Analysis
-
max time kernel
153s -
max time network
191s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 09:17
Static task
static1
Behavioral task
behavioral1
Sample
a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe
Resource
win7-20221111-en
General
-
Target
a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe
-
Size
697KB
-
MD5
343c326e824393b35e3bff033c097a0f
-
SHA1
6d7319e0ccdff67f9811a7a65ad0dacc6867162e
-
SHA256
a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02
-
SHA512
16cfa14a92eba2cf20f7e1d01138a8bbcc305361db80fbf5782d3fe8db0e8fcbcbdd4ba39e33855e51a2763f5daae820b465a21ae2488db58229561aa02e0824
-
SSDEEP
12288:Ic4zJ7hNsViyCPCE2OZtYPIUR1eDGPTja2x6AeL7J:IrJti4PCKEIAIKru2x6AK7
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
Confirmed1
Signatures
-
NirSoft MailPassView 12 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1088-59-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1088-60-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1088-61-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1088-62-0x000000000047E91E-mapping.dmp MailPassView behavioral1/memory/1088-64-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1088-66-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1956-83-0x000000000047E91E-mapping.dmp MailPassView behavioral1/memory/1052-95-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1052-96-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/1052-99-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1052-100-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1052-101-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 7 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1088-59-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1088-60-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1088-61-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1088-62-0x000000000047E91E-mapping.dmp WebBrowserPassView behavioral1/memory/1088-64-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1088-66-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1956-83-0x000000000047E91E-mapping.dmp WebBrowserPassView -
Nirsoft 12 IoCs
Processes:
resource yara_rule behavioral1/memory/1088-59-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1088-60-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1088-61-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1088-62-0x000000000047E91E-mapping.dmp Nirsoft behavioral1/memory/1088-64-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1088-66-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1956-83-0x000000000047E91E-mapping.dmp Nirsoft behavioral1/memory/1052-95-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1052-96-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/1052-99-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1052-100-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1052-101-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
Windows Update.exeWindows Update.exepid process 892 Windows Update.exe 1956 Windows Update.exe -
Deletes itself 1 IoCs
Processes:
Windows Update.exepid process 1956 Windows Update.exe -
Loads dropped DLL 2 IoCs
Processes:
a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exeWindows Update.exepid process 1088 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe 892 Windows Update.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exeWindows Update.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\jSILlzCwX = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\VAIO Update.exe\"" a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\jSILlzCwX = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\VAIO Update.exe\"" Windows Update.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 whatismyipaddress.com 4 whatismyipaddress.com 6 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exeWindows Update.exeWindows Update.exedescription pid process target process PID 792 set thread context of 1088 792 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 892 set thread context of 1956 892 Windows Update.exe Windows Update.exe PID 1956 set thread context of 1052 1956 Windows Update.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exeWindows Update.exeWindows Update.exepid process 792 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe 792 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe 892 Windows Update.exe 892 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe 1956 Windows Update.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exeWindows Update.exeWindows Update.exedescription pid process Token: SeDebugPrivilege 792 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe Token: SeDebugPrivilege 892 Windows Update.exe Token: SeDebugPrivilege 1956 Windows Update.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Windows Update.exepid process 1956 Windows Update.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exea89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exeWindows Update.exeWindows Update.exedescription pid process target process PID 792 wrote to memory of 1088 792 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 792 wrote to memory of 1088 792 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 792 wrote to memory of 1088 792 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 792 wrote to memory of 1088 792 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 792 wrote to memory of 1088 792 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 792 wrote to memory of 1088 792 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 792 wrote to memory of 1088 792 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 792 wrote to memory of 1088 792 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 792 wrote to memory of 1088 792 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 792 wrote to memory of 1088 792 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 792 wrote to memory of 1088 792 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 792 wrote to memory of 1088 792 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe PID 1088 wrote to memory of 892 1088 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe Windows Update.exe PID 1088 wrote to memory of 892 1088 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe Windows Update.exe PID 1088 wrote to memory of 892 