Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 05:25
Static task
static1
Behavioral task
behavioral1
Sample
a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe
Resource
win10v2004-20220901-en
General
-
Target
a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe
-
Size
1.8MB
-
MD5
a9c865933b8aa2b12f65b1ee21b2e67e
-
SHA1
7431a1d9b783c506871ab142bec03075d81325b9
-
SHA256
a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9
-
SHA512
22e23b9e591ffd2fc46d3b1548df5710c10357ddc9259ee0f6d9aa31850baa4d05229d13731226171641c495448528c02083e21056349413308ae1d5d5464bd1
-
SSDEEP
49152:akwkn9IMHea846H3G6PwLELhrIuXlyP9AgaPCS:JdnVmGakkrIuXlyPiPC
Malware Config
Signatures
-
Processes:
a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe -
Executes dropped EXE 2 IoCs
Processes:
4140.exewaop.exepid process 844 4140.exe 1268 waop.exe -
Loads dropped DLL 7 IoCs
Processes:
a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe4140.exewaop.exepid process 1636 a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe 1636 a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe 1636 a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe 1636 a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe 844 4140.exe 844 4140.exe 1268 waop.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
waop.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\Currentversion\Run waop.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\Currentversion\Run waop.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Xacyh = "C:\\Users\\Admin\\AppData\\Roaming\\Yzsok\\waop.exe" waop.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4140.exedescription pid process target process PID 844 set thread context of 320 844 4140.exe cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
4140.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Privacy 4140.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" 4140.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\24802CEC-00000001.eml:OECustomProperty WinMail.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
waop.exepid process 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe 1268 waop.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
4140.execmd.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 844 4140.exe Token: SeSecurityPrivilege 844 4140.exe Token: SeSecurityPrivilege 844 4140.exe Token: SeSecurityPrivilege 844 4140.exe Token: SeSecurityPrivilege 844 4140.exe Token: SeSecurityPrivilege 844 4140.exe Token: SeSecurityPrivilege 320 cmd.exe Token: SeSecurityPrivilege 320 cmd.exe Token: SeSecurityPrivilege 320 cmd.exe Token: SeSecurityPrivilege 320 cmd.exe Token: SeSecurityPrivilege 320 cmd.exe Token: SeSecurityPrivilege 320 cmd.exe Token: SeSecurityPrivilege 320 cmd.exe Token: SeManageVolumePrivilege 1776 WinMail.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
WinMail.exepid process 1776 WinMail.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
WinMail.exepid process 1776 WinMail.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 1776 WinMail.exe -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe4140.exewaop.exedescription pid process target process PID 1636 wrote to memory of 844 1636 a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe 4140.exe PID 1636 wrote to memory of 844 1636 a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe 4140.exe PID 1636 wrote to memory of 844 1636 a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe 4140.exe PID 1636 wrote to memory of 844 1636 a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe 4140.exe PID 844 wrote to memory of 1268 844 4140.exe waop.exe PID 844 wrote to memory of 1268 844 4140.exe waop.exe PID 844 wrote to memory of 1268 844 4140.exe waop.exe PID 844 wrote to memory of 1268 844 4140.exe waop.exe PID 1268 wrote to memory of 1120 1268 waop.exe taskhost.exe PID 1268 wrote to memory of 1120 1268 waop.exe taskhost.exe PID 1268 wrote to memory of 1120 1268 waop.exe taskhost.exe PID 1268 wrote to memory of 1120 1268 waop.exe taskhost.exe PID 1268 wrote to memory of 1120 1268 waop.exe taskhost.exe PID 1268 wrote to memory of 1164 1268 waop.exe Dwm.exe PID 1268 wrote to memory of 1164 1268 waop.exe Dwm.exe PID 1268 wrote to memory of 1164 1268 waop.exe Dwm.exe PID 1268 wrote to memory of 1164 1268 waop.exe Dwm.exe PID 1268 wrote to memory of 1164 1268 waop.exe Dwm.exe PID 1268 wrote to memory of 1196 1268 waop.exe Explorer.EXE PID 1268 wrote to memory of 1196 1268 waop.exe Explorer.EXE PID 1268 wrote to memory of 1196 1268 waop.exe Explorer.EXE PID 1268 wrote to memory of 1196 1268 waop.exe Explorer.EXE PID 1268 wrote to memory of 1196 1268 waop.exe Explorer.EXE PID 1268 wrote to memory of 844 1268 waop.exe 4140.exe PID 1268 wrote to memory of 844 1268 waop.exe 4140.exe PID 1268 wrote to memory of 844 1268 waop.exe 4140.exe PID 1268 wrote to memory of 844 1268 waop.exe 4140.exe PID 1268 wrote to memory of 844 1268 waop.exe 4140.exe PID 844 wrote to memory of 320 844 4140.exe cmd.exe PID 844 wrote to memory of 320 844 4140.exe cmd.exe PID 844 wrote to memory of 320 844 4140.exe cmd.exe PID 844 wrote to memory of 320 844 4140.exe cmd.exe PID 844 wrote to memory of 320 844 4140.exe cmd.exe PID 844 wrote to memory of 320 844 4140.exe cmd.exe PID 844 wrote to memory of 320 844 4140.exe cmd.exe PID 844 wrote to memory of 320 844 4140.exe cmd.exe PID 844 wrote to memory of 320 844 4140.exe cmd.exe PID 1268 wrote to memory of 1768 1268 waop.exe DllHost.exe PID 1268 wrote to memory of 1768 1268 waop.exe DllHost.exe PID 1268 wrote to memory of 1768 1268 waop.exe DllHost.exe PID 1268 wrote to memory of 1768 1268 waop.exe DllHost.exe PID 1268 wrote to memory of 1768 1268 waop.exe DllHost.exe PID 1268 wrote to memory of 1584 1268 waop.exe conhost.exe PID 1268 wrote to memory of 1584 1268 waop.exe conhost.exe PID 1268 wrote to memory of 1584 1268 waop.exe conhost.exe PID 1268 wrote to memory of 1584 1268 waop.exe conhost.exe PID 1268 wrote to memory of 1584 1268 waop.exe conhost.exe PID 1268 wrote to memory of 1776 1268 waop.exe WinMail.exe PID 1268 wrote to memory of 1776 1268 waop.exe WinMail.exe PID 1268 wrote to memory of 1776 1268 waop.exe WinMail.exe PID 1268 wrote to memory of 1776 1268 waop.exe WinMail.exe PID 1268 wrote to memory of 1776 1268 waop.exe WinMail.exe PID 1268 wrote to memory of 1712 1268 waop.exe DllHost.exe PID 1268 wrote to memory of 1712 1268 waop.exe DllHost.exe PID 1268 wrote to memory of 1712 1268 waop.exe DllHost.exe PID 1268 wrote to memory of 1712 1268 waop.exe DllHost.exe PID 1268 wrote to memory of 1712 1268 waop.exe DllHost.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe"C:\Users\Admin\AppData\Local\Temp\a0131ea9d81fde204643f8522e88629c0c066d3e56630febc093e36626fe8ce9.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\4140\4140.exe"C:\Users\Admin\AppData\Local\Temp\4140\4140.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Yzsok\waop.exe"C:\Users\Admin\AppData\Roaming\Yzsok\waop.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp31b5ad47.bat"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "525894199-8784050752104368582354203914-2135414366-482009578-1575706309406367765"1⤵
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4140\4140.exeFilesize
221KB
MD56ebdd2a615d1514c9fe6eb924301ffc3
SHA10abb35b008f89d4f37e5db1ce42dc18e212d2243
SHA2565da7beb43ed1a185967a28a4f4b029e157eb15166b1ee3c6fdec02f7160b04da
SHA5128186e16c07dc7fc1e585e0bfedb53df8fdfeb09481ee9699d369fb69a794d4c88df09cadacd9f6e7a607d5033ff1af3942eebc7e01954f67e47dbd911d8a10b9
-
C:\Users\Admin\AppData\Local\Temp\4140\4140.exeFilesize
221KB
MD56ebdd2a615d1514c9fe6eb924301ffc3
SHA10abb35b008f89d4f37e5db1ce42dc18e212d2243
SHA2565da7beb43ed1a185967a28a4f4b029e157eb15166b1ee3c6fdec02f7160b04da
SHA5128186e16c07dc7fc1e585e0bfedb53df8fdfeb09481ee9699d369fb69a794d4c88df09cadacd9f6e7a607d5033ff1af3942eebc7e01954f67e47dbd911d8a10b9
-
C:\Users\Admin\AppData\Local\Temp\tmp31b5ad47.batFilesize
197B
MD5beef34569cfd22ef37a0f4427204fc19
SHA1e3adcbc8e4335041a202abd7f12f2024ca8f7ae9
SHA2567a90d0de221a4c71b833829ecf180af6d33885d782f4e21aebd021cea085dab6
SHA512bf302b9d6aaa0f3994fd54b94e5daff23edea2cb99af2002cf1bed23639c5d6fbbc790d55e859a04cc3d540d76611ea04608bcd2be76a2e5398250408f3d1ba3
-
C:\Users\Admin\AppData\Roaming\Anpud\sysog.kisFilesize
3KB
MD5b0327b5ab692dcb518e8ccc61ed32ef5
SHA1d1937dcc11e02021036b7ad5989646ee86b6c78b
SHA256daf8d64666656acc3a0198d7569fd5a3ecece11dee5ed4e68e8202707e31fc61
SHA51285a8bcdd1f70f6ff0c1be0fe1a4f28a6de17e8539feb0a13428859948e46a13b167d4d2667157dcbc4a6c2f1585ce113d4d8998bfd5b68404df366aa539b59f1
-
C:\Users\Admin\AppData\Roaming\Yzsok\waop.exeFilesize
221KB
MD50dd619c39e9d6d335cf58203920f0df3
SHA1fc80979e4c8e6ca2be0eb32cc370e5f8e720abdb
SHA256d0359b1b6f4cf762254e5df887b7e80cc02ad3f340a6c1293f5c7515cfd306e8
SHA5126c37dfb2091845ae128b8bdcd36b9aafcf66988d0cbb29317f8fe784408d08de88b5a7f9460d5e7e617ed4697fca5ba30d65cc986160a747bd416916024aaec5
-
C:\Users\Admin\AppData\Roaming\Yzsok\waop.exeFilesize
221KB
MD50dd619c39e9d6d335cf58203920f0df3
SHA1fc80979e4c8e6ca2be0eb32cc370e5f8e720abdb
SHA256d0359b1b6f4cf762254e5df887b7e80cc02ad3f340a6c1293f5c7515cfd306e8
SHA5126c37dfb2091845ae128b8bdcd36b9aafcf66988d0cbb29317f8fe784408d08de88b5a7f9460d5e7e617ed4697fca5ba30d65cc986160a747bd416916024aaec5
-
\Users\Admin\AppData\Local\Temp\4140\4140.exeFilesize
221KB
MD56ebdd2a615d1514c9fe6eb924301ffc3
SHA10abb35b008f89d4f37e5db1ce42dc18e212d2243
SHA2565da7beb43ed1a185967a28a4f4b029e157eb15166b1ee3c6fdec02f7160b04da
SHA5128186e16c07dc7fc1e585e0bfedb53df8fdfeb09481ee9699d369fb69a794d4c88df09cadacd9f6e7a607d5033ff1af3942eebc7e01954f67e47dbd911d8a10b9
-
\Users\Admin\AppData\Local\Temp\4140\4140.exeFilesize
221KB
MD56ebdd2a615d1514c9fe6eb924301ffc3
SHA10abb35b008f89d4f37e5db1ce42dc18e212d2243
SHA2565da7beb43ed1a185967a28a4f4b029e157eb15166b1ee3c6fdec02f7160b04da
SHA5128186e16c07dc7fc1e585e0bfedb53df8fdfeb09481ee9699d369fb69a794d4c88df09cadacd9f6e7a607d5033ff1af3942eebc7e01954f67e47dbd911d8a10b9
-
\Users\Admin\AppData\Local\Temp\4140\4140.exeFilesize
221KB
MD56ebdd2a615d1514c9fe6eb924301ffc3
SHA10abb35b008f89d4f37e5db1ce42dc18e212d2243
SHA2565da7beb43ed1a185967a28a4f4b029e157eb15166b1ee3c6fdec02f7160b04da
SHA5128186e16c07dc7fc1e585e0bfedb53df8fdfeb09481ee9699d369fb69a794d4c88df09cadacd9f6e7a607d5033ff1af3942eebc7e01954f67e47dbd911d8a10b9
-
\Users\Admin\AppData\Local\Temp\4140\4140.exeFilesize
221KB
MD56ebdd2a615d1514c9fe6eb924301ffc3
SHA10abb35b008f89d4f37e5db1ce42dc18e212d2243
SHA2565da7beb43ed1a185967a28a4f4b029e157eb15166b1ee3c6fdec02f7160b04da
SHA5128186e16c07dc7fc1e585e0bfedb53df8fdfeb09481ee9699d369fb69a794d4c88df09cadacd9f6e7a607d5033ff1af3942eebc7e01954f67e47dbd911d8a10b9
-
\Users\Admin\AppData\Local\Temp\4140\4140.exeFilesize
221KB
MD56ebdd2a615d1514c9fe6eb924301ffc3
SHA10abb35b008f89d4f37e5db1ce42dc18e212d2243
SHA2565da7beb43ed1a185967a28a4f4b029e157eb15166b1ee3c6fdec02f7160b04da
SHA5128186e16c07dc7fc1e585e0bfedb53df8fdfeb09481ee9699d369fb69a794d4c88df09cadacd9f6e7a607d5033ff1af3942eebc7e01954f67e47dbd911d8a10b9
-
\Users\Admin\AppData\Roaming\Yzsok\waop.exeFilesize
221KB
MD50dd619c39e9d6d335cf58203920f0df3
SHA1fc80979e4c8e6ca2be0eb32cc370e5f8e720abdb
SHA256d0359b1b6f4cf762254e5df887b7e80cc02ad3f340a6c1293f5c7515cfd306e8
SHA5126c37dfb2091845ae128b8bdcd36b9aafcf66988d0cbb29317f8fe784408d08de88b5a7f9460d5e7e617ed4697fca5ba30d65cc986160a747bd416916024aaec5
-
\Users\Admin\AppData\Roaming\Yzsok\waop.exeFilesize
221KB
MD50dd619c39e9d6d335cf58203920f0df3
SHA1fc80979e4c8e6ca2be0eb32cc370e5f8e720abdb
SHA256d0359b1b6f4cf762254e5df887b7e80cc02ad3f340a6c1293f5c7515cfd306e8
SHA5126c37dfb2091845ae128b8bdcd36b9aafcf66988d0cbb29317f8fe784408d08de88b5a7f9460d5e7e617ed4697fca5ba30d65cc986160a747bd416916024aaec5
-
memory/320-129-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-113-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-131-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-99-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-127-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-125-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-123-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-121-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-119-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-115-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-117-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-133-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-111-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-231-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-109-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-107-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-104-0x0000000000069BF5-mapping.dmp
-
memory/320-103-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-102-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-101-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/320-270-0x0000000000050000-0x000000000008B000-memory.dmpFilesize
236KB
-
memory/844-91-0x0000000001BD0000-0x0000000001C0B000-memory.dmpFilesize
236KB
-
memory/844-95-0x0000000001BD0000-0x0000000001C0B000-memory.dmpFilesize
236KB
-
memory/844-94-0x0000000001BD0000-0x0000000001C0B000-memory.dmpFilesize
236KB
-
memory/844-93-0x0000000001BD0000-0x0000000001C0B000-memory.dmpFilesize
236KB
-
memory/844-92-0x0000000001BD0000-0x0000000001C0B000-memory.dmpFilesize
236KB
-
memory/844-105-0x0000000001BD0000-0x0000000001C0B000-memory.dmpFilesize
236KB
-
memory/844-59-0x0000000000000000-mapping.dmp
-
memory/844-90-0x0000000001BD0000-0x0000000001C0B000-memory.dmpFilesize
236KB
-
memory/1120-72-0x0000000001DE0000-0x0000000001E1B000-memory.dmpFilesize
236KB
-
memory/1120-74-0x0000000001DE0000-0x0000000001E1B000-memory.dmpFilesize
236KB
-
memory/1120-71-0x0000000001DE0000-0x0000000001E1B000-memory.dmpFilesize
236KB
-
memory/1120-69-0x0000000001DE0000-0x0000000001E1B000-memory.dmpFilesize
236KB
-
memory/1120-73-0x0000000001DE0000-0x0000000001E1B000-memory.dmpFilesize
236KB
-
memory/1164-79-0x00000000001A0000-0x00000000001DB000-memory.dmpFilesize
236KB
-
memory/1164-80-0x00000000001A0000-0x00000000001DB000-memory.dmpFilesize
236KB
-
memory/1164-77-0x00000000001A0000-0x00000000001DB000-memory.dmpFilesize
236KB
-
memory/1164-78-0x00000000001A0000-0x00000000001DB000-memory.dmpFilesize
236KB
-
memory/1196-83-0x0000000002210000-0x000000000224B000-memory.dmpFilesize
236KB
-
memory/1196-85-0x0000000002210000-0x000000000224B000-memory.dmpFilesize
236KB
-
memory/1196-84-0x0000000002210000-0x000000000224B000-memory.dmpFilesize
236KB
-
memory/1196-86-0x0000000002210000-0x000000000224B000-memory.dmpFilesize
236KB
-
memory/1268-65-0x0000000000000000-mapping.dmp
-
memory/1636-54-0x00000000762F1000-0x00000000762F3000-memory.dmpFilesize
8KB