Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
resource tags
arch:x64arch:x86image:win7-20220414-enlocale:en-usos:windows7-x64system -
submitted
16-07-2022 07:58
Static task
static1
Behavioral task
behavioral1
Sample
virussign.dll
Resource
win7-20220414-en
General
-
Target
virussign.dll
-
Size
120KB
-
MD5
7035aa8d06897d9c55e11bed39037130
-
SHA1
4e02816b2a9ec4d758f34a8aeea20376eab320f8
-
SHA256
ded9acd7c3071f3477179b0729961d0975de0b81d98bf59b35da0ce75c48c584
-
SHA512
96589f63fc3afc92adf431907cbced4b8a120193ea12656307369a23394c7aa48bf409e5ed6a431abf268b7d2d8642911c4dc354951bc0f8b2752713854e5de5
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
6bf2a9.exe6c1382.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 6bf2a9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 6bf2a9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 6c1382.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 6c1382.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 6c1382.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 6bf2a9.exe -
Processes:
6bf2a9.exe6c1382.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6bf2a9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c1382.exe -
Processes:
6c1382.exe6bf2a9.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6c1382.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 6c1382.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6bf2a9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 6bf2a9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6bf2a9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6bf2a9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6c1382.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6c1382.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6bf2a9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6bf2a9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6c1382.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6c1382.exe -
Executes dropped EXE 3 IoCs
Processes:
6bf2a9.exe6bf76a.exe6c1382.exepid process 1812 6bf2a9.exe 1152 6bf76a.exe 524 6c1382.exe -
Processes:
resource yara_rule behavioral1/memory/1812-61-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/1812-66-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/1812-83-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/1812-85-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/524-87-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/524-90-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/524-92-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 1304 rundll32.exe 1304 rundll32.exe 1304 rundll32.exe 1304 rundll32.exe 1304 rundll32.exe 1304 rundll32.exe -
Processes:
6c1382.exe6bf2a9.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6c1382.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6c1382.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 6c1382.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6bf2a9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6bf2a9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 6bf2a9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6bf2a9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6c1382.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 6c1382.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6bf2a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 6bf2a9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6c1382.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6c1382.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6bf2a9.exe -
Processes:
6bf2a9.exe6c1382.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6bf2a9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c1382.exe -
Enumerates connected drives 3 TTPs 8 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
6bf2a9.exedescription ioc process File opened (read-only) \??\F: 6bf2a9.exe File opened (read-only) \??\G: 6bf2a9.exe File opened (read-only) \??\H: 6bf2a9.exe File opened (read-only) \??\I: 6bf2a9.exe File opened (read-only) \??\J: 6bf2a9.exe File opened (read-only) \??\K: 6bf2a9.exe File opened (read-only) \??\L: 6bf2a9.exe File opened (read-only) \??\E: 6bf2a9.exe -
Drops file in Windows directory 3 IoCs
Processes:
6bf2a9.exe6c1382.exedescription ioc process File created C:\Windows\6bf49c 6bf2a9.exe File opened for modification C:\Windows\SYSTEM.INI 6bf2a9.exe File created C:\Windows\6c4d27 6c1382.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
6bf2a9.exe6c1382.exepid process 1812 6bf2a9.exe 1812 6bf2a9.exe 524 6c1382.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
Processes:
6bf2a9.exe6c1382.exedescription pid process Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 1812 6bf2a9.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe Token: SeDebugPrivilege 524 6c1382.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
rundll32.exerundll32.exe6bf2a9.exe6c1382.exedescription pid process target process PID 1612 wrote to memory of 1304 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 1304 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 1304 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 1304 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 1304 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 1304 1612 rundll32.exe rundll32.exe PID 1612 wrote to memory of 1304 1612 rundll32.exe rundll32.exe PID 1304 wrote to memory of 1812 1304 rundll32.exe 6bf2a9.exe PID 1304 wrote to memory of 1812 1304 rundll32.exe 6bf2a9.exe PID 1304 wrote to memory of 1812 1304 rundll32.exe 6bf2a9.exe PID 1304 wrote to memory of 1812 1304 rundll32.exe 6bf2a9.exe PID 1812 wrote to memory of 1136 1812 6bf2a9.exe taskhost.exe PID 1812 wrote to memory of 1200 1812 6bf2a9.exe Dwm.exe PID 1812 wrote to memory of 1268 1812 6bf2a9.exe Explorer.EXE PID 1812 wrote to memory of 1612 1812 6bf2a9.exe rundll32.exe PID 1812 wrote to memory of 1304 1812 6bf2a9.exe rundll32.exe PID 1812 wrote to memory of 1304 1812 6bf2a9.exe rundll32.exe PID 1304 wrote to memory of 1152 1304 rundll32.exe 6bf76a.exe PID 1304 wrote to memory of 1152 1304 rundll32.exe 6bf76a.exe PID 1304 wrote to memory of 1152 1304 rundll32.exe 6bf76a.exe PID 1304 wrote to memory of 1152 1304 rundll32.exe 6bf76a.exe PID 1304 wrote to memory of 524 1304 rundll32.exe 6c1382.exe PID 1304 wrote to memory of 524 1304 rundll32.exe 6c1382.exe PID 1304 wrote to memory of 524 1304 rundll32.exe 6c1382.exe PID 1304 wrote to memory of 524 1304 rundll32.exe 6c1382.exe PID 1812 wrote to memory of 1136 1812 6bf2a9.exe taskhost.exe PID 1812 wrote to memory of 1200 1812 6bf2a9.exe Dwm.exe PID 1812 wrote to memory of 1268 1812 6bf2a9.exe Explorer.EXE PID 1812 wrote to memory of 1152 1812 6bf2a9.exe 6bf76a.exe PID 1812 wrote to memory of 1152 1812 6bf2a9.exe 6bf76a.exe PID 1812 wrote to memory of 524 1812 6bf2a9.exe 6c1382.exe PID 1812 wrote to memory of 524 1812 6bf2a9.exe 6c1382.exe PID 524 wrote to memory of 1136 524 6c1382.exe taskhost.exe PID 524 wrote to memory of 1200 524 6c1382.exe Dwm.exe PID 524 wrote to memory of 1268 524 6c1382.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
6bf2a9.exe6c1382.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6bf2a9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6c1382.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\virussign.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\virussign.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6bf2a9.exeC:\Users\Admin\AppData\Local\Temp\6bf2a9.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\6bf76a.exeC:\Users\Admin\AppData\Local\Temp\6bf76a.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6c1382.exeC:\Users\Admin\AppData\Local\Temp\6c1382.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6bf2a9.exeFilesize
97KB
MD540e6009840afd3d99968196127e27aa9
SHA19b397bf1aeac9867f60bb7cdd2e8ff6b3c70e9ec
SHA2567044c42e77011ce0f9ed9c9056cf4dad1ab6db09bc1d00006c050d3c5030a6e0
SHA512d090c11b764389c80f00166bcd2dc0c720b72bdccc2c16496c9e2c7b8ceddfbc4ed8911744740f24843452e61c4597a896d2a4ee7893c169e57a034758cb4041
-
C:\Users\Admin\AppData\Local\Temp\6bf76a.exeFilesize
97KB
MD540e6009840afd3d99968196127e27aa9
SHA19b397bf1aeac9867f60bb7cdd2e8ff6b3c70e9ec
SHA2567044c42e77011ce0f9ed9c9056cf4dad1ab6db09bc1d00006c050d3c5030a6e0
SHA512d090c11b764389c80f00166bcd2dc0c720b72bdccc2c16496c9e2c7b8ceddfbc4ed8911744740f24843452e61c4597a896d2a4ee7893c169e57a034758cb4041
-
C:\Users\Admin\AppData\Local\Temp\6c1382.exeFilesize
97KB
MD540e6009840afd3d99968196127e27aa9
SHA19b397bf1aeac9867f60bb7cdd2e8ff6b3c70e9ec
