Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-02-2021 06:55
Static task
static1
Behavioral task
behavioral1
Sample
FedEx's AWB#5305323204643.exe
Resource
win7v20201028
General
-
Target
FedEx's AWB#5305323204643.exe
-
Size
20KB
-
MD5
b3e24269e8f4d613dab013ba26e08f8a
-
SHA1
81adf63b98379e81b82925ccc64c7a219b81a7fd
-
SHA256
3dfc4c40e95c69c2f87baf8ce364a350823404e78bb4ed97807330f398753f76
-
SHA512
477d9eefcd769cceb181df5d11038b8d9ca6b8a42d027b15cdb0c7eb0999e228041b0a86fa746ed26b1adf1e2bc73a83acff9751fba9816570945ca0d23176ea
Malware Config
Extracted
nanocore
1.2.2.0
185.157.160.233:2212
annapro.linkpc.net:2212
5c958888-f81c-42a4-939d-31983a2cd9ba
-
activate_away_mode
true
-
backup_connection_host
annapro.linkpc.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-10-24T06:39:59.095270636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2212
-
default_group
wuzzy122
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
5c958888-f81c-42a4-939d-31983a2cd9ba
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
185.157.160.233
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Nirsoft 7 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\AdvancedRun.exe Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepid process 1312 AdvancedRun.exe 1016 AdvancedRun.exe -
Loads dropped DLL 4 IoCs
Processes:
FedEx's AWB#5305323204643.exeAdvancedRun.exepid process 1852 FedEx's AWB#5305323204643.exe 1852 FedEx's AWB#5305323204643.exe 1312 AdvancedRun.exe 1312 AdvancedRun.exe -
Processes:
FedEx's AWB#5305323204643.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe = "0" FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Resources\Themes\OGQgtbhjcqQVstkulzRPyghcHKV\svchost.exe = "0" FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" FedEx's AWB#5305323204643.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
FedEx's AWB#5305323204643.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lAKVROuKlb = "explorer.exe \"C:\\Windows\\Resources\\Themes\\OGQgtbhjcqQVstkulzRPyghcHKV\\svchost.exe\"" FedEx's AWB#5305323204643.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
Processes:
FedEx's AWB#5305323204643.exepid process 1852 FedEx's AWB#5305323204643.exe 1852 FedEx's AWB#5305323204643.exe 1852 FedEx's AWB#5305323204643.exe 1852 FedEx's AWB#5305323204643.exe 1852 FedEx's AWB#5305323204643.exe 1852 FedEx's AWB#5305323204643.exe 1852 FedEx's AWB#5305323204643.exe 1852 FedEx's AWB#5305323204643.exe 1852 FedEx's AWB#5305323204643.exe 1852 FedEx's AWB#5305323204643.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
FedEx's AWB#5305323204643.exedescription pid process target process PID 1852 set thread context of 928 1852 FedEx's AWB#5305323204643.exe installutil.exe -
Drops file in Windows directory 2 IoCs
Processes:
FedEx's AWB#5305323204643.exedescription ioc process File created C:\Windows\Resources\Themes\OGQgtbhjcqQVstkulzRPyghcHKV\svchost.exe FedEx's AWB#5305323204643.exe File opened for modification C:\Windows\Resources\Themes\OGQgtbhjcqQVstkulzRPyghcHKV\svchost.exe FedEx's AWB#5305323204643.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 328 1852 WerFault.exe FedEx's AWB#5305323204643.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 964 timeout.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
powershell.exeAdvancedRun.exeAdvancedRun.exepowershell.exeFedEx's AWB#5305323204643.exeWerFault.exeinstallutil.exepid process 776 powershell.exe 1312 AdvancedRun.exe 1312 AdvancedRun.exe 1016 AdvancedRun.exe 1016 AdvancedRun.exe 776 powershell.exe 1384 powershell.exe 1384 powershell.exe 1852 FedEx's AWB#5305323204643.exe 1852 FedEx's AWB#5305323204643.exe 1852 FedEx's AWB#5305323204643.exe 328 WerFault.exe 328 WerFault.exe 328 WerFault.exe 328 WerFault.exe 328 WerFault.exe 928 installutil.exe 928 installutil.exe 928 installutil.exe 928 installutil.exe 928 installutil.exe 928 installutil.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
installutil.exepid process 928 installutil.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
FedEx's AWB#5305323204643.exeAdvancedRun.exepowershell.exeAdvancedRun.exepowershell.exeWerFault.exeinstallutil.exedescription pid process Token: SeDebugPrivilege 1852 FedEx's AWB#5305323204643.exe Token: SeDebugPrivilege 1312 AdvancedRun.exe Token: SeDebugPrivilege 776 powershell.exe Token: SeImpersonatePrivilege 1312 AdvancedRun.exe Token: SeDebugPrivilege 1016 AdvancedRun.exe Token: SeImpersonatePrivilege 1016 AdvancedRun.exe Token: SeDebugPrivilege 1384 powershell.exe Token: SeDebugPrivilege 328 WerFault.exe Token: SeDebugPrivilege 928 installutil.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
FedEx's AWB#5305323204643.exeAdvancedRun.execmd.exedescription pid process target process PID 1852 wrote to memory of 776 1852 FedEx's AWB#5305323204643.exe powershell.exe PID 1852 wrote to memory of 776 1852 FedEx's AWB#5305323204643.exe powershell.exe PID 1852 wrote to memory of 776 1852 FedEx's AWB#5305323204643.exe powershell.exe PID 1852 wrote to memory of 776 1852 FedEx's AWB#5305323204643.exe powershell.exe PID 1852 wrote to memory of 1312 1852 FedEx's AWB#5305323204643.exe AdvancedRun.exe PID 1852 wrote to memory of 1312 1852 FedEx's AWB#5305323204643.exe AdvancedRun.exe PID 1852 wrote to memory of 1312 1852 FedEx's AWB#5305323204643.exe AdvancedRun.exe PID 1852 wrote to memory of 1312 1852 FedEx's AWB#5305323204643.exe AdvancedRun.exe PID 1312 wrote to memory of 1016 1312 AdvancedRun.exe AdvancedRun.exe PID 1312 wrote to memory of 1016 1312 AdvancedRun.exe AdvancedRun.exe PID 1312 wrote to memory of 1016 1312 AdvancedRun.exe AdvancedRun.exe PID 1312 wrote to memory of 1016 1312 AdvancedRun.exe AdvancedRun.exe PID 1852 wrote to memory of 1384 1852 FedEx's AWB#5305323204643.exe powershell.exe PID 1852 wrote to memory of 1384 1852 FedEx's AWB#5305323204643.exe powershell.exe PID 1852 wrote to memory of 1384 1852 FedEx's AWB#5305323204643.exe powershell.exe PID 1852 wrote to memory of 1384 1852 FedEx's AWB#5305323204643.exe powershell.exe PID 1852 wrote to memory of 1620 1852 FedEx's AWB#5305323204643.exe cmd.exe PID 1852 wrote to memory of 1620 1852 FedEx's AWB#5305323204643.exe cmd.exe PID 1852 wrote to memory of 1620 1852 FedEx's AWB#5305323204643.exe cmd.exe PID 1852 wrote to memory of 1620 1852 FedEx's AWB#5305323204643.exe cmd.exe PID 1620 wrote to memory of 964 1620 cmd.exe timeout.exe PID 1620 wrote to memory of 964 1620 cmd.exe timeout.exe PID 1620 wrote to memory of 964 1620 cmd.exe timeout.exe PID 1620 wrote to memory of 964 1620 cmd.exe timeout.exe PID 1852 wrote to memory of 928 1852 FedEx's AWB#5305323204643.exe installutil.exe PID 1852 wrote to memory of 928 1852 FedEx's AWB#5305323204643.exe installutil.exe PID 1852 wrote to memory of 928 1852 FedEx's AWB#5305323204643.exe installutil.exe PID 1852 wrote to memory of 928 1852 FedEx's AWB#5305323204643.exe installutil.exe PID 1852 wrote to memory of 928 1852 FedEx's AWB#5305323204643.exe installutil.exe PID 1852 wrote to memory of 928 1852 FedEx's AWB#5305323204643.exe installutil.exe PID 1852 wrote to memory of 928 1852 FedEx's AWB#5305323204643.exe installutil.exe PID 1852 wrote to memory of 928 1852 FedEx's AWB#5305323204643.exe installutil.exe PID 1852 wrote to memory of 928 1852 FedEx's AWB#5305323204643.exe installutil.exe PID 1852 wrote to memory of 928 1852 FedEx's AWB#5305323204643.exe installutil.exe PID 1852 wrote to memory of 928 1852 FedEx's AWB#5305323204643.exe installutil.exe PID 1852 wrote to memory of 928 1852 FedEx's AWB#5305323204643.exe installutil.exe PID 1852 wrote to memory of 328 1852 FedEx's AWB#5305323204643.exe WerFault.exe PID 1852 wrote to memory of 328 1852 FedEx's AWB#5305323204643.exe WerFault.exe PID 1852 wrote to memory of 328 1852 FedEx's AWB#5305323204643.exe WerFault.exe PID 1852 wrote to memory of 328 1852 FedEx's AWB#5305323204643.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe"C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe"1⤵
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\OGQgtbhjcqQVstkulzRPyghcHKV\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:776 -
C:\Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\AdvancedRun.exe" /SpecialRun 4101d8 13123⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1384 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:964 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:928 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 14482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:328
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
11903fea4d6138c1a12d3a160917f2d8
SHA195a0f2b71951d347847f4ea91edbc5cb15c1f2a1
SHA2567a1ca816004c1875d487750942cb424a7d869ee3a992b0996741642348df47b8
SHA512572904333ef54a085fd3913b6ad5563cb92be9c6a2d2654fd5f3800f0dc7f0805c9cb7bf57f636460e9389df8efdd07bd7e63b65a8470fb6ad98e82354404290
-
\Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\480aa062-04a7-4e94-bd9b-8f7e1beb86d0\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
memory/328-84-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/328-78-0x0000000001DE0000-0x0000000001DF1000-memory.dmpFilesize
68KB
-
memory/328-77-0x0000000000000000-mapping.dmp
-
memory/776-43-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/776-58-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/776-11-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/776-10-0x00000000021A0000-0x00000000021A1000-memory.dmpFilesize
4KB
-
memory/776-9-0x0000000074840000-0x0000000074F2E000-memory.dmpFilesize
6.9MB
-
memory/776-7-0x0000000000000000-mapping.dmp
-
memory/776-8-0x00000000756C1000-0x00000000756C3000-memory.dmpFilesize
8KB
-
memory/776-24-0x0000000004AA2000-0x0000000004AA3000-memory.dmpFilesize
4KB
-
memory/776-23-0x0000000004AA0000-0x0000000004AA1000-memory.dmpFilesize
4KB
-
memory/776-25-0x0000000002590000-0x0000000002591000-memory.dmpFilesize
4KB
-
memory/776-26-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/776-29-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/776-34-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/776-35-0x0000000006180000-0x0000000006181000-memory.dmpFilesize
4KB
-
memory/776-42-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/776-59-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/776-54-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/928-72-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/928-79-0x0000000000360000-0x0000000000365000-memory.dmpFilesize
20KB
-
memory/928-83-0x0000000004D65000-0x0000000004D76000-memory.dmpFilesize
68KB
-
memory/928-82-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB
-
memory/928-81-0x00000000003D0000-0x00000000003D3000-memory.dmpFilesize
12KB
-
memory/928-80-0x0000000000370000-0x0000000000389000-memory.dmpFilesize
100KB
-
memory/928-75-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/928-74-0x0000000074840000-0x0000000074F2E000-memory.dmpFilesize
6.9MB
-
memory/928-73-0x000000000041E792-mapping.dmp
-
memory/964-63-0x0000000000000000-mapping.dmp
-
memory/1016-20-0x0000000000000000-mapping.dmp
-
memory/1312-14-0x0000000000000000-mapping.dmp
-
memory/1384-67-0x0000000004800000-0x0000000004801000-memory.dmpFilesize
4KB
-
memory/1384-68-0x0000000002300000-0x0000000002301000-memory.dmpFilesize
4KB
-
memory/1384-71-0x0000000002772000-0x0000000002773000-memory.dmpFilesize
4KB
-
memory/1384-66-0x0000000000B50000-0x0000000000B51000-memory.dmpFilesize
4KB
-
memory/1384-65-0x0000000074840000-0x0000000074F2E000-memory.dmpFilesize
6.9MB
-
memory/1384-70-0x0000000002770000-0x0000000002771000-memory.dmpFilesize
4KB
-
memory/1384-69-0x0000000005300000-0x0000000005301000-memory.dmpFilesize
4KB
-
memory/1384-60-0x0000000000000000-mapping.dmp
-
memory/1620-61-0x0000000000000000-mapping.dmp
-
memory/1852-6-0x0000000000620000-0x00000000006C9000-memory.dmpFilesize
676KB
-
memory/1852-5-0x0000000004230000-0x0000000004231000-memory.dmpFilesize
4KB
-
memory/1852-2-0x0000000074840000-0x0000000074F2E000-memory.dmpFilesize
6.9MB
-
memory/1852-3-0x0000000000920000-0x0000000000921000-memory.dmpFilesize
4KB