Analysis
-
max time kernel
100s -
max time network
104s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
24-03-2023 05:31
Static task
static1
Behavioral task
behavioral1
Sample
168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe
Resource
win10v2004-20230220-en
General
-
Target
168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe
-
Size
1.1MB
-
MD5
7b2cc7bd31191fc112de760c996e56a1
-
SHA1
8c87bbdd79eda5b6f6612a9d828d10924071e959
-
SHA256
168dd964cedab347b56461282ab409b5fb19de28f50f635d7071dfce39c04ed5
-
SHA512
9c7b924020c2c7c8d485100429449f4d0221e73ddf4f00ea197efa539a29d9cd74528928371a9640c05f8cf27f2b37348bec7b3d3a9c1006bcc304ebc85fbd7a
-
SSDEEP
24576:JpyruWBdka5dL1NELih7LqxLBwceZEY2Onj3JniDq0A5BfJXA6:Jpm9nkIdL1WCnwmDZJ2Q3ZB5BfJXA6
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 24 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 360 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1668 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1372 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 316 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1524 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 660 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1968 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1044 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1704 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 808 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1104 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1300 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 768 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1768 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1232 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 932 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1608 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1600 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1572 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2016 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1128 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2020 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1152 1508 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1196 1508 schtasks.exe -
Processes:
resource yara_rule behavioral1/memory/1048-59-0x0000000000400000-0x0000000000601000-memory.dmp dcrat behavioral1/memory/1048-62-0x0000000004720000-0x0000000004802000-memory.dmp dcrat behavioral1/memory/1048-63-0x0000000000400000-0x0000000000601000-memory.dmp dcrat behavioral1/memory/1048-65-0x00000000046E0000-0x0000000004720000-memory.dmp dcrat behavioral1/memory/1048-105-0x0000000006120000-0x0000000006321000-memory.dmp dcrat behavioral1/memory/648-109-0x0000000000400000-0x0000000000601000-memory.dmp dcrat behavioral1/memory/648-112-0x0000000000400000-0x0000000000601000-memory.dmp dcrat behavioral1/memory/648-117-0x0000000000400000-0x0000000000601000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
Processes:
sppsvc.exepid process 648 sppsvc.exe -
Loads dropped DLL 2 IoCs
Processes:
168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exepid process 1048 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe 1048 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe -
Drops file in Program Files directory 12 IoCs
Processes:
168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exedescription ioc process File created C:\Program Files\Windows NT\TableTextService\886983d96e3d3e 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Program Files (x86)\Common Files\Services\lsass.exe 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Program Files (x86)\Common Files\Services\6203df4a6bafc7 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Program Files (x86)\Internet Explorer\explorer.exe 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Program Files (x86)\Internet Explorer\7a0fd90576e088 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Program Files (x86)\Windows Media Player\Media Renderer\WMIADAP.exe 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Program Files (x86)\Windows Media Player\Media Renderer\75a57c1bdf437c 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Program Files\Windows NT\TableTextService\csrss.exe 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\6ccacd8608530f 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\smss.exe 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\69ddcba757bf72 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Idle.exe 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe -
Drops file in Windows directory 4 IoCs
Processes:
168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exedescription ioc process File created C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\csrss.exe 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\886983d96e3d3e 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Windows\Speech\Common\de-DE\taskhost.exe 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Windows\Boot\PCAT\taskhost.exe 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 24 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1600 schtasks.exe 2020 schtasks.exe 1196 schtasks.exe 1232 schtasks.exe 932 schtasks.exe 1608 schtasks.exe 1044 schtasks.exe 1704 schtasks.exe 768 schtasks.exe 1572 schtasks.exe 1152 schtasks.exe 1372 schtasks.exe 660 schtasks.exe 1968 schtasks.exe 1300 schtasks.exe 1768 schtasks.exe 1128 schtasks.exe 1668 schtasks.exe 316 schtasks.exe 1524 schtasks.exe 2016 schtasks.exe 360 schtasks.exe 808 schtasks.exe 1104 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exesppsvc.exepid process 1048 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe 648 sppsvc.exe 648 sppsvc.exe 648 sppsvc.exe 648 sppsvc.exe 648 sppsvc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exesppsvc.exedescription pid process Token: SeDebugPrivilege 1048 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe Token: SeDebugPrivilege 648 sppsvc.