Analysis
-
max time kernel
106s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 01:45
Static task
static1
Behavioral task
behavioral1
Sample
_____640.exe
Resource
win7-20220414-en
General
-
Target
_____640.exe
-
Size
931KB
-
MD5
836cda1d8a9718485cc9f9653530c2d9
-
SHA1
fca85ff9aa624547d9a315962d82388c300edac1
-
SHA256
d3793a581da66ef5840648574ce364846e7c68a559c0f5e49faf9e4892ecdc72
-
SHA512
07ca078d79f622706d08a534f6b5e2c896152fb0d0e452781fa6be5dc90028fdf074b3b78acac438f2acf5b3f5522e70afb7db4551874a3083860213e2790481
Malware Config
Extracted
azorult
https://gemateknindoperkasa.co.id/imag/index.php
Extracted
netwire
174.127.99.159:7882
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
May-B
- install_path
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
- mutex
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
- startup_name
-
use_mutex
false
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
NetWire RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1344-71-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1344-74-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1344-76-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1344-80-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1344-81-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1344-82-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1344-86-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1344-118-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Executes dropped EXE 4 IoCs
Processes:
File.exetmp.exesvhost.exesvhost.exepid process 1944 File.exe 840 tmp.exe 1344 svhost.exe 1856 svhost.exe -
Loads dropped DLL 7 IoCs
Processes:
_____640.exeFile.exepid process 1672 _____640.exe 1672 _____640.exe 1944 File.exe 1944 File.exe 1944 File.exe 1672 _____640.exe 1944 File.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
_____640.exeFile.exedescription pid process target process PID 1672 set thread context of 1344 1672 _____640.exe svhost.exe PID 1944 set thread context of 1856 1944 File.exe svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 996 timeout.exe -
NTFS ADS 2 IoCs
Processes:
cmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
_____640.exeFile.exepid process 1672 _____640.exe 1944 File.exe 1672 _____640.exe 1672 _____640.exe 1944 File.exe 1944 File.exe 1672 _____640.exe 1944 File.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
_____640.exeFile.exedescription pid process Token: SeDebugPrivilege 1672 _____640.exe Token: SeDebugPrivilege 1944 File.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
_____640.exeFile.execmd.execmd.exedescription pid process target process PID 1672 wrote to memory of 1944 1672 _____640.exe File.exe PID 1672 wrote to memory of 1944 1672 _____640.exe File.exe PID 1672 wrote to memory of 1944 1672 _____640.exe File.exe PID 1672 wrote to memory of 1944 1672 _____640.exe File.exe PID 1672 wrote to memory of 1944 1672 _____640.exe File.exe PID 1672 wrote to memory of 1944 1672 _____640.exe File.exe PID 1672 wrote to memory of 1944 1672 _____640.exe File.exe PID 1672 wrote to memory of 1344 1672 _____640.exe svhost.exe PID 1672 wrote to memory of 1344 1672 _____640.exe svhost.exe PID 1672 wrote to memory of 1344 1672 _____640.exe svhost.exe PID 1672 wrote to memory of 1344 1672 _____640.exe svhost.exe PID 1672 wrote to memory of 1344 1672 _____640.exe svhost.exe PID 1672 wrote to memory of 1344 1672 _____640.exe svhost.exe PID 1672 wrote to memory of 1344 1672 _____640.exe svhost.exe PID 1944 wrote to memory of 840 1944 File.exe tmp.exe PID 1944 wrote to memory of 840 1944 File.exe tmp.exe PID 1944 wrote to memory of 840 1944 File.exe tmp.exe PID 1944 wrote to memory of 840 1944 File.exe tmp.exe PID 1672 wrote to memory of 1344 1672 _____640.exe svhost.exe PID 1672 wrote to memory of 1344 1672 _____640.exe svhost.exe PID 1672 wrote to memory of 1344 1672 _____640.exe svhost.exe PID 1672 wrote to memory of 1344 1672 _____640.exe svhost.exe PID 1672 wrote to memory of 1344 1672 _____640.exe svhost.exe PID 1944 wrote to memory of 1856 1944 File.exe svhost.exe PID 1944 wrote to memory of 1856 1944 File.exe svhost.exe PID 1944 wrote to memory of 1856 1944 File.exe svhost.exe PID 1944 wrote to memory of 1856 1944 File.exe svhost.exe PID 1944 wrote to memory of 1856 1944 File.exe svhost.exe PID 1944 wrote to memory of 1856 1944 File.exe svhost.exe PID 1944 wrote to memory of 1856 1944 File.exe svhost.exe PID 1944 wrote to memory of 1856 1944 File.exe svhost.exe PID 1944 wrote to memory of 1856 1944 File.exe svhost.exe PID 1944 wrote to memory of 1856 1944 File.exe svhost.exe PID 1672 wrote to memory of 1960 1672 _____640.exe cmd.exe PID 1672 wrote to memory of 1960 1672 _____640.exe cmd.exe PID 1672 wrote to memory of 1960 1672 _____640.exe cmd.exe PID 1672 wrote to memory of 1960 1672 _____640.exe cmd.exe PID 1672 wrote to memory of 1912 1672 _____640.exe cmd.exe PID 1672 wrote to memory of 1912 1672 _____640.exe cmd.exe PID 1672 wrote to memory of 1912 1672 _____640.exe cmd.exe PID 1672 wrote to memory of 1912 1672 _____640.exe cmd.exe PID 1912 wrote to memory of 1636 1912 cmd.exe reg.exe PID 1912 wrote to memory of 1636 1912 cmd.exe reg.exe PID 1912 wrote to memory of 1636 1912 cmd.exe reg.exe PID 1912 wrote to memory of 1636 1912 cmd.exe reg.exe PID 1672 wrote to memory of 1040 1672 _____640.exe cmd.exe PID 1672 wrote to memory of 1040 1672 _____640.exe cmd.exe PID 1672 wrote to memory of 1040 1672 _____640.exe cmd.exe PID 1672 wrote to memory of 1040 1672 _____640.exe cmd.exe PID 1672 wrote to memory of 1464 1672 _____640.exe cmd.exe PID 1672 wrote to memory of 1464 1672 _____640.exe cmd.exe PID 1672 wrote to memory of 1464 1672 _____640.exe cmd.exe PID 1672 wrote to memory of 1464 1672 _____640.exe cmd.exe PID 1944 wrote to memory of 1976 1944 File.exe cmd.exe PID 1944 wrote to memory of 1976 1944 File.exe cmd.exe PID 1944 wrote to memory of 1976 1944 File.exe cmd.exe PID 1944 wrote to memory of 1976 1944 File.exe cmd.exe PID 1944 wrote to memory of 1036 1944 File.exe cmd.exe PID 1944 wrote to memory of 1036 1944 File.exe cmd.exe PID 1944 wrote to memory of 1036 1944 File.exe cmd.exe PID 1944 wrote to memory of 1036 1944 File.exe cmd.exe PID 1464 wrote to memory of 996 1464 cmd.exe timeout.exe PID 1464 wrote to memory of 996 1464 cmd.exe timeout.exe PID 1464 wrote to memory of 996 1464 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\_____640.exe"C:\Users\Admin\AppData\Local\Temp\_____640.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\tmp.exe"C:\Users\Admin\AppData\Roaming\tmp.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f3⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier3⤵
- NTFS ADS
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/_____640.exe" "%temp%\FolderN\name.exe" /Y2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 3003⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\File.exeFilesize
342KB
MD537c82e15058e2f8f5e9525b956e6440d
SHA13bf20d00bd7a7943c4066d534f5b276cac5ae39f
SHA25680c4716318f874881151c78c4dce9a0a01be4294834f33ee7f12a8a34bb8b2b7
SHA5125c9c37a13cac634771ae18736845b8e7c1a33fd8c6c9ae564f6863b5033a68565f0fd3da555d15870bbc547cc549153c096c44f2d7ced828baffdcfa8641da0a
-
C:\Users\Admin\AppData\Local\Temp\File.exeFilesize
342KB
MD537c82e15058e2f8f5e9525b956e6440d
SHA13bf20d00bd7a7943c4066d534f5b276cac5ae39f
SHA25680c4716318f874881151c78c4dce9a0a01be4294834f33ee7f12a8a34bb8b2b7
SHA5125c9c37a13cac634771ae18736845b8e7c1a33fd8c6c9ae564f6863b5033a68565f0fd3da555d15870bbc547cc549153c096c44f2d7ced828baffdcfa8641da0a
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exeFilesize
931KB
MD5836cda1d8a9718485cc9f9653530c2d9
SHA1fca85ff9aa624547d9a315962d82388c300edac1
SHA256d3793a581da66ef5840648574ce364846e7c68a559c0f5e49faf9e4892ecdc72
SHA51207ca078d79f622706d08a534f6b5e2c896152fb0d0e452781fa6be5dc90028fdf074b3b78acac438f2acf5b3f5522e70afb7db4551874a3083860213e2790481
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exeFilesize
342KB
MD537c82e15058e2f8f5e9525b956e6440d
SHA13bf20d00bd7a7943c4066d534f5b276cac5ae39f
SHA25680c4716318f874881151c78c4dce9a0a01be4294834f33ee7f12a8a34bb8b2b7
SHA5125c9c37a13cac634771ae18736845b8e7c1a33fd8c6c9ae564f6863b5033a68565f0fd3da555d15870bbc547cc549153c096c44f2d7ced828baffdcfa8641da0a
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exeFilesize
342KB
MD537c82e15058e2f8f5e9525b956e6440d
SHA13bf20d00bd7a7943c4066d534f5b276cac5ae39f
SHA25680c4716318f874881151c78c4dce9a0a01be4294834f33ee7f12a8a34bb8b2b7
SHA5125c9c37a13cac634771ae18736845b8e7c1a33fd8c6c9ae564f6863b5033a68565f0fd3da555d15870bbc547cc549153c096c44f2d7ced828baffdcfa8641da0a
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.batFilesize
204B
MD5bfcbf382f036462e63f307ca4ae280c7
SHA1ffe98d15fa5ea205220d6bc105e317253a6ea003
SHA2562c3dd84c3ce3e529117e611d8caf4fc7f5a902840350f4ca524c251a2152c727
SHA5121b912652cc989541b396df5fd6bf207a4cf4ed891dc6e3223b8d0497c19a2589cb644c4c96ca01d882a7643f240c566966d84e46d77e9ad33e05214f8f553d16
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnkFilesize
951B
MD5bddec2eadd85a1fa456c3310065712ff
SHA170eab98b131ef9ca0070cb2c632a5e679efbfebb
SHA256ca3074313292b16fa243f41a04eb366335ac765d06738a6c3a870478b93b9d97
SHA512e5ad11c4c9f8a6a18171f6f546506ae517dda4150b361dc87ba8c5984c69014e4099e7914df38567a663d39bc96b9cf0e3cf824fcbb7e1f5801ac13896009523
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
C:\Users\Admin\AppData\Roaming\tmp.exeFilesize
112KB
MD5bae2b04e1160950e570661f55d7cd6f8
SHA1f4abc073a091292547dda85d0ba044cab231c8da
SHA256ab0744c19af062c698e94e8eb9ee0e67bcf9a078f53d2a6a848406e2413c4d59
SHA5121bfef1217a6e2ecacee407eed70df9205cbfabb4ddfe06fcc11a7ddf2b42262ec3ab61421474b56b338fa76ffea9beac73530650d39eff61dffcfc25a7fe45b6
-
\Users\Admin\AppData\Local\Temp\File.exeFilesize
342KB
MD537c82e15058e2f8f5e9525b956e6440d
SHA13bf20d00bd7a7943c4066d534f5b276cac5ae39f
SHA25680c4716318f874881151c78c4dce9a0a01be4294834f33ee7f12a8a34bb8b2b7
SHA5125c9c37a13cac634771ae18736845b8e7c1a33fd8c6c9ae564f6863b5033a68565f0fd3da555d15870bbc547cc549153c096c44f2d7ced828baffdcfa8641da0a
-
\Users\Admin\AppData\Local\Temp\FolderN\name.exeFilesize
931KB
MD5836cda1d8a9718485cc9f9653530c2d9
SHA1fca85ff9aa624547d9a315962d82388c300edac1
SHA256d3793a581da66ef5840648574ce364846e7c68a559c0f5e49faf9e4892ecdc72
