Analysis
-
max time kernel
80s -
max time network
60s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
13-10-2022 17:31
Static task
static1
Behavioral task
behavioral1
Sample
220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe
Resource
win10v2004-20220812-en
General
-
Target
220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe
-
Size
663KB
-
MD5
63ac37f23344ad69ab9afbf47b2aa5c0
-
SHA1
ae22db3f182f5a83e10a51d53818c793eac5321f
-
SHA256
220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318
-
SHA512
07a52a91b7a64445135bafe3233ad19134f9682acd0394b7ce0397e3bd8cd035b04e8e4a759604282aca04f73996627d0cce854fab222e48183ee2a50911cb64
-
SSDEEP
12288:3dceDjsrqQW9kh9Kq1mfuN/eMldtAd1D9A3uqse4wLESEoZBI:3dce+9KqYfm/eqd6D9MuqmIEXo4
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\wwuqfh6y.dll acprotect -
Drops file in Drivers directory 1 IoCs
Processes:
220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exedescription ioc process File created C:\Windows\SysWOW64\drivers\0fc55e2e.sys 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 824 takeown.exe 728 icacls.exe 956 takeown.exe 1936 icacls.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\0fc55e2e\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\0fc55e2e.sys" 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\wwuqfh6y.dll upx behavioral1/memory/1348-70-0x0000000010000000-0x00000000105EB000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1652 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exepid process 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exepid process 1936 icacls.exe 824 takeown.exe 728 icacls.exe 956 takeown.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe -
Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe -
Drops file in System32 directory 5 IoCs
Processes:
220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exedescription ioc process File created C:\Windows\SysWOW64\fAefiHU9.dll 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe File created C:\Windows\SysWOW64\wshtcpip.dll 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe File opened for modification C:\Windows\SysWOW64\wshtcpip.dll 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe File created C:\Windows\SysWOW64\midimap.dll 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe File created C:\Windows\SysWOW64\wwuqfh6y.dll 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe -
Modifies registry class 4 IoCs
Processes:
220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe" 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "sy8.dll" 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exepid process 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exepid process 460 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
takeown.exetakeown.exe220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exedescription pid process Token: SeTakeOwnershipPrivilege 824 takeown.exe Token: SeTakeOwnershipPrivilege 956 takeown.exe Token: SeDebugPrivilege 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.execmd.execmd.exedescription pid process target process PID 1348 wrote to memory of 1560 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe cmd.exe PID 1348 wrote to memory of 1560 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe cmd.exe PID 1348 wrote to memory of 1560 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe cmd.exe PID 1348 wrote to memory of 1560 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe cmd.exe PID 1560 wrote to memory of 824 1560 cmd.exe takeown.exe PID 1560 wrote to memory of 824 1560 cmd.exe takeown.exe PID 1560 wrote to memory of 824 1560 cmd.exe takeown.exe PID 1560 wrote to memory of 824 1560 cmd.exe takeown.exe PID 1560 wrote to memory of 728 1560 cmd.exe icacls.exe PID 1560 wrote to memory of 728 1560 cmd.exe icacls.exe PID 1560 wrote to memory of 728 1560 cmd.exe icacls.exe PID 1560 wrote to memory of 728 1560 cmd.exe icacls.exe PID 1348 wrote to memory of 1944 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe cmd.exe PID 1348 wrote to memory of 1944 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe cmd.exe PID 1348 wrote to memory of 1944 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe cmd.exe PID 1348 wrote to memory of 1944 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe cmd.exe PID 1944 wrote to memory of 956 1944 cmd.exe takeown.exe PID 1944 wrote to memory of 956 1944 cmd.exe takeown.exe PID 1944 wrote to memory of 956 1944 cmd.exe takeown.exe PID 1944 wrote to memory of 956 1944 cmd.exe takeown.exe PID 1944 wrote to memory of 1936 1944 cmd.exe icacls.exe PID 1944 wrote to memory of 1936 1944 cmd.exe icacls.exe PID 1944 wrote to memory of 1936 1944 cmd.exe icacls.exe PID 1944 wrote to memory of 1936 1944 cmd.exe icacls.exe PID 1348 wrote to memory of 1652 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe cmd.exe PID 1348 wrote to memory of 1652 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe cmd.exe PID 1348 wrote to memory of 1652 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe cmd.exe PID 1348 wrote to memory of 1652 1348 220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe"C:\Users\Admin\AppData\Local\Temp\220238dd91f184fede5b90f492ea457e02b3de6b98bf45e9b9cf34aee3005318.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\midimap.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
181B
MD5bc980698d2b295eda9ea0e99e05f4603
SHA1f95514ec59d7fa1c1319f208c98d8c59ad834acd
SHA256e6f3a5bf2ed9139d959f6f522c1abce56011b2fc6117b1a52cc498316e412821
SHA5128ab18ba612fb655c388186cace3d6468d74b12cf4693154f4966512d823bc8a478a74bae8eaf26b00ba9c3ceb511cb59292bb279e305794abac26ba4e76b0e70
-
\Users\Admin\AppData\Local\Temp\wwuqfh6y.dllFilesize
5.9MB
MD5e0adcf998e2256732cdcde04535917dc
SHA1da8ac88a680daff54fc24d29412a66a7a824b18b
SHA2564f4d803ae66d122765bf84d166803aeb01dc278a8557684e7ae1558764bb2a82
SHA51286862f1795f947419f7db6b98a053bfebeebea07a4a187e3d4f702015d69361156d0be4ee973d50945e403e58be644fd44e904faab9d0277b68030f9e033c89a
-
\Windows\SysWOW64\wshtcpip.dllFilesize
19KB
MD51e636ce86ec19dfb557544828dfcf83b
SHA15a19166ffc2443d38e37b9852da5bbc7f61704e0
SHA2562d07bf9a5420e726d44206f5c9b4e138fb2f0442a81d449cee98e890c01db5d6
SHA512a6d4c298803674fd479200a40b18ee45144bc11344dea2a94d83e3b8fbdbe694158e283a959136cca56889a40ef1fef27967eb5f17602da4c937fb7a5bd3be8d
-
memory/728-59-0x0000000000000000-mapping.dmp
-
memory/824-58-0x0000000000000000-mapping.dmp
-
memory/956-61-0x0000000000000000-mapping.dmp
-
memory/1348-70-0x0000000010000000-0x00000000105EB000-memory.dmpFilesize
5.9MB
-
memory/1348-57-0x00000000001B0000-0x00000000001D0000-memory.dmpFilesize
128KB
-
memory/1348-69-0x0000000001000000-0x0000000001779000-memory.dmpFilesize
7.5MB
-
memory/1348-64-0x00000000719C1000-0x00000000719C5000-memory.dmpFilesize
16KB
-
memory/1348-56-0x0000000001000000-0x0000000001779000-memory.dmpFilesize
7.5MB
-
memory/1348-65-0x0000000001000000-0x0000000001779000-memory.dmpFilesize
7.5MB
-
memory/1348-54-0x0000000074F41000-0x0000000074F43000-memory.dmpFilesize
8KB
-
memory/1560-55-0x0000000000000000-mapping.dmp
-
memory/1652-66-0x0000000000000000-mapping.dmp
-
memory/1936-62-0x0000000000000000-mapping.dmp
-
memory/1944-60-0x0000000000000000-mapping.dmp