUZSBttVYU.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUZSBttVYU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp25B8.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe"C:\Users\Admin\AppData\Local\Temp\elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe"C:\Users\Admin\AppData\Local\Temp\elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe"C:\Users\Admin\AppData\Local\Temp\elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe"3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\elektronik odeme kaniti Swift mesaji_20230322_TL8755450.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5ce6a4376204fdc38b89cdb39a584beee
SHA162abec96ed4f6a44d0692751a75365e0577c9d1a
SHA2569547975e923beadc0639db535897934226c9b24c7e62921b31a1717297679ea3
SHA5129f85e1c9962c6dea25700bb0fbc2c7e6a415fa09507c49a324474366b81c4d572901b3e51b81d465a54673e7138021f20ac004f2c9cf4e326e5e8e7ea376328a
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wdbouvcg.5gm.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp25B8.tmpFilesize
1KB
MD52b04f45e229fe03bf755a356a104ab16
SHA1ff103d84b7a398f458373c6e3e6cc19579935c41
SHA256450e076ff7f9831c3d2b9c9c50d3bd9276673fb2791a688c6fd8688e459859d2
SHA512c0a80b2da81095f4f091fc26ef0da8d69d7d3d838b2fa247a8b559b44ed941941b97a996d0c828b9b86c08876764030a90d5ace6d291188f330ce519977682ad
-
memory/836-214-0x00000000074E0000-0x00000000074E8000-memory.dmpFilesize
32KB
-
memory/836-212-0x00000000073F0000-0x00000000073FE000-memory.dmpFilesize
56KB
-
memory/836-180-0x0000000075370000-0x00000000753BC000-memory.dmpFilesize
304KB
-
memory/836-204-0x000000007FA00000-0x000000007FA10000-memory.dmpFilesize
64KB
-
memory/836-205-0x0000000007800000-0x0000000007E7A000-memory.dmpFilesize
6.5MB
-
memory/836-184-0x0000000000D60000-0x0000000000D70000-memory.dmpFilesize
64KB
-
memory/836-147-0x0000000004F00000-0x0000000004F22000-memory.dmpFilesize
136KB
-
memory/836-150-0x0000000005880000-0x00000000058E6000-memory.dmpFilesize
408KB
-
memory/836-162-0x0000000000D60000-0x0000000000D70000-memory.dmpFilesize
64KB
-
memory/836-207-0x0000000007230000-0x000000000723A000-memory.dmpFilesize
40KB
-
memory/2164-144-0x0000000000CB0000-0x0000000000CE6000-memory.dmpFilesize
216KB
-
memory/2164-157-0x0000000000D10000-0x0000000000D20000-memory.dmpFilesize
64KB
-
memory/2164-148-0x0000000000D10000-0x0000000000D20000-memory.dmpFilesize
64KB
-
memory/2164-149-0x0000000005250000-0x00000000052B6000-memory.dmpFilesize
408KB
-
memory/2164-174-0x0000000005A50000-0x0000000005A6E000-memory.dmpFilesize
120KB
-
memory/2164-206-0x0000000006D50000-0x0000000006D6A000-memory.dmpFilesize
104KB
-
memory/2164-145-0x0000000004B80000-0x00000000051A8000-memory.dmpFilesize
6.2MB
-
memory/2164-193-0x0000000000D10000-0x0000000000D20000-memory.dmpFilesize
64KB
-
memory/2164-194-0x000000007F9D0000-0x000000007F9E0000-memory.dmpFilesize
64KB
-
memory/2164-179-0x0000000006A10000-0x0000000006A42000-memory.dmpFilesize
200KB
-
memory/2164-181-0x0000000075370000-0x00000000753BC000-memory.dmpFilesize
304KB
-
memory/2164-208-0x0000000006FD0000-0x0000000007066000-memory.dmpFilesize
600KB
-
memory/2164-213-0x0000000007090000-0x00000000070AA000-memory.dmpFilesize
104KB
-
memory/2164-192-0x0000000006020000-0x000000000603E000-memory.dmpFilesize
120KB
-
memory/3128-244-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-258-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-272-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-271-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-270-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-269-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-268-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-267-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-266-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-265-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-264-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-263-0x0000000000C80000-0x0000000000C8C000-memory.dmpFilesize
48KB
-
memory/3128-262-0x0000000000C70000-0x0000000000C72000-memory.dmpFilesize
8KB
-
memory/3128-261-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-260-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-259-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-178-0x0000000008A10000-0x0000000008B89000-memory.dmpFilesize
1.5MB
-
memory/3128-257-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-225-0x0000000008CB0000-0x0000000008E02000-memory.dmpFilesize
1.3MB
-
memory/3128-226-0x0000000008CB0000-0x0000000008E02000-memory.dmpFilesize
1.3MB
-
memory/3128-228-0x0000000008CB0000-0x0000000008E02000-memory.dmpFilesize
1.3MB
-
memory/3128-230-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-231-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-232-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-233-0x0000000008CB0000-0x0000000008E02000-memory.dmpFilesize
1.3MB
-
memory/3128-234-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-235-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-236-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-237-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-238-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-239-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-240-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-241-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-242-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-243-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-256-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-245-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-246-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/3128-247-0x0000000002AE0000-0x0000000002AEA000-memory.dmpFilesize
40KB
-
memory/3128-249-0x0000000008CB0000-0x0000000008E02000-memory.dmpFilesize
1.3MB
-
memory/3128-255-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/4324-137-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/4324-135-0x0000000004C40000-0x0000000004CD2000-memory.dmpFilesize
584KB
-
memory/4324-133-0x00000000001C0000-0x000000000028E000-memory.dmpFilesize
824KB
-
memory/4324-134-0x0000000005100000-0x00000000056A4000-memory.dmpFilesize
5.6MB
-
memory/4324-138-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/4324-139-0x00000000065B0000-0x000000000664C000-memory.dmpFilesize
624KB
-
memory/4324-136-0x0000000004CF0000-0x0000000004CFA000-memory.dmpFilesize
40KB
-
memory/4328-216-0x0000000001B00000-0x0000000001E4A000-memory.dmpFilesize
3.3MB
-
memory/4328-222-0x00000000010C0000-0x00000000010EF000-memory.dmpFilesize
188KB
-
memory/4328-211-0x00000000005F0000-0x00000000005FE000-memory.dmpFilesize
56KB
-
memory/4328-215-0x00000000010C0000-0x00000000010EF000-memory.dmpFilesize
188KB
-
memory/4328-209-0x00000000005F0000-0x00000000005FE000-memory.dmpFilesize
56KB
-
memory/4328-224-0x0000000001A00000-0x0000000001A93000-memory.dmpFilesize
588KB
-
memory/4872-164-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4872-175-0x0000000001750000-0x0000000001A9A000-memory.dmpFilesize
3.3MB
-
memory/4872-176-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4872-177-0x0000000001640000-0x0000000001654000-memory.dmpFilesize
80KB