SHA2567044c42e77011ce0f9ed9c9056cf4dad1ab6db09bc1d00006c050d3c5030a6e0
SHA512d090c11b764389c80f00166bcd2dc0c720b72bdccc2c16496c9e2c7b8ceddfbc4ed8911744740f24843452e61c4597a896d2a4ee7893c169e57a034758cb4041
-
C:\Windows\SYSTEM.INIFilesize
254B
MD5f80453f21137c7fc2f619e2ba7c6ae1d
SHA1dbabeaee931cab03ac4d3af46f0fb6c7958c0628
SHA2569a8e565e5d06809b1ee77b16330a52e5b69aba5fabf1e3e9d1bb9b4cff8f972f
SHA51205f78d2c7c06b7c91755202a8cc80f8cfb8f704c7358eed1444c6107161c4d9e24535f8a3ebf9ee13ceec6323a1283dc8ed960fa4bf00dd7fab8ed1a37aaadb4
-
\Users\Admin\AppData\Local\Temp\6bf2a9.exeFilesize
97KB
MD540e6009840afd3d99968196127e27aa9
SHA19b397bf1aeac9867f60bb7cdd2e8ff6b3c70e9ec
SHA2567044c42e77011ce0f9ed9c9056cf4dad1ab6db09bc1d00006c050d3c5030a6e0
SHA512d090c11b764389c80f00166bcd2dc0c720b72bdccc2c16496c9e2c7b8ceddfbc4ed8911744740f24843452e61c4597a896d2a4ee7893c169e57a034758cb4041
-
\Users\Admin\AppData\Local\Temp\6bf2a9.exeFilesize
97KB
MD540e6009840afd3d99968196127e27aa9
SHA19b397bf1aeac9867f60bb7cdd2e8ff6b3c70e9ec
SHA2567044c42e77011ce0f9ed9c9056cf4dad1ab6db09bc1d00006c050d3c5030a6e0
SHA512d090c11b764389c80f00166bcd2dc0c720b72bdccc2c16496c9e2c7b8ceddfbc4ed8911744740f24843452e61c4597a896d2a4ee7893c169e57a034758cb4041
-
\Users\Admin\AppData\Local\Temp\6bf76a.exeFilesize
97KB
MD540e6009840afd3d99968196127e27aa9
SHA19b397bf1aeac9867f60bb7cdd2e8ff6b3c70e9ec
SHA2567044c42e77011ce0f9ed9c9056cf4dad1ab6db09bc1d00006c050d3c5030a6e0
SHA512d090c11b764389c80f00166bcd2dc0c720b72bdccc2c16496c9e2c7b8ceddfbc4ed8911744740f24843452e61c4597a896d2a4ee7893c169e57a034758cb4041
-
\Users\Admin\AppData\Local\Temp\6bf76a.exeFilesize
97KB
MD540e6009840afd3d99968196127e27aa9
SHA19b397bf1aeac9867f60bb7cdd2e8ff6b3c70e9ec
SHA2567044c42e77011ce0f9ed9c9056cf4dad1ab6db09bc1d00006c050d3c5030a6e0
SHA512d090c11b764389c80f00166bcd2dc0c720b72bdccc2c16496c9e2c7b8ceddfbc4ed8911744740f24843452e61c4597a896d2a4ee7893c169e57a034758cb4041
-
\Users\Admin\AppData\Local\Temp\6c1382.exeFilesize
97KB
MD540e6009840afd3d99968196127e27aa9
SHA19b397bf1aeac9867f60bb7cdd2e8ff6b3c70e9ec
SHA2567044c42e77011ce0f9ed9c9056cf4dad1ab6db09bc1d00006c050d3c5030a6e0
SHA512d090c11b764389c80f00166bcd2dc0c720b72bdccc2c16496c9e2c7b8ceddfbc4ed8911744740f24843452e61c4597a896d2a4ee7893c169e57a034758cb4041
-
\Users\Admin\AppData\Local\Temp\6c1382.exeFilesize
97KB
MD540e6009840afd3d99968196127e27aa9
SHA19b397bf1aeac9867f60bb7cdd2e8ff6b3c70e9ec
SHA2567044c42e77011ce0f9ed9c9056cf4dad1ab6db09bc1d00006c050d3c5030a6e0
SHA512d090c11b764389c80f00166bcd2dc0c720b72bdccc2c16496c9e2c7b8ceddfbc4ed8911744740f24843452e61c4597a896d2a4ee7893c169e57a034758cb4041
-
memory/524-80-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/524-82-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/524-91-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/524-87-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/524-92-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/524-90-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/524-78-0x0000000000000000-mapping.dmp
-
memory/1152-69-0x0000000000000000-mapping.dmp
-
memory/1152-81-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/1152-89-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1152-75-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1304-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1304-54-0x0000000000000000-mapping.dmp
-
memory/1304-73-0x0000000000480000-0x0000000000492000-memory.dmpFilesize
72KB
-
memory/1304-74-0x0000000000480000-0x0000000000492000-memory.dmpFilesize
72KB
-
memory/1304-71-0x00000000003A0000-0x00000000003A2000-memory.dmpFilesize
8KB
-
memory/1304-55-0x0000000076531000-0x0000000076533000-memory.dmpFilesize
8KB
-
memory/1304-62-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1304-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1812-72-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/1812-85-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/1812-84-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/1812-83-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/1812-65-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1812-61-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB
-
memory/1812-58-0x0000000000000000-mapping.dmp
-
memory/1812-66-0x0000000000620000-0x00000000016DA000-memory.dmpFilesize
16.7MB