Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 13:20
Static task
static1
Behavioral task
behavioral1
Sample
payment_invoice.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
payment_invoice.exe
Resource
win10v2004-20240412-en
General
-
Target
payment_invoice.exe
-
Size
3.0MB
-
MD5
af9695cf3142c1fe17e398bf452c290c
-
SHA1
295d6df899de93ff4835b067c31c502ce894d92e
-
SHA256
566a2a768b83757d7c2398bf9f1f84deef8bb4b238da9431fff343b262227c6b
-
SHA512
104579b73feecf2f7349fad6c0b13f04831192f1466a64ab6c9c5f7003a07923ca49ba22f6d2ab1ee894c2718c64a3c959091443573ed40045a1a013a09967e2
-
SSDEEP
49152:eE73wg9RmvKdLKXFxeLjwGh9riL9uoebQJ/aldMW62ZrqrGyIEpK:eEzb9RyXF8wc9WxAbQqB5Zur9s
Malware Config
Signatures
-
Detect ZGRat V1 35 IoCs
Processes:
resource yara_rule behavioral2/memory/2404-2-0x0000000005950000-0x0000000005C3C000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-5-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-6-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-8-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-10-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-12-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-14-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-16-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-20-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-18-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-22-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-24-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-28-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-26-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-30-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-32-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-34-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-36-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-38-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-40-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-42-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-44-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-46-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-48-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-50-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-52-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-54-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-60-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-58-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-62-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-66-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-68-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-64-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2404-56-0x0000000005950000-0x0000000005C36000-memory.dmp family_zgrat_v1 behavioral2/memory/2972-7183-0x0000000005620000-0x0000000005690000-memory.dmp family_zgrat_v1 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
Processes:
payment_invoice.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key opened \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook payment_invoice.exe Key queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook payment_invoice.exe Key opened \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook payment_invoice.exe Key queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook payment_invoice.exe Key queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook payment_invoice.exe Key queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook payment_invoice.exe Key opened \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook payment_invoice.exe Key opened \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key opened \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key opened \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook payment_invoice.exe Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe Key opened \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
payment_invoice.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\notepad = "C:\\Users\\Admin\\AppData\\Local\\notepad.exe" payment_invoice.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\payment_invoice = "C:\\Users\\Admin\\AppData\\Local\\Temp\\payment_invoice.exe" powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
payment_invoice.exedescription pid process target process PID 2404 set thread context of 2972 2404 payment_invoice.exe payment_invoice.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
payment_invoice.exepowershell.exepid process 2972 payment_invoice.exe 2972 payment_invoice.exe 2972 payment_invoice.exe 2972 payment_invoice.exe 3692 powershell.exe 3692 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
payment_invoice.exepayment_invoice.exepowershell.exedescription pid process Token: SeDebugPrivilege 2404 payment_invoice.exe Token: SeDebugPrivilege 2404 payment_invoice.exe Token: SeDebugPrivilege 2972 payment_invoice.exe Token: SeDebugPrivilege 3692 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
payment_invoice.exepayment_invoice.exedescription pid process target process PID 2404 wrote to memory of 2972 2404 payment_invoice.exe payment_invoice.exe PID 2404 wrote to memory of 2972 2404 payment_invoice.exe payment_invoice.exe PID 2404 wrote to memory of 2972 2404 payment_invoice.exe payment_invoice.exe PID 2404 wrote to memory of 2972 2404 payment_invoice.exe payment_invoice.exe PID 2404 wrote to memory of 2972 2404 payment_invoice.exe payment_invoice.exe PID 2404 wrote to memory of 2972 2404 payment_invoice.exe payment_invoice.exe PID 2404 wrote to memory of 2972 2404 payment_invoice.exe payment_invoice.exe PID 2404 wrote to memory of 2972 2404 payment_invoice.exe payment_invoice.exe PID 2972 wrote to memory of 3692 2972 payment_invoice.exe powershell.exe PID 2972 wrote to memory of 3692 2972 payment_invoice.exe powershell.exe PID 2972 wrote to memory of 3692 2972 payment_invoice.exe powershell.exe -
outlook_office_path 1 IoCs
Processes:
payment_invoice.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe -
outlook_win_path 1 IoCs
Processes:
payment_invoice.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 payment_invoice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\payment_invoice.exe"C:\Users\Admin\AppData\Local\Temp\payment_invoice.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payment_invoice.exe"C:\Users\Admin\AppData\Local\Temp\payment_invoice.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'payment_invoice' -Value '"C:\Users\Admin\AppData\Local\Temp\payment_invoice.exe"' -PropertyType 'String'3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\payment_invoice.exe.logFilesize
897B
MD58794b07aaa898d651ed54a7eaedcbedf
SHA129925a1bda66a60b6b33614e972477054fe74472
SHA2563bb6961012fe6ffaf5e1a154381bfd06b8be98eba20d01399a2214dd4a61abd5
SHA5122554230b0116f5b7798e373829b1eb19133d2377461e40a10971298a7ee29cde2bb5193c0dc2509e9ae5750eba3e578b4d545676ff3558279bfb2e187e4c469b
-
C:\Users\Admin\AppData\Local\Temp\Sfygeidkn.tmpdbFilesize
152KB
MD573bd1e15afb04648c24593e8ba13e983
SHA14dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91
SHA256aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b
SHA5126eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7
-
C:\Users\Admin\AppData\Local\Temp\Woqnt.tmpdbFilesize
124KB
MD59618e15b04a4ddb39ed6c496575f6f95
SHA11c28f8750e5555776b3c80b187c5d15a443a7412
SHA256a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
SHA512f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ntxa1hy0.hwu.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/2404-1-0x0000000000CF0000-0x0000000000FEA000-memory.dmpFilesize
3.0MB
-
memory/2404-0-0x00000000743E0000-0x0000000074B90000-memory.dmpFilesize
7.7MB
-
memory/2404-2-0x0000000005950000-0x0000000005C3C000-memory.dmpFilesize
2.9MB
-
memory/2404-3-0x0000000006360000-0x0000000006904000-memory.dmpFilesize
5.6MB
-
memory/2404-4-0x0000000005EC0000-0x0000000005F52000-memory.dmpFilesize
584KB
-
memory/2404-5-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-6-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-8-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-10-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-12-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-14-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-16-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-20-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-18-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-22-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-24-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-28-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-26-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-30-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-32-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-34-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-36-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-38-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-40-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-42-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-44-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-46-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-48-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-50-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-52-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-54-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-60-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-58-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-62-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-66-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-68-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-64-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-56-0x0000000005950000-0x0000000005C36000-memory.dmpFilesize
2.9MB
-
memory/2404-2657-0x00000000743E0000-0x0000000074B90000-memory.dmpFilesize
7.7MB
-
memory/2404-4886-0x0000000005940000-0x0000000005950000-memory.dmpFilesize
64KB
-
memory/2404-4887-0x0000000006060000-0x0000000006061000-memory.dmpFilesize
4KB
-
memory/2404-4888-0x0000000006910000-0x0000000006A38000-memory.dmpFilesize
1.2MB
-
memory/2404-4889-0x0000000006130000-0x000000000617C000-memory.dmpFilesize
304KB
-
memory/2404-4890-0x0000000006C10000-0x0000000006C76000-memory.dmpFilesize
408KB
-
memory/2404-4891-0x0000000005940000-0x0000000005950000-memory.dmpFilesize
64KB
-
memory/2404-4892-0x00000000014E0000-0x0000000001534000-memory.dmpFilesize
336KB
-
memory/2404-4898-0x00000000743E0000-0x0000000074B90000-memory.dmpFilesize
7.7MB
-
memory/2972-4897-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/2972-4899-0x00000000743E0000-0x0000000074B90000-memory.dmpFilesize
7.7MB
-
memory/2972-4900-0x00000000052B0000-0x00000000053C6000-memory.dmpFilesize
1.1MB
-
memory/2972-4901-0x00000000052A0000-0x00000000052B0000-memory.dmpFilesize
64KB
-
memory/2972-7182-0x00000000053E0000-0x000000000547E000-memory.dmpFilesize
632KB
-
memory/2972-7183-0x0000000005620000-0x0000000005690000-memory.dmpFilesize
448KB
-
memory/2972-7184-0x0000000005770000-0x000000000577A000-memory.dmpFilesize
40KB
-
memory/2972-7185-0x0000000006DE0000-0x0000000006E5A000-memory.dmpFilesize
488KB
-
memory/2972-7238-0x00000000743E0000-0x0000000074B90000-memory.dmpFilesize
7.7MB
-
memory/2972-7239-0x00000000052A0000-0x00000000052B0000-memory.dmpFilesize
64KB
-
memory/3692-7240-0x0000000004C30000-0x0000000004C66000-memory.dmpFilesize
216KB
-
memory/3692-7244-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/3692-7243-0x00000000052F0000-0x0000000005918000-memory.dmpFilesize
6.2MB
-
memory/3692-7242-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/3692-7241-0x00000000743E0000-0x0000000074B90000-memory.dmpFilesize
7.7MB
-
memory/3692-7245-0x0000000005A90000-0x0000000005AB2000-memory.dmpFilesize
136KB
-
memory/3692-7255-0x0000000005C30000-0x0000000005C96000-memory.dmpFilesize
408KB
-
memory/3692-7256-0x0000000005D80000-0x00000000060D4000-memory.dmpFilesize
3.3MB
-
memory/3692-7257-0x0000000006200000-0x000000000621E000-memory.dmpFilesize
120KB
-
memory/3692-7258-0x0000000006220000-0x000000000626C000-memory.dmpFilesize
304KB
-
memory/3692-7259-0x00000000071A0000-0x0000000007236000-memory.dmpFilesize
600KB
-
memory/3692-7260-0x00000000066F0000-0x000000000670A000-memory.dmpFilesize
104KB
-
memory/3692-7261-0x0000000006740000-0x0000000006762000-memory.dmpFilesize
136KB
-
memory/3692-7264-0x00000000743E0000-0x0000000074B90000-memory.dmpFilesize
7.7MB