Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 12:56
Static task
static1
Behavioral task
behavioral1
Sample
193460b43722438a162df4b740d8ccd4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
193460b43722438a162df4b740d8ccd4.exe
Resource
win10v2004-20231215-en
General
-
Target
193460b43722438a162df4b740d8ccd4.exe
-
Size
692KB
-
MD5
193460b43722438a162df4b740d8ccd4
-
SHA1
adde849ff2ebd5ab85bdb4075b6ba812fc1f01e7
-
SHA256
87e02f29fe50e052f7fb2f65f7795484eb7ae6c41859c755fc5f86e81de6f020
-
SHA512
35443ba627bfb07f36b2b9e4d4fedb27de861666ba21781237d66313d06825f542fe5992cc03e7f5eb82b4df858169c273377ca8df37a320e61a80f4da6a93dd
-
SSDEEP
12288:P/uAGTo28+SCyqzQSTorJoBrcN6kNupgt2JxloBgl:P/uAa8vcDcrKBrUxcdJxlo2
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
69888B74A53.exe69888B74A53.exe5sWBB32.exepid process 4576 69888B74A53.exe 2000 69888B74A53.exe 3592 5sWBB32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5sWBB32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UU3UXG5IWJ3H7H3GSAQG = "C:\\winrarlab\\69888B74A53.exe" 5sWBB32.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
193460b43722438a162df4b740d8ccd4.exe69888B74A53.exedescription pid process target process PID 5012 set thread context of 3744 5012 193460b43722438a162df4b740d8ccd4.exe 193460b43722438a162df4b740d8ccd4.exe PID 4576 set thread context of 2000 4576 69888B74A53.exe 69888B74A53.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
Processes:
5sWBB32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\PhishingFilter 5sWBB32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" 5sWBB32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ShownServiceDownBalloon = "0" 5sWBB32.exe -
Processes:
5sWBB32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Recovery 5sWBB32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\ClearBrowsingHistoryOnExit = "0" 5sWBB32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
193460b43722438a162df4b740d8ccd4.exe69888B74A53.exe5sWBB32.exepid process 3744 193460b43722438a162df4b740d8ccd4.exe 3744 193460b43722438a162df4b740d8ccd4.exe 3744 193460b43722438a162df4b740d8ccd4.exe 3744 193460b43722438a162df4b740d8ccd4.exe 2000 69888B74A53.exe 2000 69888B74A53.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe 3592 5sWBB32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
193460b43722438a162df4b740d8ccd4.exe69888B74A53.exe5sWBB32.exedescription pid process Token: SeDebugPrivilege 3744 193460b43722438a162df4b740d8ccd4.exe Token: SeDebugPrivilege 3744 193460b43722438a162df4b740d8ccd4.exe Token: SeDebugPrivilege 3744 193460b43722438a162df4b740d8ccd4.exe Token: SeDebugPrivilege 3744 193460b43722438a162df4b740d8ccd4.exe Token: SeDebugPrivilege 2000 69888B74A53.exe Token: SeDebugPrivilege 2000 69888B74A53.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe Token: SeDebugPrivilege 3592 5sWBB32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
193460b43722438a162df4b740d8ccd4.exe69888B74A53.exepid process 5012 193460b43722438a162df4b740d8ccd4.exe 4576 69888B74A53.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
193460b43722438a162df4b740d8ccd4.exe193460b43722438a162df4b740d8ccd4.exe69888B74A53.exe69888B74A53.exedescription pid process target process PID 5012 wrote to memory of 3744 5012 193460b43722438a162df4b740d8ccd4.exe 193460b43722438a162df4b740d8ccd4.exe PID 5012 wrote to memory of 3744 5012 193460b43722438a162df4b740d8ccd4.exe 193460b43722438a162df4b740d8ccd4.exe PID 5012 wrote to memory of 3744 5012 193460b43722438a162df4b740d8ccd4.exe 193460b43722438a162df4b740d8ccd4.exe PID 5012 wrote to memory of 3744 5012 193460b43722438a162df4b740d8ccd4.exe 193460b43722438a162df4b740d8ccd4.exe PID 5012 wrote to memory of 3744 5012 193460b43722438a162df4b740d8ccd4.exe 193460b43722438a162df4b740d8ccd4.exe PID 5012 wrote to memory of 3744 5012 193460b43722438a162df4b740d8ccd4.exe 193460b43722438a162df4b740d8ccd4.exe PID 5012 wrote to memory of 3744 5012 193460b43722438a162df4b740d8ccd4.exe 193460b43722438a162df4b740d8ccd4.exe PID 5012 wrote to memory of 3744 5012 193460b43722438a162df4b740d8ccd4.exe 193460b43722438a162df4b740d8ccd4.exe PID 5012 wrote to memory of 3744 5012 193460b43722438a162df4b740d8ccd4.exe 193460b43722438a162df4b740d8ccd4.exe PID 5012 wrote to memory of 3744 5012 193460b43722438a162df4b740d8ccd4.exe 193460b43722438a162df4b740d8ccd4.exe PID 3744 wrote to memory of 4576 3744 193460b43722438a162df4b740d8ccd4.exe 69888B74A53.exe PID 3744 wrote to memory of 4576 3744 193460b43722438a162df4b740d8ccd4.exe 69888B74A53.exe PID 3744 wrote to memory of 4576 3744 193460b43722438a162df4b740d8ccd4.exe 69888B74A53.exe PID 4576 wrote to memory of 2000 4576 69888B74A53.exe 69888B74A53.exe PID 4576 wrote to memory of 2000 4576 69888B74A53.exe 69888B74A53.exe PID 4576 wrote to memory of 2000 4576 69888B74A53.exe 69888B74A53.exe PID 4576 wrote to memory of 2000 4576 69888B74A53.exe 69888B74A53.exe PID 4576 wrote to memory of 2000 4576 69888B74A53.exe 69888B74A53.exe PID 4576 wrote to memory of 2000 4576 69888B74A53.exe 69888B74A53.exe PID 4576 wrote to memory of 2000 4576 69888B74A53.exe 69888B74A53.exe PID 4576 wrote to memory of 2000 4576 69888B74A53.exe 69888B74A53.exe PID 4576 wrote to memory of 2000 4576 69888B74A53.exe 69888B74A53.exe PID 4576 wrote to memory of 2000 4576 69888B74A53.exe 69888B74A53.exe PID 2000 wrote to memory of 3592 2000 69888B74A53.exe 5sWBB32.exe PID 2000 wrote to memory of 3592 2000 69888B74A53.exe 5sWBB32.exe PID 2000 wrote to memory of 3592 2000 69888B74A53.exe 5sWBB32.exe PID 2000 wrote to memory of 3592 2000 69888B74A53.exe 5sWBB32.exe PID 2000 wrote to memory of 3592 2000 69888B74A53.exe 5sWBB32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\193460b43722438a162df4b740d8ccd4.exe"C:\Users\Admin\AppData\Local\Temp\193460b43722438a162df4b740d8ccd4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\193460b43722438a162df4b740d8ccd4.exeC:\Users\Admin\AppData\Local\Temp\193460b43722438a162df4b740d8ccd4.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\winrarlab\69888B74A53.exe"C:\winrarlab\69888B74A53.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\winrarlab\69888B74A53.exeC:\winrarlab\69888B74A53.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5sWBB32.exe"C:\Users\Admin\AppData\Local\Temp\5sWBB32.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5sWBB32.exeFilesize
3KB
MD529090b6b4d6605a97ac760d06436ac2d
SHA1d929d3389642e52bae5ad8512293c9c4d3e4fab5
SHA25698a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272
SHA5129121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be
-
C:\winrarlab\4750006A1CE60F1Filesize
197KB
MD545858b33b650c149aee2b1a8f8b813b4
SHA128dfe14e74bf919f88c7710e7350403c2753efa0
SHA2562d7e9299bef4f9d2ea6e3daf7eb056c71b1fa9e21feb84f083fe6fc51de1c92e
SHA5129d67266abe38470b989e18edc3144eaf796733385d95b671d8e7927109b0ed02265b826bb669387f3ffd4252d4945eda9f24fedb8eff57db7930d75207ff6b15
-
C:\winrarlab\69888B74A53.exeFilesize
692KB
MD5193460b43722438a162df4b740d8ccd4
SHA1adde849ff2ebd5ab85bdb4075b6ba812fc1f01e7
SHA25687e02f29fe50e052f7fb2f65f7795484eb7ae6c41859c755fc5f86e81de6f020
SHA51235443ba627bfb07f36b2b9e4d4fedb27de861666ba21781237d66313d06825f542fe5992cc03e7f5eb82b4df858169c273377ca8df37a320e61a80f4da6a93dd
-
memory/2000-53-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/2000-61-0x00000000005D0000-0x000000000061E000-memory.dmpFilesize
312KB
-
memory/2000-49-0x00000000022D0000-0x00000000023C0000-memory.dmpFilesize
960KB
-
memory/2000-47-0x00000000005D0000-0x000000000061E000-memory.dmpFilesize
312KB
-
memory/2000-43-0x0000000000A30000-0x0000000000B20000-memory.dmpFilesize
960KB
-
memory/2000-40-0x0000000000A30000-0x0000000000B20000-memory.dmpFilesize
960KB
-
memory/2000-39-0x0000000000A30000-0x0000000000B20000-memory.dmpFilesize
960KB
-
memory/2000-38-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3592-102-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-125-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-151-0x0000000002E40000-0x0000000002EA3000-memory.dmpFilesize
396KB
-
memory/3592-109-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-150-0x00000000030C0000-0x0000000003510000-memory.dmpFilesize
4.3MB
-
memory/3592-149-0x00000000030C0000-0x0000000003510000-memory.dmpFilesize
4.3MB
-
memory/3592-148-0x00000000030C0000-0x0000000003510000-memory.dmpFilesize
4.3MB
-
memory/3592-110-0x0000000075190000-0x00000000755E0000-memory.dmpFilesize
4.3MB
-
memory/3592-139-0x00000000005D0000-0x000000000061E000-memory.dmpFilesize
312KB
-
memory/3592-138-0x0000000002E40000-0x0000000002EA3000-memory.dmpFilesize
396KB
-
memory/3592-137-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-135-0x0000000003510000-0x0000000003550000-memory.dmpFilesize
256KB
-
memory/3592-136-0x0000000075970000-0x00000000759D3000-memory.dmpFilesize
396KB
-
memory/3592-134-0x0000000075190000-0x00000000755E0000-memory.dmpFilesize
4.3MB
-
memory/3592-133-0x00000000030C0000-0x0000000003510000-memory.dmpFilesize
4.3MB
-
memory/3592-51-0x00000000005D0000-0x000000000061E000-memory.dmpFilesize
312KB
-
memory/3592-132-0x00000000030C0000-0x0000000003510000-memory.dmpFilesize
4.3MB
-
memory/3592-57-0x0000000001000000-0x0000000001004000-memory.dmpFilesize
16KB
-
memory/3592-56-0x00000000005D0000-0x000000000061E000-memory.dmpFilesize
312KB
-
memory/3592-60-0x00000000005D0000-0x000000000061E000-memory.dmpFilesize
312KB
-
memory/3592-130-0x00000000030C0000-0x0000000003510000-memory.dmpFilesize
4.3MB
-
memory/3592-63-0x00000000005D0000-0x000000000061E000-memory.dmpFilesize
312KB
-
memory/3592-64-0x00000000001D0000-0x00000000001D5000-memory.dmpFilesize
20KB
-
memory/3592-67-0x00000000001E0000-0x00000000001E6000-memory.dmpFilesize
24KB
-
memory/3592-70-0x00000000001F0000-0x00000000001F7000-memory.dmpFilesize
28KB
-
memory/3592-131-0x00000000030C0000-0x0000000003510000-memory.dmpFilesize
4.3MB
-
memory/3592-72-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-75-0x00000000005D0000-0x000000000061E000-memory.dmpFilesize
312KB
-
memory/3592-79-0x00000000005D0000-0x000000000061E000-memory.dmpFilesize
312KB
-
memory/3592-111-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-81-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-76-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-83-0x0000000002A70000-0x0000000002EC0000-memory.dmpFilesize
4.3MB
-
memory/3592-84-0x0000000077792000-0x0000000077794000-memory.dmpFilesize
8KB
-
memory/3592-86-0x0000000077794000-0x0000000077796000-memory.dmpFilesize
8KB
-
memory/3592-87-0x0000000077792000-0x0000000077794000-memory.dmpFilesize
8KB
-
memory/3592-89-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-91-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-92-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-94-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-95-0x0000000075190000-0x00000000755E0000-memory.dmpFilesize
4.3MB
-
memory/3592-99-0x0000000075190000-0x00000000755E0000-memory.dmpFilesize
4.3MB
-
memory/3592-98-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-129-0x0000000075190000-0x00000000755E0000-memory.dmpFilesize
4.3MB
-
memory/3592-104-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-106-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-108-0x0000000075190000-0x00000000755E0000-memory.dmpFilesize
4.3MB
-
memory/3592-107-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-127-0x00000000001F0000-0x00000000001F7000-memory.dmpFilesize
28KB
-
memory/3592-128-0x0000000000450000-0x0000000000459000-memory.dmpFilesize
36KB
-
memory/3592-80-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-113-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-114-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-116-0x0000000003510000-0x0000000003550000-memory.dmpFilesize
256KB
-
memory/3592-121-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-122-0x00000000027A0000-0x00000000027A5000-memory.dmpFilesize
20KB
-
memory/3592-120-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-119-0x00000000005D0000-0x000000000061E000-memory.dmpFilesize
312KB
-
memory/3592-118-0x0000000003550000-0x00000000035B3000-memory.dmpFilesize
396KB
-
memory/3592-117-0x0000000075970000-0x00000000759D3000-memory.dmpFilesize
396KB
-
memory/3592-115-0x00000000005D0000-0x000000000061E000-memory.dmpFilesize
312KB
-
memory/3592-112-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-105-0x0000000075190000-0x00000000755E0000-memory.dmpFilesize
4.3MB
-
memory/3592-103-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-123-0x0000000075190000-0x00000000755E0000-memory.dmpFilesize
4.3MB
-
memory/3592-101-0x00000000030C0000-0x0000000003510000-memory.dmpFilesize
4.3MB
-
memory/3592-124-0x0000000075190000-0x00000000755E0000-memory.dmpFilesize
4.3MB
-
memory/3592-100-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-97-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-96-0x0000000075190000-0x00000000755E0000-memory.dmpFilesize
4.3MB
-
memory/3592-93-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-90-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-88-0x0000000077792000-0x0000000077794000-memory.dmpFilesize
8KB
-
memory/3592-126-0x00000000001E0000-0x00000000001E6000-memory.dmpFilesize
24KB
-
memory/3592-85-0x000000000BAD0000-0x000000000BB1E000-memory.dmpFilesize
312KB
-
memory/3592-82-0x00000000005D0000-0x000000000061E000-memory.dmpFilesize
312KB
-
memory/3592-78-0x00000000005D0000-0x000000000061E000-memory.dmpFilesize
312KB
-
memory/3592-77-0x0000000000450000-0x0000000000459000-memory.dmpFilesize
36KB
-
memory/3592-74-0x0000000000440000-0x0000000000446000-memory.dmpFilesize
24KB
-
memory/3592-59-0x00000000005D0000-0x000000000061E000-memory.dmpFilesize
312KB
-
memory/3744-32-0x0000000000960000-0x0000000000A50000-memory.dmpFilesize
960KB
-
memory/3744-8-0x0000000000960000-0x0000000000A50000-memory.dmpFilesize
960KB
-
memory/3744-4-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3744-18-0x0000000077792000-0x0000000077794000-memory.dmpFilesize
8KB
-
memory/3744-2-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3744-5-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3744-11-0x00000000004D0000-0x00000000004E0000-memory.dmpFilesize
64KB
-
memory/3744-19-0x00000000004D0000-0x00000000004D2000-memory.dmpFilesize
8KB
-
memory/3744-35-0x00000000004D0000-0x00000000004E0000-memory.dmpFilesize
64KB
-
memory/3744-14-0x0000000077792000-0x0000000077794000-memory.dmpFilesize
8KB
-
memory/3744-12-0x0000000000960000-0x0000000000A60000-memory.dmpFilesize
1024KB
-
memory/3744-9-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3744-13-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/3744-16-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/3744-37-0x0000000000960000-0x0000000000A60000-memory.dmpFilesize
1024KB
-
memory/3744-34-0x0000000000960000-0x0000000000A50000-memory.dmpFilesize
960KB
-
memory/3744-10-0x0000000000960000-0x0000000000A50000-memory.dmpFilesize
960KB
-
memory/3744-27-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/3744-7-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB