Analysis
-
max time kernel
151s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 07:34
Static task
static1
Behavioral task
behavioral1
Sample
81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe
Resource
win7-20220812-en
General
-
Target
81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe
-
Size
407KB
-
MD5
92ab6f3425debea9bc52f6258c8c24d4
-
SHA1
4dac2076593202265b323dc95225282c22893c78
-
SHA256
81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0
-
SHA512
a0f7e300cc657396dc1b78a8f5b1d27a56b63f638753dd1293be3ae6fe60fcf294bd32c75ed82811115d1912e267ddd546a1ca2c527283fd5cea20b1133cb284
-
SSDEEP
6144:b5Apma3f4in830cZEpwmeoqf4Z0XYI9FsMJRt:b5a3wi8KwmeoqwZM0MF
Malware Config
Extracted
cybergate
2.6
vítima
127.0.0.1:81
***MUTX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
dllregedit
-
install_file
regeditregister.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
título da mensagem
-
password
mypass
-
regkey_hkcu
HKCUz
Signatures
-
Executes dropped EXE 6 IoCs
Processes:
Stub.exe1.exe1.exe1.exeregeditregister.exeregeditregister.exepid process 1140 Stub.exe 1072 1.exe 1760 1.exe 428 1.exe 1148 regeditregister.exe 1340 regeditregister.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
1.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{3EH42JVF-048Q-HU2B-4FN5-D704254VWEUO} 1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3EH42JVF-048Q-HU2B-4FN5-D704254VWEUO}\StubPath = "C:\\Windows\\system32\\dllregedit\\regeditregister.exe Restart" 1.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{3EH42JVF-048Q-HU2B-4FN5-D704254VWEUO} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{3EH42JVF-048Q-HU2B-4FN5-D704254VWEUO}\StubPath = "C:\\Windows\\system32\\dllregedit\\regeditregister.exe" explorer.exe -
Processes:
resource yara_rule behavioral1/memory/1760-70-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1760-74-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1760-76-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1760-77-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1760-78-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1760-80-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/1760-89-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1464-94-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1464-97-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1760-99-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral1/memory/1760-107-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/1760-113-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/428-112-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/1340-125-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1340-126-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1340-127-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/428-128-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/1340-129-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/428-130-0x0000000024160000-0x00000000241C2000-memory.dmp upx -
Loads dropped DLL 4 IoCs
Processes:
1.exe1.exe1.exepid process 1072 1.exe 1760 1.exe 428 1.exe 428 1.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run 1.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCUz = "C:\\Windows\\system32\\dllregedit\\regeditregister.exe" 1.exe -
Drops file in System32 directory 3 IoCs
Processes:
1.exeregeditregister.exedescription ioc process File created C:\Windows\SysWOW64\dllregedit\regeditregister.exe 1.exe File opened for modification C:\Windows\SysWOW64\dllregedit\regeditregister.exe 1.exe File opened for modification C:\Windows\SysWOW64\dllregedit\regeditregister.exe regeditregister.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1.exeregeditregister.exedescription pid process target process PID 1072 set thread context of 1760 1072 1.exe 1.exe PID 1148 set thread context of 1340 1148 regeditregister.exe regeditregister.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
1.exepid process 1760 1.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
1.exepid process 428 1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1.exedescription pid process Token: SeDebugPrivilege 428 1.exe Token: SeDebugPrivilege 428 1.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
1.exepid process 1760 1.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
1.exeregeditregister.exepid process 1072 1.exe 1148 regeditregister.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe1.exe1.exedescription pid process target process PID 1148 wrote to memory of 1140 1148 81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe Stub.exe PID 1148 wrote to memory of 1140 1148 81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe Stub.exe PID 1148 wrote to memory of 1140 1148 81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe Stub.exe PID 1148 wrote to memory of 1072 1148 81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe 1.exe PID 1148 wrote to memory of 1072 1148 81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe 1.exe PID 1148 wrote to memory of 1072 1148 81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe 1.exe PID 1148 wrote to memory of 1072 1148 81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe 1.exe PID 1072 wrote to memory of 1760 1072 1.exe 1.exe PID 1072 wrote to memory of 1760 1072 1.exe 1.exe PID 1072 wrote to memory of 1760 1072 1.exe 1.exe PID 1072 wrote to memory of 1760 1072 1.exe 1.exe PID 1072 wrote to memory of 1760 1072 1.exe 1.exe PID 1072 wrote to memory of 1760 1072 1.exe 1.exe PID 1072 wrote to memory of 1760 1072 1.exe 1.exe PID 1072 wrote to memory of 1760 1072 1.exe 1.exe PID 1072 wrote to memory of 1760 1072 1.exe 1.exe PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE PID 1760 wrote to memory of 1380 1760 1.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe"C:\Users\Admin\AppData\Local\Temp\81f5a42b59eefb3eb8a4674411947d156c6c37f3b6cf9965b0e0aeebbb7e4ab0.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Stub.exe"C:\Users\Admin\AppData\Local\Temp\Stub.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1.exeC:\Users\Admin\AppData\Local\Temp\1.exe4⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe5⤵
- Modifies Installed Components in the registry
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllregedit\regeditregister.exe"C:\Windows\system32\dllregedit\regeditregister.exe"6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllregedit\regeditregister.exeC:\Windows\SysWOW64\dllregedit\regeditregister.exe7⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1.exeFilesize
376KB
MD5f97524e05daee70c13e637cc21f1bc91
SHA1d836528896f5cbf0f4f5df064e8ab25d7fc21b42
SHA2567ed27e40a1c0bb6eaabdda3b2a01426a372fdc0d637d7540fbe4afc7fb8ae3cf
SHA512ed35b254381a26951a2517414d39980e8052e66e68b58c0138cb41e1d27df0080a16f9380ded28dbb465cf1499b45ee93b8016a90b70ac591925f1c0e335a1dd
-
C:\Users\Admin\AppData\Local\Temp\1.exeFilesize
376KB
MD5f97524e05daee70c13e637cc21f1bc91
SHA1d836528896f5cbf0f4f5df064e8ab25d7fc21b42
SHA2567ed27e40a1c0bb6eaabdda3b2a01426a372fdc0d637d7540fbe4afc7fb8ae3cf
SHA512ed35b254381a26951a2517414d39980e8052e66e68b58c0138cb41e1d27df0080a16f9380ded28dbb465cf1499b45ee93b8016a90b70ac591925f1c0e335a1dd
-
C:\Users\Admin\AppData\Local\Temp\1.exeFilesize
376KB
MD5f97524e05daee70c13e637cc21f1bc91
SHA1d836528896f5cbf0f4f5df064e8ab25d7fc21b42
SHA2567ed27e40a1c0bb6eaabdda3b2a01426a372fdc0d637d7540fbe4afc7fb8ae3cf
SHA512ed35b254381a26951a2517414d39980e8052e66e68b58c0138cb41e1d27df0080a16f9380ded28dbb465cf1499b45ee93b8016a90b70ac591925f1c0e335a1dd
-
C:\Users\Admin\AppData\Local\Temp\1.exeFilesize
376KB
MD5f97524e05daee70c13e637cc21f1bc91
SHA1d836528896f5cbf0f4f5df064e8ab25d7fc21b42
SHA2567ed27e40a1c0bb6eaabdda3b2a01426a372fdc0d637d7540fbe4afc7fb8ae3cf
SHA512ed35b254381a26951a2517414d39980e8052e66e68b58c0138cb41e1d27df0080a16f9380ded28dbb465cf1499b45ee93b8016a90b70ac591925f1c0e335a1dd
-
C:\Users\Admin\AppData\Local\Temp\Stub.exeFilesize
15KB
MD59f0923f8db9e61c4ca6a7163c2ecd35c
SHA1809f07b4102589adda53341606d470e01d2b1562
SHA25661e333deb690adb92183f5bc499a94b550250ee45b3a0246c6a53ce53c7a2ff8
SHA5123a0b4d0b3905d5a1512d48e9e2f4bf9e37eae716ca918b97c9d13ce41b939b48d7271e30d4efe4e36be7b8762dd44ba6a96fd81f0211a66062e3e31bf384e9ad
-
C:\Users\Admin\AppData\Local\Temp\Stub.exeFilesize
15KB
MD59f0923f8db9e61c4ca6a7163c2ecd35c
SHA1809f07b4102589adda53341606d470e01d2b1562
SHA25661e333deb690adb92183f5bc499a94b550250ee45b3a0246c6a53ce53c7a2ff8
SHA5123a0b4d0b3905d5a1512d48e9e2f4bf9e37eae716ca918b97c9d13ce41b939b48d7271e30d4efe4e36be7b8762dd44ba6a96fd81f0211a66062e3e31bf384e9ad
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
229KB
MD5219ddb633aed74f1b3c429dfcbad1113
SHA1e785be485bf92c416e72dfa75c7771e369870731
SHA2569c3cd12580bd029876f5434999901558750ecde4e9448910afaee570262856d2
SHA512c2f4236ece3d6c4801ee6e68be95a03793fac34d0ca2acd74e743af12858a8938aa8f6db9756d33b4cee5b42e9fdf8ded1e8502e0ccb526b56ea6af49b0eddfe
-
C:\Windows\SysWOW64\dllregedit\regeditregister.exeFilesize
376KB
MD5f97524e05daee70c13e637cc21f1bc91
SHA1d836528896f5cbf0f4f5df064e8ab25d7fc21b42
SHA2567ed27e40a1c0bb6eaabdda3b2a01426a372fdc0d637d7540fbe4afc7fb8ae3cf
