Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 14:43
Static task
static1
Behavioral task
behavioral1
Sample
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe
Resource
win10v2004-20220721-en
General
-
Target
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe
-
Size
427KB
-
MD5
55df99a116a1369f7ad5748a8c82c6ae
-
SHA1
c557457c271b7047df114672390c3ad4f0393b3a
-
SHA256
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b
-
SHA512
260a2728e38daff602cca99116ecdf2175210320b443895917de59d79885d49b96108f250871969e846881a42e7e2217b90e1d3e2486a14f1e2faae5f5b9d7cc
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\system32\\winlogon.exe" f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe -
Executes dropped EXE 2 IoCs
Processes:
winlogon.exewinlogon.exepid process 4352 winlogon.exe 840 winlogon.exe -
Processes:
resource yara_rule behavioral2/memory/1760-139-0x0000000013140000-0x00000000131FC000-memory.dmp upx behavioral2/memory/1760-138-0x0000000013140000-0x00000000131FC000-memory.dmp upx behavioral2/memory/1760-140-0x0000000013140000-0x00000000131FC000-memory.dmp upx behavioral2/memory/1760-143-0x0000000013140000-0x00000000131FC000-memory.dmp upx behavioral2/memory/1760-146-0x0000000013140000-0x00000000131FC000-memory.dmp upx behavioral2/memory/840-166-0x0000000013140000-0x00000000131FC000-memory.dmp upx behavioral2/memory/840-164-0x0000000013140000-0x00000000131FC000-memory.dmp upx behavioral2/memory/840-167-0x0000000013140000-0x00000000131FC000-memory.dmp upx behavioral2/memory/840-169-0x0000000013140000-0x00000000131FC000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exewinlogon.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winlogon.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exenotepad.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\system32\\winlogon.exe" f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\system32\\winlogon.exe" notepad.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exewinlogon.exedescription pid process target process PID 4348 set thread context of 1760 4348 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 4352 set thread context of 840 4352 winlogon.exe winlogon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
winlogon.exef175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winlogon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winlogon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier winlogon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier winlogon.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exewinlogon.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winlogon.exe -
Modifies registry class 1 IoCs
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exewinlogon.exedescription pid process Token: SeIncreaseQuotaPrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeSecurityPrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeTakeOwnershipPrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeLoadDriverPrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeSystemProfilePrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeSystemtimePrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeProfSingleProcessPrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeIncBasePriorityPrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeCreatePagefilePrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeBackupPrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeRestorePrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeShutdownPrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeDebugPrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeSystemEnvironmentPrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeChangeNotifyPrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeRemoteShutdownPrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeUndockPrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeManageVolumePrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeImpersonatePrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeCreateGlobalPrivilege 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: 33 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: 34 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: 35 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: 36 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeIncreaseQuotaPrivilege 840 winlogon.exe Token: SeSecurityPrivilege 840 winlogon.exe Token: SeTakeOwnershipPrivilege 840 winlogon.exe Token: SeLoadDriverPrivilege 840 winlogon.exe Token: SeSystemProfilePrivilege 840 winlogon.exe Token: SeSystemtimePrivilege 840 winlogon.exe Token: SeProfSingleProcessPrivilege 840 winlogon.exe Token: SeIncBasePriorityPrivilege 840 winlogon.exe Token: SeCreatePagefilePrivilege 840 winlogon.exe Token: SeBackupPrivilege 840 winlogon.exe Token: SeRestorePrivilege 840 winlogon.exe Token: SeShutdownPrivilege 840 winlogon.exe Token: SeDebugPrivilege 840 winlogon.exe Token: SeSystemEnvironmentPrivilege 840 winlogon.exe Token: SeChangeNotifyPrivilege 840 winlogon.exe Token: SeRemoteShutdownPrivilege 840 winlogon.exe Token: SeUndockPrivilege 840 winlogon.exe Token: SeManageVolumePrivilege 840 winlogon.exe Token: SeImpersonatePrivilege 840 winlogon.exe Token: SeCreateGlobalPrivilege 840 winlogon.exe Token: 33 840 winlogon.exe Token: 34 840 winlogon.exe Token: 35 840 winlogon.exe Token: 36 840 winlogon.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exewinlogon.exewinlogon.exepid process 4348 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe 4348 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe 4348 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe 4352 winlogon.exe 4352 winlogon.exe 4352 winlogon.exe 840 winlogon.