Overview
overview
10Static
static
10Bootkits/5...1a.exe
windows7-x64
1Bootkits/5...1a.exe
windows10-2004-x64
6Bootkits/6...86.exe
windows7-x64
7Bootkits/6...86.exe
windows10-2004-x64
7Bootkits/8...f6.msi
windows7-x64
7Bootkits/8...f6.msi
windows10-2004-x64
7Bootkits/f...b1.exe
windows7-x64
7Bootkits/f...b1.exe
windows10-2004-x64
Rootkits/0...c7.exe
windows7-x64
8Rootkits/0...c7.exe
windows10-2004-x64
8Rootkits/0...6d.exe
windows7-x64
10Rootkits/0...6d.exe
windows10-2004-x64
1Rootkits/0...ae.exe
windows7-x64
1Rootkits/0...ae.exe
windows10-2004-x64
1Rootkits/0...3e.exe
windows7-x64
7Rootkits/0...3e.exe
windows10-2004-x64
10Rootkits/0...10.exe
windows7-x64
7Rootkits/0...10.exe
windows10-2004-x64
7Rootkits/2...8e.dll
windows7-x64
1Rootkits/2...8e.dll
windows10-2004-x64
1Rootkits/2...a4.exe
windows7-x64
10Rootkits/2...a4.exe
windows10-2004-x64
Rootkits/4...1b.exe
windows7-x64
7Rootkits/4...1b.exe
windows10-2004-x64
7Rootkits/6...d9.exe
windows7-x64
1Rootkits/6...d9.exe
windows10-2004-x64
1Rootkits/7...e8.exe
windows7-x64
7Rootkits/7...e8.exe
windows10-2004-x64
7Rootkits/8...22.exe
windows7-x64
1Rootkits/8...22.exe
windows10-2004-x64
1Rootkits/9...99.exe
windows7-x64
8Rootkits/9...99.exe
windows10-2004-x64
8Analysis
-
max time kernel
192s -
max time network
61s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
08-11-2023 03:15
Behavioral task
behavioral1
Sample
Bootkits/5ef62c780d7c9f82dea098972f66d5b3367841913444933cdb779adaecd06d1a.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Bootkits/5ef62c780d7c9f82dea098972f66d5b3367841913444933cdb779adaecd06d1a.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
Bootkits/6b0cd074a6c556f4d1fe0088c15160eb13f847974c4307f9eeeea4dc33d49286.exe
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
Bootkits/6b0cd074a6c556f4d1fe0088c15160eb13f847974c4307f9eeeea4dc33d49286.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
Bootkits/8dcc573293ae9a545655a47e23f106738a190f5318c31124bd3a73b12f128df6.msi
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
Bootkits/8dcc573293ae9a545655a47e23f106738a190f5318c31124bd3a73b12f128df6.msi
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
Bootkits/f428b4d0673ae67472fbe212086e70eeb5b6876e80a74b59ff8ba3e6def5e9b1.exe
Resource
win7-20231025-en
Behavioral task
behavioral8
Sample
Bootkits/f428b4d0673ae67472fbe212086e70eeb5b6876e80a74b59ff8ba3e6def5e9b1.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
Rootkits/03e903602037420acf4d1bc5084923c59385c5594f3a2de6fcf320bd4746d6c7.exe
Resource
win7-20231020-en
Behavioral task
behavioral10
Sample
Rootkits/03e903602037420acf4d1bc5084923c59385c5594f3a2de6fcf320bd4746d6c7.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral11
Sample
Rootkits/044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
Rootkits/044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral13
Sample
Rootkits/0925b8985b19d7925d68186d666b0050a4cb3f2a577d64765d770a57a2eab9ae.exe
Resource
win7-20231020-en
Behavioral task
behavioral14
Sample
Rootkits/0925b8985b19d7925d68186d666b0050a4cb3f2a577d64765d770a57a2eab9ae.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral15
Sample
Rootkits/096322b16a7395e5534e9db6752aab1bd54275515f33f993d066ec7b46ed5b3e.exe
Resource
win7-20231023-en
Behavioral task
behavioral16
Sample
Rootkits/096322b16a7395e5534e9db6752aab1bd54275515f33f993d066ec7b46ed5b3e.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral17
Sample
Rootkits/0b1b37d85a27819a8b4b9d7691e55dfc93311f7d5159433d1ac09854fcb13510.exe
Resource
win7-20231023-en
Behavioral task
behavioral18
Sample
Rootkits/0b1b37d85a27819a8b4b9d7691e55dfc93311f7d5159433d1ac09854fcb13510.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral19
Sample
Rootkits/2141974f665f4d8fecb6d8ea06add624b57f320f901368847175570ee716fd8e.dll
Resource
win7-20231023-en
Behavioral task
behavioral20
Sample
Rootkits/2141974f665f4d8fecb6d8ea06add624b57f320f901368847175570ee716fd8e.dll
Resource
win10v2004-20231023-en
Behavioral task
behavioral21
Sample
Rootkits/22ee7b8104599b47313195598ffc34aafd6a6552dcce0e7b3232ced3a90ac9a4.exe
Resource
win7-20231020-en
Behavioral task
behavioral22
Sample
Rootkits/22ee7b8104599b47313195598ffc34aafd6a6552dcce0e7b3232ced3a90ac9a4.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral23
Sample
Rootkits/40fd1fcff12afcf503175d91a18d7a6f7b4ade68726328db38eb6fd74304561b.exe
Resource
win7-20231023-en
Behavioral task
behavioral24
Sample
Rootkits/40fd1fcff12afcf503175d91a18d7a6f7b4ade68726328db38eb6fd74304561b.exe
Resource
win10v2004-20231025-en
Behavioral task
behavioral25
Sample
Rootkits/659e0d1b2405cadfa560fe648cbf6866720dd40bb6f4081d3dce2dffe20595d9.exe
Resource
win7-20231025-en
Behavioral task
behavioral26
Sample
Rootkits/659e0d1b2405cadfa560fe648cbf6866720dd40bb6f4081d3dce2dffe20595d9.exe
Resource
win10v2004-20231025-en
Behavioral task
behavioral27
Sample
Rootkits/757cd417096f37de99461b69b70ccc532fb294b8ecbf18e3fddaea7bb6058ce8.exe
Resource
win7-20231023-en
Behavioral task
behavioral28
Sample
Rootkits/757cd417096f37de99461b69b70ccc532fb294b8ecbf18e3fddaea7bb6058ce8.exe
Resource
win10v2004-20231025-en
Behavioral task
behavioral29
Sample
Rootkits/84ed7fec67de5621806dbb43af5167a5fc60ab7f2403448519dc0eca2b8f9022.exe
Resource
win7-20231023-en
Behavioral task
behavioral30
Sample
Rootkits/84ed7fec67de5621806dbb43af5167a5fc60ab7f2403448519dc0eca2b8f9022.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral31
Sample
Rootkits/9114dc1c44f6a1b7d63ca95e04541d833c49a3e65a717471042bd0ec19a3eb99.exe
Resource
win7-20231023-en
Behavioral task
behavioral32
Sample
Rootkits/9114dc1c44f6a1b7d63ca95e04541d833c49a3e65a717471042bd0ec19a3eb99.exe
Resource
win10v2004-20231023-en
General
-
Target
Rootkits/044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe
-
Size
246KB
-
MD5
5b65e0442761c3ba7ab13f19e696a3ad
-
SHA1
840cd5fabb617cdfd848ff29253b4cce79213a35
-
SHA256
044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d
-
SHA512
a5af3f57bbeea72a98fa3fcf499f98e568994a9ea29ab5558fc691d83d97decf2c9aa17d2f157442baf63c06b8fcc3c604a5098289c991cd7b061cb22cd64ec7
-
SSDEEP
3072:dZvq0Fnr1gWPgOYVkN6rnhccEYMY2wuoyq8pq+8MhHRIK8k4B7KHpwRXDYNdY2vx:dZvdr1bkVkNwzEJwu1Z/L8hgpwZY79
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP svchost.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exepid process 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exedescription pid process Token: SeDebugPrivilege 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exedescription pid process target process PID 2648 wrote to memory of 424 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe winlogon.exe PID 2648 wrote to memory of 468 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe services.exe PID 2648 wrote to memory of 484 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe lsass.exe PID 2648 wrote to memory of 492 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe lsm.exe PID 2648 wrote to memory of 600 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe svchost.exe PID 2648 wrote to memory of 680 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe svchost.exe PID 2648 wrote to memory of 764 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe svchost.exe PID 2648 wrote to memory of 816 