SHA51207ca078d79f622706d08a534f6b5e2c896152fb0d0e452781fa6be5dc90028fdf074b3b78acac438f2acf5b3f5522e70afb7db4551874a3083860213e2790481
-
\Users\Admin\AppData\Local\Temp\FolderN\name.exeFilesize
342KB
MD537c82e15058e2f8f5e9525b956e6440d
SHA13bf20d00bd7a7943c4066d534f5b276cac5ae39f
SHA25680c4716318f874881151c78c4dce9a0a01be4294834f33ee7f12a8a34bb8b2b7
SHA5125c9c37a13cac634771ae18736845b8e7c1a33fd8c6c9ae564f6863b5033a68565f0fd3da555d15870bbc547cc549153c096c44f2d7ced828baffdcfa8641da0a
-
\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
\Users\Admin\AppData\Roaming\tmp.exeFilesize
112KB
MD5bae2b04e1160950e570661f55d7cd6f8
SHA1f4abc073a091292547dda85d0ba044cab231c8da
SHA256ab0744c19af062c698e94e8eb9ee0e67bcf9a078f53d2a6a848406e2413c4d59
SHA5121bfef1217a6e2ecacee407eed70df9205cbfabb4ddfe06fcc11a7ddf2b42262ec3ab61421474b56b338fa76ffea9beac73530650d39eff61dffcfc25a7fe45b6
-
\Users\Admin\AppData\Roaming\tmp.exeFilesize
112KB
MD5bae2b04e1160950e570661f55d7cd6f8
SHA1f4abc073a091292547dda85d0ba044cab231c8da
SHA256ab0744c19af062c698e94e8eb9ee0e67bcf9a078f53d2a6a848406e2413c4d59
SHA5121bfef1217a6e2ecacee407eed70df9205cbfabb4ddfe06fcc11a7ddf2b42262ec3ab61421474b56b338fa76ffea9beac73530650d39eff61dffcfc25a7fe45b6
-
memory/840-73-0x0000000000000000-mapping.dmp
-
memory/896-119-0x0000000000000000-mapping.dmp
-
memory/996-113-0x0000000000000000-mapping.dmp
-
memory/1036-112-0x0000000000000000-mapping.dmp
-
memory/1040-107-0x0000000000000000-mapping.dmp
-
memory/1344-86-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1344-64-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1344-74-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1344-81-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1344-71-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1344-118-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1344-68-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1344-80-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1344-82-0x000000000040242D-mapping.dmp
-
memory/1344-76-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1344-65-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1464-108-0x0000000000000000-mapping.dmp
-
memory/1588-114-0x0000000000000000-mapping.dmp
-
memory/1636-104-0x0000000000000000-mapping.dmp
-
memory/1672-56-0x0000000075B61000-0x0000000075B63000-memory.dmpFilesize
8KB
-
memory/1672-55-0x0000000004800000-0x0000000004886000-memory.dmpFilesize
536KB
-
memory/1672-54-0x0000000000A00000-0x0000000000AEE000-memory.dmpFilesize
952KB
-
memory/1856-93-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1856-88-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1856-101-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1856-89-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1856-99-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1856-96-0x000000000041A1F8-mapping.dmp
-
memory/1856-95-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1856-91-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1856-92-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1912-103-0x0000000000000000-mapping.dmp
-
memory/1944-61-0x0000000000380000-0x00000000003DC000-memory.dmpFilesize
368KB
-
memory/1944-58-0x0000000000000000-mapping.dmp
-
memory/1944-62-0x0000000000350000-0x0000000000374000-memory.dmpFilesize
144KB
-
memory/1960-102-0x0000000000000000-mapping.dmp
-
memory/1976-109-0x0000000000000000-mapping.dmp