Analysis
-
max time kernel
147s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28-01-2024 16:52
Static task
static1
Behavioral task
behavioral1
Sample
7d806a8dc2cba7a19367f2df6469c637.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7d806a8dc2cba7a19367f2df6469c637.exe
Resource
win10v2004-20231215-en
General
-
Target
7d806a8dc2cba7a19367f2df6469c637.exe
-
Size
2.1MB
-
MD5
7d806a8dc2cba7a19367f2df6469c637
-
SHA1
e20e0bc603b5bb35a858e4d146e2a1a163971530
-
SHA256
c3814d14e580005378655d2ab8a2e889a0bf517b80b13e394b88d8f7e7b0d29b
-
SHA512
e8d4b5b483793ad2f655ec5e2d40388c0308d86e01995042bb5c94ad58b93a974ec041011093404faa09bc5f0982bea608f62dcd03e2e6d78cb1a5b3d7f6bf88
-
SSDEEP
49152:2uzbL+u+4fWHLY0j1IK9Fj7w1cGxRshM5q:2uvL+B8WHLXjCK9Fnccwsh9
Malware Config
Extracted
bitrat
1.38
162.33.178.83:6969
-
communication_password
1d85fa3449602b11c72669aa360263fb
-
tor_process
tor
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
7d806a8dc2cba7a19367f2df6469c637.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome.exe\"," 7d806a8dc2cba7a19367f2df6469c637.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
7d806a8dc2cba7a19367f2df6469c637.exepid process 2608 7d806a8dc2cba7a19367f2df6469c637.exe 2608 7d806a8dc2cba7a19367f2df6469c637.exe 2608 7d806a8dc2cba7a19367f2df6469c637.exe 2608 7d806a8dc2cba7a19367f2df6469c637.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7d806a8dc2cba7a19367f2df6469c637.exedescription pid process target process PID 1320 set thread context of 2608 1320 7d806a8dc2cba7a19367f2df6469c637.exe 7d806a8dc2cba7a19367f2df6469c637.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe7d806a8dc2cba7a19367f2df6469c637.exepid process 2744 powershell.exe 2736 powershell.exe 2604 powershell.exe 2948 powershell.exe 1676 powershell.exe 2892 powershell.exe 2432 powershell.exe 2476 powershell.exe 1936 powershell.exe 1652 powershell.exe 1320 7d806a8dc2cba7a19367f2df6469c637.exe 1320 7d806a8dc2cba7a19367f2df6469c637.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2744 powershell.exe Token: SeDebugPrivilege 2736 powershell.exe Token: SeDebugPrivilege 2604 powershell.exe Token: SeIncreaseQuotaPrivilege 2604 powershell.exe Token: SeSecurityPrivilege 2604 powershell.exe Token: SeTakeOwnershipPrivilege 2604 powershell.exe Token: SeLoadDriverPrivilege 2604 powershell.exe Token: SeSystemProfilePrivilege 2604 powershell.exe Token: SeSystemtimePrivilege 2604 powershell.exe Token: SeProfSingleProcessPrivilege 2604 powershell.exe Token: SeIncBasePriorityPrivilege 2604 powershell.exe Token: SeCreatePagefilePrivilege 2604 powershell.exe Token: SeBackupPrivilege 2604 powershell.exe Token: SeRestorePrivilege 2604 powershell.exe Token: SeShutdownPrivilege 2604 powershell.exe Token: SeDebugPrivilege 2604 powershell.exe Token: SeSystemEnvironmentPrivilege 2604 powershell.exe Token: SeRemoteShutdownPrivilege 2604 powershell.exe Token: SeUndockPrivilege 2604 powershell.exe Token: SeManageVolumePrivilege 2604 powershell.exe Token: 33 2604 powershell.exe Token: 34 2604 powershell.exe Token: 35 2604 powershell.exe Token: SeDebugPrivilege 2948 powershell.exe Token: SeIncreaseQuotaPrivilege 2948 powershell.exe Token: SeSecurityPrivilege 2948 powershell.exe Token: SeTakeOwnershipPrivilege 2948 powershell.exe Token: SeLoadDriverPrivilege 2948 powershell.exe Token: SeSystemProfilePrivilege 2948 powershell.exe Token: SeSystemtimePrivilege 2948 powershell.exe Token: SeProfSingleProcessPrivilege 2948 powershell.exe Token: SeIncBasePriorityPrivilege 2948 powershell.exe Token: SeCreatePagefilePrivilege 2948 powershell.exe Token: SeBackupPrivilege 2948 powershell.exe Token: SeRestorePrivilege 2948 powershell.exe Token: SeShutdownPrivilege 2948 powershell.exe Token: SeDebugPrivilege 2948 powershell.exe Token: SeSystemEnvironmentPrivilege 2948 powershell.exe Token: SeRemoteShutdownPrivilege 2948 powershell.exe Token: SeUndockPrivilege 2948 powershell.exe Token: SeManageVolumePrivilege 2948 powershell.exe Token: 33 2948 powershell.exe Token: 34 2948 powershell.exe Token: 35 2948 powershell.exe Token: SeDebugPrivilege 1676 powershell.exe Token: SeIncreaseQuotaPrivilege 1676 powershell.exe Token: SeSecurityPrivilege 1676 powershell.exe Token: SeTakeOwnershipPrivilege 1676 powershell.exe Token: SeLoadDriverPrivilege 1676 powershell.exe Token: SeSystemProfilePrivilege 1676 powershell.exe Token: SeSystemtimePrivilege 1676 powershell.exe Token: SeProfSingleProcessPrivilege 1676 powershell.exe Token: SeIncBasePriorityPrivilege 1676 powershell.exe Token: SeCreatePagefilePrivilege 1676 powershell.exe Token: SeBackupPrivilege 1676 powershell.exe Token: SeRestorePrivilege 1676 powershell.exe Token: SeShutdownPrivilege 1676 powershell.exe Token: SeDebugPrivilege 1676 powershell.exe Token: SeSystemEnvironmentPrivilege 1676 powershell.exe Token: SeRemoteShutdownPrivilege 1676 powershell.exe Token: SeUndockPrivilege 1676 powershell.exe Token: SeManageVolumePrivilege 1676 powershell.exe Token: 33 1676 powershell.exe Token: 34 1676 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
7d806a8dc2cba7a19367f2df6469c637.exepid process 2608 7d806a8dc2cba7a19367f2df6469c637.exe 2608 7d806a8dc2cba7a19367f2df6469c637.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
7d806a8dc2cba7a19367f2df6469c637.exedescription pid process target process PID 1320 wrote to memory of 2744 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2744 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2744 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2744 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2736 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2736 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2736 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2736 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2604 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2604 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2604 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2604 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2948 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2948 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2948 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2948 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 1676 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 1676 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 1676 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 1676 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2892 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2892 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2892 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2892 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2432 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2432 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2432 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2432 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2476 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2476 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2476 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2476 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 1936 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 1936 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 1936 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 1936 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 1652 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 1652 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 1652 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 1652 1320 7d806a8dc2cba7a19367f2df6469c637.exe powershell.exe PID 1320 wrote to memory of 2608 1320 7d806a8dc2cba7a19367f2df6469c637.exe 7d806a8dc2cba7a19367f2df6469c637.exe PID 1320 wrote to memory of 2608 1320 7d806a8dc2cba7a19367f2df6469c637.exe 7d806a8dc2cba7a19367f2df6469c637.exe PID 1320 wrote to memory of 2608 1320 7d806a8dc2cba7a19367f2df6469c637.exe 7d806a8dc2cba7a19367f2df6469c637.exe PID 1320 wrote to memory of 2608 1320 7d806a8dc2cba7a19367f2df6469c637.exe 7d806a8dc2cba7a19367f2df6469c637.exe PID 1320 wrote to memory of 2608 1320 7d806a8dc2cba7a19367f2df6469c637.exe 7d806a8dc2cba7a19367f2df6469c637.exe PID 1320 wrote to memory of 2608 1320 7d806a8dc2cba7a19367f2df6469c637.exe 7d806a8dc2cba7a19367f2df6469c637.exe PID 1320 wrote to memory of 2608 1320 7d806a8dc2cba7a19367f2df6469c637.exe 7d806a8dc2cba7a19367f2df6469c637.exe PID 1320 wrote to memory of 2608 1320 7d806a8dc2cba7a19367f2df6469c637.exe 7d806a8dc2cba7a19367f2df6469c637.exe PID 1320 wrote to memory of 2608 1320 7d806a8dc2cba7a19367f2df6469c637.exe 7d806a8dc2cba7a19367f2df6469c637.exe PID 1320 wrote to memory of 2608 1320 7d806a8dc2cba7a19367f2df6469c637.exe 7d806a8dc2cba7a19367f2df6469c637.exe PID 1320 wrote to memory of 2608 1320 7d806a8dc2cba7a19367f2df6469c637.exe 7d806a8dc2cba7a19367f2df6469c637.exe PID 1320 wrote to memory of 2608 1320 7d806a8dc2cba7a19367f2df6469c637.exe 7d806a8dc2cba7a19367f2df6469c637.