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exef175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exewinlogon.exewinlogon.exedescription pid process target process PID 4348 wrote to memory of 1760 4348 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 4348 wrote to memory of 1760 4348 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 4348 wrote to memory of 1760 4348 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 4348 wrote to memory of 1760 4348 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 4348 wrote to memory of 1760 4348 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 4348 wrote to memory of 1760 4348 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 4348 wrote to memory of 1760 4348 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 4348 wrote to memory of 1760 4348 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 2904 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 1760 wrote to memory of 4280 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe explorer.exe PID 1760 wrote to memory of 4280 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe explorer.exe PID 1760 wrote to memory of 4280 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe explorer.exe PID 1760 wrote to memory of 4352 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe winlogon.exe PID 1760 wrote to memory of 4352 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe winlogon.exe PID 1760 wrote to memory of 4352 1760 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe winlogon.exe PID 4352 wrote to memory of 840 4352 winlogon.exe winlogon.exe PID 4352 wrote to memory of 840 4352 winlogon.exe winlogon.exe PID 4352 wrote to memory of 840 4352 winlogon.exe winlogon.exe PID 4352 wrote to memory of 840 4352 winlogon.exe winlogon.exe PID 4352 wrote to memory of 840 4352 winlogon.exe winlogon.exe PID 4352 wrote to memory of 840 4352 winlogon.exe winlogon.exe PID 4352 wrote to memory of 840 4352 winlogon.exe winlogon.exe PID 4352 wrote to memory of 840 4352 winlogon.exe winlogon.exe PID 840 wrote to memory of 1232 840 winlogon.exe explorer.exe PID 840 wrote to memory of 1232 840 winlogon.exe explorer.exe PID 840 wrote to memory of 1232 840 winlogon.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe"C:\Users\Admin\AppData\Local\Temp\f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe"C:\Users\Admin\AppData\Local\Temp\f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe"2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
-
C:\system32\winlogon.exe"C:\system32\winlogon.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\system32\winlogon.exe"C:\system32\winlogon.exe"4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\system32\winlogon.exeFilesize
427KB
MD555df99a116a1369f7ad5748a8c82c6ae
SHA1c557457c271b7047df114672390c3ad4f0393b3a
SHA256f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b
SHA512260a2728e38daff602cca99116ecdf2175210320b443895917de59d79885d49b96108f250871969e846881a42e7e2217b90e1d3e2486a14f1e2faae5f5b9d7cc
-
C:\system32\winlogon.exeFilesize
427KB
MD555df99a116a1369f7ad5748a8c82c6ae
SHA1c557457c271b7047df114672390c3ad4f0393b3a
SHA256f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b
SHA512260a2728e38daff602cca99116ecdf2175210320b443895917de59d79885d49b96108f250871969e846881a42e7e2217b90e1d3e2486a14f1e2faae5f5b9d7cc
-
C:\system32\winlogon.exeFilesize
427KB
MD555df99a116a1369f7ad5748a8c82c6ae
SHA1c557457c271b7047df114672390c3ad4f0393b3a
SHA256f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b
SHA512260a2728e38daff602cca99116ecdf2175210320b443895917de59d79885d49b96108f250871969e846881a42e7e2217b90e1d3e2486a14f1e2faae5f5b9d7cc
-
memory/840-169-0x0000000013140000-0x00000000131FC000-memory.dmpFilesize
752KB
-
memory/840-167-0x0000000013140000-0x00000000131FC000-memory.dmpFilesize
752KB
-
memory/840-164-0x0000000013140000-0x00000000131FC000-memory.dmpFilesize
752KB
-
memory/840-166-0x0000000013140000-0x00000000131FC000-memory.dmpFilesize
752KB
-
memory/840-160-0x0000000000000000-mapping.dmp
-
memory/1232-168-0x0000000000000000-mapping.dmp
-
memory/1760-140-0x0000000013140000-0x00000000131FC000-memory.dmpFilesize
752KB
-
memory/1760-138-0x0000000013140000-0x00000000131FC000-memory.dmpFilesize
752KB
-
memory/1760-143-0x0000000013140000-0x00000000131FC000-memory.dmpFilesize
752KB
-
memory/1760-146-0x0000000013140000-0x00000000131FC000-memory.dmpFilesize
752KB
-
memory/1760-137-0x0000000000000000-mapping.dmp
-
memory/1760-139-0x0000000013140000-0x00000000131FC000-memory.dmpFilesize
752KB
-
memory/2904-144-0x0000000000000000-mapping.dmp
-
memory/4280-145-0x0000000000000000-mapping.dmp
-
memory/4348-141-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/4348-134-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/4348-131-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/4348-132-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/4348-133-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/4348-142-0x0000000003850000-0x0000000003940000-memory.dmpFilesize
960KB
-
memory/4348-130-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/4352-157-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/4352-159-0x00000000037A0000-0x0000000003890000-memory.dmpFilesize
960KB
-
memory/4352-155-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/4352-154-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/4352-147-0x0000000000000000-mapping.dmp
-
memory/4352-165-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/4352-150-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/4352-153-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/4352-152-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/4352-151-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB