Analysis
-
max time kernel
117s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 07:00
Behavioral task
behavioral1
Sample
21d6b63327f1f57348899d5992d43102.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
21d6b63327f1f57348899d5992d43102.exe
Resource
win10v2004-20240419-en
General
-
Target
21d6b63327f1f57348899d5992d43102.exe
-
Size
124KB
-
MD5
21d6b63327f1f57348899d5992d43102
-
SHA1
c1f72ac6dedd7817c094c41df3d9dd505675d93d
-
SHA256
a5d024a0be4a491e5004b9c4c1343fc172e210cc1bf78641d512c6fd9ec41f62
-
SHA512
0af75df0a6dfe44b33b03f4dc716c48db3a479f438fe0a9332b82cc832ffdb2d56254b073bfb67feed8c0f5516ede72a93f1de70e62c8ae9e9e9fd09f600d1cf
-
SSDEEP
1536:IFaM5mTEVEQnqrZM5V3J6fgNWbMb+KR0Nc8QsJq3:iaMqEVEUWZulJGgNAe0Nc8QsC
Malware Config
Extracted
metasploit
windows/reverse_tcp
86.104.74.31:9981
Extracted
metasploit
windows/reverse_winhttp
https://86.104.74.31:2526/-zHGcUeWz9B__H79GcT_vw6fiq3ZfacoOpiicZAQdFSopE75-m6Wh8pyNy-ksrVkep8OUw6qQpG4yOZsQ6Mj6I-cfdAG
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
XMRig Miner payload 2 IoCs
Processes:
resource yara_rule \Windows\System32\WindowsUpdate.exe family_xmrig \Windows\System32\WindowsUpdate.exe xmrig -
Downloads MZ/PE file
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
services.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinRing0_1_2_0\ImagePath = "\\??\\c:\\windows\\system32\\WinRing0x64.sys" services.exe -
Executes dropped EXE 5 IoCs
Processes:
IOrJ.exeIOrJ.exeIOrJ.exeWindowsUpdate.exePython-deamon.exepid process 1912 IOrJ.exe 1992 IOrJ.exe 2296 IOrJ.exe 676 WindowsUpdate.exe 1616 Python-deamon.exe -
Loads dropped DLL 5 IoCs
Processes:
cmd.exeIOrJ.exeservices.exepid process 1220 cmd.exe 1220 cmd.exe 1992 IOrJ.exe 464 services.exe 1284 -
Drops file in System32 directory 11 IoCs
Processes:
IOrJ.exeservices.exeWindowsUpdate.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 IOrJ.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 IOrJ.exe File created C:\Windows\System32\config.json services.exe File opened for modification C:\Windows\System32\loger2.log WindowsUpdate.exe File opened for modification \??\c:\windows\system32\config.json WindowsUpdate.exe File created \??\c:\windows\system32\patch-updated.txt services.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 IOrJ.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 IOrJ.exe File created C:\Windows\System32\WinRing0x64.sys services.exe File created \??\c:\windows\system32\WindowsUpdate.exe services.exe File created \??\c:\windows\system32\Python-deamon.exe services.exe -
Detects Pyinstaller 1 IoCs
Processes:
resource yara_rule C:\Windows\System32\Python-deamon.exe pyinstaller -
Modifies data under HKEY_USERS 42 IoCs
Processes:
IOrJ.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs IOrJ.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates IOrJ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs IOrJ.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
21d6b63327f1f57348899d5992d43102.exeservices.exepid process 2032 21d6b63327f1f57348899d5992d43102.exe 2032 21d6b63327f1f57348899d5992d43102.exe 464 services.exe 464 services.exe 464 services.exe 464 services.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
services.exepid process 464 services.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
21d6b63327f1f57348899d5992d43102.exeservices.exeWindowsUpdate.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeAuditPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeBackupPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeChangeNotifyPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeCreateGlobalPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeCreatePagefilePrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeCreatePermanentPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: 35 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeCreateTokenPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeDebugPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: 0 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeEnableDelegationPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeImpersonatePrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeIncBasePriorityPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeIncreaseQuotaPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: 33 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeLoadDriverPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeLockMemoryPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeMachineAccountPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeManageVolumePrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeProfSingleProcessPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: 32 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeRemoteShutdownPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeRestorePrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeSecurityPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeShutdownPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeSyncAgentPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeSystemEnvironmentPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeSystemProfilePrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeSystemtimePrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeTakeOwnershipPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeTcbPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: 34 2032 21d6b63327f1f57348899d5992d43102.exe Token: 31 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeUndockPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: 0 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeDebugPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeDebugPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeDebugPrivilege 2032 21d6b63327f1f57348899d5992d43102.exe Token: SeDebugPrivilege 464 services.exe Token: SeDebugPrivilege 464 services.exe Token: SeDebugPrivilege 464 services.exe Token: SeDebugPrivilege 464 services.exe Token: SeLockMemoryPrivilege 676 WindowsUpdate.exe Token: SeLoadDriverPrivilege 464 services.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WindowsUpdate.exepid process 676 WindowsUpdate.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
services.exepid process 464 services.exe 464 services.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
21d6b63327f1f57348899d5992d43102.execmd.exeIOrJ.exeservices.exedescription pid process target process PID 2032 wrote to memory of 1220 2032 21d6b63327f1f57348899d5992d43102.exe cmd.exe PID 2032 wrote to memory of 1220 2032 21d6b63327f1f57348899d5992d43102.exe cmd.exe PID 2032 wrote to memory of 1220 2032 21d6b63327f1f57348899d5992d43102.exe cmd.exe PID 2032 wrote to memory of 1220 2032 21d6b63327f1f57348899d5992d43102.exe cmd.exe PID 1220 wrote to memory of 1912 1220 cmd.exe IOrJ.exe PID 1220 wrote to memory of 1912 1220 cmd.exe IOrJ.exe PID 1220 wrote to memory of 1912 1220 cmd.exe IOrJ.exe PID 1220 wrote to memory of 1912 1220 cmd.exe IOrJ.exe PID 1992 wrote to memory of 2296 1992 IOrJ.exe IOrJ.exe PID 1992 wrote to memory of 2296 1992 IOrJ.exe IOrJ.exe PID 1992 wrote to memory of 2296 1992 IOrJ.exe IOrJ.exe PID 1992 wrote to memory of 2296 1992 IOrJ.exe IOrJ.exe PID 2032 wrote to memory of 464 2032 21d6b63327f1f57348899d5992d43102.exe services.exe PID 2032 wrote to memory of 464 2032 21d6b63327f1f57348899d5992d43102.exe services.exe PID 2032 wrote to memory of 464 2032 21d6b63327f1f57348899d5992d43102.exe services.exe PID 2032 wrote to memory of 464 2032 21d6b63327f1f57348899d5992d43102.exe services.exe PID 464 wrote to memory of 676 464 services.exe WindowsUpdate.exe PID 464 wrote to memory of 676 464 services.exe WindowsUpdate.exe PID 464 wrote to memory of 676 464 services.exe WindowsUpdate.exe PID 464 wrote to memory of 1616 464 services.exe Python-deamon.exe PID 464 wrote to memory of 1616 464 services.exe Python-deamon.exe PID 464 wrote to memory of 1616 464 services.exe Python-deamon.exe PID 464 wrote to memory of 1616 464 services.exe Python-deamon.exe
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Sets service image path in registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\system32\cmd.execmd.exe /c echo rrcuir > \\.\pipe\rrcuir2⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\IOrJ.exe"C:\Users\Admin\AppData\Local\Temp\IOrJ.exe" tVoebv2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\IOrJ.exeC:\Users\Admin\AppData\Local\Temp\IOrJ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2296 -
\??\c:\windows\system32\WindowsUpdate.exec:/windows/system32/\WindowsUpdate.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:676 -
\??\c:\windows\system32\Python-deamon.exec:/windows/system32/\Python-deamon.exe2⤵
- Executes dropped EXE
PID:1616
-
C:\Users\Admin\AppData\Local\Temp\21d6b63327f1f57348899d5992d43102.exe"C:\Users\Admin\AppData\Local\Temp\21d6b63327f1f57348899d5992d43102.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\IOrJ.exe" kkPVJbd2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\IOrJ.exeC:\Users\Admin\AppData\Local\Temp\IOrJ.exe kkPVJbd3⤵
- Executes dropped EXE
PID:1912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Windows\System32\Python-deamon.exeFilesize
4.9MB
MD52213c24bf5f894162377e83435bf6394
SHA134d35d4fefa2464c7a7adcf844a2055161283fcb
SHA256920ddce9db19abbde837de204acf2c28abdc93525d50c74e686f2b64560dc6a2
SHA5124fbccf72968372841668a4860ac5201138458c98eaf6dd034e435ae0741dba143cc5d5241cf19c1aee18ac425eb25ad3f9dd04452bc302b27f825313785fd554
-
C:\Windows\Temp\Tar15E6.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
\??\c:\windows\system32\config.jsonFilesize
2KB
MD597190f32e9ebd6cfc56e63a7b558b4e5
SHA19085d5e432921cfee05603fc4cee635860494c78
SHA25625e696edfadd0de5f13af4d3a7bd85a5cceac365d6d3ba96d1db4cdf3123ed2d
SHA512d521d2efe74278b74bf04ef397ca33ed32afbd4b0d61442cfd4d57b4f940981472634eba8c32dffc996dbc79d47c2ab48ae53d0fca0f786cc2bd1329a5566617
-
\Users\Admin\AppData\Local\Temp\IOrJ.exeFilesize
8KB
MD5be5834010c0a9ba9b98732357df7520f
SHA178fa14732624bf36119ee55bec40b6099ea963d3
SHA256d3735d945bf600a6025bb21af2f93a8d5016388bc2245219d89de11ab12dbdfc
SHA5128fbbae396a20052bf64887f78f478faab0417d7fe1d583e95e356cd32c14ee193f094a21c7a53d73fb6ea6649691b95eae9274a7c471e45379bc978108facee1
-
\Windows\System32\WindowsUpdate.exeFilesize
5.4MB
MD51ce931c7db9f11fe942e34857e16100e
SHA118aa4aa3d4f4653ca3c8fb706b004f911a5dd9de
SHA2567fac868eff64e2fae4e1d2cc9ef2d30b6e865e91f48782d5400f7f1376aeb543
SHA51244d99eb110efd3e636a8c74015277f13b24306e41965a67a1b970e7a07cb63343a7e6d1dc48308a6a115330e568ea5c7e50e2ec8897e639de2d322278fa67a9e
-
memory/464-289-0x0000000001C30000-0x0000000001E30000-memory.dmpFilesize
2.0MB
-
memory/464-283-0x0000000001170000-0x0000000001270000-memory.dmpFilesize
1024KB
-
memory/464-184-0x0000000001170000-0x0000000001270000-memory.dmpFilesize
1024KB
-
memory/464-170-0x0000000001C30000-0x0000000001E30000-memory.dmpFilesize
2.0MB
-
memory/464-290-0x0000000001170000-0x0000000001270000-memory.dmpFilesize
1024KB
-
memory/464-311-0x0000000001170000-0x0000000001270000-memory.dmpFilesize
1024KB
-
memory/464-134-0x0000000000120000-0x0000000000152000-memory.dmpFilesize
200KB
-
memory/2032-35-0x0000000002500000-0x0000000002525000-memory.dmpFilesize
148KB
-
memory/2032-20-0x0000000000330000-0x0000000000361000-memory.dmpFilesize
196KB
-
memory/2032-1-0x0000000000280000-0x00000000002AC000-memory.dmpFilesize
176KB
-
memory/2032-111-0x0000000002010000-0x0000000002110000-memory.dmpFilesize
1024KB
-
memory/2032-119-0x0000000002010000-0x0000000002110000-memory.dmpFilesize
1024KB
-
memory/2032-2-0x0000000000330000-0x0000000000361000-memory.dmpFilesize
196KB
-
memory/2032-127-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/2032-126-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB
-
memory/2032-62-0x0000000000330000-0x0000000000361000-memory.dmpFilesize
196KB
-
memory/2032-58-0x0000000000280000-0x00000000002AC000-memory.dmpFilesize
176KB
-
memory/2032-41-0x0000000000330000-0x0000000000361000-memory.dmpFilesize
196KB
-
memory/2032-40-0x0000000002010000-0x0000000002110000-memory.dmpFilesize
1024KB
-
memory/2032-0-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB
-
memory/2032-67-0x0000000000330000-0x0000000000361000-memory.dmpFilesize
196KB
-
memory/2032-15-0x0000000002110000-0x0000000002173000-memory.dmpFilesize
396KB
-
memory/2032-14-0x0000000002010000-0x0000000002110000-memory.dmpFilesize
1024KB
-
memory/2032-7-0x0000000000330000-0x0000000000361000-memory.dmpFilesize
196KB
-
memory/2032-6-0x0000000000330000-0x0000000000361000-memory.dmpFilesize
196KB
-
memory/2296-120-0x0000000003320000-0x0000000003720000-memory.dmpFilesize
4.0MB
-
memory/2296-77-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB