Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7 -
submitted
27-10-2020 11:33
Static task
static1
Behavioral task
behavioral1
Sample
76c8a9dbff9b571500729611595f1a1bce8dab543922d731c3bb42af5477f517.exe
Resource
win7
Behavioral task
behavioral2
Sample
76c8a9dbff9b571500729611595f1a1bce8dab543922d731c3bb42af5477f517.exe
Resource
win10
General
-
Target
76c8a9dbff9b571500729611595f1a1bce8dab543922d731c3bb42af5477f517.exe
-
Size
459KB
-
MD5
165764b4314eea6105dcb41e02a0bea4
-
SHA1
9e9218fa0b3d51ed02185658a5290200b7ced108
-
SHA256
76c8a9dbff9b571500729611595f1a1bce8dab543922d731c3bb42af5477f517
-
SHA512
641477979c2484bd5101e537bea96001bcc93737b0945d26ab4ddc6d748653dce5f09655e0f6dec002c6f16aa2918dcfc77912b5c06323adee47c807de52adc6
Malware Config
Signatures
-
Ursnif RM3
A heavily modified version of Ursnif discovered in the wild.
-
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC3C1ED1-1848-11EB-BCE6-CE7BA4EBFB24} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b530accd206940bf4cc3274d3cd52500000000020000000000106600000001000020000000621667562698983af4955f5a736105b0b20bc4df1980504c28dd20438a560ab7000000000e80000000020000200000002922d09ff14ac1fedcb839a60f86f00c6440f3cf0c96ad557513b935f77ca418900000008d82b2b26ec885a622c88131b1d9859990cf368833ff2ac53befcb943e25ca7b293649e8fd0822251c23eae7e5146740f3cd494fc9c1ae76513dbc0a062a0f45cf3546f119c4d8c10f1b1a9342d201f45a318e102535e3d2abb29970a7732acff8e07bbf3f1552b32dc0d2859ef6cd6679527376fe4bb90dd259040a2bf2147890abcaf2da1d93abb949fb353510888840000000a90a827fb0819202940b54235b847e5b8162bab2e69fc8ad5ab7100a2be3a6744140103ec344adf83f2095c3079fd544383f6d38171faf75087bb1ed5bd6e9e0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04047DB1-1849-11EB-BCE6-CE7BA4EBFB24} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exepid process 2036 iexplore.exe 1176 iexplore.exe 1164 iexplore.exe 1020 iexplore.exe 812 iexplore.exe 1104 iexplore.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEpid process 2036 iexplore.exe 2036 iexplore.exe 1036 IEXPLORE.EXE 1036 IEXPLORE.EXE 1176 iexplore.exe 1176 iexplore.exe 1832 IEXPLORE.EXE 1832 IEXPLORE.EXE 1164 iexplore.exe 1164 iexplore.exe 692 IEXPLORE.EXE 692 IEXPLORE.EXE 1020 iexplore.exe 1020 iexplore.exe 1072 IEXPLORE.EXE 1072 IEXPLORE.EXE 812 iexplore.exe 812 iexplore.exe 796 IEXPLORE.EXE 796 IEXPLORE.EXE 1104 iexplore.exe 1104 iexplore.exe 1196 IEXPLORE.EXE 1196 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exedescription pid process target process PID 2036 wrote to memory of 1036 2036 iexplore.exe IEXPLORE.EXE PID 2036 wrote to memory of 1036 2036 iexplore.exe IEXPLORE.EXE PID 2036 wrote to memory of 1036 2036 iexplore.exe IEXPLORE.EXE PID 2036 wrote to memory of 1036 2036 iexplore.exe IEXPLORE.EXE PID 1176 wrote to memory of 1832 1176 iexplore.exe IEXPLORE.EXE PID 1176 wrote to memory of 1832 1176 iexplore.exe IEXPLORE.EXE PID 1176 wrote to memory of 1832 1176 iexplore.exe IEXPLORE.EXE PID 1176 wrote to memory of 1832 1176 iexplore.exe IEXPLORE.EXE PID 1164 wrote to memory of 692 1164 iexplore.exe IEXPLORE.EXE PID 1164 wrote to memory of 692 1164 iexplore.exe IEXPLORE.EXE PID 1164 wrote to memory of 692 1164 iexplore.exe IEXPLORE.EXE PID 1164 wrote to memory of 692 1164 iexplore.exe IEXPLORE.EXE PID 1020 wrote to memory of 1072 1020 iexplore.exe IEXPLORE.EXE PID 1020 wrote to memory of 1072 1020 iexplore.exe IEXPLORE.EXE PID 1020 wrote to memory of 1072 1020 iexplore.exe IEXPLORE.EXE PID 1020 wrote to memory of 1072 1020 iexplore.exe IEXPLORE.EXE PID 812 wrote to memory of 796 812 iexplore.exe IEXPLORE.EXE PID 812 wrote to memory of 796 812 iexplore.exe IEXPLORE.EXE PID 812 wrote to memory of 796 812 iexplore.exe IEXPLORE.EXE PID 812 wrote to memory of 796 812 iexplore.exe IEXPLORE.EXE PID 1104 wrote to memory of 1196 1104 iexplore.exe IEXPLORE.EXE PID 1104 wrote to memory of 1196 1104 iexplore.exe IEXPLORE.EXE PID 1104 wrote to memory of 1196 1104 iexplore.exe IEXPLORE.EXE PID 1104 wrote to memory of 1196 1104 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\76c8a9dbff9b571500729611595f1a1bce8dab543922d731c3bb42af5477f517.exe"C:\Users\Admin\AppData\Local\Temp\76c8a9dbff9b571500729611595f1a1bce8dab543922d731c3bb42af5477f517.exe"1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1176 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1164 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1020 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:812 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1104 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9sinn1d\imagestore.datMD5
939e7d52deb3eb1d35e6bdad7d8f54f0
SHA1333e4d9b4b00e78d5da5d799decd6f0d8face1ad
SHA256b912515457694b73c9531a2e40cd234ab95b14c757172f42a012d6f8fe089e28
SHA512426cdaeea6bb74ee11ee0028ce37aac498acfa278b50a442329fef69ba970d9a421e13958fa85ba80155af60b9f5ad60160c823c21cef6adfa4da063d15e42bc
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9sinn1d\imagestore.datMD5
939e7d52deb3eb1d35e6bdad7d8f54f0
SHA1333e4d9b4b00e78d5da5d799decd6f0d8face1ad
SHA256b912515457694b73c9531a2e40cd234ab95b14c757172f42a012d6f8fe089e28
SHA512426cdaeea6bb74ee11ee0028ce37aac498acfa278b50a442329fef69ba970d9a421e13958fa85ba80155af60b9f5ad60160c823c21cef6adfa4da063d15e42bc
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9sinn1d\imagestore.datMD5
939e7d52deb3eb1d35e6bdad7d8f54f0
SHA1333e4d9b4b00e78d5da5d799decd6f0d8face1ad
SHA256b912515457694b73c9531a2e40cd234ab95b14c757172f42a012d6f8fe089e28
SHA512426cdaeea6bb74ee11ee0028ce37aac498acfa278b50a442329fef69ba970d9a421e13958fa85ba80155af60b9f5ad60160c823c21cef6adfa4da063d15e42bc
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9sinn1d\imagestore.datMD5
939e7d52deb3eb1d35e6bdad7d8f54f0
SHA1333e4d9b4b00e78d5da5d799decd6f0d8face1ad
SHA256b912515457694b73c9531a2e40cd234ab95b14c757172f42a012d6f8fe089e28
SHA512426cdaeea6bb74ee11ee0028ce37aac498acfa278b50a442329fef69ba970d9a421e13958fa85ba80155af60b9f5ad60160c823c21cef6adfa4da063d15e42bc
-
memory/316-1-0x000007FEF6B50000-0x000007FEF6DCA000-memory.dmpFilesize
2.5MB
-
memory/692-8-0x0000000000000000-mapping.dmp
-
memory/796-14-0x0000000000000000-mapping.dmp
-
memory/1036-3-0x0000000006990000-0x00000000069B3000-memory.dmpFilesize
140KB
-
memory/1036-4-0x0000000004D90000-0x0000000004D93000-memory.dmpFilesize
12KB
-
memory/1036-2-0x0000000000000000-mapping.dmp
-
memory/1072-11-0x0000000000000000-mapping.dmp
-
memory/1196-17-0x0000000000000000-mapping.dmp
-
memory/1508-0-0x00000000001B0000-0x00000000001C2000-memory.dmpFilesize
72KB
-
memory/1832-5-0x0000000000000000-mapping.dmp