Analysis
-
max time kernel
138s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:48
Static task
static1
Behavioral task
behavioral1
Sample
8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe
Resource
win10v2004-20220812-en
General
-
Target
8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe
-
Size
134KB
-
MD5
eeaf2bb4f5d50d890fb3f09513e461d4
-
SHA1
2cd23021972e59c9b9ff44c5495983aa2f5b00fc
-
SHA256
8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47
-
SHA512
fec4c68a21d6e525a2a0c7b4251e05411991ff7f5b700c86f7e6dffceb654f51e501eb4f5f52ff77b95d4d8d9c5fa4688744e6924a84f86b5576eecdc72e500b
-
SSDEEP
3072:XOpLeDl8+nQIw1x3Pbkfqbbf3J6mY6RxSebUXrMWJMb:RDl8+xwX3PbwUvJ6mY6xbq2
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\16391 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\mssviz.cmd" svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\Sample.lnk" 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exedescription pid process target process PID 816 set thread context of 1784 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe -
Drops file in Program Files directory 1 IoCs
Processes:
svchost.exedescription ioc process File created C:\PROGRA~3\LOCALS~1\Temp\mssviz.cmd svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exepid process 1784 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exepid process 1784 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe 1784 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exedescription pid process Token: SeDebugPrivilege 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exedescription pid process target process PID 816 wrote to memory of 1812 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe CMD.exe PID 816 wrote to memory of 1812 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe CMD.exe PID 816 wrote to memory of 1812 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe CMD.exe PID 816 wrote to memory of 1812 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe CMD.exe PID 816 wrote to memory of 1416 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe CMD.exe PID 816 wrote to memory of 1416 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe CMD.exe PID 816 wrote to memory of 1416 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe CMD.exe PID 816 wrote to memory of 1416 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe CMD.exe PID 816 wrote to memory of 1784 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe PID 816 wrote to memory of 1784 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe PID 816 wrote to memory of 1784 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe PID 816 wrote to memory of 1784 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe PID 816 wrote to memory of 1784 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe PID 816 wrote to memory of 1784 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe PID 816 wrote to memory of 1784 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe PID 1784 wrote to memory of 1216 1784 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe svchost.exe PID 1784 wrote to memory of 1216 1784 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe svchost.exe PID 1784 wrote to memory of 1216 1784 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe svchost.exe PID 1784 wrote to memory of 1216 1784 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe svchost.exe PID 816 wrote to memory of 1780 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1780 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1780 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1780 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1796 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1796 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1796 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1796 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1608 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1608 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1608 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1608 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1552 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1552 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1552 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1552 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 960 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 960 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 960 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 960 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1556 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1556 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1556 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe PID 816 wrote to memory of 1556 816 8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe"C:\Users\Admin\AppData\Local\Temp\8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\CMD.exe"CMD"2⤵
-
C:\Windows\SysWOW64\CMD.exe"CMD"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe"C:\Users\Admin\AppData\Local\Temp\8440d728df369728e890307c490fe4feabfe4e11d6961598db036b13b5f38c47.exe"2⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\svchost.exeC:\Windows\syswow64\svchost.exe3⤵
- Adds policy Run key to start application
- Drops file in Program Files directory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/816-110-0x0000000000402000-0x0000000000406000-memory.dmpFilesize
16KB
-
memory/816-112-0x0000000000402000-0x0000000000406000-memory.dmpFilesize
16KB
-
memory/816-56-0x00000000003D5000-0x00000000003D7000-memory.dmpFilesize
8KB
-
memory/816-57-0x00000000003D9000-0x00000000003DB000-memory.dmpFilesize
8KB
-
memory/816-58-0x00000000003DE000-0x00000000003E0000-memory.dmpFilesize
8KB
-
memory/816-59-0x00000000003E5000-0x00000000003E9000-memory.dmpFilesize
16KB
-
memory/816-60-0x00000000003E5000-0x00000000003E9000-memory.dmpFilesize
16KB
-
memory/816-61-0x00000000003E7000-0x00000000003E9000-memory.dmpFilesize
8KB
-
memory/816-62-0x00000000003E5000-0x00000000003E9000-memory.dmpFilesize
16KB
-
memory/816-63-0x00000000003E5000-0x00000000003E9000-memory.dmpFilesize
16KB
-
memory/816-64-0x00000000003E5000-0x00000000003E9000-memory.dmpFilesize
16KB
-
memory/816-65-0x00000000003E8000-0x00000000003EA000-memory.dmpFilesize
8KB
-
memory/816-66-0x00000000740B0000-0x000000007465B000-memory.dmpFilesize
5.7MB
-
memory/816-67-0x00000000003D5000-0x00000000003D7000-memory.dmpFilesize
8KB
-
memory/816-68-0x00000000003EB000-0x00000000003EF000-memory.dmpFilesize
16KB
-
memory/816-69-0x00000000003D9000-0x00000000003DB000-memory.dmpFilesize
8KB
-
memory/816-70-0x00000000003EA000-0x00000000003EC000-memory.dmpFilesize
8KB
-
memory/816-71-0x00000000003EB000-0x00000000003EF000-memory.dmpFilesize
16KB
-
memory/816-72-0x00000000003EB000-0x00000000003EF000-memory.dmpFilesize
16KB
-
memory/816-73-0x00000000003EB000-0x00000000003EF000-memory.dmpFilesize
16KB
-
memory/816-74-0x00000000003EB000-0x00000000003EF000-memory.dmpFilesize
16KB
-
memory/816-75-0x00000000003EB000-0x00000000003EF000-memory.dmpFilesize
16KB
-
memory/816-76-0x00000000003DE000-0x00000000003E0000-memory.dmpFilesize
8KB
-
memory/816-77-0x00000000003EB000-0x00000000003ED000-memory.dmpFilesize
8KB
-
memory/816-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmpFilesize
8KB
-
memory/816-79-0x00000000003F7000-0x00000000003FB000-memory.dmpFilesize
16KB
-
memory/816-80-0x00000000003E7000-0x00000000003E9000-memory.dmpFilesize
8KB
-
memory/816-81-0x00000000003F8000-0x00000000003FA000-memory.dmpFilesize
8KB
-
memory/816-82-0x00000000003F7000-0x00000000003FB000-memory.dmpFilesize
16KB
-
memory/816-83-0x00000000003F7000-0x00000000003FB000-memory.dmpFilesize
16KB
-
memory/816-84-0x00000000003F7000-0x00000000003FB000-memory.dmpFilesize
16KB
-
memory/816-85-0x00000000003F7000-0x00000000003FB000-memory.dmpFilesize
16KB
-
memory/816-86-0x00000000003E8000-0x00000000003EA000-memory.dmpFilesize
8KB
-
memory/816-87-0x00000000003F9000-0x00000000003FB000-memory.dmpFilesize
8KB
-
memory/816-88-0x00000000003F7000-0x00000000003FB000-memory.dmpFilesize
16KB
-
memory/816-111-0x0000000000402000-0x0000000000406000-memory.dmpFilesize
16KB
-
memory/816-90-0x00000000003F7000-0x00000000003FB000-memory.dmpFilesize
16KB
-
memory/816-91-0x00000000003F7000-0x00000000003FB000-memory.dmpFilesize
16KB
-
memory/816-92-0x00000000003FA000-0x00000000003FC000-memory.dmpFilesize
8KB
-
memory/816-93-0x00000000003FB000-0x00000000003FF000-memory.dmpFilesize
16KB
-
memory/816-94-0x00000000003FA000-0x00000000003FC000-memory.dmpFilesize
8KB
-
memory/816-95-0x00000000003FB000-0x00000000003FF000-memory.dmpFilesize
16KB
-
memory/816-96-0x00000000003FB000-0x00000000003FF000-memory.dmpFilesize
16KB
-
memory/816-97-0x00000000003FB000-0x00000000003FF000-memory.dmpFilesize
16KB
-
memory/816-98-0x00000000003FB000-0x00000000003FF000-memory.dmpFilesize
16KB
-
memory/816-99-0x00000000003EA000-0x00000000003EC000-memory.dmpFilesize
8KB
-
memory/816-100-0x00000000003FB000-0x00000000003FD000-memory.dmpFilesize
8KB
-
memory/816-101-0x00000000003FB000-0x00000000003FF000-memory.dmpFilesize
16KB
-
memory/816-102-0x00000000003FB000-0x00000000003FF000-memory.dmpFilesize
16KB
-
memory/816-103-0x0000000000402000-0x0000000000406000-memory.dmpFilesize
16KB
-
memory/816-104-0x0000000000402000-0x0000000000406000-memory.dmpFilesize
16KB
-
memory/816-105-0x0000000000402000-0x0000000000406000-memory.dmpFilesize
16KB
-
memory/816-106-0x0000000000402000-0x0000000000406000-memory.dmpFilesize
16KB
-
memory/816-107-0x00000000003F8000-0x00000000003FA000-memory.dmpFilesize
8KB
-
memory/816-108-0x0000000000403000-0x0000000000405000-memory.dmpFilesize
8KB
-
memory/816-109-0x0000000000402000-0x0000000000406000-memory.dmpFilesize
16KB
-
memory/816-78-0x00000000003F7000-0x00000000003FB000-memory.dmpFilesize
16KB
-
memory/816-55-0x00000000740B0000-0x000000007465B000-memory.dmpFilesize
5.7MB
-
memory/816-89-0x00000000003F7000-0x00000000003FB000-memory.dmpFilesize
16KB
-
memory/816-113-0x00000000003F9000-0x00000000003FB000-memory.dmpFilesize
8KB
-
memory/816-114-0x0000000000404000-0x0000000000406000-memory.dmpFilesize
8KB
-
memory/816-115-0x0000000000402000-0x0000000000406000-memory.dmpFilesize
16KB
-
memory/816-116-0x0000000000402000-0x0000000000406000-memory.dmpFilesize
16KB
-
memory/816-117-0x0000000000402000-0x0000000000406000-memory.dmpFilesize
16KB
-
memory/816-118-0x0000000000405000-0x0000000000407000-memory.dmpFilesize
8KB
-
memory/816-119-0x0000000000406000-0x000000000040A000-memory.dmpFilesize
16KB
-
memory/816-120-0x0000000000406000-0x000000000040A000-memory.dmpFilesize
16KB
-
memory/816-121-0x00000000003FA000-0x00000000003FC000-memory.dmpFilesize
8KB
-
memory/816-122-0x0000000000406000-0x000000000040A000-memory.dmpFilesize
16KB
-
memory/816-123-0x0000000000406000-0x000000000040A000-memory.dmpFilesize
16KB
-
memory/816-124-0x0000000000406000-0x000000000040A000-memory.dmpFilesize
16KB
-
memory/816-125-0x0000000000406000-0x000000000040A000-memory.dmpFilesize
16KB
-
memory/816-126-0x00000000003FB000-0x00000000003FD000-memory.dmpFilesize
8KB
-
memory/816-127-0x0000000000406000-0x0000000000408000-memory.dmpFilesize
8KB
-
memory/816-128-0x0000000000415000-0x0000000000417000-memory.dmpFilesize
8KB
-
memory/816-130-0x0000000000416000-0x0000000000418000-memory.dmpFilesize
8KB
-
memory/816-129-0x0000000000403000-0x0000000000405000-memory.dmpFilesize
8KB
-
memory/816-132-0x0000000000417000-0x0000000000419000-memory.dmpFilesize
8KB
-
memory/816-131-0x0000000000404000-0x0000000000406000-memory.dmpFilesize
8KB
-
memory/816-133-0x0000000000405000-0x0000000000407000-memory.dmpFilesize
8KB
-
memory/816-134-0x0000000000418000-0x000000000041A000-memory.dmpFilesize
8KB
-
memory/816-135-0x0000000000422000-0x0000000000424000-memory.dmpFilesize
8KB
-
memory/816-136-0x0000000000415000-0x0000000000417000-memory.dmpFilesize
8KB
-
memory/816-137-0x0000000000423000-0x0000000000425000-memory.dmpFilesize
8KB
-
memory/816-138-0x0000000000416000-0x0000000000418000-memory.dmpFilesize
8KB
-
memory/816-139-0x0000000000424000-0x0000000000426000-memory.dmpFilesize
8KB
-
memory/816-140-0x0000000000417000-0x0000000000419000-memory.dmpFilesize
8KB
-
memory/816-141-0x0000000000425000-0x0000000000427000-memory.dmpFilesize
8KB
-
memory/816-142-0x0000000000418000-0x000000000041A000-memory.dmpFilesize
8KB
-
memory/816-143-0x0000000000434000-0x0000000000436000-memory.dmpFilesize
8KB
-
memory/816-144-0x0000000000422000-0x0000000000424000-memory.dmpFilesize
8KB
-
memory/816-145-0x0000000000435000-0x0000000000437000-memory.dmpFilesize
8KB
-
memory/816-146-0x0000000000423000-0x0000000000425000-memory.dmpFilesize
8KB
-
memory/816-147-0x0000000000436000-0x0000000000438000-memory.dmpFilesize
8KB
-
memory/816-148-0x0000000000424000-0x0000000000426000-memory.dmpFilesize
8KB
-
memory/816-149-0x0000000000437000-0x0000000000439000-memory.dmpFilesize
8KB
-
memory/816-150-0x0000000000425000-0x0000000000427000-memory.dmpFilesize
8KB
-
memory/816-151-0x0000000000434000-0x0000000000436000-memory.dmpFilesize
8KB
-
memory/816-152-0x0000000000447000-0x0000000000449000-memory.dmpFilesize
8KB
-
memory/816-153-0x0000000000435000-0x0000000000437000-memory.dmpFilesize
8KB
-
memory/816-164-0x0000000000436000-0x0000000000438000-memory.dmpFilesize
8KB
-
memory/816-166-0x00000000740B0000-0x000000007465B000-memory.dmpFilesize
5.7MB
-
memory/816-165-0x0000000000437000-0x0000000000439000-memory.dmpFilesize
8KB
-
memory/1216-162-0x0000000000570000-0x0000000000578000-memory.dmpFilesize
32KB
-
memory/1216-163-0x0000000000020000-0x0000000000025000-memory.dmpFilesize
20KB
-
memory/1216-161-0x0000000000000000-mapping.dmp
-
memory/1216-167-0x0000000000020000-0x0000000000025000-memory.dmpFilesize
20KB
-
memory/1416-155-0x0000000000000000-mapping.dmp
-
memory/1784-156-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1784-157-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1784-159-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1784-160-0x000000000040141C-mapping.dmp
-
memory/1812-154-0x0000000000000000-mapping.dmp