Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 16:42
Static task
static1
Behavioral task
behavioral1
Sample
svchost.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
svchost.exe
Resource
win10v2004-20240419-en
General
-
Target
svchost.exe
-
Size
749KB
-
MD5
a6479dae68115fad0a37c5fb33becf99
-
SHA1
398663b27c9297a884c800aa64916c976638a036
-
SHA256
441e25c74a8c10b804e0c7f2ffa803b1055c8cddec79e7d70270efb4857e18eb
-
SHA512
aa3dc1b98aa53708a2b9834fb3dc0585ae5deffa168fe65d2aff3d80f4b0849c41d3cbd37e306ac6bfbfe5689e8c625828c93453fd21d5f7ecc0b16ad85f7452
-
SSDEEP
12288:Cv2E2CrJF9srANfrX8QoN2e9YxzKapgg3e8SIa+9j8CfL6qd8kAXDbvDYD:jE2CrJdNfjrfJ+aX3e8DaOj8wL6e
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
svchost.exeIdle.exeIdle.exeIdle.exeIdle.exeIdle.exeIdle.exeIdle.exeIdle.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation svchost.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation Idle.exe -
Executes dropped EXE 8 IoCs
Processes:
Idle.exeIdle.exeIdle.exeIdle.exeIdle.exeIdle.exeIdle.exeIdle.exepid process 3748 Idle.exe 4536 Idle.exe 5104 Idle.exe 1404 Idle.exe 1532 Idle.exe 2228 Idle.exe 3916 Idle.exe 4804 Idle.exe -
Drops file in Program Files directory 3 IoCs
Processes:
svchost.exedescription ioc process File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\System.exe svchost.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\System.exe svchost.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\27d1bcfc3c54e0 svchost.exe -
Drops file in Windows directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\Globalization\Idle.exe svchost.exe File created C:\Windows\Globalization\6ccacd8608530f svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
Idle.exeIdle.exesvchost.exeIdle.exeIdle.exeIdle.exeIdle.exeIdle.exeIdle.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings svchost.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings Idle.exe -
Runs ping.exe 1 TTPs 6 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEpid process 1392 PING.EXE 4460 PING.EXE 1816 PING.EXE 3644 PING.EXE 1172 PING.EXE 3100 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exeIdle.exepid process 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 264 svchost.exe 3748 Idle.exe 3748 Idle.exe 3748 Idle.exe 3748 Idle.exe 3748 Idle.exe 3748 Idle.exe 3748 Idle.exe 3748 Idle.exe 3748 Idle.exe 3748 Idle.exe 3748 Idle.exe 3748 Idle.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
svchost.exeIdle.exeIdle.exeIdle.exeIdle.exeIdle.exeIdle.exeIdle.exeIdle.exedescription pid process Token: SeDebugPrivilege 264 svchost.exe Token: SeDebugPrivilege 3748 Idle.exe Token: SeDebugPrivilege 4536 Idle.exe Token: SeDebugPrivilege 5104 Idle.exe Token: SeDebugPrivilege 1404 Idle.exe Token: SeDebugPrivilege 1532 Idle.exe Token: SeDebugPrivilege 2228 Idle.exe Token: SeDebugPrivilege 3916 Idle.exe Token: SeDebugPrivilege 4804 Idle.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