SHA512ed35b254381a26951a2517414d39980e8052e66e68b58c0138cb41e1d27df0080a16f9380ded28dbb465cf1499b45ee93b8016a90b70ac591925f1c0e335a1dd
-
C:\Windows\SysWOW64\dllregedit\regeditregister.exeFilesize
376KB
MD5f97524e05daee70c13e637cc21f1bc91
SHA1d836528896f5cbf0f4f5df064e8ab25d7fc21b42
SHA2567ed27e40a1c0bb6eaabdda3b2a01426a372fdc0d637d7540fbe4afc7fb8ae3cf
SHA512ed35b254381a26951a2517414d39980e8052e66e68b58c0138cb41e1d27df0080a16f9380ded28dbb465cf1499b45ee93b8016a90b70ac591925f1c0e335a1dd
-
C:\Windows\SysWOW64\dllregedit\regeditregister.exeFilesize
376KB
MD5f97524e05daee70c13e637cc21f1bc91
SHA1d836528896f5cbf0f4f5df064e8ab25d7fc21b42
SHA2567ed27e40a1c0bb6eaabdda3b2a01426a372fdc0d637d7540fbe4afc7fb8ae3cf
SHA512ed35b254381a26951a2517414d39980e8052e66e68b58c0138cb41e1d27df0080a16f9380ded28dbb465cf1499b45ee93b8016a90b70ac591925f1c0e335a1dd
-
\Users\Admin\AppData\Local\Temp\1.exeFilesize
376KB
MD5f97524e05daee70c13e637cc21f1bc91
SHA1d836528896f5cbf0f4f5df064e8ab25d7fc21b42
SHA2567ed27e40a1c0bb6eaabdda3b2a01426a372fdc0d637d7540fbe4afc7fb8ae3cf
SHA512ed35b254381a26951a2517414d39980e8052e66e68b58c0138cb41e1d27df0080a16f9380ded28dbb465cf1499b45ee93b8016a90b70ac591925f1c0e335a1dd
-
\Users\Admin\AppData\Local\Temp\1.exeFilesize
376KB
MD5f97524e05daee70c13e637cc21f1bc91
SHA1d836528896f5cbf0f4f5df064e8ab25d7fc21b42
SHA2567ed27e40a1c0bb6eaabdda3b2a01426a372fdc0d637d7540fbe4afc7fb8ae3cf
SHA512ed35b254381a26951a2517414d39980e8052e66e68b58c0138cb41e1d27df0080a16f9380ded28dbb465cf1499b45ee93b8016a90b70ac591925f1c0e335a1dd
-
\Windows\SysWOW64\dllregedit\regeditregister.exeFilesize
376KB
MD5f97524e05daee70c13e637cc21f1bc91
SHA1d836528896f5cbf0f4f5df064e8ab25d7fc21b42
SHA2567ed27e40a1c0bb6eaabdda3b2a01426a372fdc0d637d7540fbe4afc7fb8ae3cf
SHA512ed35b254381a26951a2517414d39980e8052e66e68b58c0138cb41e1d27df0080a16f9380ded28dbb465cf1499b45ee93b8016a90b70ac591925f1c0e335a1dd
-
\Windows\SysWOW64\dllregedit\regeditregister.exeFilesize
376KB
MD5f97524e05daee70c13e637cc21f1bc91
SHA1d836528896f5cbf0f4f5df064e8ab25d7fc21b42
SHA2567ed27e40a1c0bb6eaabdda3b2a01426a372fdc0d637d7540fbe4afc7fb8ae3cf
SHA512ed35b254381a26951a2517414d39980e8052e66e68b58c0138cb41e1d27df0080a16f9380ded28dbb465cf1499b45ee93b8016a90b70ac591925f1c0e335a1dd
-
memory/428-130-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/428-112-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/428-128-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/428-104-0x0000000000000000-mapping.dmp
-
memory/1072-61-0x0000000000000000-mapping.dmp
-
memory/1140-65-0x0000000000B26000-0x0000000000B45000-memory.dmpFilesize
124KB
-
memory/1140-64-0x0000000000B26000-0x0000000000B45000-memory.dmpFilesize
124KB
-
memory/1140-60-0x000007FEEDE30000-0x000007FEEEEC6000-memory.dmpFilesize
16.6MB
-
memory/1140-59-0x000007FEF28F0000-0x000007FEF3313000-memory.dmpFilesize
10.1MB
-
memory/1140-56-0x0000000000000000-mapping.dmp
-
memory/1148-54-0x000007FEF28F0000-0x000007FEF3313000-memory.dmpFilesize
10.1MB
-
memory/1148-116-0x0000000000000000-mapping.dmp
-
memory/1148-63-0x00000000007E6000-0x0000000000805000-memory.dmpFilesize
124KB
-
memory/1148-55-0x000007FEEDE30000-0x000007FEEEEC6000-memory.dmpFilesize
16.6MB
-
memory/1340-121-0x0000000000455BE0-mapping.dmp
-
memory/1340-125-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1340-126-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1340-127-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1340-129-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1380-83-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/1464-86-0x0000000000000000-mapping.dmp
-
memory/1464-88-0x00000000745F1000-0x00000000745F3000-memory.dmpFilesize
8KB
-
memory/1464-94-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1464-97-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1760-99-0x00000000240F0000-0x0000000024152000-memory.dmpFilesize
392KB
-
memory/1760-113-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1760-89-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1760-107-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/1760-80-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/1760-78-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1760-77-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1760-75-0x0000000074C11000-0x0000000074C13000-memory.dmpFilesize
8KB
-
memory/1760-76-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1760-74-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1760-71-0x0000000000455BE0-mapping.dmp
-
memory/1760-70-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB