Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2023 19:17
Behavioral task
behavioral1
Sample
ClientCrack.exe
Resource
win7-20230220-en
General
-
Target
ClientCrack.exe
-
Size
296KB
-
MD5
bc5462da689944a5426fa4d933dc5fdf
-
SHA1
8a6ab3b4ed020b4d3b60d4aa4251d2f51f5d6308
-
SHA256
d8276830ad97867bf13dc04ae0190e2c3dbcb14c08b5fe30e609ef817b110ca3
-
SHA512
35abd0160381c6c16a011ce77d8abc8d5545e1dc9ea2928e4074b9967f97404cbe134b4d3acd90dd8ff9ff2e7f86cf57678d800c975650b6f7176347e5952cf7
-
SSDEEP
6144:NMH4eWseynVKsxUthS/nOS2J0zx9F4/Gksi+4CeeTf8X8FQ1M:NMH4sn81Par0019F4/GkudRTf8SQ1M
Malware Config
Signatures
-
XMRig Miner payload 16 IoCs
Processes:
resource yara_rule behavioral2/memory/2716-227-0x0000000140000000-0x0000000140829000-memory.dmp xmrig behavioral2/memory/2716-228-0x0000000140000000-0x0000000140829000-memory.dmp xmrig behavioral2/memory/2716-230-0x0000000140000000-0x0000000140829000-memory.dmp xmrig behavioral2/memory/2716-232-0x0000000140000000-0x0000000140829000-memory.dmp xmrig behavioral2/memory/2716-236-0x0000000140000000-0x0000000140829000-memory.dmp xmrig behavioral2/memory/2716-237-0x0000000140000000-0x0000000140829000-memory.dmp xmrig behavioral2/memory/2716-238-0x0000000140000000-0x0000000140829000-memory.dmp xmrig behavioral2/memory/2716-239-0x0000000140000000-0x0000000140829000-memory.dmp xmrig behavioral2/memory/2716-240-0x0000000140000000-0x0000000140829000-memory.dmp xmrig behavioral2/memory/2716-241-0x0000000140000000-0x0000000140829000-memory.dmp xmrig behavioral2/memory/2716-242-0x0000000140000000-0x0000000140829000-memory.dmp xmrig behavioral2/memory/2716-243-0x0000000140000000-0x0000000140829000-memory.dmp xmrig behavioral2/memory/2716-244-0x0000000140000000-0x0000000140829000-memory.dmp xmrig behavioral2/memory/2716-245-0x0000000140000000-0x0000000140829000-memory.dmp xmrig behavioral2/memory/2716-246-0x0000000140000000-0x0000000140829000-memory.dmp xmrig behavioral2/memory/2716-247-0x0000000140000000-0x0000000140829000-memory.dmp xmrig -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ClientCrack.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation ClientCrack.exe -
Executes dropped EXE 3 IoCs
Processes:
crack1.exebing.exesihost64.exepid process 1264 crack1.exe 4804 bing.exe 676 sihost64.exe -
Processes:
resource yara_rule behavioral2/memory/3384-133-0x0000000000080000-0x0000000000102000-memory.dmp vmprotect C:\Users\Admin\AppData\Local\Temp\crack1.exe vmprotect C:\Users\Admin\AppData\Local\Temp\crack1.exe vmprotect behavioral2/memory/1264-193-0x0000000000400000-0x00000000010B4000-memory.dmp vmprotect C:\Users\Admin\AppData\Roaming\Windows\bing.exe vmprotect C:\Users\Admin\AppData\Roaming\Windows\bing.exe vmprotect behavioral2/memory/4804-210-0x0000000000400000-0x00000000010B4000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
crack1.exebing.exepid process 1264 crack1.exe 4804 bing.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
conhost.exedescription pid process target process PID 3868 set thread context of 2716 3868 conhost.exe notepad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 33 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.execrack1.execonhost.exebing.execonhost.exenotepad.exepid process 3052 powershell.exe 3052 powershell.exe 1264 crack1.exe 1264 crack1.exe 4276 conhost.exe 4804 bing.exe 4804 bing.exe 3868 conhost.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe 2716 notepad.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 652 -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
ClientCrack.exepowershell.execonhost.execonhost.exenotepad.exedescription pid process Token: SeDebugPrivilege 3384 ClientCrack.exe Token: SeDebugPrivilege 3052 powershell.exe Token: SeDebugPrivilege 4276 conhost.exe Token: SeDebugPrivilege 3868 conhost.exe Token: SeLockMemoryPrivilege 2716 notepad.exe Token: SeLockMemoryPrivilege 2716 notepad.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
explorer.exepid process 2536 explorer.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
ClientCrack.exeexplorer.execrack1.execonhost.execmd.execmd.exebing.execonhost.exesihost64.exedescription pid process target process PID 3384 wrote to memory of 3052 3384 ClientCrack.exe powershell.exe PID 3384 wrote to memory of 3052 3384 ClientCrack.exe powershell.exe PID 3384 wrote to memory of 3052 3384 ClientCrack.exe powershell.exe PID 3384 wrote to memory of 1216 3384 ClientCrack.exe explorer.exe PID 3384 wrote to memory of 1216 3384 ClientCrack.exe explorer.exe PID 3384 wrote to memory of 1216 3384 ClientCrack.exe explorer.exe PID 3384 wrote to memory of 4056 3384 ClientCrack.exe explorer.exe PID 3384 wrote to memory of 4056 3384 ClientCrack.exe explorer.exe PID 3384 wrote to memory of 4056 3384 ClientCrack.exe explorer.exe PID 4104 wrote to memory of 1264 4104 explorer.exe crack1.exe PID 4104 wrote to memory of 1264 4104 explorer.exe crack1.exe PID 1264 wrote to memory of 4276 1264 crack1.exe conhost.exe PID 1264 wrote to memory of 4276 1264 crack1.exe conhost.exe PID 1264 wrote to memory of 4276 1264 crack1.exe conhost.exe PID 4276 wrote to memory of 4464 4276 conhost.exe cmd.exe PID 4276 wrote to memory of 4464 4276 conhost.exe cmd.exe PID 4464 wrote to memory of 1500 4464 cmd.exe schtasks.exe PID 4464 wrote to memory of 1500 4464 cmd.exe schtasks.exe PID 4276 wrote to memory of 4796 4276 conhost.exe cmd.exe PID 4276 wrote to memory of 4796 4276 conhost.exe cmd.exe PID 4796 wrote to memory of 4804 4796 cmd.exe bing.exe PID 4796 wrote to memory of 4804 4796 cmd.exe bing.exe PID 4804 wrote to memory of 3868 4804 bing.exe conhost.exe PID 4804 wrote to memory of 3868 4804 bing.exe conhost.exe PID 4804 wrote to memory of 3868 4804 bing.exe conhost.exe PID 3868 wrote to memory of 676 3868 conhost.exe sihost64.exe PID 3868 wrote to memory of 676 3868 conhost.exe sihost64.exe PID 676 wrote to memory of 2576 676 sihost64.exe conhost.exe PID 676 wrote to memory of 2576 676 sihost64.exe conhost.exe PID 676 wrote to memory of 2576 676 sihost64.exe conhost.exe PID 3868 wrote to memory of 2716 3868 conhost.exe notepad.exe PID 3868 wrote to memory of 2716 3868 conhost.exe notepad.exe PID 3868 wrote to memory of 2716 3868 conhost.exe notepad.exe PID 3868 wrote to memory of 2716 3868 conhost.exe notepad.exe PID 3868 wrote to memory of 2716 3868 conhost.exe notepad.exe PID 3868 wrote to memory of 2716 3868 conhost.exe notepad.exe PID 3868 wrote to memory of 2716 3868 conhost.exe notepad.exe PID 3868 wrote to memory of 2716 3868 conhost.exe notepad.exe PID 3868 wrote to memory of 2716 3868 conhost.exe notepad.exe PID 3868 wrote to memory of 2716 3868 conhost.exe notepad.exe PID 3868 wrote to memory of 2716 3868 conhost.exe notepad.exe PID 3868 wrote to memory of 2716 3868 conhost.exe notepad.exe PID 3868 wrote to memory of 2716 3868 conhost.exe notepad.exe PID 3868 wrote to memory of 2716 3868 conhost.exe notepad.exe PID 3868 wrote to memory of 2716 3868 conhost.exe notepad.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ClientCrack.exe"C:\Users\Admin\AppData\Local\Temp\ClientCrack.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionExtension 'exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\crack0.exe2⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\crack1.exe2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\crack1.exe"C:\Users\Admin\AppData\Local\Temp\crack1.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\crack1.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "bing" /tr "C:\Users\Admin\AppData\Roaming\Windows\bing.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "bing" /tr "C:\Users\Admin\AppData\Roaming\Windows\bing.exe"5⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\Windows\bing.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows\bing.exeC:\Users\Admin\AppData\Roaming\Windows\bing.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\Windows\bing.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows\Telemetry\sihost64.exe"C:\Users\Admin\AppData\Roaming\Windows\Telemetry\sihost64.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "lnuosiphlfyb"8⤵
-
C:\Windows\System32\notepad.exeC:\Windows\System32\notepad.exe lljehtglibindjy0 aL9rWj13blqq3tQ6pq9BT64AEBTmmOZm2QnBzGRIrKz4lH8cILU8ujdaoXpBms5pkMWER+EsTdhKTKqT8IEqTdy5Kemgk9NU/QdLsz65HcO+0zUEL/qHUiO8LrJXiqBRJ8D62RHLpVH/QJcfgroK8jHRHPvV0tHEkzAcBKCqEYVFgUZRAEKGt21cyAzobSI2kfeIY1RxqTQoAcbo2GvrIBa6BxgzceV5W53VR8rYo72guwpY3zJmbSRhZPH4j5Ph36z98pZayAo8raem1y71UJy9Vt6U7uiIc1PpV/Yw5T+VI23SG0mix/ww0sTVWs73+a9XuuRmVA4TV7esDGm4ow==7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.logFilesize
539B
MD58ee0f3b0e00f89f7523395bb72e9118b
SHA1bec3fa36a1fb136551dc8157a4963ba5d2f957d4
SHA2568c5f958972fce1812970a1f8da8ccef94a86663d42d13e296813673638a6b68b
SHA51255f862beb42fa76ca118b2c76c92cb1e0a2586727c602645d0d4bd0e8f2120cfc2015f4333df67f3bd9f4eda8b9b399774461ab558f08312920a1489acf7a207
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xvftgogu.ai1.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\crack1.exeFilesize
7.2MB
MD57f550bd8d4691653bf6409cea54ec42b
SHA12a5e545774952143f99b9f73e08d11d0bf591600
SHA25684cbbe450bb73f5b4b3b9d553e9cbe088115cafa07cdbcd7f11623c8c71cbec4
SHA5122fcc920f89ae821ffa52b2fac74d2419b386beaf8453b78a0581b0bb7864d9b691fa9f23ba8e186465b4a96155476b8e4be99025c85b7e68b4883225be2ea978
-
C:\Users\Admin\AppData\Local\Temp\crack1.exeFilesize
7.2MB
MD57f550bd8d4691653bf6409cea54ec42b
SHA12a5e545774952143f99b9f73e08d11d0bf591600
SHA25684cbbe450bb73f5b4b3b9d553e9cbe088115cafa07cdbcd7f11623c8c71cbec4
SHA5122fcc920f89ae821ffa52b2fac74d2419b386beaf8453b78a0581b0bb7864d9b691fa9f23ba8e186465b4a96155476b8e4be99025c85b7e68b4883225be2ea978
-
C:\Users\Admin\AppData\Roaming\Windows\Telemetry\sihost64.exeFilesize
30KB
MD58a67b24952c68ff2a4c7a59f1228640e
SHA1508fb383a6285cfcbcd815a309d1cc3ce7b8a243
SHA2566105a52b0f2f127137e97af929d5a1292c173f5239dcbe5a8bf7d5082d066ef6
SHA512dc5af212a27691d1ae9553a10ca5ebaeec67764375d98e4a97f430bc364be132d34cd130443567e081055c86f071d254aee4720b332709b98ff6461e7a3b8d8e
-
C:\Users\Admin\AppData\Roaming\Windows\Telemetry\sihost64.exeFilesize
30KB
MD58a67b24952c68ff2a4c7a59f1228640e
SHA1508fb383a6285cfcbcd815a309d1cc3ce7b8a243
SHA2566105a52b0f2f127137e97af929d5a1292c173f5239dcbe5a8bf7d5082d066ef6
SHA512dc5af212a27691d1ae9553a10ca5ebaeec67764375d98e4a97f430bc364be132d34cd130443567e081055c86f071d254aee4720b332709b98ff6461e7a3b8d8e
-
C:\Users\Admin\AppData\Roaming\Windows\Telemetry\sihost64.exeFilesize
30KB
MD58a67b24952c68ff2a4c7a59f1228640e
SHA1508fb383a6285cfcbcd815a309d1cc3ce7b8a243
SHA2566105a52b0f2f127137e97af929d5a1292c173f5239dcbe5a8bf7d5082d066ef6
SHA512dc5af212a27691d1ae9553a10ca5ebaeec67764375d98e4a97f430bc364be132d34cd130443567e081055c86f071d254aee4720b332709b98ff6461e7a3b8d8e
-
C:\Users\Admin\AppData\Roaming\Windows\bing.exeFilesize
7.2MB
MD57f550bd8d4691653bf6409cea54ec42b
SHA12a5e545774952143f99b9f73e08d11d0bf591600
SHA25684cbbe450bb73f5b4b3b9d553e9cbe088115cafa07cdbcd7f11623c8c71cbec4
SHA5122fcc920f89ae821ffa52b2fac74d2419b386beaf8453b78a0581b0bb7864d9b691fa9f23ba8e186465b4a96155476b8e4be99025c85b7e68b4883225be2ea978
-
C:\Users\Admin\AppData\Roaming\Windows\bing.exeFilesize
7.2MB
MD57f550bd8d4691653bf6409cea54ec42b
SHA12a5e545774952143f99b9f73e08d11d0bf591600
SHA25684cbbe450bb73f5b4b3b9d553e9cbe088115cafa07cdbcd7f11623c8c71cbec4
SHA5122fcc920f89ae821ffa52b2fac74d2419b386beaf8453b78a0581b0bb7864d9b691fa9f23ba8e186465b4a96155476b8e4be99025c85b7e68b4883225be2ea978
-
memory/1264-193-0x0000000000400000-0x00000000010B4000-memory.dmpFilesize
12.7MB
-
memory/1264-192-0x00007FFD51F80000-0x00007FFD51F82000-memory.dmpFilesize
8KB
-
memory/1264-191-0x00007FFD51F70000-0x00007FFD51F72000-memory.dmpFilesize
8KB
-
memory/2576-226-0x0000024273030000-0x0000024273036000-memory.dmpFilesize
24KB
-
memory/2576-234-0x00000242755B0000-0x00000242755C0000-memory.dmpFilesize
64KB
-
memory/2576-233-0x00000242755B0000-0x00000242755C0000-memory.dmpFilesize
64KB
-
memory/2576-235-0x00000242755B0000-0x00000242755C0000-memory.dmpFilesize
64KB
-
memory/2576-248-0x00000242755B0000-0x00000242755C0000-memory.dmpFilesize
64KB
-
memory/2576-249-0x00000242755B0000-0x00000242755C0000-memory.dmpFilesize
64KB
-
memory/2576-250-0x00000242755B0000-0x00000242755C0000-memory.dmpFilesize
64KB
-
memory/2716-228-0x0000000140000000-0x0000000140829000-memory.dmpFilesize
8.2MB
-
memory/2716-242-0x0000000140000000-0x0000000140829000-memory.dmpFilesize
8.2MB
-
memory/2716-227-0x0000000140000000-0x0000000140829000-memory.dmpFilesize
8.2MB
-
memory/2716-230-0x0000000140000000-0x0000000140829000-memory.dmpFilesize
8.2MB
-
memory/2716-231-0x000001A3E5080000-0x000001A3E50A0000-memory.dmpFilesize
128KB
-
memory/2716-232-0x0000000140000000-0x0000000140829000-memory.dmpFilesize
8.2MB
-
memory/2716-236-0x0000000140000000-0x0000000140829000-memory.dmpFilesize
8.2MB
-
memory/2716-237-0x0000000140000000-0x0000000140829000-memory.dmpFilesize
8.2MB
-
memory/2716-238-0x0000000140000000-0x0000000140829000-memory.dmpFilesize
8.2MB
-
memory/2716-239-0x0000000140000000-0x0000000140829000-memory.dmpFilesize
8.2MB
-
memory/2716-240-0x0000000140000000-0x0000000140829000-memory.dmpFilesize
8.2MB
-
memory/2716-247-0x0000000140000000-0x0000000140829000-memory.dmpFilesize
8.2MB
-
memory/2716-246-0x0000000140000000-0x0000000140829000-memory.dmpFilesize
8.2MB
-
memory/2716-245-0x0000000140000000-0x0000000140829000-memory.dmpFilesize
8.2MB
-
memory/2716-244-0x0000000140000000-0x0000000140829000-memory.dmpFilesize
8.2MB
-
memory/2716-241-0x0000000140000000-0x0000000140829000-memory.dmpFilesize
8.2MB
-
memory/2716-243-0x0000000140000000-0x0000000140829000-memory.dmpFilesize
8.2MB
-
memory/3052-179-0x0000000007FA0000-0x0000000007FA8000-memory.dmpFilesize
32KB
-
memory/3052-177-0x0000000007EB0000-0x0000000007EBE000-memory.dmpFilesize
56KB
-
memory/3052-158-0x0000000006980000-0x000000000699E000-memory.dmpFilesize
120KB
-
memory/3052-157-0x0000000005480000-0x0000000005490000-memory.dmpFilesize
64KB
-
memory/3052-156-0x0000000005480000-0x0000000005490000-memory.dmpFilesize
64KB
-
memory/3052-160-0x0000000007B30000-0x0000000007B62000-memory.dmpFilesize
200KB
-
memory/3052-161-0x000000006FBC0000-0x000000006FC0C000-memory.dmpFilesize
304KB
-
memory/3052-142-0x0000000005AC0000-0x00000000060E8000-memory.dmpFilesize
6.2MB
-
memory/3052-178-0x0000000007FC0000-0x0000000007FDA000-memory.dmpFilesize
104KB
-
memory/3052-159-0x0000000005480000-0x0000000005490000-memory.dmpFilesize
64KB
-
memory/3052-176-0x0000000007F00000-0x0000000007F96000-memory.dmpFilesize
600KB
-
memory/3052-175-0x0000000007CF0000-0x0000000007CFA000-memory.dmpFilesize
40KB
-
memory/3052-174-0x000000007F610000-0x000000007F620000-memory.dmpFilesize
64KB
-
memory/3052-145-0x0000000006330000-0x0000000006396000-memory.dmpFilesize
408KB
-
memory/3052-172-0x00000000082D0000-0x000000000894A000-memory.dmpFilesize
6.5MB
-
memory/3052-144-0x0000000006190000-0x00000000061F6000-memory.dmpFilesize
408KB
-
memory/3052-173-0x0000000007C80000-0x0000000007C9A000-memory.dmpFilesize
104KB
-
memory/3052-171-0x0000000006F30000-0x0000000006F4E000-memory.dmpFilesize
120KB
-
memory/3052-141-0x0000000003070000-0x00000000030A6000-memory.dmpFilesize
216KB
-
memory/3052-143-0x00000000060F0000-0x0000000006112000-memory.dmpFilesize
136KB
-
memory/3384-186-0x0000000004A50000-0x0000000004A6A000-memory.dmpFilesize
104KB
-
memory/3384-185-0x0000000004A50000-0x0000000004A6A000-memory.dmpFilesize
104KB
-
memory/3384-140-0x0000000009D70000-0x0000000009D7A000-memory.dmpFilesize
40KB
-
memory/3384-134-0x0000000009520000-0x0000000009AC4000-memory.dmpFilesize
5.6MB
-
memory/3384-133-0x0000000000080000-0x0000000000102000-memory.dmpFilesize
520KB
-
memory/3384-135-0x0000000008F70000-0x0000000009002000-memory.dmpFilesize
584KB
-
memory/3384-136-0x0000000002500000-0x0000000002540000-memory.dmpFilesize
256KB
-
memory/3384-151-0x00000000090F0000-0x0000000009100000-memory.dmpFilesize
64KB
-
memory/3384-139-0x0000000004A50000-0x0000000004A6A000-memory.dmpFilesize
104KB
-
memory/3384-138-0x0000000004A50000-0x0000000004A6A000-memory.dmpFilesize
104KB
-
memory/3384-137-0x00000000090F0000-0x0000000009100000-memory.dmpFilesize
64KB
-
memory/3384-182-0x0000000002500000-0x0000000002540000-memory.dmpFilesize
256KB
-
memory/3384-183-0x00000000090F0000-0x0000000009100000-memory.dmpFilesize
64KB
-
memory/3384-184-0x0000000004A50000-0x0000000004A6A000-memory.dmpFilesize
104KB
-
memory/3384-187-0x00000000090F0000-0x0000000009100000-memory.dmpFilesize
64KB
-
memory/3868-217-0x000001B8FB950000-0x000001B8FB960000-memory.dmpFilesize
64KB
-
memory/3868-216-0x000001B8FB950000-0x000001B8FB960000-memory.dmpFilesize
64KB
-
memory/3868-215-0x000001B8FB950000-0x000001B8FB960000-memory.dmpFilesize
64KB
-
memory/4276-197-0x000001BE0B0E0000-0x000001BE0B0F0000-memory.dmpFilesize
64KB
-
memory/4276-196-0x000001BE0B0F0000-0x000001BE0B102000-memory.dmpFilesize
72KB
-
memory/4276-195-0x000001BE09120000-0x000001BE09382000-memory.dmpFilesize
2.4MB
-
memory/4276-198-0x000001BE0B0E0000-0x000001BE0B0F0000-memory.dmpFilesize
64KB
-
memory/4276-199-0x000001BE0B0E0000-0x000001BE0B0F0000-memory.dmpFilesize
64KB
-
memory/4276-201-0x000001BE0B0E0000-0x000001BE0B0F0000-memory.dmpFilesize
64KB
-
memory/4276-202-0x000001BE0B0E0000-0x000001BE0B0F0000-memory.dmpFilesize
64KB
-
memory/4804-210-0x0000000000400000-0x00000000010B4000-memory.dmpFilesize
12.7MB