Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12-02-2024 00:08
Static task
static1
Behavioral task
behavioral1
Sample
95ba95cad998d07b406c4b6161274e89.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
95ba95cad998d07b406c4b6161274e89.exe
Resource
win10v2004-20231215-en
General
-
Target
95ba95cad998d07b406c4b6161274e89.exe
-
Size
1.7MB
-
MD5
95ba95cad998d07b406c4b6161274e89
-
SHA1
457a7b403eec2863716eaa5f2e0dc6c6c4a834b8
-
SHA256
35611bfb7b38f17960d97815bf31b02fc0625cb9a839951f4beedb56de5e81d9
-
SHA512
4a83be49e87d53eb61de227ab82c96bec169199b8dd7984235a0aacfe9ce55eaba5f54d7bbe4fd0701a430a56dea2dbbbbdf2e6e35490912c1f6d6d12f61107d
-
SSDEEP
49152:Ta3Pt9AYZmGR7Q7afTDuY1tRHVMyi07Tg:u3OGhQ7a7DuG7Vaw
Malware Config
Signatures
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/2792-53-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral1/memory/2792-54-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
Nirsoft 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2672-34-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/2672-36-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/2600-45-0x0000000000400000-0x0000000000425000-memory.dmp Nirsoft behavioral1/memory/2600-46-0x0000000000400000-0x0000000000425000-memory.dmp Nirsoft behavioral1/memory/2792-53-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral1/memory/2792-54-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral1/memory/2480-62-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/2480-64-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/2536-72-0x0000000000400000-0x000000000043E000-memory.dmp Nirsoft behavioral1/memory/2536-74-0x0000000000400000-0x000000000043E000-memory.dmp Nirsoft behavioral1/memory/1700-82-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1700-83-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/2528-88-0x0000000000400000-0x0000000000410000-memory.dmp Nirsoft behavioral1/memory/2528-85-0x0000000000400000-0x0000000000410000-memory.dmp Nirsoft behavioral1/memory/2528-89-0x0000000000400000-0x0000000000410000-memory.dmp Nirsoft behavioral1/memory/952-96-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft behavioral1/memory/952-98-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft behavioral1/memory/1592-107-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft behavioral1/memory/1592-105-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft -
Executes dropped EXE 11 IoCs
Processes:
csrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exepid process 2856 csrss.exe 2192 csrss.exe 2672 csrss.exe 2600 csrss.exe 2792 csrss.exe 2480 csrss.exe 2536 csrss.exe 1700 csrss.exe 2528 csrss.exe 952 csrss.exe 1592 csrss.exe -
Loads dropped DLL 7 IoCs
Processes:
95ba95cad998d07b406c4b6161274e89.execsrss.exepid process 2928 95ba95cad998d07b406c4b6161274e89.exe 2928 95ba95cad998d07b406c4b6161274e89.exe 2928 95ba95cad998d07b406c4b6161274e89.exe 2928 95ba95cad998d07b406c4b6161274e89.exe 2856 csrss.exe 2856 csrss.exe 2856 csrss.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2856-11-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2856-23-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2856-25-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2672-30-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2672-33-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2672-34-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2672-36-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2600-40-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/2600-43-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/2600-45-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/2600-46-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/2792-49-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2792-52-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2792-53-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2792-54-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2480-56-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2856-59-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2480-60-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2480-61-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2480-62-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2480-64-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2536-67-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2536-70-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2536-72-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/2536-74-0x0000000000400000-0x000000000043E000-memory.dmp upx behavioral1/memory/1700-77-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/1700-80-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/1700-82-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/1700-83-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/952-91-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/952-94-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/952-96-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/952-98-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/1592-101-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/1592-104-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/1592-107-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/1592-105-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/2856-110-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2856-112-0x0000000000400000-0x00000000004AE000-memory.dmp upx -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
csrss.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts csrss.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
95ba95cad998d07b406c4b6161274e89.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\test.exe" 95ba95cad998d07b406c4b6161274e89.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 11 IoCs
Processes:
95ba95cad998d07b406c4b6161274e89.execsrss.exedescription pid process target process PID 2928 set thread context of 2856 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2928 set thread context of 2192 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2856 set thread context of 2672 2856 csrss.exe csrss.exe PID 2856 set thread context of 2600 2856 csrss.exe csrss.exe PID 2856 set thread context of 2792 2856 csrss.exe csrss.exe PID 2856 set thread context of 2480 2856 csrss.exe csrss.exe PID 2856 set thread context of 2536 2856 csrss.exe csrss.exe PID 2856 set thread context of 1700 2856 csrss.exe csrss.exe PID 2856 set thread context of 2528 2856 csrss.exe csrss.exe PID 2856 set thread context of 952 2856 csrss.exe csrss.exe PID 2856 set thread context of 1592 2856 csrss.exe csrss.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
csrss.execsrss.exedescription pid process Token: SeDebugPrivilege 2600 csrss.exe Token: SeDebugPrivilege 1700 csrss.exe Token: SeRestorePrivilege 1700 csrss.exe Token: SeBackupPrivilege 1700 csrss.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
csrss.exepid process 2856 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
95ba95cad998d07b406c4b6161274e89.execsrss.exedescription pid process target process PID 2928 wrote to memory of 2856 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2928 wrote to memory of 2856 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2928 wrote to memory of 2856 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2928 wrote to memory of 2856 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2928 wrote to memory of 2856 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2928 wrote to memory of 2856 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2928 wrote to memory of 2856 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2928 wrote to memory of 2856 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2928 wrote to memory of 2856 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2928 wrote to memory of 2192 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2928 wrote to memory of 2192 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2928 wrote to memory of 2192 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2928 wrote to memory of 2192 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2928 wrote to memory of 2192 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2928 wrote to memory of 2192 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2928 wrote to memory of 2192 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2928 wrote to memory of 2192 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2928 wrote to memory of 2192 2928 95ba95cad998d07b406c4b6161274e89.exe csrss.exe PID 2856 wrote to memory of 2672 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2672 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2672 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2672 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2672 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2672 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2672 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2672 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2672 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2600 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2600 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2600 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2600 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2600 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2600 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2600 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2600 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2600 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2792 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2792 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2792 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2792 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2792 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2792 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2792 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2792 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2792 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2480 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2480 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2480 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2480 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2480 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2480 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2480 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2480 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2480 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2536 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2536 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2536 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2536 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2536 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2536 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2536 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2536 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 2536 2856 csrss.exe csrss.exe PID 2856 wrote to memory of 1700 2856 csrss.exe csrss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\95ba95cad998d07b406c4b6161274e89.exe"C:\Users\Admin\AppData\Local\Temp\95ba95cad998d07b406c4b6161274e89.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\csrss.exeC:\Users\Admin\AppData\Roaming\csrss.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\csrss.exe/stext "C:\Users\Admin\AppData\Roaming\offc.dat"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\csrss.exe/stext "C:\Users\Admin\AppData\Roaming\mess.dat"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\csrss.exe/stext "C:\Users\Admin\AppData\Roaming\mail.dat"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
-
C:\Users\Admin\AppData\Roaming\csrss.exe/stext "C:\Users\Admin\AppData\Roaming\dial.dat"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\csrss.exe/stext "C:\Users\Admin\AppData\Roaming\chro.dat"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\csrss.exe/stext "C:\Users\Admin\AppData\Roaming\iexp.dat"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\csrss.exe/stext "C:\Users\Admin\AppData\Roaming\ptsg.dat"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\csrss.exe/stext "C:\Users\Admin\AppData\Roaming\ffox.dat"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\csrss.exe/stext "C:\Users\Admin\AppData\Roaming\opra.dat"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\csrss.exeC:\Users\Admin\AppData\Roaming\csrss.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\dial.datFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\offc.datFilesize
1KB
MD5fef019dd1b10e536c0b5100b0f4e30ff
SHA12c23474f60ea806fcc9ceb1edbf894e701bb68cd
SHA2561e7746d9717f5453c804cfe743b68cc4056b0afbb82976866b47f303c8e8c467
SHA512f554667494904d4edb88e7b8934e365bbe0224ccdec7c4b756eef0f57f082536f82f3b0c0471b3610b419e1b2ed928d549316a8fd1b2fa988757cf8e24cd0cc6
-
\Users\Admin\AppData\Roaming\csrss.exeMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Roaming\csrss.exeFilesize
1KB
MD5bd1829843641d264c9ef57ee175a68ae
SHA1298cdbc7f30583f964a6533bf62fb7aff501aa52
SHA25687cff8f9ae3660c6ff6fc7d6262c61b7c19b2271ae9a95abe7b9d744d386259c
SHA5126165d8d47c2e32407c0888b28989ae293f592c4e4771e43d8d09d303e3ad73f895f1c852a176677b3fbd78449536579570cac67a17b2e9135774236b159b2827
-
memory/952-98-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/952-96-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/952-94-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/952-91-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1592-105-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1592-107-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1592-104-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1592-101-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1700-82-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1700-83-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1700-80-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1700-77-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2192-20-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/2480-60-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2480-56-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2480-61-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2480-62-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2480-64-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2528-89-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2528-85-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2528-88-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2536-67-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2536-74-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2536-72-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2536-70-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2600-43-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2600-45-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2600-46-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2600-40-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2672-34-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2672-30-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2672-33-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2672-36-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2792-49-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2792-53-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2792-52-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2792-54-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2856-25-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/2856-59-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/2856-23-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/2856-11-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/2856-110-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/2856-112-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/2928-0-0x0000000074690000-0x0000000074C3B000-memory.dmpFilesize
5.7MB
-
memory/2928-24-0x0000000074690000-0x0000000074C3B000-memory.dmpFilesize
5.7MB
-
memory/2928-2-0x0000000002370000-0x00000000023B0000-memory.dmpFilesize
256KB
-
memory/2928-1-0x0000000074690000-0x0000000074C3B000-memory.dmpFilesize
5.7MB