Analysis
-
max time kernel
96s -
max time network
103s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 01:18
Static task
static1
Behavioral task
behavioral1
Sample
0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe
Resource
win10v2004-20221111-en
General
-
Target
0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe
-
Size
58KB
-
MD5
01863e8586fba732a9482bd78771f9a0
-
SHA1
4e8a0d14efe4609f51ccd0c0ccca66535d110ce9
-
SHA256
0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6
-
SHA512
2275525ae708d126a86d230b7b1e182545e7e7038461d4faaad256ddfe7777ef9e294f1cfa3909b6a8a70bc3157d7b64cce2950081021fc1eb5dc30c23c8b07b
-
SSDEEP
1536:01UmxIyYclkOZB4NgbeG/H4m5u1FaeeP8i2aC6qtY8i2:Jy28C2bD/H4m5u1EbtoO
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\Serverx = "C:\\Windows\\system32\\Serverx.exe" 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exedescription ioc process File opened (read-only) \??\K: 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe File opened (read-only) \??\E: 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe File opened (read-only) \??\M: 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe File opened (read-only) \??\N: 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe File opened (read-only) \??\R: 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe File opened (read-only) \??\L: 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe File opened (read-only) \??\Q: 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe File opened (read-only) \??\S: 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe File opened (read-only) \??\T: 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe File opened (read-only) \??\H: 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe File opened (read-only) \??\G: 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe File opened (read-only) \??\I: 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe File opened (read-only) \??\J: 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe File opened (read-only) \??\O: 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe File opened (read-only) \??\P: 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe File opened (read-only) \??\F: 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe -
Drops file in System32 directory 3 IoCs
Processes:
0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exedescription ioc process File created C:\Windows\SysWOW64\Serverx.exe 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe File opened for modification C:\WINDOWS\SysWOW64\SERVERX.EXE 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe File opened for modification C:\Windows\SysWOW64\Serverx.exe 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exepid process 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe -
Suspicious behavior: MapViewOfSection 23 IoCs
Processes:
0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exepid process 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exedescription pid process Token: SeDebugPrivilege 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe Token: SeTakeOwnershipPrivilege 2020 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe Token: SeRestorePrivilege 2020 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe Token: SeBackupPrivilege 2020 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe Token: SeChangeNotifyPrivilege 2020 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe Token: SeTakeOwnershipPrivilege 2020 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe Token: SeRestorePrivilege 2020 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe Token: SeBackupPrivilege 2020 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe Token: SeChangeNotifyPrivilege 2020 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exedescription pid process target process PID 2020 wrote to memory of 2036 2020 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe PID 2020 wrote to memory of 2036 2020 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe PID 2020 wrote to memory of 2036 2020 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe PID 2020 wrote to memory of 2036 2020 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe PID 2036 wrote to memory of 368 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe wininit.exe PID 2036 wrote to memory of 368 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe wininit.exe PID 2036 wrote to memory of 368 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe wininit.exe PID 2036 wrote to memory of 368 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe wininit.exe PID 2036 wrote to memory of 368 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe wininit.exe PID 2036 wrote to memory of 376 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe csrss.exe PID 2036 wrote to memory of 376 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe csrss.exe PID 2036 wrote to memory of 376 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe csrss.exe PID 2036 wrote to memory of 376 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe csrss.exe PID 2036 wrote to memory of 376 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe csrss.exe PID 2036 wrote to memory of 416 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe winlogon.exe PID 2036 wrote to memory of 416 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe winlogon.exe PID 2036 wrote to memory of 416 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe winlogon.exe PID 2036 wrote to memory of 416 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe winlogon.exe PID 2036 wrote to memory of 416 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe winlogon.exe PID 2036 wrote to memory of 460 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe services.exe PID 2036 wrote to memory of 460 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe services.exe PID 2036 wrote to memory of 460 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe services.exe PID 2036 wrote to memory of 460 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe services.exe PID 2036 wrote to memory of 460 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe services.exe PID 2036 wrote to memory of 476 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe lsass.exe PID 2036 wrote to memory of 476 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe lsass.exe PID 2036 wrote to memory of 476 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe lsass.exe PID 2036 wrote to memory of 476 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe lsass.exe PID 2036 wrote to memory of 476 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe lsass.exe PID 2036 wrote to memory of 484 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe lsm.exe PID 2036 wrote to memory of 484 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe lsm.exe PID 2036 wrote to memory of 484 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe lsm.exe PID 2036 wrote to memory of 484 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe lsm.exe PID 2036 wrote to memory of 484 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe lsm.exe PID 2036 wrote to memory of 596 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 596 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 596 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 596 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 596 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 676 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 676 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 676 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 676 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 676 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 760 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 760 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 760 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 760 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 760 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 804 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 804 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 804 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 804 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 804 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 844 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 844 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 844 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 844 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 844 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 872 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 872 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 872 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 872 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe PID 2036 wrote to memory of 872 2036 0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe svchost.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe"C:\Users\Admin\AppData\Local\Temp\0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe"2⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe"C:\Users\Admin\AppData\Local\Temp\0783769bd1597851bc24066d950230af3f02ca82a615405c774dc5eb2e943cc6.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1280-58-0x0000000001DE0000-0x0000000001DE1000-memory.dmpFilesize
4KB
-
memory/2020-54-0x0000000075C21000-0x0000000075C23000-memory.dmpFilesize
8KB
-
memory/2020-60-0x0000000030000000-0x000000003002E000-memory.dmpFilesize
184KB
-
memory/2020-61-0x0000000000220000-0x000000000024E000-memory.dmpFilesize
184KB
-
memory/2020-62-0x000000007EFA0000-0x000000007EFA8000-memory.dmpFilesize
32KB
-
memory/2020-63-0x0000000030000000-0x000000003002E000-memory.dmpFilesize
184KB
-
memory/2020-64-0x0000000000220000-0x000000000024E000-memory.dmpFilesize
184KB
-
memory/2020-65-0x000000007EFA0000-0x000000007EFA8000-memory.dmpFilesize
32KB
-
memory/2036-55-0x0000000000000000-mapping.dmp
-
memory/2036-57-0x0000000030000000-0x000000003002E000-memory.dmpFilesize
184KB