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exedescription pid process target process PID 1048 wrote to memory of 648 1048 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe sppsvc.exe PID 1048 wrote to memory of 648 1048 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe sppsvc.exe PID 1048 wrote to memory of 648 1048 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe sppsvc.exe PID 1048 wrote to memory of 648 1048 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe sppsvc.exe PID 1048 wrote to memory of 648 1048 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe sppsvc.exe PID 1048 wrote to memory of 648 1048 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe sppsvc.exe PID 1048 wrote to memory of 648 1048 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe sppsvc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe"C:\Users\Admin\AppData\Local\Temp\168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\MSOCache\All Users\sppsvc.exe"C:\MSOCache\All Users\sppsvc.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\TableTextService\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\TableTextService\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Services\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Services\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\WMIADAP.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\WMIADAP.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\WMIADAP.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\sppsvc.exeFilesize
1.1MB
MD57b2cc7bd31191fc112de760c996e56a1
SHA18c87bbdd79eda5b6f6612a9d828d10924071e959
SHA256168dd964cedab347b56461282ab409b5fb19de28f50f635d7071dfce39c04ed5
SHA5129c7b924020c2c7c8d485100429449f4d0221e73ddf4f00ea197efa539a29d9cd74528928371a9640c05f8cf27f2b37348bec7b3d3a9c1006bcc304ebc85fbd7a
-
C:\MSOCache\All Users\sppsvc.exeFilesize
1.1MB
MD57b2cc7bd31191fc112de760c996e56a1
SHA18c87bbdd79eda5b6f6612a9d828d10924071e959
SHA256168dd964cedab347b56461282ab409b5fb19de28f50f635d7071dfce39c04ed5
SHA5129c7b924020c2c7c8d485100429449f4d0221e73ddf4f00ea197efa539a29d9cd74528928371a9640c05f8cf27f2b37348bec7b3d3a9c1006bcc304ebc85fbd7a
-
C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Idle.exeFilesize
1.1MB
MD57b2cc7bd31191fc112de760c996e56a1
SHA18c87bbdd79eda5b6f6612a9d828d10924071e959
SHA256168dd964cedab347b56461282ab409b5fb19de28f50f635d7071dfce39c04ed5
SHA5129c7b924020c2c7c8d485100429449f4d0221e73ddf4f00ea197efa539a29d9cd74528928371a9640c05f8cf27f2b37348bec7b3d3a9c1006bcc304ebc85fbd7a
-
\MSOCache\All Users\sppsvc.exeFilesize
1.1MB
MD57b2cc7bd31191fc112de760c996e56a1
SHA18c87bbdd79eda5b6f6612a9d828d10924071e959
SHA256168dd964cedab347b56461282ab409b5fb19de28f50f635d7071dfce39c04ed5
SHA5129c7b924020c2c7c8d485100429449f4d0221e73ddf4f00ea197efa539a29d9cd74528928371a9640c05f8cf27f2b37348bec7b3d3a9c1006bcc304ebc85fbd7a
-
\MSOCache\All Users\sppsvc.exeFilesize
1.1MB
MD57b2cc7bd31191fc112de760c996e56a1
SHA18c87bbdd79eda5b6f6612a9d828d10924071e959
SHA256168dd964cedab347b56461282ab409b5fb19de28f50f635d7071dfce39c04ed5
SHA5129c7b924020c2c7c8d485100429449f4d0221e73ddf4f00ea197efa539a29d9cd74528928371a9640c05f8cf27f2b37348bec7b3d3a9c1006bcc304ebc85fbd7a
-
memory/648-109-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/648-112-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/648-108-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/648-107-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/648-106-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/648-104-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/648-103-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/648-114-0x0000000004510000-0x0000000004550000-memory.dmpFilesize
256KB
-
memory/648-113-0x0000000004510000-0x0000000004550000-memory.dmpFilesize
256KB
-
memory/648-117-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/1048-67-0x00000000046E0000-0x0000000004720000-memory.dmpFilesize
256KB
-
memory/1048-102-0x0000000006120000-0x0000000006321000-memory.dmpFilesize
2.0MB
-
memory/1048-73-0x0000000004F30000-0x0000000004F3C000-memory.dmpFilesize
48KB
-
memory/1048-74-0x0000000004F40000-0x0000000004F4A000-memory.dmpFilesize
40KB
-
memory/1048-75-0x0000000004F50000-0x0000000004F5C000-memory.dmpFilesize
48KB
-
memory/1048-71-0x0000000004ED0000-0x0000000004ED8000-memory.dmpFilesize
32KB
-
memory/1048-70-0x00000000046C0000-0x00000000046D6000-memory.dmpFilesize
88KB
-
memory/1048-69-0x0000000001FC0000-0x0000000001FDC000-memory.dmpFilesize
112KB
-
memory/1048-68-0x0000000001E20000-0x0000000001E28000-memory.dmpFilesize
32KB
-
memory/1048-100-0x0000000006120000-0x0000000006321000-memory.dmpFilesize
2.0MB
-
memory/1048-65-0x00000000046E0000-0x0000000004720000-memory.dmpFilesize
256KB
-
memory/1048-72-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/1048-66-0x00000000046E0000-0x0000000004720000-memory.dmpFilesize
256KB
-
memory/1048-105-0x0000000006120000-0x0000000006321000-memory.dmpFilesize
2.0MB
-
memory/1048-54-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/1048-64-0x00000000046E0000-0x0000000004720000-memory.dmpFilesize
256KB
-
memory/1048-63-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/1048-62-0x0000000004720000-0x0000000004802000-memory.dmpFilesize
904KB
-
memory/1048-59-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/1048-58-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/1048-57-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/1048-56-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/1048-55-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB