Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22-03-2023 19:01
Static task
static1
Behavioral task
behavioral1
Sample
Odeme3222023.scr.exe
Resource
win7-20230220-en
General
-
Target
Odeme3222023.scr.exe
-
Size
635KB
-
MD5
02e24e9cfe0669ac85121b1b35f7a942
-
SHA1
0acb91424c9e6329b0966177cc5541f0bb2c4908
-
SHA256
7158cb26fb5a843496b92e30c4366fdfa2b49cd8c59f280ee71e853a68ef0a69
-
SHA512
cc697818469e535cdb3d9470bb25d38f8d845d668d50e72b61911bd561d94ffff5e04448fda4537bba28fb5666345b1fc748b1f80443c54bac6ca191df4de013
-
SSDEEP
12288:NcrNS33L10QdrXjCDn1R6WlM96zWDfJbZEvJmD7ugVkh/fwJ6DD:wNA3R5drX2D1RTM9aEfJbUYD79ofJDD
Malware Config
Extracted
asyncrat
0.5.7B
Mnock
mooroopecamroy.sytes.net:1452
mooroopecamroy.sytes.net:1432
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
crssi.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2040-100-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/2040-105-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/2040-103-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1764-126-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1764-128-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Executes dropped EXE 5 IoCs
Processes:
kopjlkjo.sfx.exekopjlkjo.exekopjlkjo.execrssi.execrssi.exepid process 1792 kopjlkjo.sfx.exe 956 kopjlkjo.exe 2040 kopjlkjo.exe 1868 crssi.exe 1764 crssi.exe -
Loads dropped DLL 7 IoCs
Processes:
cmd.exekopjlkjo.sfx.exekopjlkjo.execmd.exepid process 1752 cmd.exe 1792 kopjlkjo.sfx.exe 1792 kopjlkjo.sfx.exe 1792 kopjlkjo.sfx.exe 1792 kopjlkjo.sfx.exe 956 kopjlkjo.exe 516 cmd.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
kopjlkjo.execrssi.exedescription pid process target process PID 956 set thread context of 2040 956 kopjlkjo.exe kopjlkjo.exe PID 1868 set thread context of 1764 1868 crssi.exe crssi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1052 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
kopjlkjo.exepid process 2040 kopjlkjo.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
kopjlkjo.exekopjlkjo.execrssi.execrssi.exedescription pid process Token: SeDebugPrivilege 956 kopjlkjo.exe Token: SeDebugPrivilege 2040 kopjlkjo.exe Token: SeDebugPrivilege 1868 crssi.exe Token: SeDebugPrivilege 1764 crssi.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 1048 DllHost.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
Odeme3222023.scr.execmd.exekopjlkjo.sfx.exekopjlkjo.exekopjlkjo.execmd.execmd.execrssi.exedescription pid process target process PID 2036 wrote to memory of 1752 2036 Odeme3222023.scr.exe cmd.exe PID 2036 wrote to memory of 1752 2036 Odeme3222023.scr.exe cmd.exe PID 2036 wrote to memory of 1752 2036 Odeme3222023.scr.exe cmd.exe PID 2036 wrote to memory of 1752 2036 Odeme3222023.scr.exe cmd.exe PID 1752 wrote to memory of 1792 1752 cmd.exe kopjlkjo.sfx.exe PID 1752 wrote to memory of 1792 1752 cmd.exe kopjlkjo.sfx.exe PID 1752 wrote to memory of 1792 1752 cmd.exe kopjlkjo.sfx.exe PID 1752 wrote to memory of 1792 1752 cmd.exe kopjlkjo.sfx.exe PID 1792 wrote to memory of 956 1792 kopjlkjo.sfx.exe kopjlkjo.exe PID 1792 wrote to memory of 956 1792 kopjlkjo.sfx.exe kopjlkjo.exe PID 1792 wrote to memory of 956 1792 kopjlkjo.sfx.exe kopjlkjo.exe PID 1792 wrote to memory of 956 1792 kopjlkjo.sfx.exe kopjlkjo.exe PID 956 wrote to memory of 2040 956 kopjlkjo.exe kopjlkjo.exe PID 956 wrote to memory of 2040 956 kopjlkjo.exe kopjlkjo.exe PID 956 wrote to memory of 2040 956 kopjlkjo.exe kopjlkjo.exe PID 956 wrote to memory of 2040 956 kopjlkjo.exe kopjlkjo.exe PID 956 wrote to memory of 2040 956 kopjlkjo.exe kopjlkjo.exe PID 956 wrote to memory of 2040 956 kopjlkjo.exe kopjlkjo.exe PID 956 wrote to memory of 2040 956 kopjlkjo.exe kopjlkjo.exe PID 956 wrote to memory of 2040 956 kopjlkjo.exe kopjlkjo.exe PID 956 wrote to memory of 2040 956 kopjlkjo.exe kopjlkjo.exe PID 2040 wrote to memory of 1524 2040 kopjlkjo.exe cmd.exe PID 2040 wrote to memory of 1524 2040 kopjlkjo.exe cmd.exe PID 2040 wrote to memory of 1524 2040 kopjlkjo.exe cmd.exe PID 2040 wrote to memory of 1524 2040 kopjlkjo.exe cmd.exe PID 2040 wrote to memory of 516 2040 kopjlkjo.exe cmd.exe PID 2040 wrote to memory of 516 2040 kopjlkjo.exe cmd.exe PID 2040 wrote to memory of 516 2040 kopjlkjo.exe cmd.exe PID 2040 wrote to memory of 516 2040 kopjlkjo.exe cmd.exe PID 1524 wrote to memory of 1640 1524 cmd.exe schtasks.exe PID 1524 wrote to memory of 1640 1524 cmd.exe schtasks.exe PID 1524 wrote to memory of 1640 1524 cmd.exe schtasks.exe PID 1524 wrote to memory of 1640 1524 cmd.exe schtasks.exe PID 516 wrote to memory of 1052 516 cmd.exe timeout.exe PID 516 wrote to memory of 1052 516 cmd.exe timeout.exe PID 516 wrote to memory of 1052 516 cmd.exe timeout.exe PID 516 wrote to memory of 1052 516 cmd.exe timeout.exe PID 516 wrote to memory of 1868 516 cmd.exe crssi.exe PID 516 wrote to memory of 1868 516 cmd.exe crssi.exe PID 516 wrote to memory of 1868 516 cmd.exe crssi.exe PID 516 wrote to memory of 1868 516 cmd.exe crssi.exe PID 1868 wrote to memory of 1764 1868 crssi.exe crssi.exe PID 1868 wrote to memory of 1764 1868 crssi.exe crssi.exe PID 1868 wrote to memory of 1764 1868 crssi.exe crssi.exe PID 1868 wrote to memory of 1764 1868 crssi.exe crssi.exe PID 1868 wrote to memory of 1764 1868 crssi.exe crssi.exe PID 1868 wrote to memory of 1764 1868 crssi.exe crssi.exe PID 1868 wrote to memory of 1764 1868 crssi.exe crssi.exe PID 1868 wrote to memory of 1764 1868 crssi.exe crssi.exe PID 1868 wrote to memory of 1764 1868 crssi.exe crssi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Odeme3222023.scr.exe"C:\Users\Admin\AppData\Local\Temp\Odeme3222023.scr.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\iliychjo.cmd" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kopjlkjo.sfx.exekopjlkjo.sfx.exe -dC:\Users\Admin\AppData\Local\Temp -pmheutdbtrfcaszjnhjfehfegddeoqxapofdgyayhdqboofhafugBbshhddfdtgxdkqekecVohobthtigdge3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kopjlkjo.exe"C:\Users\Admin\AppData\Local\Temp\kopjlkjo.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kopjlkjo.exeC:\Users\Admin\AppData\Local\Temp\kopjlkjo.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "crssi" /tr '"C:\Users\Admin\AppData\Roaming\crssi.exe"' & exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "crssi" /tr '"C:\Users\Admin\AppData\Roaming\crssi.exe"'7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2D97.tmp.bat""6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 37⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\crssi.exe"C:\Users\Admin\AppData\Roaming\crssi.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\crssi.exeC:\Users\Admin\AppData\Roaming\crssi.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HeSwift.jpgFilesize
43KB
MD5b51bcf0e5efcacc7dab333e763658a02
SHA1d377643d36ad5638647b3c0b4e97c5568fd9cc59
SHA256dfae1100f8520dc16f56924a3415f5637d5899edcd937f69b78af51715db46a3
SHA512d26ef9314a87a1632f1c019b23882754bab39a4be125819c565d5938e7519122497ce679b7c9f3ed5f8eea69e4b66c3d3eae1212ea8de91a68dfed271f5a8da8
-
C:\Users\Admin\AppData\Local\Temp\iliychjo.cmdFilesize
10KB
MD55c6c1129a2ec722e4067d9fb09369799
SHA1afab2aeb341a719dad8b48f542f7fb966a38c30c
SHA256a9b935bb8953156779753ee2cd340e3e06428120c74003ac5a6570542e7f0f9f
SHA512e86c174b327cc8c2ab3a9b5ef68ae308468a1113b905c8f3d5d0b7f031b4166eef933e26a1796bc44deac02004cc15ee1e1cf0529ec814e6dc5e959e30df0c86
-
C:\Users\Admin\AppData\Local\Temp\iliychjo.cmdFilesize
10KB
MD55c6c1129a2ec722e4067d9fb09369799
SHA1afab2aeb341a719dad8b48f542f7fb966a38c30c
SHA256a9b935bb8953156779753ee2cd340e3e06428120c74003ac5a6570542e7f0f9f
SHA512e86c174b327cc8c2ab3a9b5ef68ae308468a1113b905c8f3d5d0b7f031b4166eef933e26a1796bc44deac02004cc15ee1e1cf0529ec814e6dc5e959e30df0c86
-
C:\Users\Admin\AppData\Local\Temp\kopjlkjo.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
C:\Users\Admin\AppData\Local\Temp\kopjlkjo.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
C:\Users\Admin\AppData\Local\Temp\kopjlkjo.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
C:\Users\Admin\AppData\Local\Temp\kopjlkjo.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
C:\Users\Admin\AppData\Local\Temp\kopjlkjo.sfx.exeFilesize
446KB
MD5a70ce8a186b33c8dbad85d8717f97574
SHA1c3b041e092a2816f7e969913e44a96646762d7a1
SHA25683b8efd5fd67b4f6afa96daccd6fac873f9d2f09dd6cfb50febbd2d0543f6a6b
SHA51276cf4426aaf7a9ac7be55c1276607b2abab37c85412b959a1437ef2d80de2ebd94ba6f1a134d5affb2ec6e78900afcd9d001072957b64314aadf34a2ff82e9fb
-
C:\Users\Admin\AppData\Local\Temp\kopjlkjo.sfx.exeFilesize
446KB
MD5a70ce8a186b33c8dbad85d8717f97574
SHA1c3b041e092a2816f7e969913e44a96646762d7a1
SHA25683b8efd5fd67b4f6afa96daccd6fac873f9d2f09dd6cfb50febbd2d0543f6a6b
SHA51276cf4426aaf7a9ac7be55c1276607b2abab37c85412b959a1437ef2d80de2ebd94ba6f1a134d5affb2ec6e78900afcd9d001072957b64314aadf34a2ff82e9fb
-
C:\Users\Admin\AppData\Local\Temp\tmp2D97.tmp.batFilesize
149B
MD5ba266941194afa004c0808b3a5bdd490
SHA1e013c7fe360563b3bae043b3f37ca0f33162db25
SHA2566facc9182f83ac86aaee11fedb9d8c00a6e21a37fe50c32ae34cf6d0329c7c19
SHA5125bb3dc04469652d05d8d3549d37bdd2fbc94bff079e172cd85916c9b6f1679ca5de44fad04e6dff1cb588c2c26e66b4ff5ec783455a75eabf8e344852f8a412d
-
C:\Users\Admin\AppData\Local\Temp\tmp2D97.tmp.batFilesize
149B
MD5ba266941194afa004c0808b3a5bdd490
SHA1e013c7fe360563b3bae043b3f37ca0f33162db25
SHA2566facc9182f83ac86aaee11fedb9d8c00a6e21a37fe50c32ae34cf6d0329c7c19
SHA5125bb3dc04469652d05d8d3549d37bdd2fbc94bff079e172cd85916c9b6f1679ca5de44fad04e6dff1cb588c2c26e66b4ff5ec783455a75eabf8e344852f8a412d
-
C:\Users\Admin\AppData\Roaming\crssi.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
C:\Users\Admin\AppData\Roaming\crssi.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
C:\Users\Admin\AppData\Roaming\crssi.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
\Users\Admin\AppData\Local\Temp\kopjlkjo.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
\Users\Admin\AppData\Local\Temp\kopjlkjo.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
\Users\Admin\AppData\Local\Temp\kopjlkjo.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
\Users\Admin\AppData\Local\Temp\kopjlkjo.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
\Users\Admin\AppData\Local\Temp\kopjlkjo.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
\Users\Admin\AppData\Local\Temp\kopjlkjo.sfx.exeFilesize
446KB
MD5a70ce8a186b33c8dbad85d8717f97574
SHA1c3b041e092a2816f7e969913e44a96646762d7a1
SHA25683b8efd5fd67b4f6afa96daccd6fac873f9d2f09dd6cfb50febbd2d0543f6a6b
SHA51276cf4426aaf7a9ac7be55c1276607b2abab37c85412b959a1437ef2d80de2ebd94ba6f1a134d5affb2ec6e78900afcd9d001072957b64314aadf34a2ff82e9fb
-
\Users\Admin\AppData\Roaming\crssi.exeFilesize
227KB
MD57f27d1f429639580c990c1dfd54647a7
SHA1909e835639c112c37fbbc89af0ab7dd5c8ed07e3
SHA256a89a861186beea53d2b2638256f81149e6faa4e1f41cb8307de5452ef844d4ff
SHA512d912502b4be34c74aa72f72c54e51c9447feb160201f7aa013e7c5b3214269347bc91175c663b6a16ba42e7b5d86520276a5927b9f065d2b2ffdcbb178690f3b
-
memory/956-95-0x00000000013A0000-0x00000000013DE000-memory.dmpFilesize
248KB
-
memory/956-97-0x0000000000470000-0x00000000004AC000-memory.dmpFilesize
240KB
-
memory/956-96-0x00000000002F0000-0x00000000002F6000-memory.dmpFilesize
24KB
-
memory/956-98-0x0000000000310000-0x0000000000316000-memory.dmpFilesize
24KB
-
memory/1048-106-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1048-129-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1048-78-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/1764-130-0x00000000045E0000-0x0000000004620000-memory.dmpFilesize
256KB
-
memory/1764-126-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1764-128-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1868-121-0x0000000000880000-0x00000000008BE000-memory.dmpFilesize
248KB
-
memory/1868-122-0x0000000004B70000-0x0000000004BB0000-memory.dmpFilesize
256KB
-
memory/2036-77-0x00000000023C0000-0x00000000023C2000-memory.dmpFilesize
8KB
-
memory/2040-108-0x0000000000430000-0x0000000000470000-memory.dmpFilesize
256KB
-
memory/2040-100-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2040-105-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2040-103-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB