Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 12:06
Static task
static1
Behavioral task
behavioral1
Sample
7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe
Resource
win7-20240221-en
General
-
Target
7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe
-
Size
1.0MB
-
MD5
61a3d983a1fde813204b8f6f13842163
-
SHA1
336a3a59b782b49c2253bd0afeefdb43b24f70b6
-
SHA256
7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda
-
SHA512
a6cdbc9faae3f9d989d9c5f165dd56c3822997e463bbc924b61067fb1b1719b14ec8d60a4046ade564bdc310dd6177dfa8e84d04a0ac9226cd3f1cfdeb2adbe9
-
SSDEEP
12288:nvW7y+BSA6ZcQZlQM/vK9joU9FL5MigDv/A1S5Ag5zybvDMWCFBiVr3bmpXptcv1:nuJ6yQZnKJoWFGiAES5afueDypXfcv1
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/1548-6-0x00000000058B0000-0x00000000058D8000-memory.dmp agile_net -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exedescription ioc process File opened (read-only) \??\q: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\r: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\u: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\w: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\z: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\g: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\i: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\k: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\l: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\v: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\x: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\a: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\j: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\n: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\t: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\y: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\b: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\m: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\o: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\p: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\s: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\e: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe File opened (read-only) \??\h: 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe -
AutoIT Executable 24 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/2896-12-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-14-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-15-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-17-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-18-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-20-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-25-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-24-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-28-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-32-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-37-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-36-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-44-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-48-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-52-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-53-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-56-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-60-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-64-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-69-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-68-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-72-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-76-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe behavioral2/memory/2896-86-0x0000000000400000-0x00000000004E2000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exedescription pid process target process PID 1548 set thread context of 2896 1548 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exepid process 1548 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe 1548 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exedescription pid process Token: SeDebugPrivilege 1548 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exedescription pid process target process PID 1548 wrote to memory of 2896 1548 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe PID 1548 wrote to memory of 2896 1548 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe PID 1548 wrote to memory of 2896 1548 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe PID 1548 wrote to memory of 2896 1548 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe PID 1548 wrote to memory of 2896 1548 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe PID 1548 wrote to memory of 2896 1548 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe PID 1548 wrote to memory of 2896 1548 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe PID 1548 wrote to memory of 2896 1548 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe PID 1548 wrote to memory of 2896 1548 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe PID 1548 wrote to memory of 2896 1548 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe PID 2896 wrote to memory of 3784 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 3784 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 3784 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 2084 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 2084 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 2084 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 456 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 456 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 456 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 1064 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 1064 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 1064 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 5088 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 5088 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 5088 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 4848 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 4848 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 4848 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 1008 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 1008 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 1008 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 2264 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 2264 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 2264 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 4384 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 4384 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 4384 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 4048 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 4048 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 4048 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 3144 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 3144 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 3144 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 2688 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 2688 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 2688 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 3708 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 3708 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 3708 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 4064 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 4064 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 4064 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 1192 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 1192 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 1192 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 4988 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 4988 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 4988 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 1436 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 1436 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe PID 2896 wrote to memory of 1436 2896 7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe"C:\Users\Admin\AppData\Local\Temp\7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe"C:\Users\Admin\AppData\Local\Temp\7963f8606e4c0e7502a813969a04e1266e7cd20708bef19c338e8933c1b85eda.exe"2⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.doc" /S /B /A3⤵PID:3784
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pdf" /S /B /A3⤵PID:2084
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppt" /S /B /A3⤵PID:456
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A3⤵PID:1064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.xl" /S /B /A3⤵PID:5088
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.csv" /S /B /A3⤵PID:4848
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rtf" /S /B /A3⤵PID:1008
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.dot" /S /B /A3⤵PID:2264
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.mdb" /S /B /A3⤵PID:4384
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.accdb" /S /B /A3⤵PID:4048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pot" /S /B /A3⤵PID:3144
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.pps" /S /B /A3⤵PID:2688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.ppa" /S /B /A3⤵PID:3708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.rar" /S /B /A3⤵PID:4064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.zip" /S /B /A3⤵PID:1192
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.tar" /S /B /A3⤵PID:4988
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /U /C DIR "\Users\Admin\*.7z" /S /B /A3⤵PID:1436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1548-16-0x0000000074D90000-0x0000000075540000-memory.dmpFilesize
7.7MB
-
memory/1548-0-0x0000000000750000-0x0000000000858000-memory.dmpFilesize
1.0MB
-
memory/1548-2-0x00000000051F0000-0x000000000528C000-memory.dmpFilesize
624KB
-
memory/1548-3-0x00000000058E0000-0x0000000005E84000-memory.dmpFilesize
5.6MB
-
memory/1548-4-0x00000000053D0000-0x0000000005462000-memory.dmpFilesize
584KB
-
memory/1548-5-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/1548-6-0x00000000058B0000-0x00000000058D8000-memory.dmpFilesize
160KB
-
memory/1548-7-0x0000000006980000-0x00000000069E6000-memory.dmpFilesize
408KB
-
memory/1548-8-0x0000000006940000-0x0000000006962000-memory.dmpFilesize
136KB
-
memory/1548-9-0x00000000052E0000-0x00000000052F0000-memory.dmpFilesize
64KB
-
memory/1548-10-0x00000000071D0000-0x00000000071E4000-memory.dmpFilesize
80KB
-
memory/1548-11-0x00000000097F0000-0x00000000097F6000-memory.dmpFilesize
24KB
-
memory/1548-1-0x0000000074D90000-0x0000000075540000-memory.dmpFilesize
7.7MB
-
memory/2896-20-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-36-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-14-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-17-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-18-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-12-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-25-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-24-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-28-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-32-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-37-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-15-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-44-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-48-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-52-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-53-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-56-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-60-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-64-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-69-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-68-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-72-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-76-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/2896-86-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB