Analysis
-
max time kernel
120s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
08-05-2021 13:01
Static task
static1
Behavioral task
behavioral1
Sample
AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe
Resource
win7v20210410
General
-
Target
AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe
-
Size
444KB
-
MD5
fd442753c3895d868eed72f7854e2fba
-
SHA1
477dc12f213dd05a15b61207926b478d3a0d04c7
-
SHA256
aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202
-
SHA512
1a7ff91196019abe9dfa93bfaca299ecd87693ef173560951b4d55f9d0c66355535bef724de26865205419e7638e57c762e332d7eff85187e9695f0a92e1d0c2
Malware Config
Signatures
-
CrypVault
Ransomware family which makes encrypted files look like they have been quarantined by AV.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3968 3676 cmd.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 2568 bcdedit.exe 3416 bcdedit.exe -
Executes dropped EXE 3 IoCs
Processes:
7za.exe2D4F861D8D.exe2D4F861D8D.exepid process 2148 7za.exe 2928 2D4F861D8D.exe 472 2D4F861D8D.exe -
Processes:
resource yara_rule behavioral2/memory/472-129-0x0000000000400000-0x0000000000E28000-memory.dmp upx behavioral2/memory/472-138-0x0000000000400000-0x000000000041A000-memory.dmp upx -
Drops startup file 2 IoCs
Processes:
2D4F861D8D.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta 2D4F861D8D.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta 2D4F861D8D.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
2D4F861D8D.exedescription pid process target process PID 2928 set thread context of 472 2928 2D4F861D8D.exe 2D4F861D8D.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3868 vssadmin.exe -
Modifies registry class 2 IoCs
Processes:
AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe2D4F861D8D.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings 2D4F861D8D.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 1276 WINWORD.EXE 1276 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
2D4F861D8D.exe2D4F861D8D.exepid process 2928 2D4F861D8D.exe 2928 2D4F861D8D.exe 472 2D4F861D8D.exe 472 2D4F861D8D.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2D4F861D8D.exeWMIC.exevssvc.exedescription pid process Token: SeImpersonatePrivilege 472 2D4F861D8D.exe Token: SeTcbPrivilege 472 2D4F861D8D.exe Token: SeChangeNotifyPrivilege 472 2D4F861D8D.exe Token: SeCreateTokenPrivilege 472 2D4F861D8D.exe Token: SeBackupPrivilege 472 2D4F861D8D.exe Token: SeRestorePrivilege 472 2D4F861D8D.exe Token: SeIncreaseQuotaPrivilege 472 2D4F861D8D.exe Token: SeAssignPrimaryTokenPrivilege 472 2D4F861D8D.exe Token: SeIncreaseQuotaPrivilege 1896 WMIC.exe Token: SeSecurityPrivilege 1896 WMIC.exe Token: SeTakeOwnershipPrivilege 1896 WMIC.exe Token: SeLoadDriverPrivilege 1896 WMIC.exe Token: SeSystemProfilePrivilege 1896 WMIC.exe Token: SeSystemtimePrivilege 1896 WMIC.exe Token: SeProfSingleProcessPrivilege 1896 WMIC.exe Token: SeIncBasePriorityPrivilege 1896 WMIC.exe Token: SeCreatePagefilePrivilege 1896 WMIC.exe Token: SeBackupPrivilege 1896 WMIC.exe Token: SeRestorePrivilege 1896 WMIC.exe Token: SeShutdownPrivilege 1896 WMIC.exe Token: SeDebugPrivilege 1896 WMIC.exe Token: SeSystemEnvironmentPrivilege 1896 WMIC.exe Token: SeRemoteShutdownPrivilege 1896 WMIC.exe Token: SeUndockPrivilege 1896 WMIC.exe Token: SeManageVolumePrivilege 1896 WMIC.exe Token: 33 1896 WMIC.exe Token: 34 1896 WMIC.exe Token: 35 1896 WMIC.exe Token: 36 1896 WMIC.exe Token: SeIncreaseQuotaPrivilege 1896 WMIC.exe Token: SeSecurityPrivilege 1896 WMIC.exe Token: SeTakeOwnershipPrivilege 1896 WMIC.exe Token: SeLoadDriverPrivilege 1896 WMIC.exe Token: SeSystemProfilePrivilege 1896 WMIC.exe Token: SeSystemtimePrivilege 1896 WMIC.exe Token: SeProfSingleProcessPrivilege 1896 WMIC.exe Token: SeIncBasePriorityPrivilege 1896 WMIC.exe Token: SeCreatePagefilePrivilege 1896 WMIC.exe Token: SeBackupPrivilege 1896 WMIC.exe Token: SeRestorePrivilege 1896 WMIC.exe Token: SeShutdownPrivilege 1896 WMIC.exe Token: SeDebugPrivilege 1896 WMIC.exe Token: SeSystemEnvironmentPrivilege 1896 WMIC.exe Token: SeRemoteShutdownPrivilege 1896 WMIC.exe Token: SeUndockPrivilege 1896 WMIC.exe Token: SeManageVolumePrivilege 1896 WMIC.exe Token: 33 1896 WMIC.exe Token: 34 1896 WMIC.exe Token: 35 1896 WMIC.exe Token: 36 1896 WMIC.exe Token: SeBackupPrivilege 1280 vssvc.exe Token: SeRestorePrivilege 1280 vssvc.exe Token: SeAuditPrivilege 1280 vssvc.exe Token: SeImpersonatePrivilege 472 2D4F861D8D.exe Token: SeTcbPrivilege 472 2D4F861D8D.exe Token: SeChangeNotifyPrivilege 472 2D4F861D8D.exe Token: SeCreateTokenPrivilege 472 2D4F861D8D.exe Token: SeBackupPrivilege 472 2D4F861D8D.exe Token: SeRestorePrivilege 472 2D4F861D8D.exe Token: SeIncreaseQuotaPrivilege 472 2D4F861D8D.exe Token: SeAssignPrimaryTokenPrivilege 472 2D4F861D8D.exe Token: SeImpersonatePrivilege 472 2D4F861D8D.exe Token: SeTcbPrivilege 472 2D4F861D8D.exe Token: SeChangeNotifyPrivilege 472 2D4F861D8D.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
2D4F861D8D.exeWINWORD.EXEpid process 2928 2D4F861D8D.exe 2928 2D4F861D8D.exe 1276 WINWORD.EXE 1276 WINWORD.EXE 1276 WINWORD.EXE 1276 WINWORD.EXE -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe2D4F861D8D.exe2D4F861D8D.execmd.exedescription pid process target process PID 3152 wrote to memory of 3704 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe cmd.exe PID 3152 wrote to memory of 3704 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe cmd.exe PID 3152 wrote to memory of 3704 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe cmd.exe PID 3152 wrote to memory of 1028 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe cmd.exe PID 3152 wrote to memory of 1028 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe cmd.exe PID 3152 wrote to memory of 1028 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe cmd.exe PID 3152 wrote to memory of 1660 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe cmd.exe PID 3152 wrote to memory of 1660 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe cmd.exe PID 3152 wrote to memory of 1660 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe cmd.exe PID 3152 wrote to memory of 2148 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 7za.exe PID 3152 wrote to memory of 2148 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 7za.exe PID 3152 wrote to memory of 2148 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 7za.exe PID 3152 wrote to memory of 1128 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe cmd.exe PID 3152 wrote to memory of 1128 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe cmd.exe PID 3152 wrote to memory of 1128 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe cmd.exe PID 3152 wrote to memory of 1276 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe WINWORD.EXE PID 3152 wrote to memory of 1276 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe WINWORD.EXE PID 3152 wrote to memory of 3612 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe cmd.exe PID 3152 wrote to memory of 3612 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe cmd.exe PID 3152 wrote to memory of 3612 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe cmd.exe PID 3152 wrote to memory of 2928 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 