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d806a8dc2cba7a19367f2df6469c637.exe"C:\Users\Admin\AppData\Local\Temp\7d806a8dc2cba7a19367f2df6469c637.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\7d806a8dc2cba7a19367f2df6469c637.exeC:\Users\Admin\AppData\Local\Temp\7d806a8dc2cba7a19367f2df6469c637.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD554b540c818ebf0a66767042d606cf1a1
SHA1d3c192ced6c329b9b62bcb35326110474fe43729
SHA256cb8261b1a525e217147d221e0f8a4e7076ad0815a63edc9a4f7bd8f9f2b223a4
SHA512cdea3ff8f0cf24800d85cbbd835c9f11474b0b0edb64bb9e2fad8d44294dc869c6c4e368b961f063b72fd05eecc79a71d0268a144047cdf3105e6eb87875b30e
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1320-133-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-135-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-157-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-129-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-153-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-151-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-2-0x0000000004EF0000-0x0000000004F30000-memory.dmpFilesize
256KB
-
memory/1320-149-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-147-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-145-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-143-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-137-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-141-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-139-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-27-0x0000000074E00000-0x00000000754EE000-memory.dmpFilesize
6.9MB
-
memory/1320-113-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-108-0x0000000008620000-0x0000000008824000-memory.dmpFilesize
2.0MB
-
memory/1320-131-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-155-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-158-0x00000000004D0000-0x00000000004FA000-memory.dmpFilesize
168KB
-
memory/1320-123-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-125-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-40-0x0000000004EF0000-0x0000000004F30000-memory.dmpFilesize
256KB
-
memory/1320-121-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-119-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-127-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-1-0x0000000074E00000-0x00000000754EE000-memory.dmpFilesize
6.9MB
-
memory/1320-0-0x0000000000830000-0x0000000000A54000-memory.dmpFilesize
2.1MB
-
memory/1320-110-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-111-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-117-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1320-115-0x0000000008620000-0x000000000881E000-memory.dmpFilesize
2.0MB
-
memory/1652-109-0x00000000700C0000-0x000000007066B000-memory.dmpFilesize
5.7MB
-
memory/1652-106-0x00000000700C0000-0x000000007066B000-memory.dmpFilesize
5.7MB
-
memory/1652-105-0x0000000001B80000-0x0000000001BC0000-memory.dmpFilesize
256KB
-
memory/1652-104-0x00000000700C0000-0x000000007066B000-memory.dmpFilesize
5.7MB
-
memory/1652-107-0x0000000001B80000-0x0000000001BC0000-memory.dmpFilesize
256KB
-
memory/1676-49-0x0000000002640000-0x0000000002680000-memory.dmpFilesize
256KB
-
memory/1676-51-0x0000000002640000-0x0000000002680000-memory.dmpFilesize
256KB
-
memory/1676-48-0x00000000700C0000-0x000000007066B000-memory.dmpFilesize
5.7MB
-
memory/1676-50-0x00000000700C0000-0x000000007066B000-memory.dmpFilesize
5.7MB
-
memory/1676-52-0x00000000700C0000-0x000000007066B000-memory.dmpFilesize
5.7MB
-
memory/1936-93-0x00000000027A0000-0x00000000027E0000-memory.dmpFilesize
256KB
-
memory/1936-92-0x000000006FDA0000-0x000000007034B000-memory.dmpFilesize
5.7MB
-
memory/1936-94-0x000000006FDA0000-0x000000007034B000-memory.dmpFilesize
5.7MB
-
memory/1936-95-0x00000000027A0000-0x00000000027E0000-memory.dmpFilesize
256KB
-
memory/1936-96-0x00000000027A0000-0x00000000027E0000-memory.dmpFilesize
256KB
-
memory/1936-97-0x000000006FDA0000-0x000000007034B000-memory.dmpFilesize
5.7MB
-
memory/2432-69-0x0000000070020000-0x00000000705CB000-memory.dmpFilesize
5.7MB
-
memory/2432-70-0x00000000027B0000-0x00000000027F0000-memory.dmpFilesize
256KB
-
memory/2432-75-0x0000000070020000-0x00000000705CB000-memory.dmpFilesize
5.7MB
-
memory/2432-74-0x00000000027B0000-0x00000000027F0000-memory.dmpFilesize
256KB
-
memory/2432-73-0x00000000027B0000-0x00000000027F0000-memory.dmpFilesize
256KB
-
memory/2432-72-0x00000000027B0000-0x00000000027F0000-memory.dmpFilesize
256KB
-
memory/2432-71-0x0000000070020000-0x00000000705CB000-memory.dmpFilesize
5.7MB
-
memory/2476-85-0x0000000002730000-0x0000000002770000-memory.dmpFilesize
256KB
-
memory/2476-84-0x0000000002730000-0x0000000002770000-memory.dmpFilesize
256KB
-
memory/2476-83-0x0000000002730000-0x0000000002770000-memory.dmpFilesize
256KB
-
memory/2476-82-0x00000000700A0000-0x000000007064B000-memory.dmpFilesize
5.7MB
-
memory/2476-81-0x00000000700A0000-0x000000007064B000-memory.dmpFilesize
5.7MB
-
memory/2476-86-0x00000000700A0000-0x000000007064B000-memory.dmpFilesize
5.7MB
-
memory/2604-29-0x00000000700F0000-0x000000007069B000-memory.dmpFilesize
5.7MB
-
memory/2604-24-0x00000000700F0000-0x000000007069B000-memory.dmpFilesize
5.7MB
-
memory/2604-26-0x0000000002770000-0x00000000027B0000-memory.dmpFilesize
256KB
-
memory/2604-25-0x00000000700F0000-0x000000007069B000-memory.dmpFilesize
5.7MB
-
memory/2604-28-0x0000000002770000-0x00000000027B0000-memory.dmpFilesize
256KB
-
memory/2608-162-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2608-160-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2608-177-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2608-176-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2608-174-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2608-171-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2608-173-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2608-169-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2608-167-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2608-168-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2608-166-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2608-165-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2608-164-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2736-18-0x000000006FDA0000-0x000000007034B000-memory.dmpFilesize
5.7MB
-
memory/2736-17-0x000000006FDA0000-0x000000007034B000-memory.dmpFilesize
5.7MB
-
memory/2736-15-0x000000006FDA0000-0x000000007034B000-memory.dmpFilesize
5.7MB
-
memory/2736-16-0x00000000026B0000-0x00000000026F0000-memory.dmpFilesize
256KB
-
memory/2744-9-0x0000000070050000-0x00000000705FB000-memory.dmpFilesize
5.7MB
-
memory/2744-7-0x0000000002530000-0x0000000002570000-memory.dmpFilesize
256KB
-
memory/2744-6-0x0000000070050000-0x00000000705FB000-memory.dmpFilesize
5.7MB
-
memory/2744-5-0x0000000070050000-0x00000000705FB000-memory.dmpFilesize
5.7MB
-
memory/2744-8-0x0000000002530000-0x0000000002570000-memory.dmpFilesize
256KB
-
memory/2892-59-0x00000000027A0000-0x00000000027E0000-memory.dmpFilesize
256KB
-
memory/2892-63-0x000000006FDA0000-0x000000007034B000-memory.dmpFilesize
5.7MB
-
memory/2892-62-0x00000000027A0000-0x00000000027E0000-memory.dmpFilesize
256KB
-
memory/2892-61-0x00000000027A0000-0x00000000027E0000-memory.dmpFilesize
256KB
-
memory/2892-60-0x000000006FDA0000-0x000000007034B000-memory.dmpFilesize
5.7MB
-
memory/2892-58-0x000000006FDA0000-0x000000007034B000-memory.dmpFilesize
5.7MB
-
memory/2948-42-0x0000000070080000-0x000000007062B000-memory.dmpFilesize
5.7MB
-
memory/2948-35-0x0000000070080000-0x000000007062B000-memory.dmpFilesize
5.7MB
-
memory/2948-36-0x0000000002810000-0x0000000002850000-memory.dmpFilesize
256KB
-
memory/2948-37-0x0000000070080000-0x000000007062B000-memory.dmpFilesize
5.7MB
-
memory/2948-38-0x0000000002810000-0x0000000002850000-memory.dmpFilesize
256KB
-
memory/2948-39-0x0000000002810000-0x0000000002850000-memory.dmpFilesize
256KB
-
memory/2948-41-0x0000000002810000-0x0000000002850000-memory.dmpFilesize
256KB