Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
06-05-2021 01:56
Static task
static1
Behavioral task
behavioral1
Sample
Factura Serfinanza051053709735077235764653194.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Factura Serfinanza051053709735077235764653194.exe
Resource
win10v20210410
General
-
Target
Factura Serfinanza051053709735077235764653194.exe
-
Size
3.3MB
-
MD5
8e3a6cfb86a8c0696133c3526fe9f04b
-
SHA1
0f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
-
SHA256
673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
-
SHA512
ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
Malware Config
Extracted
remcos
databasepropersonombrecomercialideasearchwords.services:3521
Signatures
-
Nirsoft 7 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\AdvancedRun.exe Nirsoft -
Executes dropped EXE 3 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exePxxoServicesTrialNet1.exepid process 1092 AdvancedRun.exe 1840 AdvancedRun.exe 1592 PxxoServicesTrialNet1.exe -
Loads dropped DLL 6 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exeAdvancedRun.execmd.exepid process 1820 Factura Serfinanza051053709735077235764653194.exe 1820 Factura Serfinanza051053709735077235764653194.exe 1092 AdvancedRun.exe 1092 AdvancedRun.exe 344 cmd.exe 344 cmd.exe -
Processes:
Factura Serfinanza051053709735077235764653194.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths Factura Serfinanza051053709735077235764653194.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe = "0" Factura Serfinanza051053709735077235764653194.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" Factura Serfinanza051053709735077235764653194.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" Factura Serfinanza051053709735077235764653194.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Factura Serfinanza051053709735077235764653194.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" Factura Serfinanza051053709735077235764653194.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exepid process 1820 Factura Serfinanza051053709735077235764653194.exe 1820 Factura Serfinanza051053709735077235764653194.exe 1820 Factura Serfinanza051053709735077235764653194.exe 1820 Factura Serfinanza051053709735077235764653194.exe 1820 Factura Serfinanza051053709735077235764653194.exe 1820 Factura Serfinanza051053709735077235764653194.exe 1820 Factura Serfinanza051053709735077235764653194.exe 1820 Factura Serfinanza051053709735077235764653194.exe 1820 Factura Serfinanza051053709735077235764653194.exe 1820 Factura Serfinanza051053709735077235764653194.exe 1820 Factura Serfinanza051053709735077235764653194.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exedescription pid process target process PID 1820 set thread context of 920 1820 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 812 timeout.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepowershell.exeFactura Serfinanza051053709735077235764653194.exepid process 1092 AdvancedRun.exe 1092 AdvancedRun.exe 1840 AdvancedRun.exe 1840 AdvancedRun.exe 1700 powershell.exe 1820 Factura Serfinanza051053709735077235764653194.exe 1820 Factura Serfinanza051053709735077235764653194.exe 1820 Factura Serfinanza051053709735077235764653194.exe 1700 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepowershell.exeFactura Serfinanza051053709735077235764653194.exedescription pid process Token: SeDebugPrivilege 1092 AdvancedRun.exe Token: SeImpersonatePrivilege 1092 AdvancedRun.exe Token: SeDebugPrivilege 1840 AdvancedRun.exe Token: SeImpersonatePrivilege 1840 AdvancedRun.exe Token: SeDebugPrivilege 1700 powershell.exe Token: SeDebugPrivilege 1820 Factura Serfinanza051053709735077235764653194.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exeAdvancedRun.execmd.exeFactura Serfinanza051053709735077235764653194.exeWScript.execmd.exedescription pid process target process PID 1820 wrote to memory of 1092 1820 Factura Serfinanza051053709735077235764653194.exe AdvancedRun.exe PID 1820 wrote to memory of 1092 1820 Factura Serfinanza051053709735077235764653194.exe AdvancedRun.exe PID 1820 wrote to memory of 1092 1820 Factura Serfinanza051053709735077235764653194.exe AdvancedRun.exe PID 1820 wrote to memory of 1092 1820 Factura Serfinanza051053709735077235764653194.exe AdvancedRun.exe PID 1092 wrote to memory of 1840 1092 AdvancedRun.exe AdvancedRun.exe PID 1092 wrote to memory of 1840 1092 AdvancedRun.exe AdvancedRun.exe PID 1092 wrote to memory of 1840 1092 AdvancedRun.exe AdvancedRun.exe PID 1092 wrote to memory of 1840 1092 AdvancedRun.exe AdvancedRun.exe PID 1820 wrote to memory of 1700 1820 Factura Serfinanza051053709735077235764653194.exe powershell.exe PID 1820 wrote to memory of 1700 1820 Factura Serfinanza051053709735077235764653194.exe powershell.exe PID 1820 wrote to memory of 1700 1820 Factura Serfinanza051053709735077235764653194.exe powershell.exe PID 1820 wrote to memory of 1700 1820 Factura Serfinanza051053709735077235764653194.exe powershell.exe PID 1820 wrote to memory of 1876 1820 Factura Serfinanza051053709735077235764653194.exe cmd.exe PID 1820 wrote to memory of 1876 1820 Factura Serfinanza051053709735077235764653194.exe cmd.exe PID 1820 wrote to memory of 1876 1820 Factura Serfinanza051053709735077235764653194.exe cmd.exe PID 1820 wrote to memory of 1876 1820 Factura Serfinanza051053709735077235764653194.exe cmd.exe PID 1876 wrote to memory of 812 1876 cmd.exe timeout.exe PID 1876 wrote to memory of 812 1876 cmd.exe timeout.exe PID 1876 wrote to memory of 812 1876 cmd.exe timeout.exe PID 1876 wrote to memory of 812 1876 cmd.exe timeout.exe PID 1820 wrote to memory of 920 1820 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1820 wrote to memory of 920 1820 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1820 wrote to memory of 920 1820 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1820 wrote to memory of 920 1820 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1820 wrote to memory of 920 1820 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1820 wrote to memory of 920 1820 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1820 wrote to memory of 920 1820 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1820 wrote to memory of 920 1820 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1820 wrote to memory of 920 1820 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1820 wrote to memory of 920 1820 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1820 wrote to memory of 920 1820 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 920 wrote to memory of 848 920 Factura Serfinanza051053709735077235764653194.exe WScript.exe PID 920 wrote to memory of 848 920 Factura Serfinanza051053709735077235764653194.exe WScript.exe PID 920 wrote to memory of 848 920 Factura Serfinanza051053709735077235764653194.exe WScript.exe PID 920 wrote to memory of 848 920 Factura Serfinanza051053709735077235764653194.exe WScript.exe PID 848 wrote to memory of 344 848 WScript.exe cmd.exe PID 848 wrote to memory of 344 848 WScript.exe cmd.exe PID 848 wrote to memory of 344 848 WScript.exe cmd.exe PID 848 wrote to memory of 344 848 WScript.exe cmd.exe PID 344 wrote to memory of 1592 344 cmd.exe PxxoServicesTrialNet1.exe PID 344 wrote to memory of 1592 344 cmd.exe PxxoServicesTrialNet1.exe PID 344 wrote to memory of 1592 344 cmd.exe PxxoServicesTrialNet1.exe PID 344 wrote to memory of 1592 344 cmd.exe PxxoServicesTrialNet1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"1⤵
- Loads dropped DLL
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\AdvancedRun.exe" /SpecialRun 4101d8 10923⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeC:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
a39af763b1c09ead3c98a6a615f377fe
SHA19bd3d39c89e47fe7072270ecc80b810103235c03
SHA256a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f
SHA5123ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8e3a6cfb86a8c0696133c3526fe9f04b
SHA10f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
SHA256673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
SHA512ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8e3a6cfb86a8c0696133c3526fe9f04b
SHA10f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
SHA256673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
SHA512ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
-
\Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\ad15fbd3-75b4-438b-b9f0-1033176ae907\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8e3a6cfb86a8c0696133c3526fe9f04b
SHA10f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
SHA256673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
SHA512ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
-
\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8e3a6cfb86a8c0696133c3526fe9f04b
SHA10f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
SHA256673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
SHA512ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
-
memory/344-92-0x0000000000000000-mapping.dmp
-
memory/812-78-0x0000000000000000-mapping.dmp
-
memory/848-87-0x0000000000000000-mapping.dmp
-
memory/920-84-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/920-91-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/920-85-0x0000000000413FA4-mapping.dmp
-
memory/1092-65-0x0000000000000000-mapping.dmp
-
memory/1092-68-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB
-
memory/1592-98-0x0000000001070000-0x0000000001071000-memory.dmpFilesize
4KB
-
memory/1592-96-0x0000000000000000-mapping.dmp
-
memory/1700-79-0x0000000001ED0000-0x0000000001ED1000-memory.dmpFilesize
4KB
-
memory/1700-106-0x00000000060D0000-0x00000000060D1000-memory.dmpFilesize
4KB
-
memory/1700-80-0x0000000004820000-0x0000000004821000-memory.dmpFilesize
4KB
-
memory/1700-90-0x0000000004790000-0x0000000004791000-memory.dmpFilesize
4KB
-
memory/1700-83-0x00000000021C0000-0x00000000021C1000-memory.dmpFilesize
4KB
-
memory/1700-130-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/1700-82-0x00000000047E2000-0x00000000047E3000-memory.dmpFilesize
4KB
-
memory/1700-115-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/1700-131-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/1700-116-0x0000000005FA0000-0x0000000005FA1000-memory.dmpFilesize
4KB
-
memory/1700-75-0x0000000000000000-mapping.dmp
-
memory/1700-111-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1700-101-0x0000000006040000-0x0000000006041000-memory.dmpFilesize
4KB
-
memory/1700-81-0x00000000047E0000-0x00000000047E1000-memory.dmpFilesize
4KB
-
memory/1700-107-0x0000000006120000-0x0000000006121000-memory.dmpFilesize
4KB
-
memory/1820-62-0x0000000000BC0000-0x0000000000C44000-memory.dmpFilesize
528KB
-
memory/1820-67-0x00000000009E0000-0x00000000009E1000-memory.dmpFilesize
4KB
-
memory/1820-60-0x0000000001340000-0x0000000001341000-memory.dmpFilesize
4KB
-
memory/1840-72-0x0000000000000000-mapping.dmp
-
memory/1876-77-0x0000000000000000-mapping.dmp