Analysis
-
max time kernel
43s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
15-07-2022 16:19
Static task
static1
Behavioral task
behavioral1
Sample
virussign.dll
Resource
win7-20220715-en
General
-
Target
virussign.dll
-
Size
120KB
-
MD5
26a40eade629154d15e019603e4ce790
-
SHA1
6823521b875fe13e6a607db7f868b4925a71eeeb
-
SHA256
c67d559821f7c3cca0adf73727e00cf193c8c9ed7c82876235335afb4768656f
-
SHA512
765373138bb0f70c7cf92f615274b0d45be29a1746e72af9e0c15820acb8b45604baa441f891384b9c77b12b211b17e88835de85c2bc351708394f4740762dae
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
6c4c5d.exe6c28d6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 6c4c5d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 6c4c5d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 6c28d6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 6c28d6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 6c28d6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 6c4c5d.exe -
Processes:
6c28d6.exe6c4c5d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c28d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c4c5d.exe -
Processes:
6c4c5d.exe6c28d6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 6c4c5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6c28d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6c28d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 6c28d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6c28d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6c4c5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6c4c5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6c4c5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6c4c5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6c28d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6c28d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6c4c5d.exe -
Executes dropped EXE 3 IoCs
Processes:
6c28d6.exe6c2b17.exe6c4c5d.exepid process 1908 6c28d6.exe 2028 6c2b17.exe 2024 6c4c5d.exe -
Processes:
resource yara_rule behavioral1/memory/1908-61-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1908-70-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1908-84-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1908-86-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2024-90-0x0000000000900000-0x00000000019BA000-memory.dmp upx behavioral1/memory/2024-92-0x0000000000900000-0x00000000019BA000-memory.dmp upx behavioral1/memory/2024-94-0x0000000000900000-0x00000000019BA000-memory.dmp upx -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe 1124 rundll32.exe -
Processes:
6c28d6.exe6c4c5d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6c28d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6c28d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6c28d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 6c28d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6c4c5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6c28d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6c4c5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 6c4c5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6c4c5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6c28d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6c4c5d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 6c4c5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 6c28d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6c4c5d.exe -
Processes:
6c28d6.exe6c4c5d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c28d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c4c5d.exe -
Enumerates connected drives 3 TTPs 9 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
6c28d6.exe6c4c5d.exedescription ioc process File opened (read-only) \??\E: 6c28d6.exe File opened (read-only) \??\F: 6c28d6.exe File opened (read-only) \??\H: 6c28d6.exe File opened (read-only) \??\I: 6c28d6.exe File opened (read-only) \??\J: 6c28d6.exe File opened (read-only) \??\E: 6c4c5d.exe File opened (read-only) \??\G: 6c28d6.exe File opened (read-only) \??\K: 6c28d6.exe File opened (read-only) \??\L: 6c28d6.exe -
Drops file in Windows directory 3 IoCs
Processes:
6c28d6.exe6c4c5d.exedescription ioc process File created C:\Windows\6c2a1d 6c28d6.exe File opened for modification C:\Windows\SYSTEM.INI 6c28d6.exe File created C:\Windows\6c81be 6c4c5d.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
6c28d6.exe6c4c5d.exepid process 1908 6c28d6.exe 1908 6c28d6.exe 2024 6c4c5d.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
6c28d6.exe6c4c5d.exedescription pid process Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 1908 6c28d6.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe Token: SeDebugPrivilege 2024 6c4c5d.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
rundll32.exerundll32.exe6c28d6.exe6c4c5d.exedescription pid process target process PID 308 wrote to memory of 1124 308 rundll32.exe rundll32.exe PID 308 wrote to memory of 1124 308 rundll32.exe rundll32.exe PID 308 wrote to memory of 1124 308 rundll32.exe rundll32.exe PID 308 wrote to memory of 1124 308 rundll32.exe rundll32.exe PID 308 wrote to memory of 1124 308 rundll32.exe rundll32.exe PID 308 wrote to memory of 1124 308 rundll32.exe rundll32.exe PID 308 wrote to memory of 1124 308 rundll32.exe rundll32.exe PID 1124 wrote to memory of 1908 1124 rundll32.exe 6c28d6.exe PID 1124 wrote to memory of 1908 1124 rundll32.exe 6c28d6.exe PID 1124 wrote to memory of 1908 1124 rundll32.exe 6c28d6.exe PID 1124 wrote to memory of 1908 1124 rundll32.exe 6c28d6.exe PID 1908 wrote to memory of 1228 1908 6c28d6.exe taskhost.exe PID 1908 wrote to memory of 1324 1908 6c28d6.exe Dwm.exe PID 1908 wrote to memory of 1376 1908 6c28d6.exe Explorer.EXE PID 1908 wrote to memory of 308 1908 6c28d6.exe rundll32.exe PID 1908 wrote to memory of 1124 1908 6c28d6.exe rundll32.exe PID 1908 wrote to memory of 1124 1908 6c28d6.exe rundll32.exe PID 1124 wrote to memory of 2028 1124 rundll32.exe 6c2b17.exe PID 1124 wrote to memory of 2028 1124 rundll32.exe 6c2b17.exe PID 1124 wrote to memory of 2028 1124 rundll32.exe 6c2b17.exe PID 1124 wrote to memory of 2028 1124 rundll32.exe 6c2b17.exe PID 1124 wrote to memory of 2024 1124 rundll32.exe 6c4c5d.exe PID 1124 wrote to memory of 2024 1124 rundll32.exe 6c4c5d.exe PID 1124 wrote to memory of 2024 1124 rundll32.exe 6c4c5d.exe PID 1124 wrote to memory of 2024 1124 rundll32.exe 6c4c5d.exe PID 1908 wrote to memory of 1228 1908 6c28d6.exe taskhost.exe PID 1908 wrote to memory of 1324 1908 6c28d6.exe Dwm.exe PID 1908 wrote to memory of 1376 1908 6c28d6.exe Explorer.EXE PID 1908 wrote to memory of 2028 1908 6c28d6.exe 6c2b17.exe PID 1908 wrote to memory of 2028 1908 6c28d6.exe 6c2b17.exe PID 1908 wrote to memory of 2024 1908 6c28d6.exe 6c4c5d.exe PID 1908 wrote to memory of 2024 1908 6c28d6.exe 6c4c5d.exe PID 2024 wrote to memory of 1228 2024 6c4c5d.exe taskhost.exe PID 2024 wrote to memory of 1324 2024 6c4c5d.exe Dwm.exe PID 2024 wrote to memory of 1376 2024 6c4c5d.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
6c28d6.exe6c4c5d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c28d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c4c5d.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\virussign.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\virussign.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6c28d6.exeC:\Users\Admin\AppData\Local\Temp\6c28d6.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\6c2b17.exeC:\Users\Admin\AppData\Local\Temp\6c2b17.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6c4c5d.exeC:\Users\Admin\AppData\Local\Temp\6c4c5d.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6c28d6.exeFilesize
97KB
MD5b8892dfdcbe980eb546499a24bf94810
SHA13f62b7135a006944b42242bbd9099f4dbb0b67da
SHA256d8a7b054a9183b0eeb2ff0b02312bd16bd841598988794f26e9da2c3c2086fcd
SHA51255ac3d35f34c440ae415fd174732f858a40d89e5523bc52123d9ec0f12ff51759bfac78cf3a96ff1609a3dc801e348c3c715ac75dc22b22245d0c1cd89a573c5
-
C:\Users\Admin\AppData\Local\Temp\6c2b17.exeFilesize
97KB
MD5b8892dfdcbe980eb546499a24bf94810
SHA13f62b7135a006944b42242bbd9099f4dbb0b67da
SHA256d8a7b054a9183b0eeb2ff0b02312bd16bd841598988794f26e9da2c3c2086fcd
SHA51255ac3d35f34c440ae415fd174732f858a40d89e5523bc52123d9ec0f12ff51759bfac78cf3a96ff1609a3dc801e348c3c715ac75dc22b22245d0c1cd89a573c5
-
C:\Users\Admin\AppData\Local\Temp\6c4c5d.exeFilesize
97KB
MD5b8892dfdcbe980eb546499a24bf94810
SHA13f62b7135a006944b42242bbd9099f4dbb0b67da
SHA256d8a7b054a9183b0eeb2ff0b02312bd16bd841598988794f26e9da2c3c2086fcd
SHA51255ac3d35f34c440ae415fd174732f858a40d89e5523bc52123d9ec0f12ff51759bfac78cf3a96ff1609a3dc801e348c3c715ac75dc22b22245d0c1cd89a573c5
-
C:\Windows\SYSTEM.INIFilesize
255B
MD5b3244a4cc72e663760f22f1073a75807
SHA1a29d8a384bb7505c6f73264a936788b02aa3728e
SHA256f91657cef7241449fc09572b8f753ebb93cdcc130d9dcbc2fa2676aef0e667f4
SHA512b4f69002fa6efdb9654a15a56e8a874dc246132ac1eb2ce1bc49eb59bfcfb0c4638048702d4dfd278c8e2aa347167fa6a8a5a7e79e4ac510c013a9f728621f1d
-
\Users\Admin\AppData\Local\Temp\6c28d6.exeFilesize
97KB
MD5b8892dfdcbe980eb546499a24bf94810
SHA13f62b7135a006944b42242bbd9099f4dbb0b67da
SHA256d8a7b054a9183b0eeb2ff0b02312bd16bd841598988794f26e9da2c3c2086fcd
SHA51255ac3d35f34c440ae415fd174732f858a40d89e5523bc52123d9ec0f12ff51759bfac78cf3a96ff1609a3dc801e348c3c715ac75dc22b22245d0c1cd89a573c5
-
\Users\Admin\AppData\Local\Temp\6c28d6.exeFilesize
97KB
MD5b8892dfdcbe980eb546499a24bf94810
SHA13f62b7135a006944b42242bbd9099f4dbb0b67da
SHA256d8a7b054a9183b0eeb2ff0b02312bd16bd841598988794f26e9da2c3c2086fcd
SHA51255ac3d35f34c440ae415fd174732f858a40d89e5523bc52123d9ec0f12ff51759bfac78cf3a96ff1609a3dc801e348c3c715ac75dc22b22245d0c1cd89a573c5
-
\Users\Admin\AppData\Local\Temp\6c2b17.exeFilesize
97KB
MD5b8892dfdcbe980eb546499a24bf94810
SHA13f62b7135a006944b42242bbd9099f4dbb0b67da
SHA256d8a7b054a9183b0eeb2ff0b02312bd16bd841598988794f26e9da2c3c2086fcd
SHA51255ac3d35f34c440ae415fd174732f858a40d89e5523bc52123d9ec0f12ff51759bfac78cf3a96ff1609a3dc801e348c3c715ac75dc22b22245d0c1cd89a573c5
-
\Users\Admin\AppData\Local\Temp\6c2b17.exeFilesize
97KB
MD5b8892dfdcbe980eb546499a24bf94810
SHA13f62b7135a006944b42242bbd9099f4dbb0b67da
SHA256d8a7b054a9183b0eeb2ff0b02312bd16bd841598988794f26e9da2c3c2086fcd
SHA51255ac3d35f34c440ae415fd174732f858a40d89e5523bc52123d9ec0f12ff51759bfac78cf3a96ff1609a3dc801e348c3c715ac75dc22b22245d0c1cd89a573c5
-
\Users\Admin\AppData\Local\Temp\6c4c5d.exeFilesize
97KB
MD5b8892dfdcbe980eb546499a24bf94810
SHA13f62b7135a006944b42242bbd9099f4dbb0b67da
SHA256d8a7b054a9183b0eeb2ff0b02312bd16bd841598988794f26e9da2c3c2086fcd
SHA51255ac3d35f34c440ae415fd174732f858a40d89e5523bc52123d9ec0f12ff51759bfac78cf3a96ff1609a3dc801e348c3c715ac75dc22b22245d0c1cd89a573c5
-
\Users\Admin\AppData\Local\Temp\6c4c5d.exeFilesize
97KB
MD5b8892dfdcbe980eb546499a24bf94810
SHA13f62b7135a006944b42242bbd9099f4dbb0b67da
SHA256d8a7b054a9183b0eeb2ff0b02312bd16bd841598988794f26e9da2c3c2086fcd
SHA51255ac3d35f34c440ae415fd174732f858a40d89e5523bc52123d9ec0f12ff51759bfac78cf3a96ff1609a3dc801e348c3c715ac75dc22b22245d0c1cd89a573c5
-
memory/1124-73-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/1124-79-0x00000000000F0000-0x00000000000F6000-memory.dmpFilesize
24KB
-
memory/1124-68-0x00000000000F0000-0x0000000000102000-memory.dmpFilesize
72KB
-
memory/1124-67-0x00000000000F0000-0x0000000000102000-memory.dmpFilesize
72KB
-
memory/1124-66-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1124-55-0x0000000075481000-0x0000000075483000-memory.dmpFilesize
8KB
-
memory/1124-71-0x0000000000290000-0x00000000002A2000-memory.dmpFilesize
72KB
-
memory/1124-54-0x0000000000000000-mapping.dmp
-
memory/1908-72-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/1908-70-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/1908-86-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/1908-85-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/1908-61-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/1908-81-0x0000000003E80000-0x0000000003E82000-memory.dmpFilesize
8KB
-
memory/1908-58-0x0000000000000000-mapping.dmp
-
memory/1908-69-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1908-84-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2024-80-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2024-83-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2024-77-0x0000000000000000-mapping.dmp
-
memory/2024-90-0x0000000000900000-0x00000000019BA000-memory.dmpFilesize
16.7MB
-
memory/2024-92-0x0000000000900000-0x00000000019BA000-memory.dmpFilesize
16.7MB
-
memory/2024-93-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2024-94-0x0000000000900000-0x00000000019BA000-memory.dmpFilesize
16.7MB
-
memory/2024-95-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2028-82-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2028-64-0x0000000000000000-mapping.dmp
-
memory/2028-88-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2028-74-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB