Overview
overview
10Static
static
3Launcher.dll
windows10-1703-x64
1Launcher.exe
windows10-1703-x64
10data/AppIn...Ep.ps1
windows10-1703-x64
1data/AppIn...lm.ps1
windows10-1703-x64
1data/AppIn...1k.ps1
windows10-1703-x64
1data/AppIn...jT.ps1
windows10-1703-x64
1data/AppIn...G1.ps1
windows10-1703-x64
1data/AppIn...Yy.ps1
windows10-1703-x64
1data/AppIn...er.dll
windows10-1703-x64
1data/AppIn...er.exe
windows10-1703-x64
3data/AppIn...AR.exe
windows10-1703-x64
4data/AppIn...er.dll
windows10-1703-x64
1data/AppIn...er.exe
windows10-1703-x64
3data/AppIn...et.exe
windows10-1703-x64
1data/AppIn...PS.ps1
windows10-1703-x64
1data/BLAKEX64.dll
windows10-1703-x64
1data/Data/...Tg.ps1
windows10-1703-x64
1data/Data/...mc.ps1
windows10-1703-x64
1data/Data/...eI.ps1
windows10-1703-x64
1data/Data/...1Z.ps1
windows10-1703-x64
1data/Qt5Core.dll
windows10-1703-x64
1data/TC7Z64.dll
windows10-1703-x64
1data/TCLZMA64.dll
windows10-1703-x64
1data/TCUNZL64.dll
windows10-1703-x64
1data/TCsha...64.dll
windows10-1703-x64
1data/Tools...0Z.ps1
windows10-1703-x64
1data/Tools...Ov.ps1
windows10-1703-x64
1data/Tools...XO.ps1
windows10-1703-x64
1data/UNRAR64.dll
windows10-1703-x64
1data/WCMICON2.dll
windows10-1703-x64
1data/WCMICONS.exe
windows10-1703-x64
3data/WCMZIP64.dll
windows10-1703-x64
1Analysis
-
max time kernel
117s -
max time network
140s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
23-02-2024 10:15
Static task
static1
Behavioral task
behavioral1
Sample
Launcher.dll
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
Launcher.exe
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
data/AppInfo/RIBTwoUATqEp.ps1
Resource
win10-20240221-en
Behavioral task
behavioral4
Sample
data/AppInfo/VO1DaL46eflm.ps1
Resource
win10-20240221-en
Behavioral task
behavioral5
Sample
data/AppInfo/WtFlkRqeJ61k.ps1
Resource
win10-20240221-en
Behavioral task
behavioral6
Sample
data/AppInfo/Xfh5GWnGPMjT.ps1
Resource
win10-20240221-en
Behavioral task
behavioral7
Sample
data/AppInfo/YwTGpGD7UtG1.ps1
Resource
win10-20240214-en
Behavioral task
behavioral8
Sample
data/AppInfo/kGCFZO6TPVYy.ps1
Resource
win10-20240221-en
Behavioral task
behavioral9
Sample
data/AppInfo/services/Launhcer.dll
Resource
win10-20240221-en
Behavioral task
behavioral10
Sample
data/AppInfo/services/Launhcer.exe
Resource
win10-20240221-en
Behavioral task
behavioral11
Sample
data/AppInfo/services/WinRAR.exe
Resource
win10-20240221-en
Behavioral task
behavioral12
Sample
data/AppInfo/services/data/Launcher.dll
Resource
win10-20240221-en
Behavioral task
behavioral13
Sample
data/AppInfo/services/data/Launcher.exe
Resource
win10-20240221-en
Behavioral task
behavioral14
Sample
data/AppInfo/services/wget.exe
Resource
win10-20240221-en
Behavioral task
behavioral15
Sample
data/AppInfo/vhXDYuQByxPS.ps1
Resource
win10-20240214-en
Behavioral task
behavioral16
Sample
data/BLAKEX64.dll
Resource
win10-20240221-en
Behavioral task
behavioral17
Sample
data/Data/QsVakRcJSHTg.ps1
Resource
win10-20240221-en
Behavioral task
behavioral18
Sample
data/Data/YXNOU01Xhpmc.ps1
Resource
win10-20240221-en
Behavioral task
behavioral19
Sample
data/Data/jqP27MaT7teI.ps1
Resource
win10-20240214-en
Behavioral task
behavioral20
Sample
data/Data/mtgtTlysOs1Z.ps1
Resource
win10-20240221-en
Behavioral task
behavioral21
Sample
data/Qt5Core.dll
Resource
win10-20240221-en
Behavioral task
behavioral22
Sample
data/TC7Z64.dll
Resource
win10-20240221-en
Behavioral task
behavioral23
Sample
data/TCLZMA64.dll
Resource
win10-20240221-en
Behavioral task
behavioral24
Sample
data/TCUNZL64.dll
Resource
win10-20240221-en
Behavioral task
behavioral25
Sample
data/TCshareWin10x64.dll
Resource
win10-20240221-en
Behavioral task
behavioral26
Sample
data/Tools/9syz0JDU8L0Z.ps1
Resource
win10-20240221-en
Behavioral task
behavioral27
Sample
data/Tools/NcHGDdjDw8Ov.ps1
Resource
win10-20240221-en
Behavioral task
behavioral28
Sample
data/Tools/dkAdSRKzVAXO.ps1
Resource
win10-20240221-en
Behavioral task
behavioral29
Sample
data/UNRAR64.dll
Resource
win10-20240221-en
Behavioral task
behavioral30
Sample
data/WCMICON2.dll
Resource
win10-20240221-en
Behavioral task
behavioral31
Sample
data/WCMICONS.exe
Resource
win10-20240221-en
Behavioral task
behavioral32
Sample
data/WCMZIP64.dll
Resource
win10-20240214-en
General
-
Target
data/AppInfo/services/data/Launcher.exe
-
Size
364KB
-
MD5
fea10d11d84919cb9a0a0752d61c0a66
-
SHA1
aea3c65e2b62851b2dd112597f28379b49c58a0a
-
SHA256
2786febdd57874118eaf5e257382cf4467d43f9ca189ac48ff6d45494f1cbab7
-
SHA512
e382f79ec1f1c370cd0053cccc7a0db8f3dc28b22f9dacd5f425c60adfb21e4a6eed3e119a7f9bbf135839e22d46511ca793cf8b5118d0e6256ebbbe749fc508
-
SSDEEP
6144:LpS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYqliwrZR5lJWPkOD:Lp8KLBzQ7Lcf3SiQs2FTTql9unNrkvzw
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
Launcher.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD Launcher.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Launcher.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Launcher.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Launcher.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Launcher.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 216 powershell.exe 216 powershell.exe 216 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 216 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Launcher.exedescription pid process target process PID 1428 wrote to memory of 216 1428 Launcher.exe powershell.exe PID 1428 wrote to memory of 216 1428 Launcher.exe powershell.exe PID 1428 wrote to memory of 216 1428 Launcher.exe powershell.exe PID 1428 wrote to memory of 3564 1428 Launcher.exe cmd.exe PID 1428 wrote to memory of 3564 1428 Launcher.exe cmd.exe PID 1428 wrote to memory of 3564 1428 Launcher.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\data\AppInfo\services\data\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\data\AppInfo\services\data\Launcher.exe"1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath $env:ProgramData, $env:AppData, $env:SystemDrive\ "2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /K rd /s /q "C:\Users\Admin\AppData\Roaming\services" & EXIT2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nyf2y54q.0jq.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
memory/216-12-0x0000000007AD0000-0x0000000007B1B000-memory.dmpFilesize
300KB
-
memory/216-3-0x0000000072590000-0x0000000072C7E000-memory.dmpFilesize
6.9MB
-
memory/216-4-0x0000000006750000-0x0000000006760000-memory.dmpFilesize
64KB
-
memory/216-6-0x0000000006D90000-0x00000000073B8000-memory.dmpFilesize
6.2MB
-
memory/216-7-0x0000000006B10000-0x0000000006B32000-memory.dmpFilesize
136KB
-
memory/216-8-0x00000000074C0000-0x0000000007526000-memory.dmpFilesize
408KB
-
memory/216-9-0x0000000006CB0000-0x0000000006D16000-memory.dmpFilesize
408KB
-
memory/216-10-0x00000000075F0000-0x0000000007940000-memory.dmpFilesize
3.3MB
-
memory/216-30-0x000000007E570000-0x000000007E580000-memory.dmpFilesize
64KB
-
memory/216-2-0x00000000029E0000-0x0000000002A16000-memory.dmpFilesize
216KB
-
memory/216-254-0x0000000072590000-0x0000000072C7E000-memory.dmpFilesize
6.9MB
-
memory/216-5-0x0000000006750000-0x0000000006760000-memory.dmpFilesize
64KB
-
memory/216-11-0x0000000007530000-0x000000000754C000-memory.dmpFilesize
112KB
-
memory/216-31-0x0000000008DA0000-0x0000000008DD3000-memory.dmpFilesize
204KB
-
memory/216-32-0x0000000070FB0000-0x0000000070FFB000-memory.dmpFilesize
300KB
-
memory/216-33-0x0000000008D80000-0x0000000008D9E000-memory.dmpFilesize
120KB
-
memory/216-38-0x0000000008DE0000-0x0000000008E85000-memory.dmpFilesize
660KB
-
memory/216-39-0x0000000006750000-0x0000000006760000-memory.dmpFilesize
64KB
-
memory/216-40-0x00000000090A0000-0x0000000009134000-memory.dmpFilesize
592KB
-
memory/216-233-0x0000000006870000-0x000000000688A000-memory.dmpFilesize
104KB
-
memory/216-238-0x0000000006860000-0x0000000006868000-memory.dmpFilesize
32KB
-
memory/216-13-0x0000000007D20000-0x0000000007D96000-memory.dmpFilesize
472KB