1088 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe Windows Update.exe PID 1088 wrote to memory of 892 1088 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe Windows Update.exe PID 1088 wrote to memory of 892 1088 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe Windows Update.exe PID 1088 wrote to memory of 892 1088 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe Windows Update.exe PID 1088 wrote to memory of 892 1088 a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe Windows Update.exe PID 892 wrote to memory of 1956 892 Windows Update.exe Windows Update.exe PID 892 wrote to memory of 1956 892 Windows Update.exe Windows Update.exe PID 892 wrote to memory of 1956 892 Windows Update.exe Windows Update.exe PID 892 wrote to memory of 1956 892 Windows Update.exe Windows Update.exe PID 892 wrote to memory of 1956 892 Windows Update.exe Windows Update.exe PID 892 wrote to memory of 1956 892 Windows Update.exe Windows Update.exe PID 892 wrote to memory of 1956 892 Windows Update.exe Windows Update.exe PID 892 wrote to memory of 1956 892 Windows Update.exe Windows Update.exe PID 892 wrote to memory of 1956 892 Windows Update.exe Windows Update.exe PID 892 wrote to memory of 1956 892 Windows Update.exe Windows Update.exe PID 892 wrote to memory of 1956 892 Windows Update.exe Windows Update.exe PID 892 wrote to memory of 1956 892 Windows Update.exe Windows Update.exe PID 1956 wrote to memory of 1052 1956 Windows Update.exe vbc.exe PID 1956 wrote to memory of 1052 1956 Windows Update.exe vbc.exe PID 1956 wrote to memory of 1052 1956 Windows Update.exe vbc.exe PID 1956 wrote to memory of 1052 1956 Windows Update.exe vbc.exe PID 1956 wrote to memory of 1052 1956 Windows Update.exe vbc.exe PID 1956 wrote to memory of 1052 1956 Windows Update.exe vbc.exe PID 1956 wrote to memory of 1052 1956 Windows Update.exe vbc.exe PID 1956 wrote to memory of 1052 1956 Windows Update.exe vbc.exe PID 1956 wrote to memory of 1052 1956 Windows Update.exe vbc.exe PID 1956 wrote to memory of 1052 1956 Windows Update.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe"C:\Users\Admin\AppData\Local\Temp\a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe"C:\Users\Admin\AppData\Local\Temp\a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"4⤵
- Executes dropped EXE
- Deletes itself
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵
- Accesses Microsoft Outlook accounts
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SysInfo.txtFilesize
102B
MD5af05f065e77521d5b2478c39369b1441
SHA1f38175fd13f3cec255fc00885f6b4b1f0d24c2a4
SHA256cb591bf738d39544be82ec7e64618d879bfbe94afd9dd95fb2359725cbd8773e
SHA5123b0c0c49fdec99ce9aca3602092e99ea9a10d273c783001c840f25375750c7bf93f98e08275f8f5e31da23851b632a68bee83af35308079b903ef0b993954e7a
-
C:\Users\Admin\AppData\Roaming\Microsoft\VAIO Update.exeFilesize
697KB
MD5343c326e824393b35e3bff033c097a0f
SHA16d7319e0ccdff67f9811a7a65ad0dacc6867162e
SHA256a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02
SHA51216cfa14a92eba2cf20f7e1d01138a8bbcc305361db80fbf5782d3fe8db0e8fcbcbdd4ba39e33855e51a2763f5daae820b465a21ae2488db58229561aa02e0824
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
697KB
MD5343c326e824393b35e3bff033c097a0f
SHA16d7319e0ccdff67f9811a7a65ad0dacc6867162e
SHA256a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02
SHA51216cfa14a92eba2cf20f7e1d01138a8bbcc305361db80fbf5782d3fe8db0e8fcbcbdd4ba39e33855e51a2763f5daae820b465a21ae2488db58229561aa02e0824
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
697KB
MD5343c326e824393b35e3bff033c097a0f
SHA16d7319e0ccdff67f9811a7a65ad0dacc6867162e
SHA256a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02
SHA51216cfa14a92eba2cf20f7e1d01138a8bbcc305361db80fbf5782d3fe8db0e8fcbcbdd4ba39e33855e51a2763f5daae820b465a21ae2488db58229561aa02e0824
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
697KB
MD5343c326e824393b35e3bff033c097a0f
SHA16d7319e0ccdff67f9811a7a65ad0dacc6867162e
SHA256a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02
SHA51216cfa14a92eba2cf20f7e1d01138a8bbcc305361db80fbf5782d3fe8db0e8fcbcbdd4ba39e33855e51a2763f5daae820b465a21ae2488db58229561aa02e0824
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
697KB
MD5343c326e824393b35e3bff033c097a0f
SHA16d7319e0ccdff67f9811a7a65ad0dacc6867162e
SHA256a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02
SHA51216cfa14a92eba2cf20f7e1d01138a8bbcc305361db80fbf5782d3fe8db0e8fcbcbdd4ba39e33855e51a2763f5daae820b465a21ae2488db58229561aa02e0824
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
697KB
MD5343c326e824393b35e3bff033c097a0f
SHA16d7319e0ccdff67f9811a7a65ad0dacc6867162e
SHA256a89fe721aae8f6516789b934c8f055e5ef81a7ab6aa7ceebd79c4105ba75aa02
SHA51216cfa14a92eba2cf20f7e1d01138a8bbcc305361db80fbf5782d3fe8db0e8fcbcbdd4ba39e33855e51a2763f5daae820b465a21ae2488db58229561aa02e0824
-
memory/792-68-0x0000000074300000-0x00000000748AB000-memory.dmpFilesize
5.7MB
-
memory/792-55-0x0000000074300000-0x00000000748AB000-memory.dmpFilesize
5.7MB
-
memory/792-54-0x0000000074E01000-0x0000000074E03000-memory.dmpFilesize
8KB
-
memory/892-87-0x0000000074300000-0x00000000748AB000-memory.dmpFilesize
5.7MB
-
memory/892-70-0x0000000000000000-mapping.dmp
-
memory/892-75-0x0000000074300000-0x00000000748AB000-memory.dmpFilesize
5.7MB
-
memory/1052-95-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1052-101-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1052-100-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1052-99-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1052-96-0x0000000000411654-mapping.dmp
-
memory/1088-60-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1088-66-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1088-59-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1088-57-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1088-56-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1088-61-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1088-74-0x0000000074300000-0x00000000748AB000-memory.dmpFilesize
5.7MB
-
memory/1088-62-0x000000000047E91E-mapping.dmp
-
memory/1088-64-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1956-92-0x0000000074290000-0x000000007483B000-memory.dmpFilesize
5.7MB
-
memory/1956-94-0x0000000074290000-0x000000007483B000-memory.dmpFilesize
5.7MB
-
memory/1956-83-0x000000000047E91E-mapping.dmp