Analysis
-
max time kernel
148s -
max time network
116s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 01:57
Static task
static1
Behavioral task
behavioral1
Sample
aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe
Resource
win10v2004-20220901-en
General
-
Target
aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe
-
Size
813KB
-
MD5
6cd920530b09541a42f1b1b40948a460
-
SHA1
2a26a1a400d2472c743bfe7ed1b7afb902fed486
-
SHA256
aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419
-
SHA512
6746bf0d8461509253e8296fe626ac3701a98fd813cd61c2b5fe5fcbbac4871025682ce8109dbf06275624dcb9eba34ef76dd15c8fd39a3bc64c60261e48ad40
-
SSDEEP
12288:QvRwqFq+PzD6Shp6/MVqZyiqsg0iR/Cs1q0vcSouox6UauGxO9v:6uqzD83Zyi1g06/5q+cNuoxX76O
Malware Config
Signatures
-
NirSoft MailPassView 11 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1168-65-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1168-67-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1168-69-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1168-71-0x000000000047EADE-mapping.dmp MailPassView behavioral1/memory/1168-75-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1168-73-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1960-81-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1960-82-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/1960-85-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1960-87-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1960-89-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 11 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1168-65-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1168-67-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1168-69-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1168-71-0x000000000047EADE-mapping.dmp WebBrowserPassView behavioral1/memory/1168-75-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1168-73-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1372-91-0x0000000000442628-mapping.dmp WebBrowserPassView behavioral1/memory/1372-90-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1372-94-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1372-95-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1372-97-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 16 IoCs
Processes:
resource yara_rule behavioral1/memory/1168-65-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1168-67-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1168-69-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1168-71-0x000000000047EADE-mapping.dmp Nirsoft behavioral1/memory/1168-75-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1168-73-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1960-81-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1960-82-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/1960-85-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1960-87-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1960-89-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1372-91-0x0000000000442628-mapping.dmp Nirsoft behavioral1/memory/1372-90-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1372-94-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1372-95-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1372-97-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exereg.exeaa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\UTICNtwg.exe" aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\UTICNtwg.exe" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 whatismyipaddress.com 5 whatismyipaddress.com 6 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exeaa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exedescription pid process target process PID 1768 set thread context of 1168 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe PID 1168 set thread context of 1960 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 set thread context of 1372 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exepid process 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exeaa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exedescription pid process Token: SeDebugPrivilege 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe Token: SeDebugPrivilege 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exepid process 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.execsc.execmd.exeaa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exedescription pid process target process PID 1768 wrote to memory of 1328 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe csc.exe PID 1768 wrote to memory of 1328 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe csc.exe PID 1768 wrote to memory of 1328 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe csc.exe PID 1768 wrote to memory of 1328 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe csc.exe PID 1328 wrote to memory of 1812 1328 csc.exe cvtres.exe PID 1328 wrote to memory of 1812 1328 csc.exe cvtres.exe PID 1328 wrote to memory of 1812 1328 csc.exe cvtres.exe PID 1328 wrote to memory of 1812 1328 csc.exe cvtres.exe PID 1768 wrote to memory of 1168 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe PID 1768 wrote to memory of 1168 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe PID 1768 wrote to memory of 1168 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe PID 1768 wrote to memory of 1168 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe PID 1768 wrote to memory of 1168 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe PID 1768 wrote to memory of 1168 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe PID 1768 wrote to memory of 1168 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe PID 1768 wrote to memory of 1168 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe PID 1768 wrote to memory of 1168 