Analysis
-
max time kernel
31s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
resource tags
arch:x64arch:x86image:win7-20220414-enlocale:en-usos:windows7-x64system -
submitted
16-07-2022 07:58
Static task
static1
Behavioral task
behavioral1
Sample
virussign.dll
Resource
win7-20220414-en
General
-
Target
virussign.dll
-
Size
120KB
-
MD5
6366eaad7fbe650aa346862be63f0860
-
SHA1
fe6ead8133f20792b21788013770e10843c7dd8f
-
SHA256
2e7df1ce70cea4fbc38cebe86cbb7e3b1ef038c9f69f099406164c0ace977225
-
SHA512
1bf599648126446a581afe3362d36d4358d47ffca16c76ecbe49e20bc09779987f0da4a9c860c658b9a7d96a3705cdb0323df4031560559d14ceb0ebb263cf5b
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
6c4edc.exe6c3812.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 6c4edc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 6c4edc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 6c4edc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 6c3812.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 6c3812.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 6c3812.exe -
Processes:
6c3812.exe6c4edc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c3812.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c4edc.exe -
Processes:
6c3812.exe6c4edc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 6c3812.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6c3812.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6c4edc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6c3812.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6c3812.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6c3812.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6c3812.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6c4edc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6c4edc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 6c4edc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6c4edc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6c4edc.exe -
Executes dropped EXE 3 IoCs
Processes:
6c3812.exe6c3e0b.exe6c4edc.exepid process 1616 6c3812.exe 1764 6c3e0b.exe 1748 6c4edc.exe -
Processes:
resource yara_rule behavioral1/memory/1616-61-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/1616-71-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/1616-84-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/1616-86-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/1748-88-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/1748-90-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/1748-92-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 620 rundll32.exe 620 rundll32.exe 620 rundll32.exe 620 rundll32.exe 620 rundll32.exe 620 rundll32.exe -
Processes:
6c4edc.exe6c3812.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6c4edc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6c3812.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 6c3812.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6c3812.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6c3812.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6c4edc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6c4edc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6c4edc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 6c4edc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6c4edc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6c3812.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 6c3812.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6c3812.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 6c4edc.exe -
Processes:
6c3812.exe6c4edc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c3812.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c4edc.exe -
Enumerates connected drives 3 TTPs 8 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
6c3812.exedescription ioc process File opened (read-only) \??\H: 6c3812.exe File opened (read-only) \??\I: 6c3812.exe File opened (read-only) \??\J: 6c3812.exe File opened (read-only) \??\K: 6c3812.exe File opened (read-only) \??\L: 6c3812.exe File opened (read-only) \??\E: 6c3812.exe File opened (read-only) \??\F: 6c3812.exe File opened (read-only) \??\G: 6c3812.exe -
Drops file in Windows directory 3 IoCs
Processes:
