Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 11:16
Static task
static1
Behavioral task
behavioral1
Sample
69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c.exe
Resource
win10v2004-20240226-en
General
-
Target
69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c.exe
-
Size
6.0MB
-
MD5
6070a5a647568555a6544f195ec340fd
-
SHA1
61dcfa5c38a817732e0b676f5485b9ae04f341b5
-
SHA256
69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c
-
SHA512
327145d141abb27c574132ec74a33911aa83f65452cc5dc1f7b7d18b78b384f23ddf5bccc277dfdbf599f32b502e22840704ec0ca4656a3acb7523a0c80b5f9f
-
SSDEEP
98304:fbdhDqohDS1F+CRcB27OgUWZHw8VQjr+/bJBAUZLF:fbdhDD23a2sWKjr+TJVR
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c.exepid process 2156 69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c.exe -
Processes:
resource yara_rule behavioral1/memory/2156-1-0x0000000000200000-0x000000000020B000-memory.dmp upx behavioral1/memory/2156-2-0x0000000000200000-0x000000000020B000-memory.dmp upx behavioral1/memory/2156-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-4-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-8-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-6-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-5-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-12-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-40-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-47-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-10-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-22-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-26-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-49-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-48-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-44-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-42-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-38-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-36-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-34-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-32-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-30-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-28-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-24-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-20-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-16-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2156-15-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c.exedescription ioc process File opened for modification \??\PhysicalDrive0 69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98C522E1-1B51-11EF-B73D-E693E3B3207D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 564 iexplore.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c.exeiexplore.exeIEXPLORE.EXEpid process 2156 69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c.exe 2156 69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c.exe 2156 69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c.exe 564 iexplore.exe 564 iexplore.exe 2256 IEXPLORE.EXE 2256 IEXPLORE.EXE 2256 IEXPLORE.EXE 2256 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c.exeiexplore.exedescription pid process target process PID 2156 wrote to memory of 564 2156 69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c.exe iexplore.exe PID 2156 wrote to memory of 564 2156 69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c.exe iexplore.exe PID 2156 wrote to memory of 564 2156 69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c.exe iexplore.exe PID 2156 wrote to memory of 564 2156 69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c.exe iexplore.exe PID 564 wrote to memory of 2256 564 iexplore.exe IEXPLORE.EXE PID 564 wrote to memory of 2256 564 iexplore.exe IEXPLORE.EXE PID 564 wrote to memory of 2256 564 iexplore.exe IEXPLORE.EXE PID 564 wrote to memory of 2256 564 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c.exe"C:\Users\Admin\AppData\Local\Temp\69e4f6710ee8e515ea7b44c6d47329b224419c57271c2dd6c7b04646167bbe5c.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://changkongbao.lanzouq.com/ikW9T1cfeg5e2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:564 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2256