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe PID 1768 wrote to memory of 560 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe cmd.exe PID 1768 wrote to memory of 560 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe cmd.exe PID 1768 wrote to memory of 560 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe cmd.exe PID 1768 wrote to memory of 560 1768 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe cmd.exe PID 560 wrote to memory of 380 560 cmd.exe reg.exe PID 560 wrote to memory of 380 560 cmd.exe reg.exe PID 560 wrote to memory of 380 560 cmd.exe reg.exe PID 560 wrote to memory of 380 560 cmd.exe reg.exe PID 1168 wrote to memory of 1960 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1960 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1960 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1960 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1960 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1960 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1960 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1960 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1960 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1960 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1372 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1372 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1372 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1372 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1372 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1372 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1372 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1372 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1372 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe PID 1168 wrote to memory of 1372 1168 aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe"C:\Users\Admin\AppData\Local\Temp\aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vk6jgy2z.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES123B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC122A.tmp"3⤵
-
C:\Users\Admin\AppData\Local\Temp\aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe"C:\Users\Admin\AppData\Local\Temp\aa9a39a40e8344b970428a20cd8860825364ccb0e88f410ebca127c1a0cbd419.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\UTICNtwg.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\UTICNtwg.exe3⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RES123B.tmpFilesize
1KB
MD57aa7c20c0df980c92b958b3d6bed05e7
SHA1313a7af59c96f137a65b3e379e83f5725ed7cc0d
SHA25678ddfda85d5e757e4a68331dc9c98c1c90681e977c6d0ec58058d9abb70b0240
SHA51287fe16feca52d88827b0845952dca1e1f86da3b18ed64389ec2562c26088d1156ea40b340dbeb7b487c73235ce3a7caec473016eba1d15469c7180765fb798dd
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\vk6jgy2z.dllFilesize
1.1MB
MD57844351b6693ac7233bd2882c365729b
SHA1b1a2ab43cccb182f74e8101292b4ab97a4966706
SHA256bc08825feba67661e3d8f08dfb43972932e919add18378263c86a9d9ed81d620
SHA5121f52b2d40a329b0320ddc6034e803972ffeb00ed276dadd0896778400bb2af575b0fd88b1eac0471bae006f082abea866829ba7cd9aa0031d6a1f583e0140738
-
\??\c:\Users\Admin\AppData\Local\Temp\CSC122A.tmpFilesize
652B
MD5ab565cca760359ac8e1b9df7de2002c6
SHA1dc846457267b23fa0e2c64fa83858544b3dc7806
SHA256225769cc0b7a5576abf8fcf3d4c6d754f656222ab16cfce35311f79e5a488846
SHA512c7df8744ba228a7078fab2758b693f6e5a06afb4381a387611227d93a9ec445a7104bb9f373be13fa0460c4a717cc1fa57069c088dff9dc97092f8aa7dcf15c1
-
\??\c:\Users\Admin\AppData\Local\Temp\tmp1028.tmp.txtFilesize
549KB
MD592b0844476fd369c495d090e03904503
SHA17526f336151b9ff70bda24f7445ac412ae0b5738
SHA25610bd8ca479b47c9b6a543790d5b9a0fba130efa0e42d4b538a756cc3aa42ca1f
SHA512dec7fd42d3193329dae373fe67e75daacf50c9eeec31023312f819e7ee557e0e288573de2a16894aea42da1e03dc3753039ea75e3ac938e21a227e852718639e
-
\??\c:\Users\Admin\AppData\Local\Temp\vk6jgy2z.cmdlineFilesize
196B
MD5937d41bcdc700fb5675087cd2e0fc19d
SHA1a6e528f44a89d42b4c2348b2ee14c2023d1cf42c
SHA2560e43dffb952a36dfbafa9bd63fe51a92302a032c5bc120698080493b37f0543e
SHA512769ddbace82e514afb8fba13ef5e07bce604ad2b007c404e154f14de5fdfa6ef63a807b4724b75af8d4d806e5d57984e8b774792eda99d860222160ee4004427
-
memory/380-79-0x0000000000000000-mapping.dmp
-
memory/560-78-0x0000000000000000-mapping.dmp
-
memory/1168-73-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1168-88-0x0000000073F00000-0x00000000744AB000-memory.dmpFilesize
5.7MB
-
memory/1168-65-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1168-67-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1168-80-0x0000000073F00000-0x00000000744AB000-memory.dmpFilesize
5.7MB
-
memory/1168-71-0x000000000047EADE-mapping.dmp
-
memory/1168-63-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1168-75-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1168-69-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1168-62-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1328-55-0x0000000000000000-mapping.dmp
-
memory/1372-97-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1372-95-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1372-94-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1372-90-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1372-91-0x0000000000442628-mapping.dmp
-
memory/1768-77-0x0000000073F00000-0x00000000744AB000-memory.dmpFilesize
5.7MB
-
memory/1768-86-0x0000000073F00000-0x00000000744AB000-memory.dmpFilesize
5.7MB
-
memory/1768-54-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/1812-58-0x0000000000000000-mapping.dmp
-
memory/1960-87-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1960-89-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1960-85-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1960-82-0x0000000000411654-mapping.dmp
-
memory/1960-81-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB