Analysis
-
max time kernel
83s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
25-03-2024 02:50
General
-
Target
dd0e73a123f1dc8e2fb436cb240351bb.exe
-
Size
277KB
-
MD5
dd0e73a123f1dc8e2fb436cb240351bb
-
SHA1
a3db66fc6944045a9639a253bbbf425367e72437
-
SHA256
53a24bad1cdca920f35b076ef3749f9b50278fed2aa406eb37a2eb3370361daf
-
SHA512
25fc82b16583ce0777ba881def1261612f47510f4f94bf80e6f676b200a309b9b31fcf08a1a3f3b5d701b6c1130114b7c50094bf0d68bd779e5573c520dbaf7e
-
SSDEEP
6144:jlYCgzpVQBuBXxezCDWelxli397ztXMkK0a:TgzpVQoeIi3RJMkK0a
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 3 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Modifies registry class 35 IoCs
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 61 IoCs
-
Suspicious use of FindShellTrayWindow 43 IoCs
-
Suspicious use of SendNotifyMessage 32 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd0e73a123f1dc8e2fb436cb240351bb.exe"C:\Users\Admin\AppData\Local\Temp\dd0e73a123f1dc8e2fb436cb240351bb.exe"1⤵
- Modifies security service
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\LP\D3AF\C2DE.tmp"C:\Program Files (x86)\LP\D3AF\C2DE.tmp"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\dd0e73a123f1dc8e2fb436cb240351bb.exeC:\Users\Admin\AppData\Local\Temp\dd0e73a123f1dc8e2fb436cb240351bb.exe startC:\Users\Admin\AppData\Roaming\F4447\B1ED3.exe%C:\Users\Admin\AppData\Roaming\F44472⤵
-
C:\Users\Admin\AppData\Local\Temp\dd0e73a123f1dc8e2fb436cb240351bb.exeC:\Users\Admin\AppData\Local\Temp\dd0e73a123f1dc8e2fb436cb240351bb.exe startC:\Program Files (x86)\47FAC\lvvm.exe%C:\Program Files (x86)\47FAC2⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\LP\D3AF\C2DE.tmpFilesize
98KB
MD5d80b9b537e9352a07cf0832971882498
SHA14f3c79ad91344b644ed160b843946712c9201282
SHA2562a6fa00fea45fa4c2947c1da516f8dbdc3b5c53b30e9d4f1b988edf254ddfa99
SHA5127c0f43ac9ae5d03784ce7968a935c891d255d6b6f601d1ee0b16c1f01e7b18926bb7d8b772a85eb58b9ac4331c73f241bc94c8293a9a12d81ba4bebe05e46190
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
471B
MD5da26794ff771dc3d9e896bc1873b3f4a
SHA121f4258056030c93a9fc2ee772e3dfc0fc4f8d92
SHA256c9990a0c6e3161572ff16108a6c32652061402a6e3385fdd68f8a729d572f742
SHA512998d322982dc9b197b6291440c0abd14522010fda2e6b2213636ea1435d27534db630e4275dcc043ddafb6bcb3ba4db481aad12246f75c951de69f0889e26ef6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
412B
MD5a546095f14b258cee783519ba1771e71
SHA15964ff29c0403f5b752ebb8f3d44550577ae2800
SHA25606c1cec4de457a164a8625d1cf80df12c169afbb732d3932850ba9c80e8bfb71
SHA5127231b28f125ec696dccb96a46778d042cba982a3af513690769724ae6178bb18b7d69ecea1532e3e1b994ee4fce7aff8b1bc9f20b826542b3951eb43a870d6c1
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbresFilesize
2KB
MD53d93b054465078f4a23beab39b769c03
SHA11801d223ef469a31c34ff9fe495e2c7ccba94915
SHA256633db92d99d2e9c78c5ced00cfc0b2980591356aa7b6196742daaa5eca734d53
SHA5125b8518f52cf9ec926e6e2cb6cabaf80ad469508710f616471462bbface712191525ce14fa69ec3c5d120e14ae21a5034eb90901fc0d4a651727bed26e1b4d0ab
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133558086667640701.txtFilesize
74KB
MD580dffedad36ef4c303579f8c9be9dbd7
SHA1792ca2a83d616ca82d973ece361ed9e95c95a0d8
SHA256590ca4d2f62a7864a62ccb1075c55191f7f9d5c5304ea3446961bb50f9e3916e
SHA512826b97a4de7c765f8f5ebc520960f68381fd9f4bfe68c2fbe46c6118110c9c14a87dcb8ed8102e60a954b4b3c408f72e7a93fd96317be3d51120a2ddd2faa3ea
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5MIHM5LV\microsoft.windows[1].xmlFilesize
96B
MD584209e171da10686915fe7efcd51552d
SHA16bf96e86a533a68eba4d703833de374e18ce6113
SHA25604d6050009ea3c99cc718ad1c07c5d15268b459fcfb63fcb990bc9761738907b
SHA51248d2524000911cfb68ef866dedac78ee430d79aa3f4b68399f645dc2066841e6962e11a3362cbcec46680357dcd3e58cfef9994450fed1d8af04df44f76b0dfd
-
C:\Users\Admin\AppData\Roaming\F4447\7FAC.444Filesize
1KB
MD54a5998a359b689e33ae218daeb6b41b0
SHA1e07e4fed7abe99b638ef12906cc7c8c5812b97cb
SHA25637579452f80621d584df804778ad7e7ad6b97bb1ef770c15b0ee125b7bbceb52
SHA512984ea71117169504417fea55451ab2249a558df67337121592a7c2ae63c6651190ca644c974a1509ab6272a2952270b9740b29ebac1dc812d21fefdc64c1f66d
-
C:\Users\Admin\AppData\Roaming\F4447\7FAC.444Filesize
1KB
MD5734c124e6a221efe092ab808ab421f83
SHA1be2e1ee51f598d89c2cc482ddbb74f68ebdc871f
SHA256ab205bf4871bf7cf3da2c9a541f6979ed308832abd67b29833357e0f47b56f42
SHA512f9119023725bc02d8b691f1670776cb9b4efbd4cd1587d4ca14326868a776d30ade397df90451f4a08f171a6f006bededeb776cc38dad110840bbd312ac01e05
-
C:\Users\Admin\AppData\Roaming\F4447\7FAC.444Filesize
597B
MD5224430d2513b6e1f013b013f9e262f15
SHA1ae7c8ae5255ac96b6df427a1fc835028105d3eb8
SHA256210da38120a672b5854126bcc883af7071db188d3188b807e3ed0dc3e317893a
SHA512c9ea1d0ae2c37db46d4f276def0efa60e8ea0df22ea7a7b6adac47b72fc12352ec7dc180a5be04cdca8ff4b52657a544f9e10e7851f016ef3a111e1d8c219342
-
C:\Users\Admin\AppData\Roaming\F4447\7FAC.444Filesize
897B
MD59a229711cf307f815d0e42f61cb0414d
SHA197a0bd615caaef392b465f0c0177c96ab10bf7d6
SHA256133cfe5b10109e6e3344dcffa77561757ffa8130d0266b7123b9e20b1902b2c3
SHA512d6ac1ec94d945fc8f34713bea4ea479a6afc3c0a2a0a7ce524ad226891669c0664a04c01f8510c6e96ba57c077f941aa6f3ae98ec66f019dd754f8961d50f3bf
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1820-1-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1820-112-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1820-2-0x0000000000530000-0x0000000000630000-memory.dmpFilesize
1024KB
-
memory/1820-300-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1820-26-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1820-3-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1820-5-0x0000000000530000-0x0000000000630000-memory.dmpFilesize
1024KB
-
memory/1820-7-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1956-335-0x000002916E260000-0x000002916E280000-memory.dmpFilesize
128KB
-
memory/1956-347-0x000002896B610000-0x000002896BD8A000-memory.dmpFilesize
7.5MB
-
memory/1956-337-0x000002916E670000-0x000002916E690000-memory.dmpFilesize
128KB
-
memory/1956-333-0x000002916E2A0000-0x000002916E2C0000-memory.dmpFilesize
128KB
-
memory/2000-15-0x0000000000760000-0x0000000000860000-memory.dmpFilesize
1024KB
-
memory/2000-14-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2000-31-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2000-104-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2040-351-0x0000000002BF0000-0x0000000002BF1000-memory.dmpFilesize
4KB
-
memory/2564-365-0x0000022D817A0000-0x0000022D817C0000-memory.dmpFilesize
128KB
-
memory/2564-361-0x0000022D81390000-0x0000022D813B0000-memory.dmpFilesize
128KB
-
memory/2564-359-0x0000022D813D0000-0x0000022D813F0000-memory.dmpFilesize
128KB
-
memory/2564-371-0x000002257E800000-0x000002257EF7A000-memory.dmpFilesize
7.5MB
-
memory/2712-287-0x00000199F5D70000-0x00000199F5D90000-memory.dmpFilesize
128KB
-
memory/2712-298-0x00000191F3000000-0x00000191F492F000-memory.dmpFilesize
25.2MB
-
memory/2712-289-0x00000199F6180000-0x00000199F61A0000-memory.dmpFilesize
128KB
-
memory/2712-284-0x00000199F5DB0000-0x00000199F5DD0000-memory.dmpFilesize
128KB
-
memory/2744-253-0x0000000004550000-0x0000000004551000-memory.dmpFilesize
4KB
-
memory/3488-23-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/3488-25-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/3488-24-0x0000000000650000-0x0000000000750000-memory.dmpFilesize
1024KB
-
memory/3932-248-0x00000000005B0000-0x00000000006B0000-memory.dmpFilesize
1024KB
-
memory/3932-103-0x00000000005B0000-0x00000000006B0000-memory.dmpFilesize
1024KB
-
memory/3932-102-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/4124-276-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/4600-272-0x000001E96BC00000-0x000001E96C37A000-memory.dmpFilesize
7.5MB
-
memory/4600-267-0x000001F16DB40000-0x000001F16DB60000-memory.dmpFilesize
128KB
-
memory/4600-261-0x000001F16D770000-0x000001F16D790000-memory.dmpFilesize
128KB
-
memory/4600-264-0x000001F16D730000-0x000001F16D750000-memory.dmpFilesize
128KB
-
memory/5252-323-0x0000023457000000-0x000002345777A000-memory.dmpFilesize
7.5MB
-
memory/5252-318-0x0000023C58E50000-0x0000023C58E70000-memory.dmpFilesize
128KB
-
memory/5252-315-0x0000023C58A50000-0x0000023C58A70000-memory.dmpFilesize
128KB
-
memory/5252-313-0x0000023C58A30000-0x0000023C58A50000-memory.dmpFilesize
128KB
-
memory/5252-311-0x0000023C58A70000-0x0000023C58A90000-memory.dmpFilesize
128KB
-
memory/5256-246-0x00000222A3000000-0x00000222A377A000-memory.dmpFilesize
7.5MB
-
memory/5256-238-0x0000022AA49D0000-0x0000022AA49F0000-memory.dmpFilesize
128KB
-
memory/5256-234-0x0000022AA45C0000-0x0000022AA45E0000-memory.dmpFilesize
128KB
-
memory/5256-231-0x0000022AA4600000-0x0000022AA4620000-memory.dmpFilesize
128KB
-
memory/5420-326-0x0000000004D70000-0x0000000004D71000-memory.dmpFilesize
4KB
-
memory/5516-303-0x0000000002300000-0x0000000002301000-memory.dmpFilesize
4KB
-
memory/5816-225-0x0000000003F60000-0x0000000003F61000-memory.dmpFilesize
4KB