Analysis
-
max time kernel
113s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 09:12
Static task
static1
Behavioral task
behavioral1
Sample
b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe
Resource
win10v2004-20220414-en
General
-
Target
b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe
-
Size
1.2MB
-
MD5
403930f107d2434601bdf5ed6c057a05
-
SHA1
674639514389fed43f2288e1a5b0637a53568df3
-
SHA256
b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07
-
SHA512
efb64c515adedf212e38112dc68d20b1d7b2acdf4db3e20c9051ae38e6014469aa6d9bb2cd4e3f0e122fb62294c2b74771ac3a3a2e4e955a347dffdbee3d3cf7
Malware Config
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
awesome.fela@yandex.com - Password:
inJesusname1
Signatures
-
NirSoft MailPassView 8 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\test.exe.exe MailPassView C:\Users\Admin\AppData\Local\Temp\test.exe.exe MailPassView C:\Users\Admin\AppData\Local\Temp\test.exe.exe MailPassView behavioral1/memory/1960-82-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1960-83-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/1960-87-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1960-88-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1960-111-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 8 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\test.exe.exe WebBrowserPassView C:\Users\Admin\AppData\Local\Temp\test.exe.exe WebBrowserPassView C:\Users\Admin\AppData\Local\Temp\test.exe.exe WebBrowserPassView behavioral1/memory/632-96-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/632-97-0x0000000000442628-mapping.dmp WebBrowserPassView behavioral1/memory/632-100-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/632-101-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/632-106-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 13 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\test.exe.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\test.exe.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\test.exe.exe Nirsoft behavioral1/memory/1960-82-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1960-83-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/1960-87-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1960-88-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/632-96-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/632-97-0x0000000000442628-mapping.dmp Nirsoft behavioral1/memory/632-100-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/632-101-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/632-106-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1960-111-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft -
Executes dropped EXE 3 IoCs
Processes:
test.exe.exefilemgr.scrfilemgr.scrpid process 1944 test.exe.exe 1208 filemgr.scr 2028 filemgr.scr -
Loads dropped DLL 4 IoCs
Processes:
b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exefilemgr.scrpid process 304 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe 304 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe 304 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe 1208 filemgr.scr -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
WScript.exetest.exe.exefilemgr.scrdescription ioc process Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\filemgr.scr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\subfolder\\filemgr.vbs -cc" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" test.exe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DSL Service = "C:\\Program Files (x86)\\DSL Service\\dslsv.exe" filemgr.scr -
Processes:
filemgr.scrdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA filemgr.scr -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
filemgr.scrtest.exe.exedescription pid process target process PID 1208 set thread context of 2028 1208 filemgr.scr filemgr.scr PID 1944 set thread context of 1960 1944 test.exe.exe vbc.exe PID 1944 set thread context of 632 1944 test.exe.exe vbc.exe -
Drops file in Program Files directory 2 IoCs
Processes:
filemgr.scrdescription ioc process File opened for modification C:\Program Files (x86)\DSL Service\dslsv.exe filemgr.scr File created C:\Program Files (x86)\DSL Service\dslsv.exe filemgr.scr -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
filemgr.scrtest.exe.exepid process 2028 filemgr.scr 2028 filemgr.scr 2028 filemgr.scr 1944 test.exe.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
filemgr.scrpid process 2028 filemgr.scr -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
test.exe.exefilemgr.scrdescription pid process Token: SeDebugPrivilege 1944 test.exe.exe Token: SeDebugPrivilege 2028 filemgr.scr -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exefilemgr.scrtest.exe.exepid process 304 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe 1208 filemgr.scr 1944 test.exe.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
filemgr.scrpid process 2028 filemgr.scr -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exefilemgr.scrtest.exe.exefilemgr.scrdescription pid process target process PID 304 wrote to memory of 1944 304 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe test.exe.exe PID 304 wrote to memory of 1944 304 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe test.exe.exe PID 304 wrote to memory of 1944 304 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe test.exe.exe PID 304 wrote to memory of 1944 304 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe test.exe.exe PID 304 wrote to memory of 1928 304 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe WScript.exe PID 304 wrote to memory of 1928 304 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe WScript.exe PID 304 wrote to memory of 1928 304 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe WScript.exe PID 304 wrote to memory of 1928 304 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe WScript.exe PID 304 wrote to memory of 1208 304 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe filemgr.scr PID 304 wrote to memory of 1208 304 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe filemgr.scr PID 304 wrote to memory of 1208 304 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe filemgr.scr PID 304 wrote to memory of 1208 304 b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe filemgr.scr PID 1208 wrote to memory of 2028 1208 filemgr.scr filemgr.scr PID 1208 wrote to memory of 2028 1208 filemgr.scr filemgr.scr PID 1208 wrote to memory of 2028 1208 filemgr.scr filemgr.scr PID 1208 wrote to memory of 2028 1208 filemgr.scr filemgr.scr PID 1944 wrote to memory of 1960 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 1960 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 1960 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 1960 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 1960 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 1960 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 1960 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 1960 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 1960 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 1960 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 632 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 632 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 632 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 632 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 632 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 632 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 632 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 632 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 632 1944 test.exe.exe vbc.exe PID 1944 wrote to memory of 632 1944 test.exe.exe vbc.exe PID 2028 wrote to memory of 1700 2028 filemgr.scr schtasks.exe PID 2028 wrote to memory of 1700 2028 filemgr.scr schtasks.exe PID 2028 wrote to memory of 1700 2028 filemgr.scr schtasks.exe PID 2028 wrote to memory of 1700 2028 filemgr.scr schtasks.exe PID 2028 wrote to memory of 920 2028 filemgr.scr schtasks.exe PID 2028 wrote to memory of 920 2028 filemgr.scr schtasks.exe PID 2028 wrote to memory of 920 2028 filemgr.scr schtasks.exe PID 2028 wrote to memory of 920 2028 filemgr.scr schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe"C:\Users\Admin\AppData\Local\Temp\b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\test.exe.exe"C:\Users\Admin\AppData\Local\Temp\test.exe.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\subfolder\filemgr.vbs"2⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filemgr.scr"C:\Users\Admin\AppData\Local\Temp\subfolder\filemgr.scr" /S2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filemgr.scrC:\Users\Admin\AppData\Local\Temp\subfolder\filemgr.scr" /S3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: SetClipboardViewer
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DSL Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpCFBE.tmp"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DSL Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpDBE0.tmp"4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filemgr.scrFilesize
1.2MB
MD5403930f107d2434601bdf5ed6c057a05
SHA1674639514389fed43f2288e1a5b0637a53568df3
SHA256b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07
SHA512efb64c515adedf212e38112dc68d20b1d7b2acdf4db3e20c9051ae38e6014469aa6d9bb2cd4e3f0e122fb62294c2b74771ac3a3a2e4e955a347dffdbee3d3cf7
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filemgr.scrFilesize
1.2MB
MD5403930f107d2434601bdf5ed6c057a05
SHA1674639514389fed43f2288e1a5b0637a53568df3
SHA256b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07
SHA512efb64c515adedf212e38112dc68d20b1d7b2acdf4db3e20c9051ae38e6014469aa6d9bb2cd4e3f0e122fb62294c2b74771ac3a3a2e4e955a347dffdbee3d3cf7
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filemgr.scrFilesize
1.2MB
MD5403930f107d2434601bdf5ed6c057a05
SHA1674639514389fed43f2288e1a5b0637a53568df3
SHA256b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07
SHA512efb64c515adedf212e38112dc68d20b1d7b2acdf4db3e20c9051ae38e6014469aa6d9bb2cd4e3f0e122fb62294c2b74771ac3a3a2e4e955a347dffdbee3d3cf7
-
C:\Users\Admin\AppData\Local\Temp\subfolder\filemgr.vbsFilesize
1024B
MD54e980196cd8e8c7a9b012281f1ef7a0a
SHA1b99e0a492a63d9d1434fd9cd47f97ac93ab64ffa
SHA2561d678cd10989ecc6b139d3e7abee2ad5f8fb5e4ac15b43cdd794fea6615c512c
SHA512fbfb264dbbf6f71dc8d550afed476b6dc6994710e94d8594d3643d24be6ad3585cefd87ff143c8e8d5679708b7b0c35a4af25d70bb5a6530b82f51b6a686fe66
-
C:\Users\Admin\AppData\Local\Temp\test.exe.exeFilesize
520KB
MD576cca11696a4dc301f0efab653a07b38
SHA139861a65d4704f33778c217b85a1d80baf4dbe72
SHA2564f98e23f3897db247c1e19108f6cb97b33ecbc83b6a40e76b20e3912c76080c8
SHA512e3f0fa3c46b64d254a86abed97e94b5d438ba211c7b4a57a2baf8692718d44cee5d6d3e6d9fc60efc3d767bf02240bb9ba07b6c4ab83861e5f7e3732ea8d4f7f
-
C:\Users\Admin\AppData\Local\Temp\test.exe.exeFilesize
520KB
MD576cca11696a4dc301f0efab653a07b38
SHA139861a65d4704f33778c217b85a1d80baf4dbe72
SHA2564f98e23f3897db247c1e19108f6cb97b33ecbc83b6a40e76b20e3912c76080c8
SHA512e3f0fa3c46b64d254a86abed97e94b5d438ba211c7b4a57a2baf8692718d44cee5d6d3e6d9fc60efc3d767bf02240bb9ba07b6c4ab83861e5f7e3732ea8d4f7f
-
C:\Users\Admin\AppData\Local\Temp\tmpCFBE.tmpFilesize
1KB
MD5eac26a063c2f289cd1062579b6079073
SHA1b1cd3470849772cbeee47424557212b0e94b1bb4
SHA2568b646dae0c439687ed02f8e5a50dfc7c7a3f994687dc514b9a3c488f86969d52
SHA5121ba80a6466b9f71141e7523986f3bc0cbde95479c1b3a5ba4929be7f4699981727dbcca380e166a1607766b5447fcddae7f466e043774f3b2e806a98bfb5ae29
-
\Users\Admin\AppData\Local\Temp\subfolder\filemgr.scrFilesize
1.2MB
MD5403930f107d2434601bdf5ed6c057a05
SHA1674639514389fed43f2288e1a5b0637a53568df3
SHA256b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07
SHA512efb64c515adedf212e38112dc68d20b1d7b2acdf4db3e20c9051ae38e6014469aa6d9bb2cd4e3f0e122fb62294c2b74771ac3a3a2e4e955a347dffdbee3d3cf7
-
\Users\Admin\AppData\Local\Temp\subfolder\filemgr.scrFilesize
1.2MB
MD5403930f107d2434601bdf5ed6c057a05
SHA1674639514389fed43f2288e1a5b0637a53568df3
SHA256b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07
SHA512efb64c515adedf212e38112dc68d20b1d7b2acdf4db3e20c9051ae38e6014469aa6d9bb2cd4e3f0e122fb62294c2b74771ac3a3a2e4e955a347dffdbee3d3cf7
-
\Users\Admin\AppData\Local\Temp\subfolder\filemgr.scrFilesize
1.2MB
MD5403930f107d2434601bdf5ed6c057a05
SHA1674639514389fed43f2288e1a5b0637a53568df3
SHA256b5fcb373c4e4837606464220b2c802dfd4b7cdb8370c4506515975a52821ce07
SHA512efb64c515adedf212e38112dc68d20b1d7b2acdf4db3e20c9051ae38e6014469aa6d9bb2cd4e3f0e122fb62294c2b74771ac3a3a2e4e955a347dffdbee3d3cf7
-
\Users\Admin\AppData\Local\Temp\test.exe.exeFilesize
520KB
MD576cca11696a4dc301f0efab653a07b38
SHA139861a65d4704f33778c217b85a1d80baf4dbe72
SHA2564f98e23f3897db247c1e19108f6cb97b33ecbc83b6a40e76b20e3912c76080c8
SHA512e3f0fa3c46b64d254a86abed97e94b5d438ba211c7b4a57a2baf8692718d44cee5d6d3e6d9fc60efc3d767bf02240bb9ba07b6c4ab83861e5f7e3732ea8d4f7f
-
memory/304-56-0x0000000000260000-0x0000000000266000-memory.dmpFilesize
24KB
-
memory/304-69-0x0000000077410000-0x0000000077590000-memory.dmpFilesize
1.5MB
-
memory/304-58-0x0000000077410000-0x0000000077590000-memory.dmpFilesize
1.5MB
-
memory/304-57-0x0000000075311000-0x0000000075313000-memory.dmpFilesize
8KB
-
memory/632-100-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/632-106-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/632-101-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/632-97-0x0000000000442628-mapping.dmp
-
memory/632-96-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/920-104-0x0000000000000000-mapping.dmp
-
memory/1208-81-0x0000000077410000-0x0000000077590000-memory.dmpFilesize
1.5MB
-
memory/1208-66-0x0000000000000000-mapping.dmp
-
memory/1700-102-0x0000000000000000-mapping.dmp
-
memory/1928-63-0x0000000000000000-mapping.dmp
-
memory/1944-60-0x0000000000000000-mapping.dmp
-
memory/1944-74-0x00000000740A0000-0x000000007464B000-memory.dmpFilesize
5.7MB
-
memory/1944-107-0x00000000002E5000-0x00000000002F6000-memory.dmpFilesize
68KB
-
memory/1944-75-0x00000000740A0000-0x000000007464B000-memory.dmpFilesize
5.7MB
-
memory/1944-85-0x00000000002E5000-0x00000000002F6000-memory.dmpFilesize
68KB
-
memory/1960-87-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1960-83-0x0000000000411654-mapping.dmp
-
memory/1960-88-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1960-111-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1960-82-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2028-94-0x00000000740A0000-0x000000007464B000-memory.dmpFilesize
5.7MB
-
memory/2028-95-0x0000000008930000-0x00000000090CC000-memory.dmpFilesize
7.6MB
-
memory/2028-90-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2028-92-0x0000000077410000-0x0000000077590000-memory.dmpFilesize
1.5MB
-
memory/2028-93-0x0000000077410000-0x0000000077590000-memory.dmpFilesize
1.5MB
-
memory/2028-108-0x0000000077410000-0x0000000077590000-memory.dmpFilesize
1.5MB
-
memory/2028-109-0x0000000077410000-0x0000000077590000-memory.dmpFilesize
1.5MB
-
memory/2028-110-0x00000000740A0000-0x000000007464B000-memory.dmpFilesize
5.7MB
-
memory/2028-79-0x0000000000512BEF-mapping.dmp