Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12-10-2023 00:43
Static task
static1
Behavioral task
behavioral1
Sample
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe
Resource
win7-20230831-en
General
-
Target
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe
-
Size
7.6MB
-
MD5
18e07c4772a2687ee06a434ffef9572f
-
SHA1
ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
-
SHA256
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
-
SHA512
8795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b
-
SSDEEP
196608:eMoIG1kQ7PENK4JQp9ny9MK07ZMCmPSxF:gJB7PGqKMKeBm4F
Malware Config
Extracted
bitrat
1.38
185.225.75.68:3569
-
communication_password
0edcbe7d888380c49e7d1dcf67b6ea6e
-
tor_process
tor
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
state.exestate.exestate.exestate.exepid process 2812 state.exe 2172 state.exe 2600 state.exe 1656 state.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exestate.exestate.exepid process 2092 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe 2092 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe 2092 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe 2092 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe 2172 state.exe 1656 state.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exestate.exestate.exedescription pid process target process PID 2308 set thread context of 2092 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 2812 set thread context of 2172 2812 state.exe state.exe PID 2600 set thread context of 1656 2600 state.exe state.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2444 schtasks.exe 2228 schtasks.exe 2900 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exestate.exestate.exedescription pid process Token: SeDebugPrivilege 2092 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe Token: SeShutdownPrivilege 2092 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe Token: SeDebugPrivilege 2172 state.exe Token: SeShutdownPrivilege 2172 state.exe Token: SeDebugPrivilege 1656 state.exe Token: SeShutdownPrivilege 1656 state.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exepid process 2092 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe 2092 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.execmd.exetaskeng.exestate.execmd.exedescription pid process target process PID 2308 wrote to memory of 2092 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 2308 wrote to memory of 2092 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 2308 wrote to memory of 2092 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 2308 wrote to memory of 2092 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 2308 wrote to memory of 2092 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 2308 wrote to memory of 2092 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 2308 wrote to memory of 2092 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 2308 wrote to memory of 2092 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 2308 wrote to memory of 2092 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 2308 wrote to memory of 2092 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 2308 wrote to memory of 2092 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 2308 wrote to memory of 2092 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe PID 2308 wrote to memory of 2504 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 2308 wrote to memory of 2504 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 2308 wrote to memory of 2504 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 2308 wrote to memory of 2504 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 2308 wrote to memory of 2868 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 2308 wrote to memory of 2868 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 2308 wrote to memory of 2868 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 2308 wrote to memory of 2868 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 2308 wrote to memory of 2532 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 2308 wrote to memory of 2532 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 2308 wrote to memory of 2532 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 2308 wrote to memory of 2532 2308 ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe cmd.exe PID 2868 wrote to memory of 2444 2868 cmd.exe schtasks.exe PID 2868 wrote to memory of 2444 2868 cmd.exe schtasks.exe PID 2868 wrote to memory of 2444 2868 cmd.exe schtasks.exe PID 2868 wrote to memory of 2444 2868 cmd.exe schtasks.exe PID 2772 wrote to memory of 2812 2772 taskeng.exe state.exe PID 2772 wrote to memory of 2812 2772 taskeng.exe state.exe PID 2772 wrote to memory of 2812 2772 taskeng.exe state.exe PID 2772 wrote to memory of 2812 2772 taskeng.exe state.exe PID 2812 wrote to memory of 2172 2812 state.exe state.exe PID 2812 wrote to memory of 2172 2812 state.exe state.exe PID 2812 wrote to memory of 2172 2812 state.exe state.exe PID 2812 wrote to memory of 2172 2812 state.exe state.exe PID 2812 wrote to memory of 2172 2812 state.exe state.exe PID 2812 wrote to memory of 2172 2812 state.exe state.exe PID 2812 wrote to memory of 2172 2812 state.exe state.exe PID 2812 wrote to memory of 2172 2812 state.exe state.exe PID 2812 wrote to memory of 2172 2812 state.exe state.exe PID 2812 wrote to memory of 2172 2812 state.exe state.exe PID 2812 wrote to memory of 2172 2812 state.exe state.exe PID 2812 wrote to memory of 2172 2812 state.exe state.exe PID 2812 wrote to memory of 1580 2812 state.exe cmd.exe PID 2812 wrote to memory of 1580 2812 state.exe cmd.exe PID 2812 wrote to memory of 1580 2812 state.exe cmd.exe PID 2812 wrote to memory of 1580 2812 state.exe cmd.exe PID 2812 wrote to memory of 2412 2812 state.exe cmd.exe PID 2812 wrote to memory of 2412 2812 state.exe cmd.exe PID 2812 wrote to memory of 2412 2812 state.exe cmd.exe PID 2812 wrote to memory of 2412 2812 state.exe cmd.exe PID 2812 wrote to memory of 1948 2812 state.exe cmd.exe PID 2812 wrote to memory of 1948 2812 state.exe cmd.exe PID 2812 wrote to memory of 1948 2812 state.exe cmd.exe PID 2812 wrote to memory of 1948 2812 state.exe cmd.exe PID 2412 wrote to memory of 2228 2412 cmd.exe schtasks.exe PID 2412 wrote to memory of 2228 2412 cmd.exe schtasks.exe PID 2412 wrote to memory of 2228 2412 cmd.exe schtasks.exe PID 2412 wrote to memory of 2228 2412 cmd.exe schtasks.exe PID 2772 wrote to memory of 2600 2772 taskeng.exe state.exe PID 2772 wrote to memory of 2600 2772 taskeng.exe state.exe PID 2772 wrote to memory of 2600 2772 taskeng.exe state.exe PID 2772 wrote to memory of 2600 2772 taskeng.exe state.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe"C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe"C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2092 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\state"2⤵PID:2504
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f3⤵
- Creates scheduled task(s)
PID:2444 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8_JC.exe" "C:\Users\Admin\AppData\Roaming\state\state.exe"2⤵PID:2532
-
C:\Windows\system32\taskeng.exetaskeng.exe {C05BEA3C-49E0-4ADC-AA11-119E5C0DF6B2} S-1-5-21-86725733-3001458681-3405935542-1000:ZWKQHIWB\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Roaming\state\state.exeC:\Users\Admin\AppData\Roaming\state\state.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Roaming\state\state.exe"C:\Users\Admin\AppData\Roaming\state\state.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\state"3⤵PID:1580
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\state\state.exe" "C:\Users\Admin\AppData\Roaming\state\state.exe"3⤵PID:1948
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f4⤵
- Creates scheduled task(s)
PID:2228 -
C:\Users\Admin\AppData\Roaming\state\state.exeC:\Users\Admin\AppData\Roaming\state\state.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2600 -
C:\Users\Admin\AppData\Roaming\state\state.exe"C:\Users\Admin\AppData\Roaming\state\state.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1656 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\state"3⤵PID:2392
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f3⤵PID:1032
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\state\state.exe'" /f4⤵
- Creates scheduled task(s)
PID:2900 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\state\state.exe" "C:\Users\Admin\AppData\Roaming\state\state.exe"3⤵PID:2344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\state\state.exeFilesize
7.6MB
MD518e07c4772a2687ee06a434ffef9572f
SHA1ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
SHA256ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
SHA5128795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b
-
C:\Users\Admin\AppData\Roaming\state\state.exeFilesize
7.6MB
MD518e07c4772a2687ee06a434ffef9572f
SHA1ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
SHA256ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
SHA5128795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b
-
C:\Users\Admin\AppData\Roaming\state\state.exeFilesize
7.6MB
MD518e07c4772a2687ee06a434ffef9572f
SHA1ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
SHA256ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
SHA5128795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b
-
C:\Users\Admin\AppData\Roaming\state\state.exeFilesize
7.6MB
MD518e07c4772a2687ee06a434ffef9572f
SHA1ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
SHA256ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
SHA5128795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b
-
C:\Users\Admin\AppData\Roaming\state\state.exeFilesize
7.6MB
MD518e07c4772a2687ee06a434ffef9572f
SHA1ff1a7e4f53efdbd0935bcf8a8dac338ea96c9dbe
SHA256ef509cb0a60d929e4f0acd3696e724397dc8113170df0ef478ea2afaae7800d8
SHA5128795a49d7c5993f24a290e9d5f9299871af4ffd51a66b0656bf0057cdc15b1286350aae55be7b69cec660df1353f5a4dffdc08004a1b447b1b75e5645ac6188b
-
memory/1656-102-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1656-96-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2092-41-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-71-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-14-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-16-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2092-20-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-25-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-29-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-4-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-33-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-34-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-35-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-36-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-37-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-39-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-38-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-40-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-70-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-42-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-10-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-8-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-12-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2092-6-0x0000000000460000-0x000000000082E000-memory.dmpFilesize
3.8MB
-
memory/2172-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2172-62-0x0000000000BF0000-0x0000000000FBE000-memory.dmpFilesize
3.8MB
-
memory/2172-66-0x0000000000BF0000-0x0000000000FBE000-memory.dmpFilesize
3.8MB
-
memory/2172-68-0x0000000000BF0000-0x0000000000FBE000-memory.dmpFilesize
3.8MB
-
memory/2172-69-0x0000000000BF0000-0x0000000000FBE000-memory.dmpFilesize
3.8MB
-
memory/2308-30-0x0000000073E40000-0x000000007452E000-memory.dmpFilesize
6.9MB
-
memory/2308-1-0x00000000012F0000-0x0000000001A8E000-memory.dmpFilesize
7.6MB
-
memory/2308-2-0x0000000004FA0000-0x0000000004FE0000-memory.dmpFilesize
256KB
-
memory/2308-3-0x00000000053F0000-0x0000000005B7A000-memory.dmpFilesize
7.5MB
-
memory/2308-0-0x0000000073E40000-0x000000007452E000-memory.dmpFilesize
6.9MB
-
memory/2600-74-0x0000000001040000-0x00000000017DE000-memory.dmpFilesize
7.6MB
-
memory/2600-73-0x0000000073B80000-0x000000007426E000-memory.dmpFilesize
6.9MB
-
memory/2600-75-0x00000000009D0000-0x0000000000A10000-memory.dmpFilesize
256KB
-
memory/2600-97-0x0000000073B80000-0x000000007426E000-memory.dmpFilesize
6.9MB
-
memory/2812-47-0x0000000000280000-0x00000000002C0000-memory.dmpFilesize
256KB
-
memory/2812-45-0x0000000073C00000-0x00000000742EE000-memory.dmpFilesize
6.9MB
-
memory/2812-67-0x0000000073C00000-0x00000000742EE000-memory.dmpFilesize
6.9MB
-
memory/2812-46-0x00000000002E0000-0x0000000000A7E000-memory.dmpFilesize
7.6MB