svchost.execmd.exeIdle.execmd.exeIdle.execmd.exeIdle.execmd.exeIdle.execmd.exeIdle.execmd.exeIdle.execmd.exeIdle.execmd.exedescription pid process target process PID 264 wrote to memory of 4644 264 svchost.exe cmd.exe PID 264 wrote to memory of 4644 264 svchost.exe cmd.exe PID 4644 wrote to memory of 1536 4644 cmd.exe chcp.com PID 4644 wrote to memory of 1536 4644 cmd.exe chcp.com PID 4644 wrote to memory of 3396 4644 cmd.exe w32tm.exe PID 4644 wrote to memory of 3396 4644 cmd.exe w32tm.exe PID 4644 wrote to memory of 3748 4644 cmd.exe Idle.exe PID 4644 wrote to memory of 3748 4644 cmd.exe Idle.exe PID 3748 wrote to memory of 4312 3748 Idle.exe cmd.exe PID 3748 wrote to memory of 4312 3748 Idle.exe cmd.exe PID 4312 wrote to memory of 3204 4312 cmd.exe chcp.com PID 4312 wrote to memory of 3204 4312 cmd.exe chcp.com PID 4312 wrote to memory of 1392 4312 cmd.exe PING.EXE PID 4312 wrote to memory of 1392 4312 cmd.exe PING.EXE PID 4312 wrote to memory of 4536 4312 cmd.exe Idle.exe PID 4312 wrote to memory of 4536 4312 cmd.exe Idle.exe PID 4536 wrote to memory of 3600 4536 Idle.exe cmd.exe PID 4536 wrote to memory of 3600 4536 Idle.exe cmd.exe PID 3600 wrote to memory of 1616 3600 cmd.exe chcp.com PID 3600 wrote to memory of 1616 3600 cmd.exe chcp.com PID 3600 wrote to memory of 1988 3600 cmd.exe w32tm.exe PID 3600 wrote to memory of 1988 3600 cmd.exe w32tm.exe PID 3600 wrote to memory of 5104 3600 cmd.exe Idle.exe PID 3600 wrote to memory of 5104 3600 cmd.exe Idle.exe PID 5104 wrote to memory of 1724 5104 Idle.exe cmd.exe PID 5104 wrote to memory of 1724 5104 Idle.exe cmd.exe PID 1724 wrote to memory of 4248 1724 cmd.exe chcp.com PID 1724 wrote to memory of 4248 1724 cmd.exe chcp.com PID 1724 wrote to memory of 4460 1724 cmd.exe PING.EXE PID 1724 wrote to memory of 4460 1724 cmd.exe PING.EXE PID 1724 wrote to memory of 1404 1724 cmd.exe Idle.exe PID 1724 wrote to memory of 1404 1724 cmd.exe Idle.exe PID 1404 wrote to memory of 2388 1404 Idle.exe cmd.exe PID 1404 wrote to memory of 2388 1404 Idle.exe cmd.exe PID 2388 wrote to memory of 4360 2388 cmd.exe chcp.com PID 2388 wrote to memory of 4360 2388 cmd.exe chcp.com PID 2388 wrote to memory of 1816 2388 cmd.exe PING.EXE PID 2388 wrote to memory of 1816 2388 cmd.exe PING.EXE PID 2388 wrote to memory of 1532 2388 cmd.exe Idle.exe PID 2388 wrote to memory of 1532 2388 cmd.exe Idle.exe PID 1532 wrote to memory of 2520 1532 Idle.exe cmd.exe PID 1532 wrote to memory of 2520 1532 Idle.exe cmd.exe PID 2520 wrote to memory of 4832 2520 cmd.exe chcp.com PID 2520 wrote to memory of 4832 2520 cmd.exe chcp.com PID 2520 wrote to memory of 4472 2520 cmd.exe w32tm.exe PID 2520 wrote to memory of 4472 2520 cmd.exe w32tm.exe PID 2520 wrote to memory of 2228 2520 cmd.exe Idle.exe PID 2520 wrote to memory of 2228 2520 cmd.exe Idle.exe PID 2228 wrote to memory of 4420 2228 Idle.exe cmd.exe PID 2228 wrote to memory of 4420 2228 Idle.exe cmd.exe PID 4420 wrote to memory of 4928 4420 cmd.exe chcp.com PID 4420 wrote to memory of 4928 4420 cmd.exe chcp.com PID 4420 wrote to memory of 3644 4420 cmd.exe PING.EXE PID 4420 wrote to memory of 3644 4420 cmd.exe PING.EXE PID 4420 wrote to memory of 3916 4420 cmd.exe Idle.exe PID 4420 wrote to memory of 3916 4420 cmd.exe Idle.exe PID 3916 wrote to memory of 4480 3916 Idle.exe cmd.exe PID 3916 wrote to memory of 4480 3916 Idle.exe cmd.exe PID 4480 wrote to memory of 2460 4480 cmd.exe chcp.com PID 4480 wrote to memory of 2460 4480 cmd.exe chcp.com PID 4480 wrote to memory of 1172 4480 cmd.exe PING.EXE PID 4480 wrote to memory of 1172 4480 cmd.exe PING.EXE PID 4480 wrote to memory of 4804 4480 cmd.exe Idle.exe PID 4480 wrote to memory of 4804 4480 cmd.exe Idle.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FC0UcdkYVv.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:1536
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:3396
-
C:\Windows\Globalization\Idle.exe"C:\Windows\Globalization\Idle.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\W1ZleRNNoI.bat"4⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\system32\chcp.comchcp 650015⤵PID:3204
-
C:\Windows\system32\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
PID:1392 -
C:\Windows\Globalization\Idle.exe"C:\Windows\Globalization\Idle.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NiOMBGhh72.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\system32\chcp.comchcp 650017⤵PID:1616
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:1988
-
C:\Windows\Globalization\Idle.exe"C:\Windows\Globalization\Idle.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\W1ZleRNNoI.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\system32\chcp.comchcp 650019⤵PID:4248
-
C:\Windows\system32\PING.EXEping -n 10 localhost9⤵
- Runs ping.exe
PID:4460 -
C:\Windows\Globalization\Idle.exe"C:\Windows\Globalization\Idle.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ruhG0OcHGE.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\system32\chcp.comchcp 6500111⤵PID:4360
-
C:\Windows\system32\PING.EXEping -n 10 localhost11⤵
- Runs ping.exe
PID:1816 -
C:\Windows\Globalization\Idle.exe"C:\Windows\Globalization\Idle.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NiOMBGhh72.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\system32\chcp.comchcp 6500113⤵PID:4832
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:4472
-
C:\Windows\Globalization\Idle.exe"C:\Windows\Globalization\Idle.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OwDUg2gYJx.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\system32\chcp.comchcp 6500115⤵PID:4928
-
C:\Windows\system32\PING.EXEping -n 10 localhost15⤵
- Runs ping.exe
PID:3644 -
C:\Windows\Globalization\Idle.exe"C:\Windows\Globalization\Idle.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ruhG0OcHGE.bat"16⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\system32\chcp.comchcp 6500117⤵PID:2460
-
C:\Windows\system32\PING.EXEping -n 10 localhost17⤵
- Runs ping.exe
PID:1172 -
C:\Windows\Globalization\Idle.exe"C:\Windows\Globalization\Idle.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4804 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qgs8WdcQ4J.bat"18⤵PID:3584
-
C:\Windows\system32\chcp.comchcp 6500119⤵PID:1420
-
C:\Windows\system32\PING.EXEping -n 10 localhost19⤵
- Runs ping.exe
PID:3100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Idle.exe.logFilesize
1KB
MD56060462f0131e17459549582a33147bf
SHA1ca110cc4856a558e2917bd4475456c31151ab819
SHA2560adc7638b7470f67db0dbc5309aaf8bf99745f00f30a843eec5038410b828e5c
SHA512d6c50b7c0439afb5328ac0ab49b186a2deba356d52200860122c30f291987cbe79d4d3ae7d60a24f2bcefb2125f3748f67ee45ff274da6bcf9b4decff3f3bdef
-
C:\Users\Admin\AppData\Local\Temp\FC0UcdkYVv.batFilesize
209B
MD5981f1f4817f90724a1fb63b0673391f8
SHA1ec86725689b01d3597c66c82c2de862952fce6ca
SHA2567ed1baa91e710b8c444d9f81f6b4d61a0c5aa21a763db6126354d228ca7a3013
SHA51268f987ff247eedbcb64cb1b1c0d3b35913ccb9375633ff531ad8ee1c3c64ff1a9f4dbdc5c3d54221d91efaa06a02bb323c403245ca6920385a4118125aca25f3
-
C:\Users\Admin\AppData\Local\Temp\NiOMBGhh72.batFilesize
209B
MD5e7ec4a0f430226cac7e808934c79ac49
SHA1fcefdc394bea62585303d3926c4e56c3cb439028
SHA256c9e0d9297b9401c2c89cc8392e903453e9bf749149f8bb262b40492e36dcd704
SHA5127733d50061d7b7db9ddc029f643d82f2e5bd828d474224e2f40be42c929bbbe46eafb54f1645560280c751849b5b4109dabdc53c310a32adc508e922e8acc345
-
C:\Users\Admin\AppData\Local\Temp\OwDUg2gYJx.batFilesize
161B
MD54f61dc5e560b473ebea617c7182bb350
SHA16217fa56e63f096d3c7fc94d2a3eca539fa3a4a5
SHA2562e5504c469878807b7446a93b785df79f60fe7eb3d9e3e706a72cac27dd38458
SHA5126fd8c9a1ed73bc61e31bd678716aa48593904fbcc1bd7dfc665a45287de8ca9f08d06a954e2da9817e3c64a49748416cc688465bcddd1be161a898cb33c578f8
-
C:\Users\Admin\AppData\Local\Temp\W1ZleRNNoI.batFilesize
161B
MD5f147400928880e56c2d49f43e5a68ab5
SHA17c0a95c4ce36ff19b82bd3cd5cd2ce2b26f4890a
SHA256aaeeb1b212f125f414e77299aec9a9d5d631e3d81a3b23dd93e92008cd4c0657
SHA51246aa61a637ea6eef591ff9d654dff5de8eaf3c34e4b051bae57c80aced38599a7323b37a6762b8991d2f518c8b33127471228efd380ba0fb3a1a4f64cf6b5e28
-
C:\Users\Admin\AppData\Local\Temp\qgs8WdcQ4J.batFilesize
161B
MD5d5f53365035871ede950570a9287d1c4
SHA156db1770a2581ea5b47318560bef80fe7e07c38f
SHA256df2d1d48614841c0ceb3776f26cf96067e7cfa84c99f655b6a895cc304061b36
SHA5127720e7fd401c9184b47ea283e29798ffb8c08878da6c815647c7f0e1c1c0e43effa749b7b8e97f57cb7c02cb1f6a59edd0be4dd0145c3b9a4320a3c71393d6ce
-
C:\Users\Admin\AppData\Local\Temp\ruhG0OcHGE.batFilesize
161B
MD5f5b27f037012cbc66a63e8e04981ba3b
SHA1e8c92926e16afa132cb9e7070776440e1cc168ff
SHA2567e9c2407930c0c964dd37783272a51097ddbc34c6d79b834d6b0d0fd603c305b
SHA512367b3d42d87350994390b75f15e000a22dc1d4ba3b755ddaf93965c9cbfd163a32a1185b2b4c7232d60142638092e5402de2066c0421a57b5eb8329c2f3f9961
-
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\RuntimeBroker.exeFilesize
749KB
MD5a6479dae68115fad0a37c5fb33becf99
SHA1398663b27c9297a884c800aa64916c976638a036
SHA256441e25c74a8c10b804e0c7f2ffa803b1055c8cddec79e7d70270efb4857e18eb
SHA512aa3dc1b98aa53708a2b9834fb3dc0585ae5deffa168fe65d2aff3d80f4b0849c41d3cbd37e306ac6bfbfe5689e8c625828c93453fd21d5f7ecc0b16ad85f7452
-
memory/264-30-0x00007FFE42250000-0x00007FFE42269000-memory.dmpFilesize
100KB
-
memory/264-8-0x00007FFE4FC30000-0x00007FFE4FC31000-memory.dmpFilesize
4KB
-
memory/264-12-0x000001824F000000-0x000001824F018000-memory.dmpFilesize
96KB
-
memory/264-31-0x00007FFE33BC0000-0x00007FFE34681000-memory.dmpFilesize
10.8MB
-
memory/264-0-0x0000018233550000-0x0000018233612000-memory.dmpFilesize
776KB
-
memory/264-29-0x00007FFE51BF0000-0x00007FFE51DE5000-memory.dmpFilesize
2.0MB
-
memory/264-9-0x000001824F050000-0x000001824F0A0000-memory.dmpFilesize
320KB
-
memory/264-1-0x000001824DCD0000-0x000001824DD8E000-memory.dmpFilesize
760KB
-
memory/264-2-0x00007FFE33BC0000-0x00007FFE34681000-memory.dmpFilesize
10.8MB
-
memory/264-4-0x000001824DDA0000-0x000001824DDAE000-memory.dmpFilesize
56KB
-
memory/264-5-0x00007FFE4FC40000-0x00007FFE4FC41000-memory.dmpFilesize
4KB
-
memory/264-7-0x000001824DDD0000-0x000001824DDEC000-memory.dmpFilesize
112KB
-
memory/264-10-0x00007FFE4FC20000-0x00007FFE4FC21000-memory.dmpFilesize
4KB
-
memory/3748-48-0x00007FFE33BC0000-0x00007FFE34681000-memory.dmpFilesize
10.8MB
-
memory/3748-49-0x00007FFE51BF0000-0x00007FFE51DE5000-memory.dmpFilesize
2.0MB
-
memory/3748-47-0x00007FFE42250000-0x00007FFE42269000-memory.dmpFilesize
100KB
-
memory/3748-41-0x00007FFE51BF0000-0x00007FFE51DE5000-memory.dmpFilesize
2.0MB
-
memory/3748-37-0x000001B672E80000-0x000001B672E90000-memory.dmpFilesize
64KB
-
memory/3748-36-0x00007FFE33BC0000-0x00007FFE34681000-memory.dmpFilesize
10.8MB