Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 01:12
Static task
static1
Behavioral task
behavioral1
Sample
a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe
Resource
win10v2004-20240508-en
General
-
Target
a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe
-
Size
7.5MB
-
MD5
28987206ca2a073ef849b33c5cac99ac
-
SHA1
4d5f611a3c348083c10e667d1f6da6944e0b8ebc
-
SHA256
a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6
-
SHA512
eead925200a214da5ea9376871647cdc1e40dbf55c6dc7072a45f0dd69f2cb88c90b27b80798c409bf7577650078c6728b36b9a5cc892a21836a10809c558e0e
-
SSDEEP
196608:OqeQ4Uv0SgzIbfyUmvVAkCTC7ipRdQYuUhKAzqeyAUX:5R4/SxfGGkKnpRdQYsAzq2UX
Malware Config
Signatures
-
Detects executables packed with Dotfuscator 26 IoCs
Processes:
resource yara_rule behavioral2/memory/116-3-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-9-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-10-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-12-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-13-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-42-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-43-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-44-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-45-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-46-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-48-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-49-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-50-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-85-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-86-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-87-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-123-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-125-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-161-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-162-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-163-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-164-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-201-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-206-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/116-271-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator behavioral2/memory/3272-272-0x0000000000400000-0x0000000000FA7000-memory.dmp INDICATOR_EXE_Packed_Dotfuscator -
Detects executables packed with Goliath 26 IoCs
Processes:
resource yara_rule behavioral2/memory/116-3-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-9-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-10-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-12-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-13-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-42-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-43-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-44-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-45-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-46-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-48-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-49-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-50-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-85-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-86-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-87-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-123-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-125-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-161-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-162-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-163-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-164-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-201-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-206-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/116-271-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_Goliath behavioral2/memory/3272-272-0x0000000000400000-0x0000000000FA7000-memory.dmp INDICATOR_EXE_Packed_Goliath -
Detects executables packed with SmartAssembly 26 IoCs
Processes:
resource yara_rule behavioral2/memory/116-3-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-9-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-10-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-12-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-13-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-42-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-43-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-44-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-45-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-46-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-48-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-49-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-50-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-85-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-86-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-87-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-123-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-125-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-161-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-162-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-163-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-164-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-201-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-206-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/116-271-0x0000000000400000-0x0000000000FC3000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/3272-272-0x0000000000400000-0x0000000000FA7000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe -
Executes dropped EXE 1 IoCs
Processes:
a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exepid process 3272 a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe -
Obfuscated with Agile.Net obfuscator 27 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/116-3-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-9-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-10-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-12-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-13-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-42-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-43-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-44-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-45-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-46-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-48-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-49-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-50-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-85-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-86-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-87-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-123-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-124-0x000000000088C000-0x0000000000F91000-memory.dmp agile_net behavioral2/memory/116-125-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-161-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-162-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-163-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-164-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-201-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-206-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/116-271-0x0000000000400000-0x0000000000FC3000-memory.dmp agile_net behavioral2/memory/3272-272-0x0000000000400000-0x0000000000FA7000-memory.dmp agile_net -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exea6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exepid process 116 a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe 3272 a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4960 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exea6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exepid process 116 a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe 116 a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe 3272 a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe 3272 a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exedescription pid process Token: SeDebugPrivilege 116 a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.execmd.exedescription pid process target process PID 116 wrote to memory of 3272 116 a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe PID 116 wrote to memory of 3272 116 a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe PID 116 wrote to memory of 3272 116 a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe PID 116 wrote to memory of 3936 116 a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe cmd.exe PID 116 wrote to memory of 3936 116 a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe cmd.exe PID 116 wrote to memory of 3936 116 a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe cmd.exe PID 3936 wrote to memory of 4960 3936 cmd.exe timeout.exe PID 3936 wrote to memory of 4960 3936 cmd.exe timeout.exe PID 3936 wrote to memory of 4960 3936 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe"C:\Users\Admin\AppData\Local\Temp\a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe"C:\Users\Admin\AppData\Local\Temp\a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C timeout /T 3 & del "C:\Users\Admin\AppData\Local\Temp\*.tmp"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /T 33⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\a6292e209366413314dd2acbbf10e75e11b6885f983843d442a0e0b5550ea6e6.exeFilesize
7.5MB
MD571f8442345a910fee4ef661e5be9c620
SHA155899f077f8edac0b28787ec45e7b9c443fe1dba
SHA256bcf6e5f4a2d0009f7f4d35a04978e58a792ba7f20932387403c972596b7cae79
SHA5127e9672405d893e259380d6e510e14a5d2f7d59e583a92573fc29ee9bf02f2c4253b6869293027e78c290e2b2a175d96d18d0a9fde45d55e9df9ffb5cdfff26e4
-
memory/116-0-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-1-0x000000000088C000-0x0000000000F91000-memory.dmpFilesize
7.0MB
-
memory/116-2-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-4-0x00000000011A0000-0x00000000011A1000-memory.dmpFilesize
4KB
-
memory/116-5-0x00000000012D0000-0x0000000001310000-memory.dmpFilesize
256KB
-
memory/116-3-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-6-0x0000000076F50000-0x0000000077165000-memory.dmpFilesize
2.1MB
-
memory/116-7-0x00000000763D0000-0x0000000076651000-memory.dmpFilesize
2.5MB
-
memory/116-9-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-8-0x0000000075D90000-0x0000000075E73000-memory.dmpFilesize
908KB
-
memory/116-10-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-11-0x0000000072B50000-0x0000000072BD9000-memory.dmpFilesize
548KB
-
memory/116-12-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-13-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-14-0x0000000009E30000-0x000000000A822000-memory.dmpFilesize
9.9MB
-
memory/116-15-0x000000000B820000-0x000000000BAE4000-memory.dmpFilesize
2.8MB
-
memory/116-16-0x000000000BAF0000-0x000000000BC09000-memory.dmpFilesize
1.1MB
-
memory/116-18-0x000000000BAF0000-0x000000000BC09000-memory.dmpFilesize
1.1MB
-
memory/116-17-0x000000000BAF0000-0x000000000BC09000-memory.dmpFilesize
1.1MB
-
memory/116-37-0x0000000010000000-0x0000000010005000-memory.dmpFilesize
20KB
-
memory/116-35-0x0000000010000000-0x0000000010005000-memory.dmpFilesize
20KB
-
memory/116-32-0x0000000010000000-0x0000000010005000-memory.dmpFilesize
20KB
-
memory/116-41-0x0000000076940000-0x0000000076EF3000-memory.dmpFilesize
5.7MB
-
memory/116-29-0x0000000010000000-0x0000000010005000-memory.dmpFilesize
20KB
-
memory/116-42-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-27-0x0000000010000000-0x0000000010005000-memory.dmpFilesize
20KB
-
memory/116-43-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-44-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-45-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-46-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-47-0x000000000F420000-0x000000000F4B2000-memory.dmpFilesize
584KB
-
memory/116-48-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-49-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-50-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-57-0x0000000075590000-0x000000007564F000-memory.dmpFilesize
764KB
-
memory/116-66-0x0000000074870000-0x0000000074878000-memory.dmpFilesize
32KB
-
memory/116-65-0x0000000074880000-0x000000007488F000-memory.dmpFilesize
60KB
-
memory/116-67-0x00000000740C0000-0x0000000074870000-memory.dmpFilesize
7.7MB
-
memory/116-79-0x000000000F6A0000-0x000000000F703000-memory.dmpFilesize
396KB
-
memory/116-78-0x000000006E870000-0x000000006E89B000-memory.dmpFilesize
172KB
-
memory/116-77-0x000000006E8A0000-0x000000006E983000-memory.dmpFilesize
908KB
-
memory/116-76-0x000000000BD50000-0x000000000BD68000-memory.dmpFilesize
96KB
-
memory/116-75-0x0000000003370000-0x0000000003376000-memory.dmpFilesize
24KB
-
memory/116-74-0x00000000766D0000-0x00000000766E9000-memory.dmpFilesize
100KB
-
memory/116-73-0x0000000071FC0000-0x0000000071FD2000-memory.dmpFilesize
72KB
-
memory/116-72-0x0000000072A40000-0x0000000072B45000-memory.dmpFilesize
1.0MB
-
memory/116-71-0x0000000072B50000-0x0000000072BD9000-memory.dmpFilesize
548KB
-
memory/116-69-0x0000000073FF0000-0x000000007409B000-memory.dmpFilesize
684KB
-
memory/116-68-0x00000000740A0000-0x00000000740B4000-memory.dmpFilesize
80KB
-
memory/116-64-0x0000000074890000-0x000000007491D000-memory.dmpFilesize
564KB
-
memory/116-63-0x00000000752D0000-0x0000000075315000-memory.dmpFilesize
276KB
-
memory/116-62-0x0000000074950000-0x0000000074974000-memory.dmpFilesize
144KB
-
memory/116-61-0x0000000075200000-0x0000000075296000-memory.dmpFilesize
600KB
-
memory/116-60-0x00000000763D0000-0x0000000076651000-memory.dmpFilesize
2.5MB
-
memory/116-59-0x0000000075010000-0x0000000075062000-memory.dmpFilesize
328KB
-
memory/116-56-0x0000000075650000-0x00000000756C5000-memory.dmpFilesize
468KB
-
memory/116-55-0x0000000076310000-0x00000000763CF000-memory.dmpFilesize
764KB
-
memory/116-54-0x0000000075C70000-0x0000000075D90000-memory.dmpFilesize
1.1MB
-
memory/116-53-0x0000000075BF0000-0x0000000075C6B000-memory.dmpFilesize
492KB
-
memory/116-52-0x0000000076890000-0x00000000768B4000-memory.dmpFilesize
144KB
-
memory/116-51-0x0000000076F50000-0x0000000077165000-memory.dmpFilesize
2.1MB
-
memory/116-85-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-86-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-87-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-123-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-124-0x000000000088C000-0x0000000000F91000-memory.dmpFilesize
7.0MB
-
memory/116-125-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-161-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-162-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-163-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-164-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-200-0x0000000012200000-0x00000000127A4000-memory.dmpFilesize
5.6MB
-
memory/116-201-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-206-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/116-271-0x0000000000400000-0x0000000000FC3000-memory.dmpFilesize
11.8MB
-
memory/3272-214-0x0000000000400000-0x0000000000FA7000-memory.dmpFilesize
11.7MB
-
memory/3272-226-0x0000000000400000-0x0000000000FA7000-memory.dmpFilesize
11.7MB
-
memory/3272-272-0x0000000000400000-0x0000000000FA7000-memory.dmpFilesize
11.7MB