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe svchost.exe PID 2648 wrote to memory of 860 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe svchost.exe PID 2648 wrote to memory of 972 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe svchost.exe PID 2648 wrote to memory of 272 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe svchost.exe PID 2648 wrote to memory of 916 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe spoolsv.exe PID 2648 wrote to memory of 1060 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe svchost.exe PID 2648 wrote to memory of 1120 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe taskhost.exe PID 2648 wrote to memory of 1176 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe Dwm.exe PID 2648 wrote to memory of 1204 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe Explorer.EXE PID 2648 wrote to memory of 2224 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe svchost.exe PID 2648 wrote to memory of 2076 2648 044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe sppsvc.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
- Modifies security service
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\Rootkits\044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe"C:\Users\Admin\AppData\Local\Temp\Rootkits\044d94183a778f39e47f255fcb985d20bfd885771a74217cfbca9e63d7d9936d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/272-164-0x0000000000910000-0x000000000093A000-memory.dmpFilesize
168KB
-
memory/272-96-0x0000000000910000-0x000000000093A000-memory.dmpFilesize
168KB
-
memory/272-104-0x0000000037420000-0x0000000037430000-memory.dmpFilesize
64KB
-
memory/424-52-0x0000000000870000-0x000000000089A000-memory.dmpFilesize
168KB
-
memory/424-12-0x0000000037420000-0x0000000037430000-memory.dmpFilesize
64KB
-
memory/424-10-0x0000000077431000-0x0000000077432000-memory.dmpFilesize
4KB
-
memory/424-9-0x000007FEBED70000-0x000007FEBED80000-memory.dmpFilesize
64KB
-
memory/424-8-0x0000000000870000-0x000000000089A000-memory.dmpFilesize
168KB
-
memory/424-6-0x00000000004F0000-0x0000000000513000-memory.dmpFilesize
140KB
-
memory/424-4-0x00000000004F0000-0x0000000000513000-memory.dmpFilesize
140KB
-
memory/468-18-0x0000000000120000-0x000000000014A000-memory.dmpFilesize
168KB
-
memory/468-61-0x0000000000120000-0x000000000014A000-memory.dmpFilesize
168KB
-
memory/468-19-0x000007FEBED70000-0x000007FEBED80000-memory.dmpFilesize
64KB
-
memory/468-20-0x0000000037420000-0x0000000037430000-memory.dmpFilesize
64KB
-
memory/484-29-0x0000000037420000-0x0000000037430000-memory.dmpFilesize
64KB
-
memory/484-28-0x000007FEBED70000-0x000007FEBED80000-memory.dmpFilesize
64KB
-
memory/484-26-0x0000000000A50000-0x0000000000A7A000-memory.dmpFilesize
168KB
-
memory/484-74-0x0000000000A50000-0x0000000000A7A000-memory.dmpFilesize
168KB
-
memory/492-32-0x00000000004C0000-0x00000000004EA000-memory.dmpFilesize
168KB
-
memory/492-35-0x000007FEBED70000-0x000007FEBED80000-memory.dmpFilesize
64KB
-
memory/492-38-0x00000000004C0000-0x00000000004EA000-memory.dmpFilesize
168KB
-
memory/492-42-0x0000000037420000-0x0000000037430000-memory.dmpFilesize
64KB
-
memory/492-83-0x00000000004C0000-0x00000000004EA000-memory.dmpFilesize
168KB
-
memory/600-45-0x00000000004D0000-0x00000000004FA000-memory.dmpFilesize
168KB
-
memory/600-41-0x000007FEBED70000-0x000007FEBED80000-memory.dmpFilesize
64KB
-
memory/600-90-0x00000000004D0000-0x00000000004FA000-memory.dmpFilesize
168KB
-
memory/600-37-0x00000000004D0000-0x00000000004FA000-memory.dmpFilesize
168KB
-
memory/600-44-0x0000000037420000-0x0000000037430000-memory.dmpFilesize
64KB
-
memory/680-53-0x000007FEBED70000-0x000007FEBED80000-memory.dmpFilesize
64KB
-
memory/680-55-0x0000000037420000-0x0000000037430000-memory.dmpFilesize
64KB
-
memory/680-114-0x00000000003F0000-0x000000000041A000-memory.dmpFilesize
168KB
-
memory/680-50-0x00000000003F0000-0x000000000041A000-memory.dmpFilesize
168KB
-
memory/764-56-0x0000000000A30000-0x0000000000A5A000-memory.dmpFilesize
168KB
-
memory/764-68-0x0000000037420000-0x0000000037430000-memory.dmpFilesize
64KB
-
memory/764-119-0x0000000000A30000-0x0000000000A5A000-memory.dmpFilesize
168KB
-
memory/764-63-0x000007FEBED70000-0x000007FEBED80000-memory.dmpFilesize
64KB
-
memory/816-126-0x0000000000890000-0x00000000008BA000-memory.dmpFilesize
168KB
-
memory/816-64-0x000007FEBED70000-0x000007FEBED80000-memory.dmpFilesize
64KB
-
memory/816-60-0x0000000000890000-0x00000000008BA000-memory.dmpFilesize
168KB
-
memory/816-65-0x0000000000890000-0x00000000008BA000-memory.dmpFilesize
168KB
-
memory/816-66-0x0000000037420000-0x0000000037430000-memory.dmpFilesize
64KB
-
memory/860-73-0x0000000000870000-0x000000000089A000-memory.dmpFilesize
168KB
-
memory/860-146-0x0000000000870000-0x000000000089A000-memory.dmpFilesize
168KB
-
memory/860-77-0x0000000000870000-0x000000000089A000-memory.dmpFilesize
168KB
-
memory/916-108-0x0000000037420000-0x0000000037430000-memory.dmpFilesize
64KB
-
memory/916-101-0x0000000001BC0000-0x0000000001BEA000-memory.dmpFilesize
168KB
-
memory/916-166-0x0000000001BC0000-0x0000000001BEA000-memory.dmpFilesize
168KB
-
memory/972-93-0x0000000037420000-0x0000000037430000-memory.dmpFilesize
64KB
-
memory/972-86-0x0000000000880000-0x00000000008AA000-memory.dmpFilesize
168KB
-
memory/972-82-0x0000000000880000-0x00000000008AA000-memory.dmpFilesize
168KB
-
memory/972-156-0x0000000000880000-0x00000000008AA000-memory.dmpFilesize
168KB
-
memory/1060-170-0x00000000008D0000-0x00000000008FA000-memory.dmpFilesize
168KB
-
memory/1060-116-0x0000000037420000-0x0000000037430000-memory.dmpFilesize
64KB
-
memory/1060-111-0x00000000008D0000-0x00000000008FA000-memory.dmpFilesize
168KB
-
memory/1120-121-0x0000000001B70000-0x0000000001B9A000-memory.dmpFilesize
168KB
-
memory/1120-123-0x0000000037420000-0x0000000037430000-memory.dmpFilesize
64KB
-
memory/1120-171-0x0000000001B70000-0x0000000001B9A000-memory.dmpFilesize
168KB
-
memory/1176-132-0x0000000001C30000-0x0000000001C5A000-memory.dmpFilesize
168KB
-
memory/1176-172-0x0000000001C30000-0x0000000001C5A000-memory.dmpFilesize
168KB
-
memory/1176-136-0x0000000037420000-0x0000000037430000-memory.dmpFilesize
64KB
-
memory/1204-139-0x0000000002990000-0x00000000029BA000-memory.dmpFilesize
168KB
-
memory/1204-173-0x0000000002990000-0x00000000029BA000-memory.dmpFilesize
168KB
-
memory/1204-144-0x0000000037420000-0x0000000037430000-memory.dmpFilesize
64KB
-
memory/2076-175-0x00000000007F0000-0x000000000081A000-memory.dmpFilesize
168KB
-
memory/2076-160-0x00000000007F0000-0x000000000081A000-memory.dmpFilesize
168KB
-
memory/2076-168-0x0000000037420000-0x0000000037430000-memory.dmpFilesize
64KB
-
memory/2224-150-0x0000000000140000-0x000000000016A000-memory.dmpFilesize
168KB
-
memory/2224-153-0x0000000037420000-0x0000000037430000-memory.dmpFilesize
64KB
-
memory/2224-174-0x0000000000140000-0x000000000016A000-memory.dmpFilesize
168KB
-
memory/2648-3-0x00000000771C0000-0x00000000772DF000-memory.dmpFilesize
1.1MB
-
memory/2648-1-0x00000000773E0000-0x0000000077589000-memory.dmpFilesize
1.7MB
-
memory/2648-169-0x0000000000230000-0x000000000025A000-memory.dmpFilesize
168KB
-
memory/2648-34-0x00000000773E0000-0x0000000077589000-memory.dmpFilesize
1.7MB