Analysis
-
max time kernel
152s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2023 16:00
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
General
-
Target
tmp.exe
-
Size
264KB
-
MD5
f45c92927e94a2d19a1096122bcaf1fd
-
SHA1
9887b3edbfaa5737911ae3883517087b34c8b11c
-
SHA256
e7f86bbfa56f8c4c2751260d5084b6896c40dbd9976f292828912a700f1042da
-
SHA512
0ea77012b26abd6927dca4afb0eae405906141efec2eb6e6b9773cb60fa3e36375345332e4bde699dba592f1c69b937ffbdab594d5efa67ec563d9a4c69c4d8e
-
SSDEEP
6144:/Ya68OD5y2TAsWI4JTPGX152WGZi4fLPikivmWEaAjkhVt1:/Y6u5y2U849eF5zv4jPpcm0AMVf
Malware Config
Extracted
formbook
poub
WY0eksfISzRg4O6c+opnGL6gaw==
moRjn9ExtYi8UmUo+Tya
2vME+GedoxzFnuLXesUoVj4=
EvW4JWJ1NQ8nN3tA3SM=
2mK9efMZMgN1VOs=
8d0jua5b0J6AQEW7
/2cyThOd37DSTYMASDye4Q0t/Vs=
ral+tbIh2KKAQEW7
YLY9jsPtYB/FRmMo+Tya
R1WcElWAMtFxFrVqtZT2ZpIS9xRZNho=
KFXGg/T1pCC9GjrxUPTcjw==
8mMlK5nDwjjPFTP5jMtAtQ0t/Vs=
c7am8nhhlCo=
UW91trZj6dENxuRdpxOvW1Cf
sjOMUcvq6lYJCZEfV4euFzY=
62nBgPjdmWQkmWElww==
64E8JqA1aruSUvw=
NqI1reXpcR+REye0
8+y1oOsbjgSyEhjXUPTcjw==
Rx9by8gNBwN1VOs=
Muif0yE4CQN1VOs=
VEt6//SsIukFo46EOTs=
Z8su52MYL67C
usDwuHRs8/KlWg==
idmltXXu7XAgHLE/UPTcjw==
QPrxO2shWNiGexGboHDSRqBQ1TBd
hq9rqBND8/KlWg==
QS9iHFx08/KlWg==
v1soVFoThEdt/B/dK0v4+6Wb
7rqJytN13KKAQEW7
OWbeN2SDJwonsI6EOTs=
aqQrrKZDm16GMlAtvxavW1Cf
imnEZWIEbC4M8Q+i
Bry3oQg5+6ZaUNxzwg==
B3vYmyxPQS5XYvmCsqQXX8X948Zf
KbGBmwwCyKTKsUcRUNN6CD61aw==
2WpDae4P+W4cdqc8kPBcjqg0wS1X
MvkZLPRY25jI
Alr0VZGxYxG3dR/zSNjBhQ==
ZJkdjczlrF+8l0Os
dcmMkFm+QhFD4OM=
fMdUrd4J1n4mmWElww==
Gat+k1fHg11vTQ==
sn+7Q4uxaAu9FyGv7k24F1DWaBEvmRI=
CjvGRTnXOhtN6QSNxhmvW1Cf
CpHvP2VSxaKAQEW7
qQWkEUJYFKhPttOZ4MarX8KKLl+/Jg==
GNVP4yIy8/KlWg==
pqfVAERhYxN7YPM=
9nS5b/AGCpZNAfZj1A==
a3GcpSND8/KlWg==
fin6NmQXayreIOrzPyw=
EjdROfeTsDPVH+rzPyw=
DO4xD8nURBwM8Q+i
+p/LQHFh0KOAQEW7
iNos10QpwjvjvFrXJYtYFiuHdA==
SX//aFP4Yi5T6NbcKQr07J6e
2NKh0dNr52sTdH4OSNjBhQ==
ZMSJmgsxFrlp5fnecrgeVYcP4xRZNho=
oXmlavAJ+3IbFbl3Gm4H+iKG
ijjWRYCaXiTcigreSNjBhQ==
ZqpH49I4XPu1k+rzPyw=
ZZUh+4FrrBbKukgJWoeuFzY=
lLnTxHn7rq/W9G8rzjsgCnyBYw==
drzjup.space
Signatures
-
Xloader payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4108-141-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral2/memory/4108-146-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral2/memory/3376-154-0x0000000000B30000-0x0000000000B5C000-memory.dmp xloader behavioral2/memory/3376-156-0x0000000000B30000-0x0000000000B5C000-memory.dmp xloader -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
NETSTAT.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run NETSTAT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ZLRL1NFPZ = "C:\\Program Files (x86)\\Xtbe8w\\cz18ulc0bc0y.exe" NETSTAT.EXE -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lhblug.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation lhblug.exe -
Executes dropped EXE 3 IoCs
Processes:
lhblug.exelhblug.execz18ulc0bc0y.exepid process 4556 lhblug.exe 4108 lhblug.exe 3848 cz18ulc0bc0y.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
lhblug.exelhblug.exeNETSTAT.EXEdescription pid process target process PID 4556 set thread context of 4108 4556 lhblug.exe lhblug.exe PID 4108 set thread context of 3172 4108 lhblug.exe Explorer.EXE PID 3376 set thread context of 3172 3376 NETSTAT.EXE Explorer.EXE -
Drops file in Program Files directory 4 IoCs
Processes:
Explorer.EXENETSTAT.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Xtbe8w Explorer.EXE File created C:\Program Files (x86)\Xtbe8w\cz18ulc0bc0y.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Xtbe8w\cz18ulc0bc0y.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Xtbe8w\cz18ulc0bc0y.exe NETSTAT.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 3376 NETSTAT.EXE -
Processes:
NETSTAT.EXEdescription ioc process Key created \Registry\User\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
lhblug.exeNETSTAT.EXEpid process 4108 lhblug.exe 4108 lhblug.exe 4108 lhblug.exe 4108 lhblug.exe 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3172 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
lhblug.exelhblug.exeNETSTAT.EXEpid process 4556 lhblug.exe 4108 lhblug.exe 4108 lhblug.exe 4108 lhblug.exe 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE 3376 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
lhblug.exeNETSTAT.EXEExplorer.EXEdescription pid process Token: SeDebugPrivilege 4108 lhblug.exe Token: SeDebugPrivilege 3376 NETSTAT.EXE Token: SeShutdownPrivilege 3172 Explorer.EXE Token: SeCreatePagefilePrivilege 3172 Explorer.EXE Token: SeShutdownPrivilege 3172 Explorer.EXE Token: SeCreatePagefilePrivilege 3172 Explorer.EXE Token: SeShutdownPrivilege 3172 Explorer.EXE Token: SeCreatePagefilePrivilege 3172 Explorer.EXE Token: SeShutdownPrivilege 3172 Explorer.EXE Token: SeCreatePagefilePrivilege 3172 Explorer.EXE Token: SeShutdownPrivilege 3172 Explorer.EXE Token: SeCreatePagefilePrivilege 3172 Explorer.EXE Token: SeShutdownPrivilege 3172 Explorer.EXE Token: SeCreatePagefilePrivilege 3172 Explorer.EXE Token: SeShutdownPrivilege 3172 Explorer.EXE Token: SeCreatePagefilePrivilege 3172 Explorer.EXE Token: SeShutdownPrivilege 3172 Explorer.EXE Token: SeCreatePagefilePrivilege 3172 Explorer.EXE Token: SeShutdownPrivilege 3172 Explorer.EXE Token: SeCreatePagefilePrivilege 3172 Explorer.EXE Token: SeShutdownPrivilege 3172 Explorer.EXE Token: SeCreatePagefilePrivilege 3172 Explorer.EXE -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
tmp.exelhblug.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 4916 wrote to memory of 4556 4916 tmp.exe lhblug.exe PID 4916 wrote to memory of 4556 4916 tmp.exe lhblug.exe PID 4916 wrote to memory of 4556 4916 tmp.exe lhblug.exe PID 4556 wrote to memory of 4108 4556 lhblug.exe lhblug.exe PID 4556 wrote to memory of 4108 4556 lhblug.exe lhblug.exe PID 4556 wrote to memory of 4108 4556 lhblug.exe lhblug.exe PID 4556 wrote to memory of 4108 4556 lhblug.exe lhblug.exe PID 3172 wrote to memory of 3376 3172 Explorer.EXE NETSTAT.EXE PID 3172 wrote to memory of 3376 3172 Explorer.EXE NETSTAT.EXE PID 3172 wrote to memory of 3376 3172 Explorer.EXE NETSTAT.EXE PID 3376 wrote to memory of 3656 3376 NETSTAT.EXE cmd.exe PID 3376 wrote to memory of 3656 3376 NETSTAT.EXE cmd.exe PID 3376 wrote to memory of 3656 3376 NETSTAT.EXE cmd.exe PID 3376 wrote to memory of 2672 3376 NETSTAT.EXE cmd.exe PID 3376 wrote to memory of 2672 3376 NETSTAT.EXE cmd.exe PID 3376 wrote to memory of 2672 3376 NETSTAT.EXE cmd.exe PID 3376 wrote to memory of 3584 3376 NETSTAT.EXE cmd.exe PID 3376 wrote to memory of 3584 3376 NETSTAT.EXE cmd.exe PID 3376 wrote to memory of 3584 3376 NETSTAT.EXE cmd.exe PID 3376 wrote to memory of 1608 3376 NETSTAT.EXE Firefox.exe PID 3376 wrote to memory of 1608 3376 NETSTAT.EXE Firefox.exe PID 3376 wrote to memory of 1608 3376 NETSTAT.EXE Firefox.exe PID 3172 wrote to memory of 3848 3172 Explorer.EXE cz18ulc0bc0y.exe PID 3172 wrote to memory of 3848 3172 Explorer.EXE cz18ulc0bc0y.exe PID 3172 wrote to memory of 3848 3172 Explorer.EXE cz18ulc0bc0y.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lhblug.exe"C:\Users\Admin\AppData\Local\Temp\lhblug.exe" C:\Users\Admin\AppData\Local\Temp\eublbmjt.q3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lhblug.exe"C:\Users\Admin\AppData\Local\Temp\lhblug.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\lhblug.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Xtbe8w\cz18ulc0bc0y.exe"C:\Program Files (x86)\Xtbe8w\cz18ulc0bc0y.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Xtbe8w\cz18ulc0bc0y.exeFilesize
85KB
MD57db397f547de47ba7b50fa2256c97686
SHA193fa9a0c9976d44a24c63bdcc76a1fb5fb190c69
SHA2566ca9caa0e7e3c7d7663b0854decebc27d183abd427e5a07f1db72183c7659574
SHA5122668c06739cfbb270df39bdbde3e046e02a7267aadef104feca197c109de734f74069f66e24114c288336f67c0f6aa40446e85c88b8db503bca30e53af00eb31
-
C:\Program Files (x86)\Xtbe8w\cz18ulc0bc0y.exeFilesize
85KB
MD57db397f547de47ba7b50fa2256c97686
SHA193fa9a0c9976d44a24c63bdcc76a1fb5fb190c69
SHA2566ca9caa0e7e3c7d7663b0854decebc27d183abd427e5a07f1db72183c7659574
SHA5122668c06739cfbb270df39bdbde3e046e02a7267aadef104feca197c109de734f74069f66e24114c288336f67c0f6aa40446e85c88b8db503bca30e53af00eb31
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
C:\Users\Admin\AppData\Local\Temp\Xtbe8w\cz18ulc0bc0y.exeFilesize
85KB
MD57db397f547de47ba7b50fa2256c97686
SHA193fa9a0c9976d44a24c63bdcc76a1fb5fb190c69
SHA2566ca9caa0e7e3c7d7663b0854decebc27d183abd427e5a07f1db72183c7659574
SHA5122668c06739cfbb270df39bdbde3e046e02a7267aadef104feca197c109de734f74069f66e24114c288336f67c0f6aa40446e85c88b8db503bca30e53af00eb31
-
C:\Users\Admin\AppData\Local\Temp\eublbmjt.qFilesize
5KB
MD52ee1d9c55c43f5beb7e3286162bb508a
SHA1a1589bcd997bf299782d6f10c0bcc56b3119ee1f
SHA256af7fa0bd8adc5e3720890a1af8a4f397a5d474abfa8908463ec2dde31283a634
SHA512841863b1387473404ed9fdde003b404e11aabb0d7caae4263b0ae965b347061421276dd9e18a4250d2ae72dffeb30f9cd69cc46e92f16537dbea25d99487dcae
-
C:\Users\Admin\AppData\Local\Temp\lhblug.exeFilesize
85KB
MD57db397f547de47ba7b50fa2256c97686
SHA193fa9a0c9976d44a24c63bdcc76a1fb5fb190c69
SHA2566ca9caa0e7e3c7d7663b0854decebc27d183abd427e5a07f1db72183c7659574
SHA5122668c06739cfbb270df39bdbde3e046e02a7267aadef104feca197c109de734f74069f66e24114c288336f67c0f6aa40446e85c88b8db503bca30e53af00eb31
-
C:\Users\Admin\AppData\Local\Temp\lhblug.exeFilesize
85KB
MD57db397f547de47ba7b50fa2256c97686
SHA193fa9a0c9976d44a24c63bdcc76a1fb5fb190c69
SHA2566ca9caa0e7e3c7d7663b0854decebc27d183abd427e5a07f1db72183c7659574
SHA5122668c06739cfbb270df39bdbde3e046e02a7267aadef104feca197c109de734f74069f66e24114c288336f67c0f6aa40446e85c88b8db503bca30e53af00eb31
-
C:\Users\Admin\AppData\Local\Temp\lhblug.exeFilesize
85KB
MD57db397f547de47ba7b50fa2256c97686
SHA193fa9a0c9976d44a24c63bdcc76a1fb5fb190c69
SHA2566ca9caa0e7e3c7d7663b0854decebc27d183abd427e5a07f1db72183c7659574
SHA5122668c06739cfbb270df39bdbde3e046e02a7267aadef104feca197c109de734f74069f66e24114c288336f67c0f6aa40446e85c88b8db503bca30e53af00eb31
-
C:\Users\Admin\AppData\Local\Temp\twjnycti.znwFilesize
196KB
MD56ea8e7368b5562271d022833ae3433fa
SHA1f335e11efd09cacfd40d6761a1d2b340b9d55b8e
SHA256ad209e6922772376eb700c829b51bd3d0268d59a7fd51080007d63010fdec086
SHA5128ad80a05298aa676f42d27a405fc9b8e28193c540d54d93924c1388e05351819471bb1ecc21d7761691ff6b1a8269aacd17b28fc1b2239e6c462eb0c54968aa5
-
memory/3172-200-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-205-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-290-0x0000000001250000-0x0000000001252000-memory.dmpFilesize
8KB
-
memory/3172-159-0x0000000009090000-0x000000000918A000-memory.dmpFilesize
1000KB
-
memory/3172-160-0x0000000009090000-0x000000000918A000-memory.dmpFilesize
1000KB
-
memory/3172-161-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-162-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-163-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-164-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-165-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-166-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-167-0x0000000008300000-0x0000000008302000-memory.dmpFilesize
8KB
-
memory/3172-168-0x0000000008300000-0x0000000008302000-memory.dmpFilesize
8KB
-
memory/3172-169-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-170-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-171-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-172-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-173-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-174-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-175-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-176-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-177-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-178-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-179-0x0000000008300000-0x0000000008302000-memory.dmpFilesize
8KB
-
memory/3172-181-0x0000000009090000-0x000000000918A000-memory.dmpFilesize
1000KB
-
memory/3172-279-0x0000000001250000-0x0000000001252000-memory.dmpFilesize
8KB
-
memory/3172-272-0x0000000001250000-0x0000000001252000-memory.dmpFilesize
8KB
-
memory/3172-195-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-196-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-197-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-198-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-199-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-149-0x0000000008FD0000-0x0000000009081000-memory.dmpFilesize
708KB
-
memory/3172-201-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-202-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-203-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-204-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-236-0x0000000003190000-0x00000000031A0000-memory.dmpFilesize
64KB
-
memory/3172-206-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-207-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-208-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-209-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-210-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-211-0x00000000031A0000-0x00000000031A2000-memory.dmpFilesize
8KB
-
memory/3172-212-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-213-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-214-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-215-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-216-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-217-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-219-0x00000000031A0000-0x00000000031A2000-memory.dmpFilesize
8KB
-
memory/3172-220-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-221-0x0000000003190000-0x00000000031A0000-memory.dmpFilesize
64KB
-
memory/3172-223-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-222-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-224-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-225-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-226-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-227-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-228-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-229-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-230-0x0000000008010000-0x0000000008020000-memory.dmpFilesize
64KB
-
memory/3172-231-0x0000000003190000-0x00000000031A0000-memory.dmpFilesize
64KB
-
memory/3172-232-0x0000000003190000-0x00000000031A0000-memory.dmpFilesize
64KB
-
memory/3172-233-0x00000000031A0000-0x00000000031A2000-memory.dmpFilesize
8KB
-
memory/3172-235-0x0000000003190000-0x00000000031A0000-memory.dmpFilesize
64KB
-
memory/3376-156-0x0000000000B30000-0x0000000000B5C000-memory.dmpFilesize
176KB
-
memory/3376-153-0x00000000000E0000-0x00000000000EB000-memory.dmpFilesize
44KB
-
memory/3376-151-0x00000000000E0000-0x00000000000EB000-memory.dmpFilesize
44KB
-
memory/3376-154-0x0000000000B30000-0x0000000000B5C000-memory.dmpFilesize
176KB
-
memory/3376-155-0x0000000001470000-0x00000000017BA000-memory.dmpFilesize
3.3MB
-
memory/3376-158-0x00000000012F0000-0x0000000001380000-memory.dmpFilesize
576KB
-
memory/4108-141-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4108-145-0x0000000000A60000-0x0000000000DAA000-memory.dmpFilesize
3.3MB
-
memory/4108-146-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4108-148-0x00000000005D0000-0x00000000005E1000-memory.dmpFilesize
68KB