Analysis
-
max time kernel
4s -
max time network
60s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-03-2024 23:02
Behavioral task
behavioral1
Sample
9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe
Resource
win10v2004-20240226-en
General
-
Target
9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe
-
Size
2.0MB
-
MD5
7c35f4679f0af25a874454f9faaf1eae
-
SHA1
55d7736cbf4a85a8c600371e6dde14c244f2cc98
-
SHA256
9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2
-
SHA512
715b65e9368cf3fdee931c8a8ebda89a115ed62e94b680ba96eba25ba1de3194f5b0b37827a0eed4fb5c8580801f1a59a20250b032d1be76710fa80bbe2811a9
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYD:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Yt
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar behavioral2/memory/4996-31-0x0000000000380000-0x00000000003DE000-memory.dmp family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar -
Detects Windows executables referencing non-Windows User-Agents 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/4996-31-0x0000000000380000-0x00000000003DE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects executables containing common artifacts observed in infostealers 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe INDICATOR_SUSPICIOUS_GENInfoStealer behavioral2/memory/4996-31-0x0000000000380000-0x00000000003DE000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe INDICATOR_SUSPICIOUS_GENInfoStealer -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe -
Executes dropped EXE 3 IoCs
Processes:
vnc.exewindef.exewinsock.exepid process 2288 vnc.exe 4996 windef.exe 2648 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exedescription ioc process File opened (read-only) \??\p: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\q: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\s: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\a: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\l: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\n: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\t: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\u: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\w: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\x: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\y: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\b: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\h: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\i: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\m: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\o: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\r: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\e: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\j: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\k: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\v: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\z: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe File opened (read-only) \??\g: 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 18 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exedescription pid process target process PID 2824 set thread context of 2844 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1388 2288 WerFault.exe vnc.exe 2152 2648 WerFault.exe winsock.exe 3368 4828 WerFault.exe vnc.exe -
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4044 schtasks.exe 3204 schtasks.exe 3616 schtasks.exe 3912 schtasks.exe 964 schtasks.exe 3364 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exepid process 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
windef.exewinsock.exedescription pid process Token: SeDebugPrivilege 4996 windef.exe Token: SeDebugPrivilege 2648 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
winsock.exepid process 2648 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exevnc.exewindef.exewinsock.exedescription pid process target process PID 2824 wrote to memory of 2288 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe vnc.exe PID 2824 wrote to memory of 2288 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe vnc.exe PID 2824 wrote to memory of 2288 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe vnc.exe PID 2288 wrote to memory of 2452 2288 vnc.exe svchost.exe PID 2288 wrote to memory of 2452 2288 vnc.exe svchost.exe PID 2824 wrote to memory of 4996 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe windef.exe PID 2824 wrote to memory of 4996 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe windef.exe PID 2824 wrote to memory of 4996 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe windef.exe PID 2288 wrote to memory of 2452 2288 vnc.exe svchost.exe PID 2824 wrote to memory of 2844 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe PID 2824 wrote to memory of 2844 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe PID 2824 wrote to memory of 2844 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe PID 2824 wrote to memory of 2844 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe PID 2824 wrote to memory of 2844 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe PID 2824 wrote to memory of 3616 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe schtasks.exe PID 2824 wrote to memory of 3616 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe schtasks.exe PID 2824 wrote to memory of 3616 2824 9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe schtasks.exe PID 4996 wrote to memory of 3912 4996 windef.exe schtasks.exe PID 4996 wrote to memory of 3912 4996 windef.exe schtasks.exe PID 4996 wrote to memory of 3912 4996 windef.exe schtasks.exe PID 4996 wrote to memory of 2648 4996 windef.exe winsock.exe PID 4996 wrote to memory of 2648 4996 windef.exe winsock.exe PID 4996 wrote to memory of 2648 4996 windef.exe winsock.exe PID 2648 wrote to memory of 964 2648 winsock.exe schtasks.exe PID 2648 wrote to memory of 964 2648 winsock.exe schtasks.exe PID 2648 wrote to memory of 964 2648 winsock.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe"C:\Users\Admin\AppData\Local\Temp\9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 5563⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Qaue0pRiSfbd.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 22724⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe"C:\Users\Admin\AppData\Local\Temp\9da0fc554b79cb7e6eb8209714a2f49a6e65c37d12945deba5aa8db19a3fc6e2.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2288 -ip 22881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2648 -ip 26481⤵
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 5203⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4828 -ip 48281⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\windef.exe.logFilesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
C:\Users\Admin\AppData\Local\Temp\Qaue0pRiSfbd.batFilesize
208B
MD5cd92c2e18f236e7fc1db50723451cf4f
SHA1b1f16de92aa991a426262e350b5e84c2601683a8
SHA256970b54cd5a52fdd3d7be5b40a180e06355248fac0512eeddc8c879a17fcc73d6
SHA51255ee19da8562a767116fee595fe76ac607194fd79b4ec86ea5cf2d10ea3e8a5fb7d944eed138d9d725c22ee874e7c5c59d79759ecc4753f1e0a4a78d13ecd0cd
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Roaming\Logs\03-26-2024Filesize
224B
MD5580ae1042232f9920c63ac6512faa3ca
SHA151fd3ce5b8512d589859b982b9a922ceecd7d284
SHA2562ccb63b35fd5204063c1ed7a0943982a894c7d035a7d0024aa655b1ee447a364
SHA512395d625e37bb5db5b07da48b392f83bb869051585f92a8440bc040b9ad5bb2d9052b5612fa3f41a775b19031f2351fe8981c89e9cfa04ecbc2610e990254f0ea
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeFilesize
2.0MB
MD50bb901b23e999162a5f22e87f5e1c3a9
SHA16b398ea80b11756b1308a93a582ee34f155eff8a
SHA2565fbc626caaca981c433bf360a207350ed6328a35d373d439c879f44f8a1d660c
SHA51279751242b16b354f6c3bc4cd32ed85f7fc6e950f2f7da1873a5c1e5f5d4b135880c95225d6fbaf190dce39344dc87ee778bc9cbd9ff7b49f2324e19ae45f35e4
-
memory/1216-89-0x0000000000A80000-0x0000000000AA0000-memory.dmpFilesize
128KB
-
memory/1216-80-0x0000000000A80000-0x0000000000AA0000-memory.dmpFilesize
128KB
-
memory/1460-99-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/1460-98-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/2648-47-0x00000000057A0000-0x00000000057B0000-memory.dmpFilesize
64KB
-
memory/2648-46-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/2648-49-0x0000000006D80000-0x0000000006D8A000-memory.dmpFilesize
40KB
-
memory/2648-50-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/2648-51-0x00000000057A0000-0x00000000057B0000-memory.dmpFilesize
64KB
-
memory/2648-56-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/2824-21-0x00000000041E0000-0x00000000041E1000-memory.dmpFilesize
4KB
-
memory/2844-32-0x00000000008F0000-0x0000000000910000-memory.dmpFilesize
128KB
-
memory/2844-18-0x00000000008F0000-0x0000000000910000-memory.dmpFilesize
128KB
-
memory/4416-95-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/4416-103-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/4628-79-0x0000000004AF0000-0x0000000004B00000-memory.dmpFilesize
64KB
-
memory/4628-78-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/4628-96-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/4996-45-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB
-
memory/4996-38-0x0000000005F10000-0x0000000005F4C000-memory.dmpFilesize
240KB
-
memory/4996-37-0x00000000059D0000-0x00000000059E2000-memory.dmpFilesize
72KB
-
memory/4996-36-0x0000000004C90000-0x0000000004CF6000-memory.dmpFilesize
408KB
-
memory/4996-35-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/4996-34-0x0000000004D30000-0x0000000004DC2000-memory.dmpFilesize
584KB
-
memory/4996-33-0x00000000052E0000-0x0000000005884000-memory.dmpFilesize
5.6MB
-
memory/4996-31-0x0000000000380000-0x00000000003DE000-memory.dmpFilesize
376KB
-
memory/4996-28-0x00000000732D0000-0x0000000073A80000-memory.dmpFilesize
7.7MB