6c3812.exe6c4edc.exedescription ioc process File created C:\Windows\6c3988 6c3812.exe File opened for modification C:\Windows\SYSTEM.INI 6c3812.exe File created C:\Windows\6c93a9 6c4edc.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
6c3812.exe6c4edc.exepid process 1616 6c3812.exe 1616 6c3812.exe 1748 6c4edc.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
Processes:
6c3812.exe6c4edc.exedescription pid process Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1616 6c3812.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe Token: SeDebugPrivilege 1748 6c4edc.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
rundll32.exerundll32.exe6c3812.exe6c4edc.exedescription pid process target process PID 1360 wrote to memory of 620 1360 rundll32.exe rundll32.exe PID 1360 wrote to memory of 620 1360 rundll32.exe rundll32.exe PID 1360 wrote to memory of 620 1360 rundll32.exe rundll32.exe PID 1360 wrote to memory of 620 1360 rundll32.exe rundll32.exe PID 1360 wrote to memory of 620 1360 rundll32.exe rundll32.exe PID 1360 wrote to memory of 620 1360 rundll32.exe rundll32.exe PID 1360 wrote to memory of 620 1360 rundll32.exe rundll32.exe PID 620 wrote to memory of 1616 620 rundll32.exe 6c3812.exe PID 620 wrote to memory of 1616 620 rundll32.exe 6c3812.exe PID 620 wrote to memory of 1616 620 rundll32.exe 6c3812.exe PID 620 wrote to memory of 1616 620 rundll32.exe 6c3812.exe PID 1616 wrote to memory of 1116 1616 6c3812.exe taskhost.exe PID 1616 wrote to memory of 1180 1616 6c3812.exe Dwm.exe PID 1616 wrote to memory of 1232 1616 6c3812.exe Explorer.EXE PID 1616 wrote to memory of 1360 1616 6c3812.exe rundll32.exe PID 1616 wrote to memory of 620 1616 6c3812.exe rundll32.exe PID 1616 wrote to memory of 620 1616 6c3812.exe rundll32.exe PID 620 wrote to memory of 1764 620 rundll32.exe 6c3e0b.exe PID 620 wrote to memory of 1764 620 rundll32.exe 6c3e0b.exe PID 620 wrote to memory of 1764 620 rundll32.exe 6c3e0b.exe PID 620 wrote to memory of 1764 620 rundll32.exe 6c3e0b.exe PID 620 wrote to memory of 1748 620 rundll32.exe 6c4edc.exe PID 620 wrote to memory of 1748 620 rundll32.exe 6c4edc.exe PID 620 wrote to memory of 1748 620 rundll32.exe 6c4edc.exe PID 620 wrote to memory of 1748 620 rundll32.exe 6c4edc.exe PID 1616 wrote to memory of 1116 1616 6c3812.exe taskhost.exe PID 1616 wrote to memory of 1180 1616 6c3812.exe Dwm.exe PID 1616 wrote to memory of 1232 1616 6c3812.exe Explorer.EXE PID 1616 wrote to memory of 1764 1616 6c3812.exe 6c3e0b.exe PID 1616 wrote to memory of 1764 1616 6c3812.exe 6c3e0b.exe PID 1616 wrote to memory of 1748 1616 6c3812.exe 6c4edc.exe PID 1616 wrote to memory of 1748 1616 6c3812.exe 6c4edc.exe PID 1748 wrote to memory of 1116 1748 6c4edc.exe taskhost.exe PID 1748 wrote to memory of 1180 1748 6c4edc.exe Dwm.exe PID 1748 wrote to memory of 1232 1748 6c4edc.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
6c3812.exe6c4edc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c3812.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c4edc.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\virussign.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\virussign.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6c3812.exeC:\Users\Admin\AppData\Local\Temp\6c3812.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\6c3e0b.exeC:\Users\Admin\AppData\Local\Temp\6c3e0b.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6c4edc.exeC:\Users\Admin\AppData\Local\Temp\6c4edc.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6c3812.exeFilesize
97KB
MD59b35cecb7a9bc697158583de34fc110a
SHA12c384746380573acf369cae64f62eda3e9a80710
SHA256cff3a2b9361fa5e7c90ef82bf16ff0038579858f83df88e489feb7dd6f0b29bc
SHA512b0025491503ddb123339036f47b363f0b22fce080415b759a45056f684f5fe729c70f3ff940ea0ad698d773f213399ac11226acd17de825b6541291ea39b356d
-
C:\Users\Admin\AppData\Local\Temp\6c3e0b.exeFilesize
97KB
MD59b35cecb7a9bc697158583de34fc110a
SHA12c384746380573acf369cae64f62eda3e9a80710
SHA256cff3a2b9361fa5e7c90ef82bf16ff0038579858f83df88e489feb7dd6f0b29bc
SHA512b0025491503ddb123339036f47b363f0b22fce080415b759a45056f684f5fe729c70f3ff940ea0ad698d773f213399ac11226acd17de825b6541291ea39b356d
-
C:\Users\Admin\AppData\Local\Temp\6c4edc.exeFilesize
97KB
MD59b35cecb7a9bc697158583de34fc110a
SHA12c384746380573acf369cae64f62eda3e9a80710
SHA256cff3a2b9361fa5e7c90ef82bf16ff0038579858f83df88e489feb7dd6f0b29bc
