Analysis
-
max time kernel
150s -
max time network
184s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
18-06-2021 15:36
Static task
static1
Behavioral task
behavioral1
Sample
智速安全助手.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
智速安全助手.exe
Resource
win10v20210408
General
-
Target
智速安全助手.exe
-
Size
25.3MB
-
MD5
936f260dac63fa0d43d9a1d207660b42
-
SHA1
472c5c732f7dbd909dbae8ae798bd541c70e196d
-
SHA256
481bf0ecceeea501eec4900700b1e691bdab665b4217755758a40fe6d6fd9c8b
-
SHA512
82056eb7dd60a4267810ed0855d912eab08641e9b20cd47bca94fe0103a15444670735c66d304cb0cd523752584dbe852544aa9bb30a46d16b2d9d9175c59c60
Malware Config
Extracted
C:\\y42x39-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A7D031C38933EE26
http://decryptor.cc/A7D031C38933EE26
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Executes dropped EXE 1 IoCs
Processes:
ZSsafe.exepid process 580 ZSsafe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
智速安全助手.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main 智速安全助手.exe -
Processes:
ZSsafe.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C ZSsafe.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 ZSsafe.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 ZSsafe.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e210f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 ZSsafe.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
ZSsafe.exepid process 580 ZSsafe.exe 580 ZSsafe.exe 580 ZSsafe.exe 580 ZSsafe.exe 580 ZSsafe.exe 580 ZSsafe.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 1828 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1828 AUDIODG.EXE Token: 33 1828 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1828 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
智速安全助手.exeZSsafe.exepid process 1816 智速安全助手.exe 1816 智速安全助手.exe 580 ZSsafe.exe 580 ZSsafe.exe 580 ZSsafe.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
智速安全助手.exedescription pid process target process PID 1816 wrote to memory of 580 1816 智速安全助手.exe ZSsafe.exe PID 1816 wrote to memory of 580 1816 智速安全助手.exe ZSsafe.exe PID 1816 wrote to memory of 580 1816 智速安全助手.exe ZSsafe.exe PID 1816 wrote to memory of 580 1816 智速安全助手.exe ZSsafe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\智速安全助手.exe"C:\Users\Admin\AppData\Local\Temp\智速安全助手.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\ZSsafe.exe"C:\ZSsafe.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:580
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4641⤵
- Suspicious use of AdjustPrivilegeToken
PID:1828
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\y42x39-readme.txt1⤵PID:1516
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Data\1.sjMD5
c20ae9f76afdb6f73fcf95fb1ce6d9b2
SHA115da66997fd4e2393aaaa9b1ef8bb63c87a797fe
SHA256f7325e1061c06cc42f3aba1656e187ee2d54103484bb02c06a47dc7ee0b0831e
SHA5125d449b0b84283668d20b2dbde934e28c87a2d6a5bff32a8597c9cfcfcc7bbbff2b723ea244fac8d65683a582e6db55ddfa8f00c1942bfc8c198935f7dac4ff9f
-
C:\Data\10.sjMD5
16852b14f23529326b4cb65f1413f4a4
SHA1723f869bb5d0c93b255fad6a7facaa213206ec80
SHA256b868f3b24b33fd9b2188c507d4884c2620e7b522776c2b476f15f9fd5feeea46
SHA5125f804a8a4d902475ad8c618edc3d705fc9a941927538a993e595cde48b026526ca2f18b2fa1dd37007acaad25636c63c7000f2c17e190b37e95e1e00312f7ab4
-
C:\Data\11.sjMD5
a0b26208a7401883b5f0b4afcee3bca4
SHA1036cc968d25635bf63afa0d6047f725833447896
SHA256f1251294b8dd43931602a12da53b71a034e613734f911457092fff31fbbeeb42
SHA512218a79659226047b4abe7a118388af3bb1d53eee2e13ce687d74264ca859e50282dce39be4d798a7767d659e99578e3759916dbbba2a6c678d7dca215468699f
-
C:\Data\12.sjMD5
53b83aa18cc3689c5032d327022a3084
SHA13b9da2f8e327edbb756792a8dcdac4d364b91040
SHA2564b4bc3acfa41dee6e3a4690e263f65074e5a41afd9c5e398f8fdf6aa654c6947
SHA512a1b35b9694c773159825799d3f80ee349522133d4cc7dd16d63d05c8b24738ef90d30513fa8f9f650d19787b5c6e980c5a143fc9552b9ff6476682ae9512eadc
-
C:\Data\2.sjMD5
1e627b94da9fdc4b690a88a5ba78c36a
SHA19ffa5fea1657f7e39473e927deac18dfeb627d05
SHA256d3b12cd97714fb396f7cfff05235169cbab1e72f6473e78eeb93480a0b3c03bc
SHA51250e8b45cb422e18fefa1ecbda4fb1f75e95122dbf0d579301ef76c0d84d3d08cdb4890544c230341c5de88fa4f4e6aeac4b7841108a8a2f1ad6ea8f545b9b25b
-
C:\Data\3.sjMD5
c5a9e5baf53fc517f46e466936b8aea1
SHA1f05e916f05f4e449ff74d38d30124bc63412a213
SHA256bb3e4a87050cbe4a0b657ea873442b915c4ff5c169bbf173b99cc66436e2f587
SHA51295ca4d77549e712fdb35889e4eef61d4c08d1d27d9635df03cb36ee5c529f63a0811e49db54886076b9790c6bceccb5130fdaebf5ca1e3dbce7845d89957a07d
-
C:\Data\4.sjMD5
b8804a4f516dff44b09d738e2c62f796
SHA16d6044c5d4bae3fd4ba91df46534238b2440f793
SHA25657afa5ebdf825fa33c1e12f716259a80cdd78f547ed2cd81f497067531f014d5
SHA512498ae7a557b96027ce5fa8dc94c83818f78b022447a89f3e313728c84d95cb4184cabb095acecf412a188e5618f5fb96ded77d3b7953f7c5404745a5b0aa54b6
-
C:\Data\5.sjMD5
28c546d135cbc6ba5bc09d3a968183ca
SHA19456683c182a31f332e354583ba8666fe264230b
SHA256d4a667e66ae0f2235e63c1048f6b749d8b461932e448a79c0ff8da760d2b8f99
SHA512ad786c86e8dd7b950629b0ddec3a1a7b276daa618f64fd4ee0707f7f1c77df0a14b377203ec91fe860fb2eea3b7d1e7d7d3ae5e667d333c7421099b4adc4a981
-
C:\Data\6.sjMD5
d12578946c310c19082bfcd3ede7a5be
SHA1c367e3802bca3631cf87430bd6e51c4fd87297bc
SHA2563598ed4a8ca8fb4aa399f1817369cbc73956b45c2f69334493ebef9e932a9389
SHA512ff5df09a7b7e82fc16d4a82e4b8b2a1e5aec01cecb2af8b7223fe6515c32ce22d616c5d1b061e031f08e11ed4b15a614f4e6d1fbf309833c4158e336d83b6198
-
C:\Data\7.sjMD5
e129e1bdf5cfd8e8ed4873fa00143c4c
SHA1b13b090715c7fe818813e7a8961a496a3d57dfc4
SHA25615ff7b216341edff8d128e175a8bbeb671a549db1293e681d33b718ee84a77f9
SHA512018418553e0f8eea760c00403619257d9aabeda8d4a2115ff46e289c4c9732e4b3e83148ca7c8d62e9cc1ee7d207e71f2ae60e14324a78659c2652d862c9e058
-
C:\Data\8.sjMD5
f7d27ce2e88da521b568796d267e2afd
SHA19e0b7a7b167112e31221988f04b8331de189d2a6
SHA25668deb4d7966724030dc52d2d411eb38a6930a46085c8a2bb454487e7b3e6dcea
SHA5123c6d20687c106abe5991159977c743f59c19cc7badfd14bd0f9e906014889b5fa5198d4c3b23a31fad3194a9e3f66fd858cbcd0fc48174b4e6196f7e92859d92
-
C:\Data\9.sjMD5
427372fa8512086dddea2ca9373c3ba7
SHA127ae4b749c56ac9c7a77ef90799a487d43aa8179
SHA2569dbbb591beb54ce1ccdcc1871d278418c2fe4d5e40d39ce391e529d8d59e9206
SHA512074ce6a5a31813f5a05ca48bff7a70f137b98d31dbedadc07a99c19bb0bef157498c6daea1db10fd73d2896a0539264d8b1294c5d5e4db81e2ec2a12f5b18a80
-
C:\Special.dllMD5
a2146a58d6251ab47222e68b226d029b
SHA1f923a64872177950711f9450e6507671f5baae14
SHA256f84b48d814a6531f722a3ff1ca51df9b7a1200a644b0e80c13e9fe1395002eb3
SHA512d46b7a2f1b739ab553cc0346a8b19feb1765f854b264987853af1b826fd91de7a182809ed8c14c38020fd2fa37cb8c220f0a68c3f7347f152b48088f237d8443
-
C:\ZSantivirus.dllMD5
fa6ac34f43c09064641b929db0dd3b22
SHA15803f03b747816aa385406b64814100c4d492d50
SHA2561f1b078f257c1f9b9f8c74c7035ca547a721d7043a032f048378422992feed01
SHA5124ffc579193c337fea78d8022309c2e626e181a1545822b6097b5d4f16a6d309ea9d7a27a23436ee1466bbe25d08c0c7919b69d6576fd8791cdb8c80b9d120b1a
-
C:\ZSexpand.dllMD5
e2a305a6edf5792a63940f998580726c
SHA128e698d656c7a542cd206c9b0053e006d58e8ed0
SHA25630bcd7382aade6d3bc5dc81e675f14b41817a4774c5c71b1ef7c996d5a3352fa
SHA5123c9015a1d734daada471e2fcc1628f55055057392acbb66adab4b0c171fc0b79b24f574b093613c440d1cc7421e16be1693495fe56f8e63d993b2109fceab535
-
C:\ZSsafe.exeMD5
207811d669828366e60e9277ab2edcca
SHA135bb1d01e12b8f5c3338c744cdf82a34b29d201f
SHA2565a161fe657f36e5c866ad99d0fb2fb47106aaa18bf8d5491460ae70c8cf67aaf
SHA512d3fe3387e43b000417cc57699d605dcd67998e06402be3b2ee03291d06be3d671cc64639c2b2d12e84e9913be16716cff5ad08b5a7de2e4ed72564f7b51801ce
-
C:\ZSsafe.exeMD5
207811d669828366e60e9277ab2edcca
SHA135bb1d01e12b8f5c3338c744cdf82a34b29d201f
SHA2565a161fe657f36e5c866ad99d0fb2fb47106aaa18bf8d5491460ae70c8cf67aaf
SHA512d3fe3387e43b000417cc57699d605dcd67998e06402be3b2ee03291d06be3d671cc64639c2b2d12e84e9913be16716cff5ad08b5a7de2e4ed72564f7b51801ce
-
C:\set.iniMD5
9eea1ef5d4b2c6a0566b408cb49a52b0
SHA1deea4567c4a08f42ad9952ce3899947cdd61f372
SHA256cbba29cb8c4cfad5f865f23d6b542a801c777fadd7ef642f5b9f447cfa66aa8f
SHA512db34684fe89399f5dbb9cac02636f2045f6d0079b0ed9f95ec0499967015a7726b7b25edcb9ce356acca49626312a62e8954d61746b85a34a66610d16d96614d
-
C:\y42x39-readme.txtMD5
ecb199655332f016e90f75652d131b76
SHA1226fe6167a52f671ef9540d8efcf9e1a53c88a38
SHA2567e8de707985108db869d1d2f4f21702fea3926eaba799acb74fbf33c3b5f04f3
SHA512c3f2c13e58f73229bfd92e05a2f98d827de28449a9efc3bddcdc05811e22d9c34e2319cb3156534a121111f439bd8ec30a4be09e16b49c0d2c865624ea0eb6cd
-
memory/580-71-0x00000000012B0000-0x00000000012B1000-memory.dmpFilesize
4KB
-
memory/580-72-0x0000000000400000-0x0000000001264000-memory.dmpFilesize
14.4MB
-
memory/580-70-0x00000000012A0000-0x00000000012A1000-memory.dmpFilesize
4KB
-
memory/580-69-0x0000000001290000-0x0000000001291000-memory.dmpFilesize
4KB
-
memory/580-68-0x0000000001280000-0x0000000001281000-memory.dmpFilesize
4KB
-
memory/580-67-0x0000000001270000-0x0000000001271000-memory.dmpFilesize
4KB
-
memory/580-65-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/580-66-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/580-80-0x0000000010000000-0x00000000110BA000-memory.dmpFilesize
16.7MB
-
memory/580-61-0x0000000000000000-mapping.dmp
-
memory/580-93-0x0000000004F80000-0x0000000004F81000-memory.dmpFilesize
4KB
-
memory/1516-74-0x000007FEFC181000-0x000007FEFC183000-memory.dmpFilesize
8KB
-
memory/1816-60-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB