Analysis
-
max time kernel
116s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 17:57
Static task
static1
Behavioral task
behavioral1
Sample
0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe
Resource
win10v2004-20220812-en
General
-
Target
0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe
-
Size
6.7MB
-
MD5
c3c418b7342a3c95091959ff676b75ec
-
SHA1
b470140d808ed45db15038f245606db79bf8c137
-
SHA256
0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211
-
SHA512
dc825864c6e8df727c6ebe8fd38d5164368d049cdf01c4b51ae6540bbe51c7797674eb6f5ee06d79077ae347b1d258c7bedb8911bffbe76d14c089410385ea51
-
SSDEEP
98304:iXCbohcBBUVl3YWbj3unY62eGHWdSfKPtoBWZfyjJy58BmH9XbpMDCE3EHotwMJC:iwBWn7und2eOFat2Ipo0ItwMJQTzT
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
6d56f7.exedescription ioc process File created C:\Windows\SysWOW64\drivers\3648a599.sys 6d56f7.exe -
Executes dropped EXE 3 IoCs
Processes:
6d4d56.tmp0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe6d56f7.exepid process 1972 6d4d56.tmp 1276 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe 1608 6d56f7.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 544 takeown.exe 1940 icacls.exe 1684 takeown.exe 1396 icacls.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
6d56f7.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\3648a599\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\3648a599.sys" 6d56f7.exe -
Deletes itself 1 IoCs
Processes:
6d4d56.tmppid process 1972 6d4d56.tmp -
Loads dropped DLL 5 IoCs
Processes:
0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe6d4d56.tmppid process 996 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe 996 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe 1972 6d4d56.tmp 1972 6d4d56.tmp 1972 6d4d56.tmp -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 544 takeown.exe 1940 icacls.exe 1684 takeown.exe 1396 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
6d56f7.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 6d56f7.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} 6d56f7.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 6d56f7.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects 6d56f7.exe -
Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
6d56f7.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 6d56f7.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 6d56f7.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 6d56f7.exe -
Drops file in System32 directory 4 IoCs
Processes:
6d56f7.exedescription ioc process File created C:\Windows\SysWOW64\ws2tcpip.dll 6d56f7.exe File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll 6d56f7.exe File created C:\Windows\SysWOW64\wshtcpip.dll 6d56f7.exe File created C:\Windows\SysWOW64\midimap.dll 6d56f7.exe -
Modifies registry class 4 IoCs
Processes:
6d56f7.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL 6d56f7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "BrHuurH7D.dll" 6d56f7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID 6d56f7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "6d56f7.exe" 6d56f7.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6d56f7.exepid process 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe 1608 6d56f7.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
6d56f7.exepid process 464 1608 6d56f7.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
6d56f7.exetakeown.exetakeown.exedescription pid process Token: SeDebugPrivilege 1608 6d56f7.exe Token: SeTakeOwnershipPrivilege 544 takeown.exe Token: SeTakeOwnershipPrivilege 1684 takeown.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe6d4d56.tmp6d56f7.execmd.execmd.exedescription pid process target process PID 996 wrote to memory of 1972 996 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe 6d4d56.tmp PID 996 wrote to memory of 1972 996 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe 6d4d56.tmp PID 996 wrote to memory of 1972 996 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe 6d4d56.tmp PID 996 wrote to memory of 1972 996 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe 6d4d56.tmp PID 1972 wrote to memory of 1276 1972 6d4d56.tmp 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe PID 1972 wrote to memory of 1276 1972 6d4d56.tmp 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe PID 1972 wrote to memory of 1276 1972 6d4d56.tmp 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe PID 1972 wrote to memory of 1276 1972 6d4d56.tmp 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe PID 1972 wrote to memory of 1276 1972 6d4d56.tmp 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe PID 1972 wrote to memory of 1276 1972 6d4d56.tmp 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe PID 1972 wrote to memory of 1276 1972 6d4d56.tmp 0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe PID 1972 wrote to memory of 1608 1972 6d4d56.tmp 6d56f7.exe PID 1972 wrote to memory of 1608 1972 6d4d56.tmp 6d56f7.exe PID 1972 wrote to memory of 1608 1972 6d4d56.tmp 6d56f7.exe PID 1972 wrote to memory of 1608 1972 6d4d56.tmp 6d56f7.exe PID 1608 wrote to memory of 1508 1608 6d56f7.exe cmd.exe PID 1608 wrote to memory of 1508 1608 6d56f7.exe cmd.exe PID 1608 wrote to memory of 1508 1608 6d56f7.exe cmd.exe PID 1608 wrote to memory of 1508 1608 6d56f7.exe cmd.exe PID 1508 wrote to memory of 544 1508 cmd.exe takeown.exe PID 1508 wrote to memory of 544 1508 cmd.exe takeown.exe PID 1508 wrote to memory of 544 1508 cmd.exe takeown.exe PID 1508 wrote to memory of 544 1508 cmd.exe takeown.exe PID 1508 wrote to memory of 1940 1508 cmd.exe icacls.exe PID 1508 wrote to memory of 1940 1508 cmd.exe icacls.exe PID 1508 wrote to memory of 1940 1508 cmd.exe icacls.exe PID 1508 wrote to memory of 1940 1508 cmd.exe icacls.exe PID 1608 wrote to memory of 1476 1608 6d56f7.exe cmd.exe PID 1608 wrote to memory of 1476 1608 6d56f7.exe cmd.exe PID 1608 wrote to memory of 1476 1608 6d56f7.exe cmd.exe PID 1608 wrote to memory of 1476 1608 6d56f7.exe cmd.exe PID 1476 wrote to memory of 1684 1476 cmd.exe takeown.exe PID 1476 wrote to memory of 1684 1476 cmd.exe takeown.exe PID 1476 wrote to memory of 1684 1476 cmd.exe takeown.exe PID 1476 wrote to memory of 1684 1476 cmd.exe takeown.exe PID 1476 wrote to memory of 1396 1476 cmd.exe icacls.exe PID 1476 wrote to memory of 1396 1476 cmd.exe icacls.exe PID 1476 wrote to memory of 1396 1476 cmd.exe icacls.exe PID 1476 wrote to memory of 1396 1476 cmd.exe icacls.exe PID 1608 wrote to memory of 564 1608 6d56f7.exe cmd.exe PID 1608 wrote to memory of 564 1608 6d56f7.exe cmd.exe PID 1608 wrote to memory of 564 1608 6d56f7.exe cmd.exe PID 1608 wrote to memory of 564 1608 6d56f7.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe"C:\Users\Admin\AppData\Local\Temp\0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\6d4d56.tmp>C:\Users\Admin\AppData\Local\Temp\0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe2⤵
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe"C:\Users\Admin\AppData\Local\Temp\0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exe"3⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\6d56f7.exe"C:\Users\Admin\AppData\Local\Temp\\6d56f7.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F4⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:544 -
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1940 -
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F4⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\midimap.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1684 -
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1396 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat4⤵PID:564
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exeFilesize
6.0MB
MD5b2efbcefd835b3fce42080fa3537a0f1
SHA11b4907d26fc9e3b01c04bae8bc9ae585db93d453
SHA25639dd2098b2fa1cac516a844b1178c2da64b476006fae557a7a050e3bea1fa1fe
SHA5124757c6b08d122019d5087c3ecab13a5f99e7f7092b147c2f71c94a14c78174a9c6715ee4f53a5371dda71ca6e33a0c085f3c270fe2513a412f4e1284ece53973
-
C:\Users\Admin\AppData\Local\Temp\0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exeFilesize
6.0MB
MD5b2efbcefd835b3fce42080fa3537a0f1
SHA11b4907d26fc9e3b01c04bae8bc9ae585db93d453
SHA25639dd2098b2fa1cac516a844b1178c2da64b476006fae557a7a050e3bea1fa1fe
SHA5124757c6b08d122019d5087c3ecab13a5f99e7f7092b147c2f71c94a14c78174a9c6715ee4f53a5371dda71ca6e33a0c085f3c270fe2513a412f4e1284ece53973
-
C:\Users\Admin\AppData\Local\Temp\6d4d56.tmpFilesize
6.7MB
MD5c3c418b7342a3c95091959ff676b75ec
SHA1b470140d808ed45db15038f245606db79bf8c137
SHA2560a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211
SHA512dc825864c6e8df727c6ebe8fd38d5164368d049cdf01c4b51ae6540bbe51c7797674eb6f5ee06d79077ae347b1d258c7bedb8911bffbe76d14c089410385ea51
-
