Analysis
-
max time kernel
203s -
max time network
198s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:44
Static task
static1
Behavioral task
behavioral1
Sample
c1cca7728dabf7ce7ecdfaecc8c54412207aff39490cd557b1db568c97437100.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c1cca7728dabf7ce7ecdfaecc8c54412207aff39490cd557b1db568c97437100.exe
Resource
win10v2004-20221111-en
General
-
Target
c1cca7728dabf7ce7ecdfaecc8c54412207aff39490cd557b1db568c97437100.exe
-
Size
346KB
-
MD5
8e5b11b4459592014296f9ab307004a6
-
SHA1
b0cd326c8389db2adeadd541cb21e1fbfb346c80
-
SHA256
c1cca7728dabf7ce7ecdfaecc8c54412207aff39490cd557b1db568c97437100
-
SHA512
a9cac4fbd5eb23fa15564bcfac2734171b4650d7bf8e9218e917e2f0168667a88f0538c21f75ce6057355ea825bdddafee62afc063503e18bf6f824dd50d5b16
-
SSDEEP
6144:jPL9R55VPkcn0QtPoNHMTMnUDHohJMJ/rTK/Va13YTJt2:rpRZPA06MTMUqddC2a
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
Processes:
yysl.exeyysl.exeFB_4210.tmp.exeFB_654A.tmp.exegowi.exepid process 2032 yysl.exe 1012 yysl.exe 1484 FB_4210.tmp.exe 1148 FB_654A.tmp.exe 760 gowi.exe -
Drops startup file 1 IoCs
Processes:
c1cca7728dabf7ce7ecdfaecc8c54412207aff39490cd557b1db568c97437100.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bbb5s.vbs c1cca7728dabf7ce7ecdfaecc8c54412207aff39490cd557b1db568c97437100.exe -
Loads dropped DLL 7 IoCs
Processes:
c1cca7728dabf7ce7ecdfaecc8c54412207aff39490cd557b1db568c97437100.exeyysl.exeFB_654A.tmp.exepid process 952 c1cca7728dabf7ce7ecdfaecc8c54412207aff39490cd557b1db568c97437100.exe 1012 yysl.exe 1012 yysl.exe 1012 yysl.exe 1012 yysl.exe 1148 FB_654A.tmp.exe 1148 FB_654A.tmp.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
gowi.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\Currentversion\Run gowi.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\{54DF4F93-C3DB-B596-1DCC-24A51EB7729F} = "C:\\Users\\Admin\\AppData\\Roaming\\Zuaga\\gowi.exe" gowi.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
yysl.exeFB_654A.tmp.exedescription pid process target process PID 2032 set thread context of 1012 2032 yysl.exe yysl.exe PID 1148 set thread context of 2028 1148 FB_654A.tmp.exe cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
FB_654A.tmp.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Privacy FB_654A.tmp.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" FB_654A.tmp.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
gowi.exepid process 760 gowi.exe 760 gowi.exe 760 gowi.exe 760 gowi.exe 760 gowi.exe 760 gowi.exe 760 gowi.exe 760 gowi.exe 760 gowi.exe 760 gowi.exe 760 gowi.exe 760 gowi.exe 760 gowi.exe 760 gowi.exe 760 gowi.exe 760 gowi.exe 760 gowi.exe 760 gowi.exe 760 gowi.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
yysl.exepid process 2032 yysl.exe 2032 yysl.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
FB_654A.tmp.execmd.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 1148 FB_654A.tmp.exe Token: SeSecurityPrivilege 1148 FB_654A.tmp.exe Token: SeSecurityPrivilege 1148 FB_654A.tmp.exe Token: SeSecurityPrivilege 2028 cmd.exe Token: SeManageVolumePrivilege 1576 WinMail.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 1576 WinMail.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c1cca7728dabf7ce7ecdfaecc8c54412207aff39490cd557b1db568c97437100.exeyysl.exeyysl.exeFB_654A.tmp.exegowi.exedescription pid process target process PID 952 wrote to memory of 2032 952 c1cca7728dabf7ce7ecdfaecc8c54412207aff39490cd557b1db568c97437100.exe yysl.exe PID 952 wrote to memory of 2032 952 c1cca7728dabf7ce7ecdfaecc8c54412207aff39490cd557b1db568c97437100.exe yysl.exe PID 952 wrote to memory of 2032 952 c1cca7728dabf7ce7ecdfaecc8c54412207aff39490cd557b1db568c97437100.exe yysl.exe PID 952 wrote to memory of 2032 952 c1cca7728dabf7ce7ecdfaecc8c54412207aff39490cd557b1db568c97437100.exe yysl.exe PID 2032 wrote to memory of 1012 2032 yysl.exe yysl.exe PID 2032 wrote to memory of 1012 2032 yysl.exe yysl.exe PID 2032 wrote to memory of 1012 2032 yysl.exe yysl.exe PID 2032 wrote to memory of 1012 2032 yysl.exe yysl.exe PID 1012 wrote to memory of 1484 1012 yysl.exe FB_4210.tmp.exe PID 1012 wrote to memory of 1484 1012 yysl.exe FB_4210.tmp.exe PID 1012 wrote to memory of 1484 1012 yysl.exe FB_4210.tmp.exe PID 1012 wrote to memory of 1484 1012 yysl.exe FB_4210.tmp.exe PID 1012 wrote to memory of 1148 1012 yysl.exe FB_654A.tmp.exe PID 1012 wrote to memory of 1148 1012 yysl.exe FB_654A.tmp.exe PID 1012 wrote to memory of 1148 1012 yysl.exe FB_654A.tmp.exe PID 1012 wrote to memory of 1148 1012 yysl.exe FB_654A.tmp.exe PID 1148 wrote to memory of 760 1148 FB_654A.tmp.exe gowi.exe PID 1148 wrote to memory of 760 1148 FB_654A.tmp.exe gowi.exe PID 1148 wrote to memory of 760 1148 FB_654A.tmp.exe gowi.exe PID 1148 wrote to memory of 760 1148 FB_654A.tmp.exe gowi.exe PID 760 wrote to memory of 1124 760 gowi.exe taskhost.exe PID 760 wrote to memory of 1124 760 gowi.exe taskhost.exe PID 760 wrote to memory of 1124 760 gowi.exe taskhost.exe PID 760 wrote to memory of 1124 760 gowi.exe taskhost.exe PID 760 wrote to memory of 1124 760 gowi.exe taskhost.exe PID 760 wrote to memory of 1180 760 gowi.exe Dwm.exe PID 760 wrote to memory of 1180 760 gowi.exe Dwm.exe PID 760 wrote to memory of 1180 760 gowi.exe Dwm.exe PID 760 wrote to memory of 1180 760 gowi.exe Dwm.exe PID 760 wrote to memory of 1180 760 gowi.exe Dwm.exe PID 760 wrote to memory of 1216 760 gowi.exe Explorer.EXE PID 760 wrote to memory of 1216 760 gowi.exe Explorer.EXE PID 760 wrote to memory of 1216 760 gowi.exe Explorer.EXE PID 760 wrote to memory of 1216 760 gowi.exe Explorer.EXE PID 760 wrote to memory of 1216 760 gowi.exe Explorer.EXE PID 760 wrote to memory of 1148 760 gowi.exe FB_654A.tmp.exe PID 760 wrote to memory of 1148 760 gowi.exe