Analysis
-
max time kernel
150s -
max time network
99s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14-05-2024 05:31
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240426-en
General
-
Target
file.exe
-
Size
4.5MB
-
MD5
96422a2b982c99614d31dff7f2b64680
-
SHA1
e8f25aa518b0ef54bcdf770479ef28dd99dd8efc
-
SHA256
fe74f06d7437d213d96466b4475db2809c60a4e8aced9df338f4a71cf9bc7c16
-
SHA512
882beba69a0ab2d6f7d048ecb4666b9ba4fe3ea17387ece13fb5bd589ce0db4d7343fbce6e2d836192aed2a920aae4edd1f4b6fa090fe807d54e024dbc234de9
-
SSDEEP
24576:Epu+lTdASQBeSbtpO2+RZ8XK5OG/wS4gIVnxff9t+oQ9GXiqgbaaz2ub2UbRdL/h:EX
Malware Config
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral1/memory/1972-2-0x0000000005FC0000-0x0000000006200000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-3-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-4-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-18-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-24-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-6-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-40-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-12-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-28-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-44-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-46-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-48-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-50-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-56-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-60-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-62-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-66-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-64-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-58-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-54-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-52-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-42-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-38-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-36-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-34-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-32-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-30-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-26-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-22-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-20-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-16-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-14-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-10-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 behavioral1/memory/1972-8-0x0000000005FC0000-0x00000000061FA000-memory.dmp family_zgrat_v1 -
Modifies security service 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP svchost.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection svchost.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
powershell.EXEdescription pid process target process PID 2632 created 436 2632 powershell.EXE winlogon.exe -
Drops startup file 1 IoCs
Processes:
file.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77Wakgksusfez.vbs file.exe -
Executes dropped EXE 2 IoCs
Processes:
$7795bd29$772ce69dpid process 2520 $7795bd29 1036 $772ce69d -
Loads dropped DLL 2 IoCs
Processes:
file.exepid process 1972 file.exe 1972 file.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
$772ce69ddescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\$772ce69d'\"" $772ce69d -
Drops file in System32 directory 1 IoCs
Processes:
powershell.EXEdescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE -
Suspicious use of SetThreadContext 3 IoCs
Processes:
file.exepowershell.EXEdescription pid process target process PID 1972 set thread context of 2520 1972 file.exe $7795bd29 PID 1972 set thread context of 1036 1972 file.exe $772ce69d PID 2632 set thread context of 3052 2632 powershell.EXE dllhost.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
powershell.EXEdescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 30219e00c0a5da01 powershell.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.EXEfile.exedllhost.exepid process 2632 powershell.EXE 1972 file.exe 2632 powershell.EXE 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe 3052 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
file.exepowershell.EXEdllhost.exedescription pid process Token: SeDebugPrivilege 1972 file.exe Token: SeDebugPrivilege 2632 powershell.EXE Token: SeDebugPrivilege 1972 file.exe Token: SeDebugPrivilege 2632 powershell.EXE Token: SeDebugPrivilege 3052 dllhost.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
file.exetaskeng.exepowershell.EXEdllhost.exedescription pid process target process PID 1972 wrote to memory of 2520 1972 file.exe $7795bd29 PID 1972 wrote to memory of 2520 1972 file.exe $7795bd29 PID 1972 wrote to memory of 2520 1972 file.exe $7795bd29 PID 1972 wrote to memory of 2520 1972 file.exe $7795bd29 PID 1972 wrote to memory of 2520 1972 file.exe $7795bd29 PID 1972 wrote to memory of 2520 1972 file.exe $7795bd29 PID 1972 wrote to memory of 2520 1972 file.exe $7795bd29 PID 1972 wrote to memory of 2520 1972 file.exe $7795bd29 PID 1972 wrote to memory of 2520 1972 file.exe $7795bd29 PID 1972 wrote to memory of 2520 1972 file.exe $7795bd29 PID 2060 wrote to memory of 2632 2060 taskeng.exe powershell.EXE PID 2060 wrote to memory of 2632 2060 taskeng.exe powershell.EXE PID 2060 wrote to memory of 2632 2060 taskeng.exe powershell.EXE PID 1972 wrote to memory of 1036 1972 file.exe $772ce69d PID 1972 wrote to memory of 1036 1972 file.exe $772ce69d PID 1972 wrote to memory of 1036 1972 file.exe $772ce69d PID 1972 wrote to memory of 1036 1972 file.exe $772ce69d PID 1972 wrote to memory of 1036 1972 file.exe $772ce69d PID 1972 wrote to memory of 1036 1972 file.exe $772ce69d PID 1972 wrote to memory of 1036 1972 file.exe $772ce69d PID 1972 wrote to memory of 1036 1972 file.exe $772ce69d PID 1972 wrote to memory of 1036 1972 file.exe $772ce69d PID 1972 wrote to memory of 1036 1972 file.exe $772ce69d PID 2632 wrote to memory of 3052 2632 powershell.EXE dllhost.exe PID 2632 wrote to memory of 3052 2632 powershell.EXE dllhost.exe PID 2632 wrote to memory of 3052 2632 powershell.EXE dllhost.exe PID 2632 wrote to memory of 3052 2632 powershell.EXE dllhost.exe PID 2632 wrote to memory of 3052 2632 powershell.EXE dllhost.exe PID 2632 wrote to memory of 3052 2632 powershell.EXE dllhost.exe PID 2632 wrote to memory of 3052 2632 powershell.EXE dllhost.exe PID 2632 wrote to memory of 3052 2632 powershell.EXE dllhost.exe PID 2632 wrote to memory of 3052 2632 powershell.EXE dllhost.exe PID 3052 wrote to memory of 436 3052 dllhost.exe winlogon.exe PID 3052 wrote to memory of 480 3052 dllhost.exe services.exe PID 3052 wrote to memory of 496 3052 dllhost.exe lsass.exe PID 3052 wrote to memory of 504 3052 dllhost.exe lsm.exe PID 3052 wrote to memory of 592 3052 dllhost.exe svchost.exe PID 3052 wrote to memory of 672 3052 dllhost.exe svchost.exe PID 3052 wrote to memory of 744 3052 dllhost.exe svchost.exe PID 3052 wrote to memory of 812 3052 dllhost.exe svchost.exe PID 3052 wrote to memory of 864 3052 dllhost.exe svchost.exe PID 3052 wrote to memory of 1004 3052 dllhost.exe svchost.exe PID 3052 wrote to memory of 296 3052 dllhost.exe svchost.exe PID 3052 wrote to memory of 920 3052 dllhost.exe spoolsv.exe PID 3052 wrote to memory of 344 3052 dllhost.exe svchost.exe PID 3052 wrote to memory of 1252 3052 dllhost.exe taskhost.exe PID 3052 wrote to memory of 1336 3052 dllhost.exe Dwm.exe PID 3052 wrote to memory of 1376 3052 dllhost.exe Explorer.EXE PID 3052 wrote to memory of 2664 3052 dllhost.exe svchost.exe PID 3052 wrote to memory of 1680 3052 dllhost.exe sppsvc.exe PID 3052 wrote to memory of 2060 3052 dllhost.exe taskeng.exe PID 3052 wrote to memory of 2632 3052 dllhost.exe powershell.EXE PID 3052 wrote to memory of 1956 3052 dllhost.exe conhost.exe PID 3052 wrote to memory of 1036 3052 dllhost.exe $772ce69d
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{bdc85aa1-fb2b-4e86-b5f7-d1bdea809142}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
- Modifies security service
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {193CB52A-8235-40A2-B829-15996F0C90FC} S-1-5-18:NT AUTHORITY\System:Service:3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+'F'+'T'+[Char](87)+'A'+[Char](82)+'E').GetValue('$'+[Char](55)+'7'+[Char](115)+''+[Char](116)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\$7795bd29"C:\Users\Admin\AppData\Local\Temp\$7795bd29"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\$772ce69d"C:\Users\Admin\AppData\Local\Temp\$772ce69d"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-5736592181577275068164228039811597435481741225853-1205417798-1395281556-412873299"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\$7795bd29Filesize
4.5MB
MD596422a2b982c99614d31dff7f2b64680
SHA1e8f25aa518b0ef54bcdf770479ef28dd99dd8efc
SHA256fe74f06d7437d213d96466b4475db2809c60a4e8aced9df338f4a71cf9bc7c16
SHA512882beba69a0ab2d6f7d048ecb4666b9ba4fe3ea17387ece13fb5bd589ce0db4d7343fbce6e2d836192aed2a920aae4edd1f4b6fa090fe807d54e024dbc234de9
-
memory/1972-30-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-6-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-3-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-4-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-18-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-24-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-22-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-40-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-12-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-28-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-44-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-46-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-48-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-50-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-56-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-60-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-62-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-66-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-64-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-20-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-54-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-52-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-42-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-38-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-36-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-34-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-32-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-0-0x0000000074A5E000-0x0000000074A5F000-memory.dmpFilesize
4KB
-
memory/1972-26-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-2-0x0000000005FC0000-0x0000000006200000-memory.dmpFilesize
2.2MB
-
memory/1972-58-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-16-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-14-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-10-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-8-0x0000000005FC0000-0x00000000061FA000-memory.dmpFilesize
2.2MB
-
memory/1972-4884-0x0000000002450000-0x000000000249C000-memory.dmpFilesize
304KB
-
memory/1972-4883-0x00000000025A0000-0x000000000261E000-memory.dmpFilesize
504KB
-
memory/1972-4885-0x0000000074A50000-0x000000007513E000-memory.dmpFilesize
6.9MB
-
memory/1972-4886-0x0000000074A50000-0x000000007513E000-memory.dmpFilesize
6.9MB
-
memory/1972-4887-0x0000000074A5E000-0x0000000074A5F000-memory.dmpFilesize
4KB
-
memory/1972-4888-0x0000000074A50000-0x000000007513E000-memory.dmpFilesize
6.9MB
-
memory/1972-4889-0x0000000074A50000-0x000000007513E000-memory.dmpFilesize
6.9MB
-
memory/1972-1-0x0000000000AB0000-0x0000000000F36000-memory.dmpFilesize
4.5MB
-
memory/1972-4944-0x0000000074A50000-0x000000007513E000-memory.dmpFilesize
6.9MB
-
memory/1972-4917-0x0000000002530000-0x0000000002584000-memory.dmpFilesize
336KB
-
memory/2520-4909-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2632-4911-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmpFilesize
9.6MB
-
memory/2632-4912-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmpFilesize
9.6MB
-
memory/2632-4913-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmpFilesize
9.6MB
-
memory/2632-4914-0x0000000019FD0000-0x000000001A2B2000-memory.dmpFilesize
2.9MB
-
memory/2632-4915-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmpFilesize
9.6MB
-
memory/2632-4916-0x0000000000870000-0x0000000000878000-memory.dmpFilesize
32KB
-
memory/2632-4910-0x000007FEF5E8E000-0x000007FEF5E8F000-memory.dmpFilesize
4KB
-
memory/2632-4945-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmpFilesize
9.6MB
-
memory/2632-4946-0x0000000001370000-0x000000000139A000-memory.dmpFilesize
168KB
-
memory/2632-5112-0x000007FEF5BD0000-0x000007FEF656D000-memory.dmpFilesize
9.6MB
-
memory/2632-5113-0x000007FEF5E8E000-0x000007FEF5E8F000-memory.dmpFilesize
4KB