2D4F861D8D.exe PID 3152 wrote to memory of 2928 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 2D4F861D8D.exe PID 3152 wrote to memory of 2928 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 2D4F861D8D.exe PID 3152 wrote to memory of 3900 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe cmd.exe PID 3152 wrote to memory of 3900 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe cmd.exe PID 3152 wrote to memory of 3900 3152 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe cmd.exe PID 2928 wrote to memory of 472 2928 2D4F861D8D.exe 2D4F861D8D.exe PID 2928 wrote to memory of 472 2928 2D4F861D8D.exe 2D4F861D8D.exe PID 2928 wrote to memory of 472 2928 2D4F861D8D.exe 2D4F861D8D.exe PID 2928 wrote to memory of 472 2928 2D4F861D8D.exe 2D4F861D8D.exe PID 2928 wrote to memory of 472 2928 2D4F861D8D.exe 2D4F861D8D.exe PID 2928 wrote to memory of 472 2928 2D4F861D8D.exe 2D4F861D8D.exe PID 2928 wrote to memory of 472 2928 2D4F861D8D.exe 2D4F861D8D.exe PID 2928 wrote to memory of 472 2928 2D4F861D8D.exe 2D4F861D8D.exe PID 2928 wrote to memory of 472 2928 2D4F861D8D.exe 2D4F861D8D.exe PID 2928 wrote to memory of 472 2928 2D4F861D8D.exe 2D4F861D8D.exe PID 2928 wrote to memory of 472 2928 2D4F861D8D.exe 2D4F861D8D.exe PID 472 wrote to memory of 2872 472 2D4F861D8D.exe mshta.exe PID 472 wrote to memory of 2872 472 2D4F861D8D.exe mshta.exe PID 472 wrote to memory of 2872 472 2D4F861D8D.exe mshta.exe PID 472 wrote to memory of 1896 472 2D4F861D8D.exe WMIC.exe PID 472 wrote to memory of 1896 472 2D4F861D8D.exe WMIC.exe PID 472 wrote to memory of 1896 472 2D4F861D8D.exe WMIC.exe PID 3968 wrote to memory of 3868 3968 cmd.exe vssadmin.exe PID 3968 wrote to memory of 3868 3968 cmd.exe vssadmin.exe PID 3968 wrote to memory of 2568 3968 cmd.exe bcdedit.exe PID 3968 wrote to memory of 2568 3968 cmd.exe bcdedit.exe PID 3968 wrote to memory of 3416 3968 cmd.exe bcdedit.exe PID 3968 wrote to memory of 3416 3968 cmd.exe bcdedit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe"C:\Users\Admin\AppData\Local\Temp\AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 2D4F861D8DCF8C8F2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\CF8C8F" 7za.exe2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 2D4F861D8DCF8C8F2⤵
-
C:\Users\Admin\AppData\Local\Temp\7za.exe"C:\Users\Admin\AppData\Local\Temp\7za.exe" e "C:\Users\Admin\AppData\Local\Temp\2D4F861D8D" -y -p2D4F861D8D2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 2D4F861D8DCF8C8F2⤵
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 2D4F861D8DCF8C8F2⤵
-
C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.exe"C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.exe"C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\VAULT.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}4⤵
-
C:\Windows\SysWOW64\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" process call create "cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 2D4F861D8DCF8C8F2⤵
-
C:\Windows\system32\cmd.execmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no2⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2D4F861D8DMD5
efe5c5a45d6b6746daa3272d09e175d7
SHA180a805c3e5a73a121ecbc2c2aed0b2e846890477
SHA2565f0156b73d2b9f5d0a999734812ca0d0881fe683a331737df9ded5d24a145271
SHA512410553b0c58e699fb83557815cdc4e22dec1b14e870326f62dd09c2e26bd8d5c8a1fde66470a55f1cfa4b076be66747595f83cfa71070d38c6d7f01846b70a75
-
C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.docMD5
efcd0a5ec6bb1d981333bf9dea7a72ee
SHA1b9ca0a20adcf6c69dd626e0de86468e4a5514fe3
SHA256718e07ae563bcf629616ac3f056930e804af88e38377b98629ba60257f666699
SHA512dd41d489164891a5c8c2c582f77f6b8c8b54360849ec38b7af0fec4b28137172a4ef9cc2fe6eb10726431152751f3affbc1dd19671bff841742404d809180457
-
C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.exeMD5
810f74773b1d921274c3766df5c00445
SHA190d547916e077dbb6fe56b215df4bc86b936a6f6
SHA25655eee544f1210a27540b418936b2e1240dcf6818fb4023374596621a91f6438f
SHA512e4d8d6ae1629021e28a55e459e1e8835142a19c3c9c97b195a523e2487cac6f46e366b3c0c39ef504e1943d7c74c76d461c963d0153dca1fadf3452c499f7388
-
C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.exeMD5
810f74773b1d921274c3766df5c00445
SHA190d547916e077dbb6fe56b215df4bc86b936a6f6
SHA25655eee544f1210a27540b418936b2e1240dcf6818fb4023374596621a91f6438f
SHA512e4d8d6ae1629021e28a55e459e1e8835142a19c3c9c97b195a523e2487cac6f46e366b3c0c39ef504e1943d7c74c76d461c963d0153dca1fadf3452c499f7388
-
C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.exeMD5
810f74773b1d921274c3766df5c00445
SHA190d547916e077dbb6fe56b215df4bc86b936a6f6
SHA25655eee544f1210a27540b418936b2e1240dcf6818fb4023374596621a91f6438f
SHA512e4d8d6ae1629021e28a55e459e1e8835142a19c3c9c97b195a523e2487cac6f46e366b3c0c39ef504e1943d7c74c76d461c963d0153dca1fadf3452c499f7388
-
C:\Users\Admin\AppData\Local\Temp\7za.exeMD5
42badc1d2f03a8b1e4875740d3d49336
SHA1cee178da1fb05f99af7a3547093122893bd1eb46
SHA256c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
SHA5126bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c
-
C:\Users\Admin\AppData\Local\Temp\CF8C8FMD5
42badc1d2f03a8b1e4875740d3d49336
SHA1cee178da1fb05f99af7a3547093122893bd1eb46
SHA256c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
SHA5126bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c
-
C:\Users\Admin\Desktop\VAULT.htaMD5
1cf60361078e1c2f1219d27c4b3e760c
SHA108d350d205da687672b13e22b253932dd1708e75
SHA256c2d9c1bd8bb434dffd5ebbd0e8020ee73123f2e8134b19cbde4b6458f0d05a43
SHA51290f973c08c663dc7ca8575196ca2d6939bbeb9e1943268e8c8bae3b5cd895e85f654726924c86a0f1ffca4830f05c75ac6e80b44d4adeff345e9ff2cacaacccb
-
memory/472-130-0x0000000000418C90-mapping.dmp
-
memory/472-129-0x0000000000400000-0x0000000000E28000-memory.dmpFilesize
10.2MB
-
memory/472-138-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1028-115-0x0000000000000000-mapping.dmp
-
memory/1128-121-0x0000000000000000-mapping.dmp
-
memory/1276-135-0x00007FFD35790000-0x00007FFD357A0000-memory.dmpFilesize
64KB
-
memory/1276-139-0x00007FFD35790000-0x00007FFD357A0000-memory.dmpFilesize
64KB
-
memory/1276-146-0x00007FFD4E340000-0x00007FFD50235000-memory.dmpFilesize
31.0MB
-
memory/1276-144-0x00007FFD50240000-0x00007FFD5132E000-memory.dmpFilesize
16.9MB
-
memory/1276-136-0x00007FFD567F0000-0x00007FFD59313000-memory.dmpFilesize
43.1MB
-
memory/1276-132-0x00007FFD35790000-0x00007FFD357A0000-memory.dmpFilesize
64KB
-
memory/1276-133-0x00007FFD35790000-0x00007FFD357A0000-memory.dmpFilesize
64KB
-
memory/1276-134-0x00007FFD35790000-0x00007FFD357A0000-memory.dmpFilesize
64KB
-
memory/1276-123-0x0000000000000000-mapping.dmp
-
memory/1660-117-0x0000000000000000-mapping.dmp
-
memory/1896-143-0x0000000000000000-mapping.dmp
-
memory/2148-118-0x0000000000000000-mapping.dmp
-
memory/2568-148-0x0000000000000000-mapping.dmp
-
memory/2872-142-0x0000000000000000-mapping.dmp
-
memory/2928-137-0x00000000021C0000-0x00000000021C5000-memory.dmpFilesize
20KB
-
memory/2928-126-0x0000000000000000-mapping.dmp
-
memory/3416-149-0x0000000000000000-mapping.dmp
-
memory/3612-124-0x0000000000000000-mapping.dmp
-
memory/3704-114-0x0000000000000000-mapping.dmp
-
memory/3868-147-0x0000000000000000-mapping.dmp
-
memory/3900-127-0x0000000000000000-mapping.dmp