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b54c485c8d07c363f6a2f192969db96f
SHA15dd6cd5b3cf766843cdfd430ebd72126158c6150
SHA25608196bdb9ba5f3895759ee3bdc93b9b6fb197a9c9db74365b1d553910929ff2a
SHA51226f0f5f6adb861eb7106e85ae9336471258813fef9086f8edfd130887b802101199c64c2e5f712526de1108d14f95f7bf75b6c66cedf6035ca6396d3c01b3dba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5959f755d6664e265246ed650922c4fd7
SHA18af2550fb2586c3fdc39e063214aa5687893efda
SHA256a2fd98ec6a2947845e8d95942daf2c2dd322920179b8225c2b1e9a980c64e5e1
SHA5122e9fd859a431af47743630785c4c68804b1537fa7b5778df1632f4ee782be787343187bc1a780d2d4f63b0980a268549a97faa87304b92aa69cbe255f6da46db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5738af5c8c1dd356c85544877485bfb2c
SHA15ab86f4b0561f55db94aa3773cf17f0235d751e0
SHA256b0fd4265a40c493f230b5b9102e91519e373cf09184795244a5db692d64e4019
SHA51259d011eff8ed20d0045da3ddbe7d10e6d4b1d675639dc7ff4dbc5e3b4eb0b780a8fe684ba3bc6b266e4d4fc59b18d3ce5b277fc849ef2dfd59277724b711d863
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5adc54c36626a284178caf95257860542
SHA1dddf8570c55fc9ed3596985eab9b9b19a23c1738
SHA256c7398d9649fa106035c2ff920f0dba387c4d7d68c341a871ebbeab6cfc1f0cfb
SHA51217910bbcb50c3c744842a01e1d56210f8fbcef6e1793a9f7101fcb19a5813d94240728ad4f6590d11986932fe684e1289666f2ffcc1644099276e2d644352ad6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55a7d9fd9074c3c71658e06fd6cb1c2d5
SHA1b39093b4840cb633ce6e5e3c8daa4e7ecbdad89d
SHA256e1aa48b94b27c559754d69b78676507e8846513cca346edee972f45c72e8735a
SHA5123536fb487289c2978f5a3eb982c07a54b912dc8f5693bdb6473a6e313cb6b5d5a3a9ec8075f1d2d0df8f9366078dd00e01814b69173d45a3907c489804b2ebdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5968db7896da1f5c28d0fef0035c821c9
SHA1da2f80246ddf94b5c142db28e4980ed69eddcc6d
SHA2565aeb7849d294e44449347ad5b86071f10c37898c70cf41cd06ad422c124399a9
SHA51214102b5934b9aa631a9ecdeb77412f27d143208d76b6414005011110730451a2b965581dda8d3beb493d96a70f1fc72ae6dc479949fc7646cb3e3e44fab0bafd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5dd5bf082147e269e67d0bb78b647adac
SHA13cc949de5254b1507cc64d29be25ba7c8c0d9e8e
SHA256ea5761f1f93b2eeb977782fa592e1d70a0d2ed48ba57cb151f49665c3fe85ad9
SHA5122dfc5d38a2bad8768dafd84ffee4a542e6135b356ca449b4e2ce971a907ba05951e42047d73d7f884cc598e977c07493c0de6dc38539ce9b28d41a7dd58cfea3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5d87e82e296c0f4e31fd791e5c35ef5f0
SHA1b814b3d83f9658c3d6f24e2c07f8cda5e165c8dd
SHA2569145f4cb8f2ddb5caaa81a4f2b182412f13d201fd4211660c9884c0fdde6a35b
SHA512ead152b5bb8bf7eb3a05b6604403983ac78de3d74069173b52c28c232e8e8cd4ecbe9f86d6fbe91b4783f9e28730e28abaac518248ba9d5bdf747d7311ddb8f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD557b256379a9c9be9188e1eb0ae8b1a72
SHA1a75efb160445fd45e50621bc5fad12bf9640d4c5
SHA256a55e4bab28679051072e945d2e67e1baaaaae87539388be98fc62aac97b56426
SHA51291f909a534c31b8e810b2d952a4babef0f819288c341adbbcc1b7c2768d8e83600a9db0b7df08c6b9acaa7f7b5914f1c202fdf6fb2dfd94e8261f0a03481e280
-
C:\Users\Admin\AppData\Local\Temp\Cab5055.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Cab5112.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar5127.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\·½°¸.iniFilesize
8KB
MD566b747a2e42a147cdd58f6ac27b0559e
SHA1377d11244426348f252e063c5456fb56ad287dc2
SHA2569b14dd453bf79634e4b13b51f32a5edd6e079d9e03991a511874b844b3310f3f
SHA5123d091f68ededb48fbbb2bd1f2c92e192c9e37291cdc4fd272ba3d41d2f257768eb149e61b0ea2d4e849e26dc02f2a5b5b89c021eba1835b634b6d2750b546549
-
C:\Users\Admin\AppData\Local\Temp\·½°¸.iniFilesize
8KB
MD516ef8177433976c14d23f839a8c1152a
SHA12b653ca841498be9292cbbc8b5119504e225f56d
SHA2562a30dc50f2e6e73b059d7419b34924114bffcfa8d99f7703bfbdd4f9e5da8855
SHA5129cccf0eb97b898988e5da63584e195528dd3a0f34d0608844a33c6ac5928d83c8159151a7a15d5382a10114b819cb72d8c5840d254d9ac1023ad6ac22ac4833e
-
C:\Users\Admin\AppData\Local\Temp\¿ì½Ý·¢ÑÔ·½°¸.txtFilesize
189B
MD5322f59ce015ff2f1f00ecbe4fdfce380
SHA1eb4756a5bb023f6d1feacdbeac6e94013e15d5b0
SHA256c96ef901d8f23cb7626ef980c4cf5bece7aafeef9b2b8b28829d3a11a51562c1
SHA5122610ce1c0a55da67faa9ddaca26529a87bf5ebc6706621682d54024fa887ca9cd54cdc5b854f8b79ea99b02a5277d6931f633fa876107d9ec1bf503bee23a02c
-
C:\Users\Admin\AppData\Local\Temp\ÉèÖÃ.iniFilesize
246B
MD5b06ddcfdb64cc28ca0a0ef609de5f05f
SHA1bd95d141935795e249d2ab00824839fd42c8f505
SHA256da0a5d79dc6a120811b556885b704f9fd158b1f19dd5a9c595719feb56065f00
SHA512a1dd3cc527ce6a6c4b0ea2c369d4370f6f1bf332c9255e1a8eebfd5986c133dacc2e6c6a55071e5bcf4724f37ff2920f2e17567ca32571e664b458e526be72b5
-
C:\Users\Admin\AppData\Local\Temp\ÉèÖÃ.iniFilesize
260B
MD5924bf7a4ce305dad87743ba3c5773aa9
SHA112d0fddb472394b23e5176ab4ede38974e723b81
SHA25601faf5e88442653bf38adc145d517f44d3495398e0aa666c7486b7030c126cbd
SHA5122380c957717d3bc97ae2de96aba9cd3b50a1774eb96dc47840add1b12ee13485ee6cc6c4d30953b8f42d32ae3b02657966229fcbe58a60843df0cbd6170eb44e
-
\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32_20230421.libFilesize
1.5MB
MD5ef48d7cc52338513cc0ce843c5e3916b
SHA120965d86b7b358edf8b5d819302fa7e0e6159c18
SHA256835bfef980ad0cedf10d8ade0cf5671d9f56062f2b22d0a0547b07772ceb25a8
SHA512fd4602bd487eaad5febb5b3e9d8fe75f4190d1e44e538e7ae2d2129087f35b72b254c85d7335a81854aa2bdb4f0f2fa22e02a892ee23ac57b78cdd03a79259b9
-
memory/2156-22-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-48-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-36-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-34-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-32-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-30-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-28-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-24-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-20-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-19-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-16-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-15-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-53-0x0000000000C80000-0x0000000000C81000-memory.dmpFilesize
4KB
-
memory/2156-56-0x0000000000C90000-0x0000000000C91000-memory.dmpFilesize
4KB
-
memory/2156-55-0x00000000022C0000-0x00000000022C1000-memory.dmpFilesize
4KB
-
memory/2156-42-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-44-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-38-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-49-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-50-0x0000000000C70000-0x0000000000C71000-memory.dmpFilesize
4KB
-
memory/2156-26-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-0-0x0000000000400000-0x0000000000A6D000-memory.dmpFilesize
6.4MB
-
memory/2156-10-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-47-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-40-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-12-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-5-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-6-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-8-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-4-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-3-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2156-2-0x0000000000200000-0x000000000020B000-memory.dmpFilesize
44KB
-
memory/2156-1-0x0000000000200000-0x000000000020B000-memory.dmpFilesize
44KB