SHA512b0025491503ddb123339036f47b363f0b22fce080415b759a45056f684f5fe729c70f3ff940ea0ad698d773f213399ac11226acd17de825b6541291ea39b356d
-
C:\Windows\SYSTEM.INIFilesize
255B
MD5ba6bf8bfe6865c6e437a657eb12f217b
SHA19616ca17f58c5fd79cc2b6191e6b8433cb61bab6
SHA256b74543cdb70ab3edff8598ce7f3b3b3c72ae8f1c5e7bd0a7c37962279a48e0c9
SHA512f9b5177be2aad7c6577df46f2bcc35b464b958e3757f1deeba378a3c4a4e4b2c720e1cc7db6e6d64fbb1b78fa23ad71ab45590bfe020cbc5c9a779a193e148e4
-
\Users\Admin\AppData\Local\Temp\6c3812.exeFilesize
97KB
MD59b35cecb7a9bc697158583de34fc110a
SHA12c384746380573acf369cae64f62eda3e9a80710
SHA256cff3a2b9361fa5e7c90ef82bf16ff0038579858f83df88e489feb7dd6f0b29bc
SHA512b0025491503ddb123339036f47b363f0b22fce080415b759a45056f684f5fe729c70f3ff940ea0ad698d773f213399ac11226acd17de825b6541291ea39b356d
-
\Users\Admin\AppData\Local\Temp\6c3812.exeFilesize
97KB
MD59b35cecb7a9bc697158583de34fc110a
SHA12c384746380573acf369cae64f62eda3e9a80710
SHA256cff3a2b9361fa5e7c90ef82bf16ff0038579858f83df88e489feb7dd6f0b29bc
SHA512b0025491503ddb123339036f47b363f0b22fce080415b759a45056f684f5fe729c70f3ff940ea0ad698d773f213399ac11226acd17de825b6541291ea39b356d
-
\Users\Admin\AppData\Local\Temp\6c3e0b.exeFilesize
97KB
MD59b35cecb7a9bc697158583de34fc110a
SHA12c384746380573acf369cae64f62eda3e9a80710
SHA256cff3a2b9361fa5e7c90ef82bf16ff0038579858f83df88e489feb7dd6f0b29bc
SHA512b0025491503ddb123339036f47b363f0b22fce080415b759a45056f684f5fe729c70f3ff940ea0ad698d773f213399ac11226acd17de825b6541291ea39b356d
-
\Users\Admin\AppData\Local\Temp\6c3e0b.exeFilesize
97KB
MD59b35cecb7a9bc697158583de34fc110a
SHA12c384746380573acf369cae64f62eda3e9a80710
SHA256cff3a2b9361fa5e7c90ef82bf16ff0038579858f83df88e489feb7dd6f0b29bc
SHA512b0025491503ddb123339036f47b363f0b22fce080415b759a45056f684f5fe729c70f3ff940ea0ad698d773f213399ac11226acd17de825b6541291ea39b356d
-
\Users\Admin\AppData\Local\Temp\6c4edc.exeFilesize
97KB
MD59b35cecb7a9bc697158583de34fc110a
SHA12c384746380573acf369cae64f62eda3e9a80710
SHA256cff3a2b9361fa5e7c90ef82bf16ff0038579858f83df88e489feb7dd6f0b29bc
SHA512b0025491503ddb123339036f47b363f0b22fce080415b759a45056f684f5fe729c70f3ff940ea0ad698d773f213399ac11226acd17de825b6541291ea39b356d
-
\Users\Admin\AppData\Local\Temp\6c4edc.exeFilesize
97KB
MD59b35cecb7a9bc697158583de34fc110a
SHA12c384746380573acf369cae64f62eda3e9a80710
SHA256cff3a2b9361fa5e7c90ef82bf16ff0038579858f83df88e489feb7dd6f0b29bc
SHA512b0025491503ddb123339036f47b363f0b22fce080415b759a45056f684f5fe729c70f3ff940ea0ad698d773f213399ac11226acd17de825b6541291ea39b356d
-
memory/620-73-0x00000000001F0000-0x0000000000202000-memory.dmpFilesize
72KB
-
memory/620-74-0x00000000001A0000-0x00000000001A2000-memory.dmpFilesize
8KB
-
memory/620-63-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/620-68-0x0000000000160000-0x0000000000172000-memory.dmpFilesize
72KB
-
memory/620-69-0x0000000000160000-0x0000000000172000-memory.dmpFilesize
72KB
-
memory/620-55-0x0000000076011000-0x0000000076013000-memory.dmpFilesize
8KB
-
memory/620-79-0x0000000000160000-0x0000000000166000-memory.dmpFilesize
24KB
-
memory/620-66-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/620-54-0x0000000000000000-mapping.dmp
-
memory/1616-61-0x0000000000960000-0x0000000001A1A000-memory.dmpFilesize
16.7MB
-
memory/1616-84-0x0000000000960000-0x0000000001A1A000-memory.dmpFilesize
16.7MB
-
memory/1616-70-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1616-86-0x0000000000960000-0x0000000001A1A000-memory.dmpFilesize
16.7MB
-
memory/1616-72-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/1616-71-0x0000000000960000-0x0000000001A1A000-memory.dmpFilesize
16.7MB
-
memory/1616-58-0x0000000000000000-mapping.dmp
-
memory/1616-85-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/1748-83-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/1748-81-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1748-78-0x0000000000000000-mapping.dmp
-
memory/1748-88-0x0000000000910000-0x00000000019CA000-memory.dmpFilesize
16.7MB
-
memory/1748-90-0x0000000000910000-0x00000000019CA000-memory.dmpFilesize
16.7MB
-
memory/1748-91-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1748-92-0x0000000000910000-0x00000000019CA000-memory.dmpFilesize
16.7MB
-
memory/1764-75-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1764-82-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/1764-65-0x0000000000000000-mapping.dmp