Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
15-01-2024 18:38
Static task
static1
Behavioral task
behavioral1
Sample
5dcca8cd88e96c87d548d21c582e6534.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5dcca8cd88e96c87d548d21c582e6534.exe
Resource
win10v2004-20231215-en
General
-
Target
5dcca8cd88e96c87d548d21c582e6534.exe
-
Size
1.7MB
-
MD5
5dcca8cd88e96c87d548d21c582e6534
-
SHA1
0715d363f54b89afc0a2e3b685ffa45cf76fcbeb
-
SHA256
2b0e5a007f1b13a5f5380718ba98c8e00c087315501667d03ebd6bf986205e2b
-
SHA512
5d48b7f2182f440a0201cb4c83f283b3866f9745ff0d2b8b79e2dfbcf68742d0d42a93fdcae680e031c09cdcdf417c40607e62e519adc264383da4a4e74ef2a7
-
SSDEEP
49152:MZO7NPP6UaRoNqZRTeSSwvA8kfLQ68fkCtgHREBfJXA:CcPP6UaRoNqDeSS6tEQ68fkCuHREBfK
Malware Config
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral2/memory/2540-9-0x0000000005400000-0x000000000545A000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-10-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-11-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-13-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-15-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-17-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-19-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-21-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-23-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-27-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-25-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-29-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-31-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-33-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-35-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-37-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-39-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-41-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-43-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-45-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-47-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-49-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-51-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-53-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-55-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-57-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-59-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-61-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-63-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-65-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-67-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-69-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-71-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 behavioral2/memory/2540-73-0x0000000005400000-0x0000000005454000-memory.dmp family_zgrat_v1 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5dcca8cd88e96c87d548d21c582e6534.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 5dcca8cd88e96c87d548d21c582e6534.exe Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation WScript.exe -
Deletes itself 1 IoCs
Processes:
powershell.exepid process 2524 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
RegAsm.exepid process 1072 RegAsm.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5dcca8cd88e96c87d548d21c582e6534.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinRAR = "\"C:\\Users\\Admin\\AppData\\Roaming\\WinRAR\\WinRAR.exe\"" 5dcca8cd88e96c87d548d21c582e6534.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
RegAsm.exepid process 1072 RegAsm.exe 1072 RegAsm.exe 1072 RegAsm.exe 1072 RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5dcca8cd88e96c87d548d21c582e6534.exedescription pid process target process PID 2540 set thread context of 1072 2540 5dcca8cd88e96c87d548d21c582e6534.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
5dcca8cd88e96c87d548d21c582e6534.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings 5dcca8cd88e96c87d548d21c582e6534.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
5dcca8cd88e96c87d548d21c582e6534.exepowershell.exepowershell.exepid process 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 2540 5dcca8cd88e96c87d548d21c582e6534.exe 216 powershell.exe 2524 powershell.exe 2524 powershell.exe 216 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
5dcca8cd88e96c87d548d21c582e6534.exepowershell.exepowershell.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 2540 5dcca8cd88e96c87d548d21c582e6534.exe Token: SeDebugPrivilege 2524 powershell.exe Token: SeDebugPrivilege 216 powershell.exe Token: SeShutdownPrivilege 1072 RegAsm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegAsm.exepid process 1072 RegAsm.exe 1072 RegAsm.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
5dcca8cd88e96c87d548d21c582e6534.exeWScript.exedescription pid process target process PID 2540 wrote to memory of 2348 2540 5dcca8cd88e96c87d548d21c582e6534.exe WScript.exe PID 2540 wrote to memory of 2348 2540 5dcca8cd88e96c87d548d21c582e6534.exe WScript.exe PID 2540 wrote to memory of 2348 2540 5dcca8cd88e96c87d548d21c582e6534.exe WScript.exe PID 2540 wrote to memory of 2524 2540 5dcca8cd88e96c87d548d21c582e6534.exe powershell.exe PID 2540 wrote to memory of 2524 2540 5dcca8cd88e96c87d548d21c582e6534.exe powershell.exe PID 2540 wrote to memory of 2524 2540 5dcca8cd88e96c87d548d21c582e6534.exe powershell.exe PID 2540 wrote to memory of 1072 2540 5dcca8cd88e96c87d548d21c582e6534.exe RegAsm.exe PID 2540 wrote to memory of 1072 2540 5dcca8cd88e96c87d548d21c582e6534.exe RegAsm.exe PID 2540 wrote to memory of 1072 2540 5dcca8cd88e96c87d548d21c582e6534.exe RegAsm.exe PID 2540 wrote to memory of 1072 2540 5dcca8cd88e96c87d548d21c582e6534.exe RegAsm.exe PID 2540 wrote to memory of 1072 2540 5dcca8cd88e96c87d548d21c582e6534.exe RegAsm.exe PID 2540 wrote to memory of 1072 2540 5dcca8cd88e96c87d548d21c582e6534.exe RegAsm.exe PID 2540 wrote to memory of 1072 2540 5dcca8cd88e96c87d548d21c582e6534.exe RegAsm.exe PID 2348 wrote to memory of 216 2348 WScript.exe powershell.exe PID 2348 wrote to memory of 216 2348 WScript.exe powershell.exe PID 2348 wrote to memory of 216 2348 WScript.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5dcca8cd88e96c87d548d21c582e6534.exe"C:\Users\Admin\AppData\Local\Temp\5dcca8cd88e96c87d548d21c582e6534.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Fqwxizhaqzzkrkb.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\WinRAR\WinRAR.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\AppData\Local\Temp\5dcca8cd88e96c87d548d21c582e6534.exe" -Force2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD525604a2821749d30ca35877a7669dff9
SHA149c624275363c7b6768452db6868f8100aa967be
SHA2567f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476
SHA512206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5c31e6a4467d0a6ff2eefb3f6bb56ced6
SHA16d0390a4029aa897b2222b225022a23b975d9c13
SHA256869175bc221d58731ae270ac1d1a8d52ff1f1809ce3920ac6e1664bc660f20b2
SHA5125cac574dbd68a65ba6b9ea2f72aeeba4430d4763589805220aaf2852dbd78c88f398e79f2ee8dfff629eb1360ae948169518e7a3e0b2d72e515e112ba1ac17cb
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeFilesize
63KB
MD50d5df43af2916f47d00c1573797c1a13
SHA1230ab5559e806574d26b4c20847c368ed55483b0
SHA256c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
SHA512f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
-
C:\Users\Admin\AppData\Local\Temp\_Fqwxizhaqzzkrkb.vbsFilesize
143B
MD5a005d0cdeced63bd69946fdc567f5790
SHA12a8f8b628dfb1c122c6a7f6df720bc0b1a4edfa9
SHA2562c1c3db64a15478fabe2013f50ad9ec329b75a10b8054be67f765d9891582c8e
SHA512a4cfd3f0567f9b378b8643fc31350048a3c8d272568104df1e851da4406a72ad61e5865a34a3d0d9a9b3643f2c54a3e96b85362797ebcb747826745ccd38235b
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lp5uouuq.dom.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/216-1835-0x0000000006EB0000-0x0000000006ECE000-memory.dmpFilesize
120KB
-
memory/216-1787-0x00000000056E0000-0x0000000005702000-memory.dmpFilesize
136KB
-
memory/216-1853-0x0000000000CC0000-0x0000000000CD0000-memory.dmpFilesize
64KB
-
memory/216-1784-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/216-1852-0x0000000007530000-0x0000000007538000-memory.dmpFilesize
32KB
-
memory/216-1851-0x0000000007550000-0x000000000756A000-memory.dmpFilesize
104KB
-
memory/216-1850-0x0000000007450000-0x0000000007464000-memory.dmpFilesize
80KB
-
memory/216-1849-0x0000000007440000-0x000000000744E000-memory.dmpFilesize
56KB
-
memory/216-1848-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/216-1785-0x0000000000CC0000-0x0000000000CD0000-memory.dmpFilesize
64KB
-
memory/216-1786-0x0000000000CC0000-0x0000000000CD0000-memory.dmpFilesize
64KB
-
memory/216-1843-0x0000000007420000-0x0000000007431000-memory.dmpFilesize
68KB
-
memory/216-1842-0x0000000007480000-0x0000000007516000-memory.dmpFilesize
600KB
-
memory/216-1857-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/216-1810-0x0000000005ED0000-0x0000000005EEE000-memory.dmpFilesize
120KB
-
memory/216-1837-0x0000000007280000-0x000000000728A000-memory.dmpFilesize
40KB
-
memory/216-1836-0x0000000006ED0000-0x0000000006F73000-memory.dmpFilesize
652KB
-
memory/216-1820-0x0000000000CC0000-0x0000000000CD0000-memory.dmpFilesize
64KB
-
memory/216-1825-0x0000000070750000-0x000000007079C000-memory.dmpFilesize
304KB
-
memory/216-1824-0x00000000064B0000-0x00000000064E2000-memory.dmpFilesize
200KB
-
memory/1072-1809-0x0000000070910000-0x0000000070949000-memory.dmpFilesize
228KB
-
memory/1072-1869-0x00000000756C0000-0x00000000756F9000-memory.dmpFilesize
228KB
-
memory/1072-1863-0x00000000756C0000-0x00000000756F9000-memory.dmpFilesize
228KB
-
memory/1072-1860-0x00000000756C0000-0x00000000756F9000-memory.dmpFilesize
228KB
-
memory/1072-1819-0x0000000070540000-0x0000000070579000-memory.dmpFilesize
228KB
-
memory/1072-1841-0x000000006FF70000-0x000000006FFA9000-memory.dmpFilesize
228KB
-
memory/1072-1866-0x00000000756C0000-0x00000000756F9000-memory.dmpFilesize
228KB
-
memory/2524-1788-0x0000000005D60000-0x0000000005DC6000-memory.dmpFilesize
408KB
-
memory/2524-1821-0x00000000050F0000-0x0000000005100000-memory.dmpFilesize
64KB
-
memory/2524-1838-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/2524-1823-0x0000000006880000-0x000000000689A000-memory.dmpFilesize
104KB
-
memory/2524-1811-0x0000000006400000-0x000000000644C000-memory.dmpFilesize
304KB
-
memory/2524-1844-0x0000000006940000-0x0000000006962000-memory.dmpFilesize
136KB
-
memory/2524-1847-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/2524-1799-0x0000000005E40000-0x0000000006194000-memory.dmpFilesize
3.3MB
-
memory/2524-1780-0x0000000005730000-0x0000000005D58000-memory.dmpFilesize
6.2MB
-
memory/2524-1775-0x00000000050F0000-0x0000000005100000-memory.dmpFilesize
64KB
-
memory/2524-1773-0x0000000002AA0000-0x0000000002AD6000-memory.dmpFilesize
216KB
-
memory/2524-1772-0x00000000050F0000-0x0000000005100000-memory.dmpFilesize
64KB
-
memory/2524-1771-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/2524-1822-0x0000000007AE0000-0x000000000815A000-memory.dmpFilesize
6.5MB
-
memory/2540-35-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-37-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-1759-0x0000000005CC0000-0x0000000005CD0000-memory.dmpFilesize
64KB
-
memory/2540-1758-0x00000000084F0000-0x0000000008556000-memory.dmpFilesize
408KB
-
memory/2540-1757-0x00000000081B0000-0x00000000081CE000-memory.dmpFilesize
120KB
-
memory/2540-1170-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/2540-73-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-71-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-69-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-1783-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/2540-67-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-65-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-63-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-61-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-59-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-57-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-55-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-53-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-51-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-49-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-47-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-45-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-43-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-41-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-39-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-1760-0x0000000005CC0000-0x0000000005CD0000-memory.dmpFilesize
64KB
-
memory/2540-0-0x0000000074EA0000-0x0000000075650000-memory.dmpFilesize
7.7MB
-
memory/2540-33-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-31-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-29-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-25-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-27-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-23-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-21-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-19-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-17-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-15-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-13-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-11-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-10-0x0000000005400000-0x0000000005454000-memory.dmpFilesize
336KB
-
memory/2540-9-0x0000000005400000-0x000000000545A000-memory.dmpFilesize
360KB
-
memory/2540-8-0x0000000008200000-0x0000000008276000-memory.dmpFilesize
472KB
-
memory/2540-7-0x0000000007FE0000-0x0000000008184000-memory.dmpFilesize
1.6MB
-
memory/2540-6-0x0000000005CC0000-0x0000000005CD0000-memory.dmpFilesize
64KB
-
memory/2540-5-0x0000000005B10000-0x0000000005B1A000-memory.dmpFilesize
40KB
-
memory/2540-4-0x0000000005CC0000-0x0000000005CD0000-memory.dmpFilesize
64KB
-
memory/2540-3-0x0000000005A40000-0x0000000005AD2000-memory.dmpFilesize
584KB
-
memory/2540-2-0x00000000060C0000-0x0000000006664000-memory.dmpFilesize
5.6MB
-
memory/2540-1-0x0000000000EB0000-0x000000000106C000-memory.dmpFilesize
1.7MB