Analysis
-
max time kernel
152s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 18:00
Static task
static1
Behavioral task
behavioral1
Sample
e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe
Resource
win10v2004-20220901-en
General
-
Target
e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe
-
Size
1.7MB
-
MD5
25608c802cc888e22266120f327032fd
-
SHA1
164717002d508e77a9131b4fd8828e93167886d7
-
SHA256
e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c
-
SHA512
0cebd8c895748ae7392f73ab3e0c37eb38bd1bc2973294adf3f3c71595e772a3d8054d6ba9f82382283a6a010e33fd7b72a730ee4b4e4a574a7e47fe3dc4821c
-
SSDEEP
49152:PD1YJREKyzVULk4FdtIYTAdZTCbMklbm:5Yz/yatFdtI3ZTCb
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
IpOverUsbSvrc.exeatiesrx.exepid process 584 IpOverUsbSvrc.exe 1004 atiesrx.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Loads dropped DLL 2 IoCs
Processes:
e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exeIpOverUsbSvrc.exepid process 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 584 IpOverUsbSvrc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
IpOverUsbSvrc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Multimedia Class Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\IpOverUsbSvrc.exe" IpOverUsbSvrc.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 myip.dnsomatic.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exeatiesrx.exedescription pid process target process PID 1600 set thread context of 1756 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 1004 set thread context of 1804 1004 atiesrx.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exevbc.exeIpOverUsbSvrc.exepid process 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1756 vbc.exe 1756 vbc.exe 1756 vbc.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 584 IpOverUsbSvrc.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 584 IpOverUsbSvrc.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 584 IpOverUsbSvrc.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 584 IpOverUsbSvrc.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 584 IpOverUsbSvrc.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 584 IpOverUsbSvrc.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 584 IpOverUsbSvrc.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 584 IpOverUsbSvrc.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 584 IpOverUsbSvrc.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 584 IpOverUsbSvrc.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 584 IpOverUsbSvrc.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 584 IpOverUsbSvrc.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exeIpOverUsbSvrc.exeatiesrx.exedescription pid process Token: SeDebugPrivilege 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe Token: SeDebugPrivilege 584 IpOverUsbSvrc.exe Token: SeDebugPrivilege 1004 atiesrx.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exevbc.exeWScript.execmd.exeIpOverUsbSvrc.exeatiesrx.exedescription pid process target process PID 1600 wrote to memory of 1756 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 1600 wrote to memory of 1756 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 1600 wrote to memory of 1756 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 1600 wrote to memory of 1756 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 1600 wrote to memory of 1756 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 1600 wrote to memory of 1756 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 1600 wrote to memory of 1756 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 1600 wrote to memory of 1756 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 1600 wrote to memory of 1756 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 1600 wrote to memory of 1756 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 1600 wrote to memory of 1756 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe vbc.exe PID 1600 wrote to memory of 584 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe IpOverUsbSvrc.exe PID 1600 wrote to memory of 584 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe IpOverUsbSvrc.exe PID 1600 wrote to memory of 584 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe IpOverUsbSvrc.exe PID 1600 wrote to memory of 584 1600 e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe IpOverUsbSvrc.exe PID 1756 wrote to memory of 1572 1756 vbc.exe WScript.exe PID 1756 wrote to memory of 1572 1756 vbc.exe WScript.exe PID 1756 wrote to memory of 1572 1756 vbc.exe WScript.exe PID 1756 wrote to memory of 1572 1756 vbc.exe WScript.exe PID 1572 wrote to memory of 984 1572 WScript.exe cmd.exe PID 1572 wrote to memory of 984 1572 WScript.exe cmd.exe PID 1572 wrote to memory of 984 1572 WScript.exe cmd.exe PID 1572 wrote to memory of 984 1572 WScript.exe cmd.exe PID 984 wrote to memory of 1628 984 cmd.exe attrib.exe PID 984 wrote to memory of 1628 984 cmd.exe attrib.exe PID 984 wrote to memory of 1628 984 cmd.exe attrib.exe PID 984 wrote to memory of 1628 984 cmd.exe attrib.exe PID 584 wrote to memory of 1004 584 IpOverUsbSvrc.exe atiesrx.exe PID 584 wrote to memory of 1004 584 IpOverUsbSvrc.exe atiesrx.exe PID 584 wrote to memory of 1004 584 IpOverUsbSvrc.exe atiesrx.exe PID 584 wrote to memory of 1004 584 IpOverUsbSvrc.exe atiesrx.exe PID 1004 wrote to memory of 1804 1004 atiesrx.exe vbc.exe PID 1004 wrote to memory of 1804 1004 atiesrx.exe vbc.exe PID 1004 wrote to memory of 1804 1004 atiesrx.exe vbc.exe PID 1004 wrote to memory of 1804 1004 atiesrx.exe vbc.exe PID 1004 wrote to memory of 1804 1004 atiesrx.exe vbc.exe PID 1004 wrote to memory of 1804 1004 atiesrx.exe vbc.exe PID 1004 wrote to memory of 1804 1004 atiesrx.exe vbc.exe PID 1004 wrote to memory of 1804 1004 atiesrx.exe vbc.exe PID 1004 wrote to memory of 1804 1004 atiesrx.exe vbc.exe PID 1004 wrote to memory of 1804 1004 atiesrx.exe vbc.exe PID 1004 wrote to memory of 1804 1004 atiesrx.exe vbc.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe"C:\Users\Admin\AppData\Local\Temp\e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\RealNetowrks\Hide_Folder_1.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\RealNetowrks\Hide_Folder_1.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h C:\Users\Admin\AppData\Roaming\RealNetowrks5⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exeFilesize
11KB
MD55249a17cb09bb8d857feb19c047a894b
SHA1c9e8a8f6cf2d4f14c68b85f409a2d50a57114c79
SHA25679c10fbcc5f86767857e5193096dcb866dff14e039da6bfa07c7cbd9095b99f1
SHA51256bfecdc10e0d5e89a9fad91a033fe7f81c673e1167cd994fd5f57c126c02563d18d734713da82d3e30e47201920e49059ff169d0ba486d8be835688e0856d23
-
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exeFilesize
11KB
MD55249a17cb09bb8d857feb19c047a894b
SHA1c9e8a8f6cf2d4f14c68b85f409a2d50a57114c79
SHA25679c10fbcc5f86767857e5193096dcb866dff14e039da6bfa07c7cbd9095b99f1
SHA51256bfecdc10e0d5e89a9fad91a033fe7f81c673e1167cd994fd5f57c126c02563d18d734713da82d3e30e47201920e49059ff169d0ba486d8be835688e0856d23
-
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exeFilesize
1.7MB
MD525608c802cc888e22266120f327032fd
SHA1164717002d508e77a9131b4fd8828e93167886d7
SHA256e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c
SHA5120cebd8c895748ae7392f73ab3e0c37eb38bd1bc2973294adf3f3c71595e772a3d8054d6ba9f82382283a6a010e33fd7b72a730ee4b4e4a574a7e47fe3dc4821c
-
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exeFilesize
1.7MB
MD525608c802cc888e22266120f327032fd
SHA1164717002d508e77a9131b4fd8828e93167886d7
SHA256e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c
SHA5120cebd8c895748ae7392f73ab3e0c37eb38bd1bc2973294adf3f3c71595e772a3d8054d6ba9f82382283a6a010e33fd7b72a730ee4b4e4a574a7e47fe3dc4821c
-
C:\Users\Admin\AppData\Roaming\RealNetowrks\Hide_Folder_1.batFilesize
56B
MD54a55a5a5ca857637659220aeb1a91d92
SHA14c73b21f348ed194dec47bcb0c3a83071be864e8
SHA2560aa9d5a6e2d224e57d44bd4267c6d98479e25b052c878e579cc5d2facbcc601f
SHA512d7ea2948e2c5f60675c08d6a8308cd7c449e1efaef818a24bf0481b8f5a45412a04b5fd580035127bcd052cc754fb948dc947989528ee9a52ce64457ab2eac51
-
C:\Users\Admin\AppData\Roaming\RealNetowrks\Hide_Folder_1.vbsFilesize
169B
MD53d987aec0fa7269c334d9d52676f7ae6
SHA1c912e179bfcad6b0d10061cfe4eb84bfa069a5f5
SHA256757a187de0343591d7d49a2fa71ef8a8f8325f61df8f2bff905c36d599bdd549
SHA5128ff828024cfdb0db4bc0474ce4b5f00e691c0d9c4193ebd67bb57b4ba7907690e688c6c0a78863a8ece6e244ef21e89c0aa1b7f073146fad0a2b0e59beb58e63
-
\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exeFilesize
11KB
MD55249a17cb09bb8d857feb19c047a894b
SHA1c9e8a8f6cf2d4f14c68b85f409a2d50a57114c79
SHA25679c10fbcc5f86767857e5193096dcb866dff14e039da6bfa07c7cbd9095b99f1
SHA51256bfecdc10e0d5e89a9fad91a033fe7f81c673e1167cd994fd5f57c126c02563d18d734713da82d3e30e47201920e49059ff169d0ba486d8be835688e0856d23
-
\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exeFilesize
1.7MB
MD525608c802cc888e22266120f327032fd
SHA1164717002d508e77a9131b4fd8828e93167886d7
SHA256e1312cad3fd1a88923cebcf43de8be347ee346b9c3293b73400f55f4dbfe783c
SHA5120cebd8c895748ae7392f73ab3e0c37eb38bd1bc2973294adf3f3c71595e772a3d8054d6ba9f82382283a6a010e33fd7b72a730ee4b4e4a574a7e47fe3dc4821c
-
memory/584-87-0x0000000074100000-0x00000000746AB000-memory.dmpFilesize
5.7MB
-
memory/584-74-0x0000000000000000-mapping.dmp
-
memory/584-79-0x0000000074100000-0x00000000746AB000-memory.dmpFilesize
5.7MB
-
memory/984-84-0x0000000000000000-mapping.dmp
-
memory/1004-90-0x0000000000000000-mapping.dmp
-
memory/1004-93-0x0000000074100000-0x00000000746AB000-memory.dmpFilesize
5.7MB
-
memory/1004-94-0x0000000074100000-0x00000000746AB000-memory.dmpFilesize
5.7MB
-
memory/1572-80-0x0000000000000000-mapping.dmp
-
memory/1600-95-0x0000000074100000-0x00000000746AB000-memory.dmpFilesize
5.7MB
-
memory/1600-54-0x00000000752B1000-0x00000000752B3000-memory.dmpFilesize
8KB
-
memory/1600-56-0x0000000074100000-0x00000000746AB000-memory.dmpFilesize
5.7MB
-
memory/1600-55-0x0000000074100000-0x00000000746AB000-memory.dmpFilesize
5.7MB
-
memory/1628-85-0x0000000000000000-mapping.dmp
-
memory/1756-66-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1756-78-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1756-86-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1756-72-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1756-69-0x0000000000450741-mapping.dmp
-
memory/1756-68-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1756-64-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1756-62-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1756-60-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1756-58-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1756-57-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB
-
memory/1804-108-0x0000000000450741-mapping.dmp
-
memory/1804-112-0x0000000000400000-0x000000000048E000-memory.dmpFilesize
568KB