Analysis
-
max time kernel
188s -
max time network
214s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 22:46
Static task
static1
Behavioral task
behavioral1
Sample
19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe
Resource
win7-20221111-en
General
-
Target
19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe
-
Size
269KB
-
MD5
652cff0c8e9559836174208bbc4d30ac
-
SHA1
1d201e2ba05ea77830bb6d309934efd03870e169
-
SHA256
19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768
-
SHA512
1064c866ca2b451dc94d7a609cde8382532ace465150fd4a4205b88ee1e25dc97628bccad0e54a5c6d43d0be00d5aff32be93eeada83f740c4c1528ec6204969
-
SSDEEP
6144:pAsBZEpJNN/wel76jWJqj4/ZTqUpS4G561nv:spJDH6UhmN56hv
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe -
Sets file execution options in registry 2 TTPs 4 IoCs
Processes:
19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ku19oym7cg19w59.exe 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ku19oym7cg19w59.exe\DisableExceptionChainValidation 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "bejeksueo.exe" explorer.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe -
Loads dropped DLL 1 IoCs
Processes:
19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exepid process 1356 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Search 5.3.10 = "\"C:\\ProgramData\\Windows Search 5.3.10\\ku19oym7cg19w59.exe\"" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Search 5.3.10 = "C:\\ProgramData\\Windows Search 5.3.10\\ku19oym7cg19w59.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe -
Processes:
19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exedescription ioc process File created C:\ProgramData\Windows Search 5.3.10\desktop.ini 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe File opened for modification C:\ProgramData\Windows Search 5.3.10\desktop.ini 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
Processes:
19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exeexplorer.exepid process 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exedescription pid process target process PID 1356 set thread context of 472 1356 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exeexplorer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main explorer.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
explorer.exepid process 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exeexplorer.exepid process 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe 1496 explorer.exe 1496 explorer.exe 1496 explorer.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exepid process 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exeexplorer.exedescription pid process Token: SeDebugPrivilege 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe Token: SeRestorePrivilege 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe Token: SeBackupPrivilege 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe Token: SeLoadDriverPrivilege 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe Token: SeCreatePagefilePrivilege 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe Token: SeShutdownPrivilege 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe Token: SeTakeOwnershipPrivilege 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe Token: SeChangeNotifyPrivilege 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe Token: SeCreateTokenPrivilege 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe Token: SeMachineAccountPrivilege 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe Token: SeSecurityPrivilege 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe Token: SeAssignPrimaryTokenPrivilege 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe Token: SeCreateGlobalPrivilege 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe Token: 33 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe Token: SeDebugPrivilege 1496 explorer.exe Token: SeRestorePrivilege 1496 explorer.exe Token: SeBackupPrivilege 1496 explorer.exe Token: SeLoadDriverPrivilege 1496 explorer.exe Token: SeCreatePagefilePrivilege 1496 explorer.exe Token: SeShutdownPrivilege 1496 explorer.exe Token: SeTakeOwnershipPrivilege 1496 explorer.exe Token: SeChangeNotifyPrivilege 1496 explorer.exe Token: SeCreateTokenPrivilege 1496 explorer.exe Token: SeMachineAccountPrivilege 1496 explorer.exe Token: SeSecurityPrivilege 1496 explorer.exe Token: SeAssignPrimaryTokenPrivilege 1496 explorer.exe Token: SeCreateGlobalPrivilege 1496 explorer.exe Token: 33 1496 explorer.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exeexplorer.exedescription pid process target process PID 1356 wrote to memory of 472 1356 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe PID 1356 wrote to memory of 472 1356 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe PID 1356 wrote to memory of 472 1356 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe PID 1356 wrote to memory of 472 1356 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe PID 1356 wrote to memory of 472 1356 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe PID 1356 wrote to memory of 472 1356 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe PID 1356 wrote to memory of 472 1356 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe PID 1356 wrote to memory of 472 1356 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe PID 1356 wrote to memory of 472 1356 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe PID 1356 wrote to memory of 472 1356 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe PID 1356 wrote to memory of 472 1356 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe PID 1356 wrote to memory of 472 1356 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe PID 1356 wrote to memory of 472 1356 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe PID 1356 wrote to memory of 472 1356 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe PID 472 wrote to memory of 1496 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe explorer.exe PID 472 wrote to memory of 1496 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe explorer.exe PID 472 wrote to memory of 1496 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe explorer.exe PID 472 wrote to memory of 1496 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe explorer.exe PID 472 wrote to memory of 1496 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe explorer.exe PID 472 wrote to memory of 1496 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe explorer.exe PID 472 wrote to memory of 1496 472 19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe explorer.exe PID 1496 wrote to memory of 1168 1496 explorer.exe Dwm.exe PID 1496 wrote to memory of 1168 1496 explorer.exe Dwm.exe PID 1496 wrote to memory of 1168 1496 explorer.exe Dwm.exe PID 1496 wrote to memory of 1168 1496 explorer.exe Dwm.exe PID 1496 wrote to memory of 1168 1496 explorer.exe Dwm.exe PID 1496 wrote to memory of 1168 1496 explorer.exe Dwm.exe PID 1496 wrote to memory of 1224 1496 explorer.exe Explorer.EXE PID 1496 wrote to memory of 1224 1496 explorer.exe Explorer.EXE PID 1496 wrote to memory of 1224 1496 explorer.exe Explorer.EXE PID 1496 wrote to memory of 1224 1496 explorer.exe Explorer.EXE PID 1496 wrote to memory of 1224 1496 explorer.exe Explorer.EXE PID 1496 wrote to memory of 1224 1496 explorer.exe Explorer.EXE PID 1496 wrote to memory of 924 1496 explorer.exe DllHost.exe PID 1496 wrote to memory of 924 1496 explorer.exe DllHost.exe PID 1496 wrote to memory of 924 1496 explorer.exe DllHost.exe PID 1496 wrote to memory of 924 1496 explorer.exe DllHost.exe PID 1496 wrote to memory of 924 1496 explorer.exe DllHost.exe PID 1496 wrote to memory of 924 1496 explorer.exe DllHost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe"C:\Users\Admin\AppData\Local\Temp\19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe"C:\Users\Admin\AppData\Local\Temp\19efed081f95e2d54bd2261580c49e4e0a96378e9ef2ffcb69c48600b41a9768.exe"3⤵
- Sets file execution options in registry
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nso2FCA.tmp\jailhouse.dllFilesize
14KB
MD58e81330474a400a1dec632839cd89f74
SHA1ebc3941a2ea60b81dab0856354e71febb320d6b6
SHA256a338454b2181d2ec512837415e703edcd25879c0c8caa2f438b1d8eee2440e42
SHA5129223011bf23d135568c74423f6215c6328b07f7edb597ade8411f019e8b4ebe50aec1512fae1c88a01007fab5897aa332c0f18702fee548986acf3c788189fe9
-
memory/472-70-0x0000000000440000-0x00000000004A0000-memory.dmpFilesize
384KB
-
memory/472-63-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/472-67-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/472-58-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/472-59-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/472-60-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/472-62-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/472-81-0x0000000000440000-0x00000000004A0000-memory.dmpFilesize
384KB
-
memory/472-64-0x00000000004015C6-mapping.dmp
-
memory/472-72-0x0000000000440000-0x00000000004A0000-memory.dmpFilesize
384KB
-
memory/472-57-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/472-56-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/472-66-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/472-73-0x0000000000260000-0x000000000026D000-memory.dmpFilesize
52KB
-
memory/472-74-0x00000000007A0000-0x00000000007AC000-memory.dmpFilesize
48KB
-
memory/472-75-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1224-83-0x0000000002210000-0x0000000002216000-memory.dmpFilesize
24KB
-
memory/1356-54-0x0000000076AE1000-0x0000000076AE3000-memory.dmpFilesize
8KB
-
memory/1496-78-0x0000000075151000-0x0000000075153000-memory.dmpFilesize
8KB
-
memory/1496-79-0x0000000077C10000-0x0000000077D90000-memory.dmpFilesize
1.5MB
-
memory/1496-80-0x00000000000D0000-0x0000000000177000-memory.dmpFilesize
668KB
-
memory/1496-76-0x0000000000000000-mapping.dmp
-
memory/1496-82-0x00000000003B0000-0x00000000003BC000-memory.dmpFilesize
48KB