C:\Users\Admin\AppData\Local\Temp\6d4d56.tmpFilesize
6.7MB
MD5c3c418b7342a3c95091959ff676b75ec
SHA1b470140d808ed45db15038f245606db79bf8c137
SHA2560a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211
SHA512dc825864c6e8df727c6ebe8fd38d5164368d049cdf01c4b51ae6540bbe51c7797674eb6f5ee06d79077ae347b1d258c7bedb8911bffbe76d14c089410385ea51
-
C:\Users\Admin\AppData\Local\Temp\6d56f7.exeFilesize
714KB
MD5343df0ebec1cd6e5731b5758d1741db0
SHA129f48ff645f53279c4cf7be585cfc7c5c82373c8
SHA256f5140b3d67edfbd1a8d5ce8519ddfb32e1efa7362285ed59aabb905b7fada762
SHA512fae17f537c4d991005cc90b29e01aa1a250436a9dc3e509ec760c594a9c97ef0e372e90332072998d527f9247fc91e4a1027e967200d67bf40df0a5aff4d79f3
-
C:\Users\Admin\AppData\Local\Temp\6d56f7.exeFilesize
714KB
MD5343df0ebec1cd6e5731b5758d1741db0
SHA129f48ff645f53279c4cf7be585cfc7c5c82373c8
SHA256f5140b3d67edfbd1a8d5ce8519ddfb32e1efa7362285ed59aabb905b7fada762
SHA512fae17f537c4d991005cc90b29e01aa1a250436a9dc3e509ec760c594a9c97ef0e372e90332072998d527f9247fc91e4a1027e967200d67bf40df0a5aff4d79f3
-
C:\Users\Admin\AppData\Local\Temp\ahnmove.batFilesize
177B
MD58c9f905a7199e31644ab7462ad3def1f
SHA1ab3295e2b1fca8f6e122202b07fb1e44d37b0d79
SHA2568f3a90244c199ddf837bc19017d9d36e92090c2fb92cb0e5dde9e6efc201be40
SHA512b433668e3056689b6443cc966638708c0c5a6a98ba9ed51e915f734c48846e64a59135b90dead2864ef968c9b3743f40a99e606d2da3ce7b23fa3707df09bbd2
-
\Users\Admin\AppData\Local\Temp\0a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211.exeFilesize
6.0MB
MD5b2efbcefd835b3fce42080fa3537a0f1
SHA11b4907d26fc9e3b01c04bae8bc9ae585db93d453
SHA25639dd2098b2fa1cac516a844b1178c2da64b476006fae557a7a050e3bea1fa1fe
SHA5124757c6b08d122019d5087c3ecab13a5f99e7f7092b147c2f71c94a14c78174a9c6715ee4f53a5371dda71ca6e33a0c085f3c270fe2513a412f4e1284ece53973
-
\Users\Admin\AppData\Local\Temp\6d4d56.tmpFilesize
6.7MB
MD5c3c418b7342a3c95091959ff676b75ec
SHA1b470140d808ed45db15038f245606db79bf8c137
SHA2560a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211
SHA512dc825864c6e8df727c6ebe8fd38d5164368d049cdf01c4b51ae6540bbe51c7797674eb6f5ee06d79077ae347b1d258c7bedb8911bffbe76d14c089410385ea51
-
\Users\Admin\AppData\Local\Temp\6d4d56.tmpFilesize
6.7MB
MD5c3c418b7342a3c95091959ff676b75ec
SHA1b470140d808ed45db15038f245606db79bf8c137
SHA2560a68f0e9db1d21658e23195595dac0d2b3c5b5434a48d9bc9fd36fc134660211
SHA512dc825864c6e8df727c6ebe8fd38d5164368d049cdf01c4b51ae6540bbe51c7797674eb6f5ee06d79077ae347b1d258c7bedb8911bffbe76d14c089410385ea51
-
\Users\Admin\AppData\Local\Temp\6d56f7.exeFilesize
714KB
MD5343df0ebec1cd6e5731b5758d1741db0
SHA129f48ff645f53279c4cf7be585cfc7c5c82373c8
SHA256f5140b3d67edfbd1a8d5ce8519ddfb32e1efa7362285ed59aabb905b7fada762
SHA512fae17f537c4d991005cc90b29e01aa1a250436a9dc3e509ec760c594a9c97ef0e372e90332072998d527f9247fc91e4a1027e967200d67bf40df0a5aff4d79f3
-
\Users\Admin\AppData\Local\Temp\6d56f7.exeFilesize
714KB
MD5343df0ebec1cd6e5731b5758d1741db0
SHA129f48ff645f53279c4cf7be585cfc7c5c82373c8
SHA256f5140b3d67edfbd1a8d5ce8519ddfb32e1efa7362285ed59aabb905b7fada762
SHA512fae17f537c4d991005cc90b29e01aa1a250436a9dc3e509ec760c594a9c97ef0e372e90332072998d527f9247fc91e4a1027e967200d67bf40df0a5aff4d79f3
-
memory/544-79-0x0000000000000000-mapping.dmp
-
memory/564-84-0x0000000000000000-mapping.dmp
-
memory/996-58-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1276-61-0x0000000000000000-mapping.dmp
-
memory/1276-63-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/1396-83-0x0000000000000000-mapping.dmp
-
memory/1476-81-0x0000000000000000-mapping.dmp
-
memory/1508-78-0x0000000000000000-mapping.dmp
-
memory/1608-76-0x00000000002B0000-0x00000000002D0000-memory.dmpFilesize
128KB
-
memory/1608-66-0x0000000000000000-mapping.dmp
-
memory/1608-77-0x0000000001000000-0x0000000001BC7000-memory.dmpFilesize
11.8MB
-
memory/1608-74-0x0000000001000000-0x0000000001BC7000-memory.dmpFilesize
11.8MB
-
memory/1608-73-0x00000000002B0000-0x00000000002D0000-memory.dmpFilesize
128KB
-
memory/1608-86-0x0000000001000000-0x0000000001BC7000-memory.dmpFilesize
11.8MB
-
memory/1684-82-0x0000000000000000-mapping.dmp
-
memory/1940-80-0x0000000000000000-mapping.dmp
-
memory/1972-70-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1972-69-0x00000000025B0000-0x0000000003177000-memory.dmpFilesize
11.8MB
-
memory/1972-68-0x00000000025B0000-0x0000000003177000-memory.dmpFilesize
11.8MB
-
memory/1972-56-0x0000000000000000-mapping.dmp