FB_654A.tmp.exe PID 760 wrote to memory of 1148 760 gowi.exe FB_654A.tmp.exe PID 760 wrote to memory of 1148 760 gowi.exe FB_654A.tmp.exe PID 760 wrote to memory of 1148 760 gowi.exe FB_654A.tmp.exe PID 1148 wrote to memory of 2028 1148 FB_654A.tmp.exe cmd.exe PID 1148 wrote to memory of 2028 1148 FB_654A.tmp.exe cmd.exe PID 1148 wrote to memory of 2028 1148 FB_654A.tmp.exe cmd.exe PID 1148 wrote to memory of 2028 1148 FB_654A.tmp.exe cmd.exe PID 1148 wrote to memory of 2028 1148 FB_654A.tmp.exe cmd.exe PID 1148 wrote to memory of 2028 1148 FB_654A.tmp.exe cmd.exe PID 1148 wrote to memory of 2028 1148 FB_654A.tmp.exe cmd.exe PID 1148 wrote to memory of 2028 1148 FB_654A.tmp.exe cmd.exe PID 1148 wrote to memory of 2028 1148 FB_654A.tmp.exe cmd.exe PID 760 wrote to memory of 668 760 gowi.exe conhost.exe PID 760 wrote to memory of 668 760 gowi.exe conhost.exe PID 760 wrote to memory of 668 760 gowi.exe conhost.exe PID 760 wrote to memory of 668 760 gowi.exe conhost.exe PID 760 wrote to memory of 668 760 gowi.exe conhost.exe PID 760 wrote to memory of 1640 760 gowi.exe DllHost.exe PID 760 wrote to memory of 1640 760 gowi.exe DllHost.exe PID 760 wrote to memory of 1640 760 gowi.exe DllHost.exe PID 760 wrote to memory of 1640 760 gowi.exe DllHost.exe PID 760 wrote to memory of 1640 760 gowi.exe DllHost.exe PID 760 wrote to memory of 2020 760 gowi.exe DllHost.exe PID 760 wrote to memory of 2020 760 gowi.exe DllHost.exe PID 760 wrote to memory of 2020 760 gowi.exe DllHost.exe PID 760 wrote to memory of 2020 760 gowi.exe DllHost.exe PID 760 wrote to memory of 2020 760 gowi.exe DllHost.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\c1cca7728dabf7ce7ecdfaecc8c54412207aff39490cd557b1db568c97437100.exe"C:\Users\Admin\AppData\Local\Temp\c1cca7728dabf7ce7ecdfaecc8c54412207aff39490cd557b1db568c97437100.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wrdr\yysl.exe"C:\Users\Admin\AppData\Roaming\wrdr\yysl.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wrdr\yysl.exe"C:\Users\Admin\AppData\Roaming\wrdr\yysl.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FB_4210.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_4210.tmp.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\FB_654A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_654A.tmp.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Zuaga\gowi.exe"C:\Users\Admin\AppData\Roaming\Zuaga\gowi.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp86dc9a7d.bat"6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "603643580181230018331382670816828274531957060527897768329-1946219206-433460032"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FB_4210.tmp.exeFilesize
3KB
MD574bafb3e707c7b0c63938ac200f99c7f
SHA110c5506337845ed9bf25c73d2506f9c15ab8e608
SHA256129450ba06ad589cf6846a455a5b6b5f55e164ee4906e409eb692ab465269689
SHA5125b24dc5acd14f812658e832b587b60695fb16954fca006c2c3a7382ef0ec65c3bd1aaf699425c49ff3cceef16869e75dd6f00ec189b9f673f08f7e1b80cf7781
-
C:\Users\Admin\AppData\Local\Temp\FB_654A.tmp.exeFilesize
138KB
MD5c20a02e741f60444d5958b82ea1f9733
SHA1bbb9aa78eeb9ef412c1bd78ce44d328118b5706e
SHA256c89c7939f95bcf69c4d0be1eab980e232f7bce1d3ab4178c311bb25506e35084
SHA51248ea63d2e4b8f80a30ae4a52c6e3591bb37f5a6b2b0be8f1762d501d1c5a5ec7bc4bf9ac2944e758a6b97d69c8eadb5950c4de2070a644430fa628ccd4d96dbc
-
C:\Users\Admin\AppData\Local\Temp\FB_654A.tmp.exeFilesize
138KB
MD5c20a02e741f60444d5958b82ea1f9733
SHA1bbb9aa78eeb9ef412c1bd78ce44d328118b5706e
SHA256c89c7939f95bcf69c4d0be1eab980e232f7bce1d3ab4178c311bb25506e35084
SHA51248ea63d2e4b8f80a30ae4a52c6e3591bb37f5a6b2b0be8f1762d501d1c5a5ec7bc4bf9ac2944e758a6b97d69c8eadb5950c4de2070a644430fa628ccd4d96dbc
-
C:\Users\Admin\AppData\Roaming\Ucmyom\olne.omyFilesize
345B
MD5ae690e3b434efcf6616ed9dd4072247f
SHA149f622a42323e97a44415619eb4a723ec6e02d41
SHA2568a64599f4f4b8d15bd767c40ebf5ad369ac0c09b98608493677802c9ab4efcb7
SHA5128280ca3092aadea10c2da1fb549a2a9fe6a5b9abff78125514faf8cdb7781b7e6670621b14a3927bae8de6905229bae195067feb0d973455e399b6fa9e867eec
-
C:\Users\Admin\AppData\Roaming\Zuaga\gowi.exeFilesize
138KB
MD5f6e0699583c92f70399db89461dc5583
SHA12a3214320a66b47573e50dfa8d792081c6cfddb5
SHA2566cefbba2dcafa50398d271f5d462a4200486f31b4c2b1786e9f80b128714a23c
SHA512a9dc7bc9165615bb6d1e93336e55650c9701262062341e1cc118822c74f98826780c3730162e57ca8bd86e7b410451140a5f3e1bec3af2abc1320042939d8fb3
-
C:\Users\Admin\AppData\Roaming\Zuaga\gowi.exeFilesize
138KB
MD5f6e0699583c92f70399db89461dc5583
SHA12a3214320a66b47573e50dfa8d792081c6cfddb5
SHA2566cefbba2dcafa50398d271f5d462a4200486f31b4c2b1786e9f80b128714a23c
SHA512a9dc7bc9165615bb6d1e93336e55650c9701262062341e1cc118822c74f98826780c3730162e57ca8bd86e7b410451140a5f3e1bec3af2abc1320042939d8fb3
-
C:\Users\Admin\AppData\Roaming\wrdr\yysl.exeFilesize
346KB
MD58e5b11b4459592014296f9ab307004a6
SHA1b0cd326c8389db2adeadd541cb21e1fbfb346c80
SHA256c1cca7728dabf7ce7ecdfaecc8c54412207aff39490cd557b1db568c97437100
SHA512a9cac4fbd5eb23fa15564bcfac2734171b4650d7bf8e9218e917e2f0168667a88f0538c21f75ce6057355ea825bdddafee62afc063503e18bf6f824dd50d5b16
-
C:\Users\Admin\AppData\Roaming\wrdr\yysl.exeFilesize
346KB
MD58e5b11b4459592014296f9ab307004a6
SHA1b0cd326c8389db2adeadd541cb21e1fbfb346c80
SHA256c1cca7728dabf7ce7ecdfaecc8c54412207aff39490cd557b1db568c97437100
SHA512a9cac4fbd5eb23fa15564bcfac2734171b4650d7bf8e9218e917e2f0168667a88f0538c21f75ce6057355ea825bdddafee62afc063503e18bf6f824dd50d5b16
-
\Users\Admin\AppData\Local\Temp\FB_4210.tmp.exeFilesize
3KB
MD574bafb3e707c7b0c63938ac200f99c7f
SHA110c5506337845ed9bf25c73d2506f9c15ab8e608
SHA256129450ba06ad589cf6846a455a5b6b5f55e164ee4906e409eb692ab465269689
SHA5125b24dc5acd14f812658e832b587b60695fb16954fca006c2c3a7382ef0ec65c3bd1aaf699425c49ff3cceef16869e75dd6f00ec189b9f673f08f7e1b80cf7781
-
\Users\Admin\AppData\Local\Temp\FB_4210.tmp.exeFilesize
3KB
MD574bafb3e707c7b0c63938ac200f99c7f
SHA110c5506337845ed9bf25c73d2506f9c15ab8e608
SHA256129450ba06ad589cf6846a455a5b6b5f55e164ee4906e409eb692ab465269689
SHA5125b24dc5acd14f812658e832b587b60695fb16954fca006c2c3a7382ef0ec65c3bd1aaf699425c49ff3cceef16869e75dd6f00ec189b9f673f08f7e1b80cf7781
-
\Users\Admin\AppData\Local\Temp\FB_654A.tmp.exeFilesize
138KB
MD5c20a02e741f60444d5958b82ea1f9733
SHA1bbb9aa78eeb9ef412c1bd78ce44d328118b5706e
SHA256c89c7939f95bcf69c4d0be1eab980e232f7bce1d3ab4178c311bb25506e35084
SHA51248ea63d2e4b8f80a30ae4a52c6e3591bb37f5a6b2b0be8f1762d501d1c5a5ec7bc4bf9ac2944e758a6b97d69c8eadb5950c4de2070a644430fa628ccd4d96dbc
-
\Users\Admin\AppData\Local\Temp\FB_654A.tmp.exeFilesize
138KB
MD5c20a02e741f60444d5958b82ea1f9733
SHA1bbb9aa78eeb9ef412c1bd78ce44d328118b5706e
SHA256c89c7939f95bcf69c4d0be1eab980e232f7bce1d3ab4178c311bb25506e35084
SHA51248ea63d2e4b8f80a30ae4a52c6e3591bb37f5a6b2b0be8f1762d501d1c5a5ec7bc4bf9ac2944e758a6b97d69c8eadb5950c4de2070a644430fa628ccd4d96dbc
-
\Users\Admin\AppData\Roaming\Zuaga\gowi.exeFilesize
138KB
MD5f6e0699583c92f70399db89461dc5583
SHA12a3214320a66b47573e50dfa8d792081c6cfddb5
SHA2566cefbba2dcafa50398d271f5d462a4200486f31b4c2b1786e9f80b128714a23c
SHA512a9dc7bc9165615bb6d1e93336e55650c9701262062341e1cc118822c74f98826780c3730162e57ca8bd86e7b410451140a5f3e1bec3af2abc1320042939d8fb3
-
\Users\Admin\AppData\Roaming\Zuaga\gowi.exeFilesize
138KB
MD5f6e0699583c92f70399db89461dc5583
SHA12a3214320a66b47573e50dfa8d792081c6cfddb5
SHA2566cefbba2dcafa50398d271f5d462a4200486f31b4c2b1786e9f80b128714a23c
SHA512a9dc7bc9165615bb6d1e93336e55650c9701262062341e1cc118822c74f98826780c3730162e57ca8bd86e7b410451140a5f3e1bec3af2abc1320042939d8fb3
-
\Users\Admin\AppData\Roaming\wrdr\yysl.exeFilesize
346KB
MD58e5b11b4459592014296f9ab307004a6
SHA1b0cd326c8389db2adeadd541cb21e1fbfb346c80
SHA256c1cca7728dabf7ce7ecdfaecc8c54412207aff39490cd557b1db568c97437100
SHA512a9cac4fbd5eb23fa15564bcfac2734171b4650d7bf8e9218e917e2f0168667a88f0538c21f75ce6057355ea825bdddafee62afc063503e18bf6f824dd50d5b16
-
memory/668-117-0x0000000001A40000-0x0000000001A67000-memory.dmpFilesize
156KB
-
memory/668-121-0x0000000001A40000-0x0000000001A67000-memory.dmpFilesize
156KB
-
memory/668-119-0x0000000001A40000-0x0000000001A67000-memory.dmpFilesize
156KB
-
memory/668-118-0x0000000001A40000-0x0000000001A67000-memory.dmpFilesize
156KB
-
memory/760-75-0x0000000000000000-mapping.dmp
-
memory/952-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB
-
memory/1012-59-0x0000000000401190-mapping.dmp
-
memory/1012-62-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1124-79-0x0000000001C10000-0x0000000001C37000-memory.dmpFilesize
156KB
-
memory/1124-82-0x0000000001C10000-0x0000000001C37000-memory.dmpFilesize
156KB
-
memory/1124-84-0x0000000001C10000-0x0000000001C37000-memory.dmpFilesize
156KB
-
memory/1124-83-0x0000000001C10000-0x0000000001C37000-memory.dmpFilesize
156KB
-
memory/1124-81-0x0000000001C10000-0x0000000001C37000-memory.dmpFilesize
156KB
-
memory/1148-105-0x0000000000290000-0x00000000002B7000-memory.dmpFilesize
156KB
-
memory/1148-69-0x0000000000000000-mapping.dmp
-
memory/1148-101-0x0000000000290000-0x00000000002B7000-memory.dmpFilesize
156KB
-
memory/1148-99-0x0000000000290000-0x00000000002B7000-memory.dmpFilesize
156KB
-
memory/1148-100-0x0000000000290000-0x00000000002B7000-memory.dmpFilesize
156KB
-
memory/1148-102-0x0000000000290000-0x00000000002B7000-memory.dmpFilesize
156KB
-
memory/1148-103-0x0000000000290000-0x00000000002B7000-memory.dmpFilesize
156KB
-
memory/1180-88-0x0000000001AF0000-0x0000000001B17000-memory.dmpFilesize
156KB
-
memory/1180-89-0x0000000001AF0000-0x0000000001B17000-memory.dmpFilesize
156KB
-
memory/1180-90-0x0000000001AF0000-0x0000000001B17000-memory.dmpFilesize
156KB
-
memory/1180-87-0x0000000001AF0000-0x0000000001B17000-memory.dmpFilesize
156KB
-
memory/1216-93-0x0000000002250000-0x0000000002277000-memory.dmpFilesize
156KB
-
memory/1216-96-0x0000000002250000-0x0000000002277000-memory.dmpFilesize
156KB
-
memory/1216-95-0x0000000002250000-0x0000000002277000-memory.dmpFilesize
156KB
-
memory/1216-94-0x0000000002250000-0x0000000002277000-memory.dmpFilesize
156KB
-
memory/1484-65-0x0000000000000000-mapping.dmp
-
memory/1576-142-0x0000000001FC0000-0x0000000001FD0000-memory.dmpFilesize
64KB
-
memory/1576-136-0x0000000001F60000-0x0000000001F70000-memory.dmpFilesize
64KB
-
memory/1576-135-0x000007FEF57E1000-0x000007FEF57E3000-memory.dmpFilesize
8KB
-
memory/1576-134-0x000007FEFBA61000-0x000007FEFBA63000-memory.dmpFilesize
8KB
-
memory/1640-125-0x00000000004F0000-0x0000000000517000-memory.dmpFilesize
156KB
-
memory/1640-124-0x00000000004F0000-0x0000000000517000-memory.dmpFilesize
156KB
-
memory/1640-126-0x00000000004F0000-0x0000000000517000-memory.dmpFilesize
156KB
-
memory/1640-127-0x00000000004F0000-0x0000000000517000-memory.dmpFilesize
156KB
-
memory/2020-133-0x0000000002510000-0x0000000002537000-memory.dmpFilesize
156KB
-
memory/2020-132-0x0000000002510000-0x0000000002537000-memory.dmpFilesize
156KB
-
memory/2020-131-0x0000000002510000-0x0000000002537000-memory.dmpFilesize
156KB
-
memory/2020-130-0x0000000002510000-0x0000000002537000-memory.dmpFilesize
156KB
-
memory/2028-113-0x00000000000C2CBA-mapping.dmp
-
memory/2028-120-0x00000000000B0000-0x00000000000D7000-memory.dmpFilesize
156KB
-
memory/2028-112-0x00000000000B0000-0x00000000000D7000-memory.dmpFilesize
156KB
-
memory/2028-111-0x00000000000B0000-0x00000000000D7000-memory.dmpFilesize
156KB
-
memory/2028-110-0x00000000000B0000-0x00000000000D7000-memory.dmpFilesize
156KB
-
memory/2028-108-0x00000000000B0000-0x00000000000D7000-memory.dmpFilesize
156KB
-
memory/2032-56-0x0000000000000000-mapping.dmp