Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-06-2023 00:30
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order f.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Purchase Order f.exe
Resource
win10v2004-20230220-en
General
-
Target
Purchase Order f.exe
-
Size
990KB
-
MD5
d9c112f69af98e4bf1b9b60172cc6e4b
-
SHA1
97c7ff692a8798aecd01008348b5532946b376d4
-
SHA256
c6b9351ebdc6c29c327f1c49af903664b8df0ebd221da40c02bfc6aba6a07663
-
SHA512
518d5855189a59dabf051de830d2b20d49e65c88d4fecd42efc5dfc82256b80d3d10dd8bc271dba045a1553fd08f4b0dd08493a15290a58328c29fbc3038478e
-
SSDEEP
24576:aDrW6G2PnQd7Oy8eOLVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVU:aDqtUnI7O8CVVVVVVVVVVVVVVVVVVVVe
Malware Config
Extracted
formbook
nvp4
EiywrQNofDNveWY1IESoBA==
yqEWFGRfErX7ICQCwyQ+YeLXtaA=
Ers0rc50nbjso0jbdZTmBw==
XQxVP45+F5OZn3ZBTC7MLe1OF3G5c5uK9A==
RHh4uwtsttjzlxy+eW3+
W+xQshfnvmF5n5x2d+cEVdBNIkQRHRE=
FwlyiuXNX0+Trw==
euLn91on/7DeDe++zbQ4YeLXtaA=
td4cO8m3HDRWtl8p7Q==
ZrlyAAPqc3GXI5k=
OM0IisKOI78FJC/IuIxxAu5nRg==
d6A0QJ6PV+AOpyK+eW3+
+EgxFWUu3Ulatl8p7Q==
GC/stck1ILXn+cWZx7w8W6rPFmO6c5uK9A==
hhIiK4+CKEOfB4tr
mA1pyQ85ye8N
4xgWYcEpEoidv8eXKNncAQ==
L+hOVbe+IWyc8oVUclc=
J7EGaJ+L+wKLXUYg7w==
L5R/nfdgQdMHD+TUKw1Zo3Hb
E4z2kWG/vE6yt5E=
+efGEVp82EycSL2U4cpFU2an/aM5SDuF
6zA2kAqIdAQKkve6y7RjtRBf+i8Nvw==
VRqXzvXLVF+hS9arybBihGeOTaKP
PgKByBDCpL4cd9+yO52n/xZmQZeF
pMit5lre4GVyi3xcfywQY58=
F/vD9x4Oz0RWtl8p7Q==
hvZhvTgp/H7Lm2RNdl0=
h/xWhNLDOEpSZUTmIguoBA==
o8qw6kCdiDV4kn1FMZ6et06V+dCQZEmG
bgMOGYox8vMQ
YmFKj+ZWVRBcep49cl0=
Wox2hOnIRnGp3s2RMZ9Zo3Hb
eeTk5zCrpCpSyntTeF0=
FOA7J3NsxuomwEARYVLNU1TR
yuLXKrWb72SKrA==
K6T6LoiKKwZrHY5i
B8UkEkol7nBvrLeOjSwQY58=
GwvWc8gVAk6yt5E=
4IboPYD24Hqi5mxf+g==
L4XQI2A00QtXxxi+eW3+
doMqp/ZMkE6yt5E=
1ebXKoTs0GSYqMZZc1U=
CYnoUKIiG5vI4/HHLNXpCw==
P/FwuirU0FeJxseeKNncAQ==
N21GaMlCYhFbtl8p7Q==
KY95j+NDjk6yt5E=
C/rJL7ACO0yfB4tr
z6QDKYo85+nxAx+zmTgBLYY=
IPBjddXCgzlvd2Y/C3KaMomhUQ==
KNsyKXJjN+wYPi8OLgNZo3Hb
kht0meHAHPpzqQ==
Rm5BMnxa1/s/yxq2wSJcfpc=
+Tn9l2Ax8vMQ
rwkQV4ruG7v1/s+ZKNncAQ==
7+RhcuhVYBpggr5YZUw=
YRaX4klS4xWfB4tr
YIZ5wgZjYOsslloz9A==
+SAdmP/smDZ6oKF4GxNZo3Hb
mSIWBEa/uz9JSodz
PGc0UrsbRk1LwHVWOp+9CQ==
DnJQctQ5jE6yt5E=
gYmlw+nLOxtYl4k=
eRJtqhQDH3KQsg==
brainbookgroup.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 63 IoCs
Processes:
resource yara_rule behavioral2/memory/1448-135-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-136-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-137-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-138-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-139-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-140-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-141-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-142-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-143-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-144-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-145-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-146-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-147-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-148-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-149-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-150-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-151-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-152-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-153-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-154-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-155-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-156-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-157-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-158-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-159-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-160-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-161-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-162-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-163-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-164-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-165-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-166-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-167-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-168-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-169-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-170-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-171-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-172-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-173-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-174-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-175-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-176-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-177-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-178-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-179-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-180-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-181-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-182-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-183-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-184-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-185-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-186-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-187-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-188-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-189-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-190-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-191-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-192-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-193-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-194-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-195-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-196-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 behavioral2/memory/1448-197-0x00000000028A0000-0x00000000028D1000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Purchase Order f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cprdqspg = "C:\\Users\\Public\\Cprdqspg.url" Purchase Order f.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
colorcpl.exeraserver.exedescription pid process target process PID 4444 set thread context of 3160 4444 colorcpl.exe Explorer.EXE PID 464 set thread context of 3160 464 raserver.exe Explorer.EXE -
Processes:
raserver.exedescription ioc process Key created \Registry\User\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 raserver.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 20 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 22 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
Purchase Order f.execolorcpl.exeraserver.exepid process 1448 Purchase Order f.exe 1448 Purchase Order f.exe 4444 colorcpl.exe 4444 colorcpl.exe 4444 colorcpl.exe 4444 colorcpl.exe 4444 colorcpl.exe 4444 colorcpl.exe 4444 colorcpl.exe 4444 colorcpl.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3160 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
colorcpl.exeraserver.exepid process 4444 colorcpl.exe 4444 colorcpl.exe 4444 colorcpl.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe 464 raserver.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
colorcpl.exeExplorer.EXEraserver.exedescription pid process Token: SeDebugPrivilege 4444 colorcpl.exe Token: SeShutdownPrivilege 3160 Explorer.EXE Token: SeCreatePagefilePrivilege 3160 Explorer.EXE Token: SeShutdownPrivilege 3160 Explorer.EXE Token: SeCreatePagefilePrivilege 3160 Explorer.EXE Token: SeShutdownPrivilege 3160 Explorer.EXE Token: SeCreatePagefilePrivilege 3160 Explorer.EXE Token: SeDebugPrivilege 464 raserver.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Purchase Order f.exeExplorer.EXEraserver.exedescription pid process target process PID 1448 wrote to memory of 4444 1448 Purchase Order f.exe colorcpl.exe PID 1448 wrote to memory of 4444 1448 Purchase Order f.exe colorcpl.exe PID 1448 wrote to memory of 4444 1448 Purchase Order f.exe colorcpl.exe PID 1448 wrote to memory of 4444 1448 Purchase Order f.exe colorcpl.exe PID 1448 wrote to memory of 4444 1448 Purchase Order f.exe colorcpl.exe PID 1448 wrote to memory of 4444 1448 Purchase Order f.exe colorcpl.exe PID 3160 wrote to memory of 464 3160 Explorer.EXE raserver.exe PID 3160 wrote to memory of 464 3160 Explorer.EXE raserver.exe PID 3160 wrote to memory of 464 3160 Explorer.EXE raserver.exe PID 464 wrote to memory of 1336 464 raserver.exe Firefox.exe PID 464 wrote to memory of 1336 464 raserver.exe Firefox.exe PID 464 wrote to memory of 1336 464 raserver.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order f.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order f.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/464-366-0x0000000000F10000-0x0000000000F3D000-memory.dmpFilesize
180KB
-
memory/464-365-0x0000000000130000-0x000000000014F000-memory.dmpFilesize
124KB
-
memory/464-367-0x0000000002FE0000-0x000000000332A000-memory.dmpFilesize
3.3MB
-
memory/464-370-0x0000000002E10000-0x0000000002E9F000-memory.dmpFilesize
572KB
-
memory/464-372-0x0000000000F10000-0x0000000000F3D000-memory.dmpFilesize
180KB
-
memory/1448-167-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-139-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-136-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-137-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-168-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-169-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-140-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-141-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-142-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-143-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-144-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-145-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-146-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-147-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-148-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-149-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-150-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-151-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-152-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-153-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-154-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-155-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-156-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-157-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-158-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-159-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-160-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-161-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-162-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-163-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-164-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-165-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-166-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-134-0x0000000000400000-0x00000000004FE000-memory.dmpFilesize
1016KB
-
memory/1448-170-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-135-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-138-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-171-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-172-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-173-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-174-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-175-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-176-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-177-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-178-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-179-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-180-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-181-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-182-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-183-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-184-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-185-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-186-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-187-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-188-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-189-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-190-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-191-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-192-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-193-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-194-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-195-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-196-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-197-0x00000000028A0000-0x00000000028D1000-memory.dmpFilesize
196KB
-
memory/1448-133-0x0000000002290000-0x0000000002291000-memory.dmpFilesize
4KB
-
memory/3160-371-0x0000000008DD0000-0x0000000008EF1000-memory.dmpFilesize
1.1MB
-
memory/3160-349-0x0000000008C80000-0x0000000008DC2000-memory.dmpFilesize
1.3MB
-
memory/3160-376-0x0000000008DD0000-0x0000000008EF1000-memory.dmpFilesize
1.1MB
-
memory/4444-343-0x0000000010410000-0x000000001043F000-memory.dmpFilesize
188KB
-
memory/4444-340-0x00000000047A0000-0x00000000047A1000-memory.dmpFilesize
4KB
-
memory/4444-345-0x0000000004BA0000-0x0000000004EEA000-memory.dmpFilesize
3.3MB
-
memory/4444-346-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB