Analysis
-
max time kernel
151s -
max time network
62s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-10-2022 19:52
Static task
static1
Behavioral task
behavioral1
Sample
aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0.exe
Resource
win10v2004-20220901-en
General
-
Target
aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0.exe
-
Size
137KB
-
MD5
7290d6c5b840d629b677940ba7864850
-
SHA1
46d8fdaf6386cd259ae9dc6fd273bfbc215f9b3b
-
SHA256
aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0
-
SHA512
94a7b9b36ccb1813708037a07cec10324d69cda9c7dc3f4db205489bf03af99868d933486093a07fdd0b4cba2a2050dd8a6ae00b4627c47f9f591c70ecfefea2
-
SSDEEP
3072:Cnj9jtfU+INndIc0JQ5iKVk25T6nd8a9bK6PvA95hESK0A:CjbeimJTAd8d6n05hT0
Malware Config
Extracted
njrat
0.7d
HacKed
trung0979774557.homeip.net:5552
192936889c1ad904a258ba1ec13299b3
-
reg_key
192936889c1ad904a258ba1ec13299b3
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 5 IoCs
Processes:
B.exeB.exeB.exeserver.exeserver.exepid process 1968 B.exe 1396 B.exe 1516 B.exe 1736 server.exe 304 server.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 9 IoCs
Processes:
aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0.exeB.exeB.exeserver.exeserver.exepid process 1784 aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0.exe 1968 B.exe 1968 B.exe 1968 B.exe 1516 B.exe 1516 B.exe 1736 server.exe 1736 server.exe 304 server.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
server.exeaef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\192936889c1ad904a258ba1ec13299b3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\192936889c1ad904a258ba1ec13299b3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
B.exeserver.exedescription pid process target process PID 1968 set thread context of 1516 1968 B.exe B.exe PID 1736 set thread context of 304 1736 server.exe server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
B.exeserver.exepid process 1968 B.exe 1736 server.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
B.exeserver.exeserver.exedescription pid process Token: SeDebugPrivilege 1968 B.exe Token: SeDebugPrivilege 1736 server.exe Token: SeDebugPrivilege 304 server.exe Token: 33 304 server.exe Token: SeIncBasePriorityPrivilege 304 server.exe Token: 33 304 server.exe Token: SeIncBasePriorityPrivilege 304 server.exe Token: 33 304 server.exe Token: SeIncBasePriorityPrivilege 304 server.exe Token: 33 304 server.exe Token: SeIncBasePriorityPrivilege 304 server.exe Token: 33 304 server.exe Token: SeIncBasePriorityPrivilege 304 server.exe Token: 33 304 server.exe Token: SeIncBasePriorityPrivilege 304 server.exe Token: 33 304 server.exe Token: SeIncBasePriorityPrivilege 304 server.exe Token: 33 304 server.exe Token: SeIncBasePriorityPrivilege 304 server.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0.exeB.exeB.exeserver.exeserver.exedescription pid process target process PID 1784 wrote to memory of 1968 1784 aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0.exe B.exe PID 1784 wrote to memory of 1968 1784 aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0.exe B.exe PID 1784 wrote to memory of 1968 1784 aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0.exe B.exe PID 1784 wrote to memory of 1968 1784 aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0.exe B.exe PID 1784 wrote to memory of 1968 1784 aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0.exe B.exe PID 1784 wrote to memory of 1968 1784 aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0.exe B.exe PID 1784 wrote to memory of 1968 1784 aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0.exe B.exe PID 1968 wrote to memory of 1396 1968 B.exe B.exe PID 1968 wrote to memory of 1396 1968 B.exe B.exe PID 1968 wrote to memory of 1396 1968 B.exe B.exe PID 1968 wrote to memory of 1396 1968 B.exe B.exe PID 1968 wrote to memory of 1396 1968 B.exe B.exe PID 1968 wrote to memory of 1396 1968 B.exe B.exe PID 1968 wrote to memory of 1396 1968 B.exe B.exe PID 1968 wrote to memory of 1516 1968 B.exe B.exe PID 1968 wrote to memory of 1516 1968 B.exe B.exe PID 1968 wrote to memory of 1516 1968 B.exe B.exe PID 1968 wrote to memory of 1516 1968 B.exe B.exe PID 1968 wrote to memory of 1516 1968 B.exe B.exe PID 1968 wrote to memory of 1516 1968 B.exe B.exe PID 1968 wrote to memory of 1516 1968 B.exe B.exe PID 1968 wrote to memory of 1516 1968 B.exe B.exe PID 1968 wrote to memory of 1516 1968 B.exe B.exe PID 1968 wrote to memory of 1516 1968 B.exe B.exe PID 1968 wrote to memory of 1516 1968 B.exe B.exe PID 1968 wrote to memory of 1516 1968 B.exe B.exe PID 1968 wrote to memory of 1516 1968 B.exe B.exe PID 1516 wrote to memory of 1736 1516 B.exe server.exe PID 1516 wrote to memory of 1736 1516 B.exe server.exe PID 1516 wrote to memory of 1736 1516 B.exe server.exe PID 1516 wrote to memory of 1736 1516 B.exe server.exe PID 1516 wrote to memory of 1736 1516 B.exe server.exe PID 1516 wrote to memory of 1736 1516 B.exe server.exe PID 1516 wrote to memory of 1736 1516 B.exe server.exe PID 1736 wrote to memory of 304 1736 server.exe server.exe PID 1736 wrote to memory of 304 1736 server.exe server.exe PID 1736 wrote to memory of 304 1736 server.exe server.exe PID 1736 wrote to memory of 304 1736 server.exe server.exe PID 1736 wrote to memory of 304 1736 server.exe server.exe PID 1736 wrote to memory of 304 1736 server.exe server.exe PID 1736 wrote to memory of 304 1736 server.exe server.exe PID 1736 wrote to memory of 304 1736 server.exe server.exe PID 1736 wrote to memory of 304 1736 server.exe server.exe PID 1736 wrote to memory of 304 1736 server.exe server.exe PID 1736 wrote to memory of 304 1736 server.exe server.exe PID 1736 wrote to memory of 304 1736 server.exe server.exe PID 1736 wrote to memory of 304 1736 server.exe server.exe PID 304 wrote to memory of 836 304 server.exe netsh.exe PID 304 wrote to memory of 836 304 server.exe netsh.exe PID 304 wrote to memory of 836 304 server.exe netsh.exe PID 304 wrote to memory of 836 304 server.exe netsh.exe PID 304 wrote to memory of 836 304 server.exe netsh.exe PID 304 wrote to memory of 836 304 server.exe netsh.exe PID 304 wrote to memory of 836 304 server.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0.exe"C:\Users\Admin\AppData\Local\Temp\aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\B.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\B.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\B.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\B.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\B.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\B.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\server.exeC:\Users\Admin\AppData\Local\Temp\server.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE6⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\CSIDL_Filesize
64KB
MD5e55002c9131eb52ae05d4a5ce0c8659a
SHA172515fb30347176ec0310eab22720a077f762c22
SHA2566bc0a5d9f2b33cf7c5289a6c74fd311add64dd9ad7e674b1bbebc4df4fdb7890
SHA5126fa33d9f2faf217b7933f5fc7655876d545c9a58631c5d97bd2328d82d4e604413da2023b9e248935523333bb6b4f4ca1507149c3d1b57f2ace973f0d9750ce3
-
C:\Users\Admin\AppData\Local\CSIDL_XFilesize
64KB
MD5e55002c9131eb52ae05d4a5ce0c8659a
SHA172515fb30347176ec0310eab22720a077f762c22
SHA2566bc0a5d9f2b33cf7c5289a6c74fd311add64dd9ad7e674b1bbebc4df4fdb7890
SHA5126fa33d9f2faf217b7933f5fc7655876d545c9a58631c5d97bd2328d82d4e604413da2023b9e248935523333bb6b4f4ca1507149c3d1b57f2ace973f0d9750ce3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\B.ex_Filesize
64KB
MD5e55002c9131eb52ae05d4a5ce0c8659a
SHA172515fb30347176ec0310eab22720a077f762c22
SHA2566bc0a5d9f2b33cf7c5289a6c74fd311add64dd9ad7e674b1bbebc4df4fdb7890
SHA5126fa33d9f2faf217b7933f5fc7655876d545c9a58631c5d97bd2328d82d4e604413da2023b9e248935523333bb6b4f4ca1507149c3d1b57f2ace973f0d9750ce3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\B.exeFilesize
40KB
MD567eeab292f21456677476f6139574c00
SHA17cc0dfbd6a7b34334049eb877770bdf9e377be9d
SHA25601715e84d2abaab8f786b656b17fc5ce653e7d0b42468abadff24c5d1d63ee6e
SHA5123def31df679ad447e2a53b21033453f75d17e7e6c711ee883a5f6c60ddc8fa5159ba82a7a40999354e29df29a92539a0e2eb609ba066fb942081624ea8e4cb60
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\B.exeFilesize
40KB
MD567eeab292f21456677476f6139574c00
SHA17cc0dfbd6a7b34334049eb877770bdf9e377be9d
SHA25601715e84d2abaab8f786b656b17fc5ce653e7d0b42468abadff24c5d1d63ee6e
SHA5123def31df679ad447e2a53b21033453f75d17e7e6c711ee883a5f6c60ddc8fa5159ba82a7a40999354e29df29a92539a0e2eb609ba066fb942081624ea8e4cb60
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\B.exeFilesize
40KB
MD567eeab292f21456677476f6139574c00
SHA17cc0dfbd6a7b34334049eb877770bdf9e377be9d
SHA25601715e84d2abaab8f786b656b17fc5ce653e7d0b42468abadff24c5d1d63ee6e
SHA5123def31df679ad447e2a53b21033453f75d17e7e6c711ee883a5f6c60ddc8fa5159ba82a7a40999354e29df29a92539a0e2eb609ba066fb942081624ea8e4cb60
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\B.exeFilesize
40KB
MD567eeab292f21456677476f6139574c00
SHA17cc0dfbd6a7b34334049eb877770bdf9e377be9d
SHA25601715e84d2abaab8f786b656b17fc5ce653e7d0b42468abadff24c5d1d63ee6e
SHA5123def31df679ad447e2a53b21033453f75d17e7e6c711ee883a5f6c60ddc8fa5159ba82a7a40999354e29df29a92539a0e2eb609ba066fb942081624ea8e4cb60
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
40KB
MD567eeab292f21456677476f6139574c00
SHA17cc0dfbd6a7b34334049eb877770bdf9e377be9d
SHA25601715e84d2abaab8f786b656b17fc5ce653e7d0b42468abadff24c5d1d63ee6e
SHA5123def31df679ad447e2a53b21033453f75d17e7e6c711ee883a5f6c60ddc8fa5159ba82a7a40999354e29df29a92539a0e2eb609ba066fb942081624ea8e4cb60
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
40KB
MD567eeab292f21456677476f6139574c00
SHA17cc0dfbd6a7b34334049eb877770bdf9e377be9d
SHA25601715e84d2abaab8f786b656b17fc5ce653e7d0b42468abadff24c5d1d63ee6e
SHA5123def31df679ad447e2a53b21033453f75d17e7e6c711ee883a5f6c60ddc8fa5159ba82a7a40999354e29df29a92539a0e2eb609ba066fb942081624ea8e4cb60
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
40KB
MD567eeab292f21456677476f6139574c00
SHA17cc0dfbd6a7b34334049eb877770bdf9e377be9d
SHA25601715e84d2abaab8f786b656b17fc5ce653e7d0b42468abadff24c5d1d63ee6e
SHA5123def31df679ad447e2a53b21033453f75d17e7e6c711ee883a5f6c60ddc8fa5159ba82a7a40999354e29df29a92539a0e2eb609ba066fb942081624ea8e4cb60
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startupx\system.pifFilesize
40KB
MD567eeab292f21456677476f6139574c00
SHA17cc0dfbd6a7b34334049eb877770bdf9e377be9d
SHA25601715e84d2abaab8f786b656b17fc5ce653e7d0b42468abadff24c5d1d63ee6e
SHA5123def31df679ad447e2a53b21033453f75d17e7e6c711ee883a5f6c60ddc8fa5159ba82a7a40999354e29df29a92539a0e2eb609ba066fb942081624ea8e4cb60
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\B.exeFilesize
40KB
MD567eeab292f21456677476f6139574c00
SHA17cc0dfbd6a7b34334049eb877770bdf9e377be9d
SHA25601715e84d2abaab8f786b656b17fc5ce653e7d0b42468abadff24c5d1d63ee6e
SHA5123def31df679ad447e2a53b21033453f75d17e7e6c711ee883a5f6c60ddc8fa5159ba82a7a40999354e29df29a92539a0e2eb609ba066fb942081624ea8e4cb60
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\B.exeFilesize
40KB
MD567eeab292f21456677476f6139574c00
SHA17cc0dfbd6a7b34334049eb877770bdf9e377be9d
SHA25601715e84d2abaab8f786b656b17fc5ce653e7d0b42468abadff24c5d1d63ee6e
SHA5123def31df679ad447e2a53b21033453f75d17e7e6c711ee883a5f6c60ddc8fa5159ba82a7a40999354e29df29a92539a0e2eb609ba066fb942081624ea8e4cb60
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\B.exeFilesize
40KB
MD567eeab292f21456677476f6139574c00
SHA17cc0dfbd6a7b34334049eb877770bdf9e377be9d
SHA25601715e84d2abaab8f786b656b17fc5ce653e7d0b42468abadff24c5d1d63ee6e
SHA5123def31df679ad447e2a53b21033453f75d17e7e6c711ee883a5f6c60ddc8fa5159ba82a7a40999354e29df29a92539a0e2eb609ba066fb942081624ea8e4cb60
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\B.exeFilesize
40KB
MD567eeab292f21456677476f6139574c00
SHA17cc0dfbd6a7b34334049eb877770bdf9e377be9d
SHA25601715e84d2abaab8f786b656b17fc5ce653e7d0b42468abadff24c5d1d63ee6e
SHA5123def31df679ad447e2a53b21033453f75d17e7e6c711ee883a5f6c60ddc8fa5159ba82a7a40999354e29df29a92539a0e2eb609ba066fb942081624ea8e4cb60
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\B.exeFilesize
40KB
MD567eeab292f21456677476f6139574c00
SHA17cc0dfbd6a7b34334049eb877770bdf9e377be9d
SHA25601715e84d2abaab8f786b656b17fc5ce653e7d0b42468abadff24c5d1d63ee6e
SHA5123def31df679ad447e2a53b21033453f75d17e7e6c711ee883a5f6c60ddc8fa5159ba82a7a40999354e29df29a92539a0e2eb609ba066fb942081624ea8e4cb60
-
\Users\Admin\AppData\Local\Temp\server.exeFilesize
40KB
MD567eeab292f21456677476f6139574c00
SHA17cc0dfbd6a7b34334049eb877770bdf9e377be9d
SHA25601715e84d2abaab8f786b656b17fc5ce653e7d0b42468abadff24c5d1d63ee6e
SHA5123def31df679ad447e2a53b21033453f75d17e7e6c711ee883a5f6c60ddc8fa5159ba82a7a40999354e29df29a92539a0e2eb609ba066fb942081624ea8e4cb60
-
\Users\Admin\AppData\Local\Temp\server.exeFilesize
40KB
MD567eeab292f21456677476f6139574c00
SHA17cc0dfbd6a7b34334049eb877770bdf9e377be9d
SHA25601715e84d2abaab8f786b656b17fc5ce653e7d0b42468abadff24c5d1d63ee6e
SHA5123def31df679ad447e2a53b21033453f75d17e7e6c711ee883a5f6c60ddc8fa5159ba82a7a40999354e29df29a92539a0e2eb609ba066fb942081624ea8e4cb60
-
\Users\Admin\AppData\Local\Temp\server.exeFilesize
40KB
MD567eeab292f21456677476f6139574c00
SHA17cc0dfbd6a7b34334049eb877770bdf9e377be9d
SHA25601715e84d2abaab8f786b656b17fc5ce653e7d0b42468abadff24c5d1d63ee6e
SHA5123def31df679ad447e2a53b21033453f75d17e7e6c711ee883a5f6c60ddc8fa5159ba82a7a40999354e29df29a92539a0e2eb609ba066fb942081624ea8e4cb60
-
\Users\Admin\AppData\Local\Temp\server.exeFilesize
40KB
MD567eeab292f21456677476f6139574c00
SHA17cc0dfbd6a7b34334049eb877770bdf9e377be9d
SHA25601715e84d2abaab8f786b656b17fc5ce653e7d0b42468abadff24c5d1d63ee6e
SHA5123def31df679ad447e2a53b21033453f75d17e7e6c711ee883a5f6c60ddc8fa5159ba82a7a40999354e29df29a92539a0e2eb609ba066fb942081624ea8e4cb60
-
memory/304-101-0x0000000000400000-0x00000000032E0000-memory.dmpFilesize
46.9MB
-
memory/304-100-0x0000000000400000-0x00000000032E0000-memory.dmpFilesize
46.9MB
-
memory/304-119-0x00000000740B0000-0x000000007465B000-memory.dmpFilesize
5.7MB
-
memory/304-115-0x00000000740B0000-0x000000007465B000-memory.dmpFilesize
5.7MB
-
memory/304-112-0x0000000000400000-0x00000000032E0000-memory.dmpFilesize
46.9MB
-
memory/304-110-0x0000000000400000-0x00000000032E0000-memory.dmpFilesize
46.9MB
-
memory/304-107-0x000000000040749E-mapping.dmp
-
memory/304-106-0x0000000000400000-0x00000000032E0000-memory.dmpFilesize
46.9MB
-
memory/304-105-0x0000000000400000-0x00000000032E0000-memory.dmpFilesize
46.9MB
-
memory/304-103-0x0000000000400000-0x00000000032E0000-memory.dmpFilesize
46.9MB
-
memory/836-117-0x0000000000000000-mapping.dmp
-
memory/1516-76-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1516-93-0x00000000740B0000-0x000000007465B000-memory.dmpFilesize
5.7MB
-
memory/1516-68-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1516-66-0x0000000000090000-0x000000000018A000-memory.dmpFilesize
1000KB
-
memory/1516-72-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1516-70-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1516-83-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1516-86-0x00000000740B0000-0x000000007465B000-memory.dmpFilesize
5.7MB
-
memory/1516-74-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1516-79-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1516-77-0x000000000040749E-mapping.dmp
-
memory/1736-104-0x00000000740B0000-0x000000007465B000-memory.dmpFilesize
5.7MB
-
memory/1736-88-0x0000000000000000-mapping.dmp
-
memory/1736-116-0x00000000740B0000-0x000000007465B000-memory.dmpFilesize
5.7MB
-
memory/1784-54-0x00000000764D1000-0x00000000764D3000-memory.dmpFilesize
8KB
-
memory/1968-56-0x0000000000000000-mapping.dmp
-
memory/1968-80-0x0000000074250000-0x00000000747FB000-memory.dmpFilesize
5.7MB
-
memory/1968-82-0x0000000000630000-0x0000000000634000-memory.dmpFilesize
16KB
-
memory/1968-61-0x0000000074250000-0x00000000747FB000-memory.dmpFilesize
5.7MB