Analysis
-
max time kernel
242s -
max time network
337s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 07:43
Static task
static1
Behavioral task
behavioral1
Sample
6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exe
Resource
win10v2004-20221111-en
General
-
Target
6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exe
-
Size
595KB
-
MD5
187e823d21f4f97771aaba5317d47470
-
SHA1
df211400139ee9229a364dd78560bcf119057a8f
-
SHA256
6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f
-
SHA512
4d86ba93b158d5e6864485a420e636131a5036b9e06ec376a356b75434303397318749241f80591c6d0c0f502f973908c38d324cf910a87364e70a9409d33f00
-
SSDEEP
12288:ko0ZjcnNr3So4Ybgob0vSZcVm/IMnfiNAKrCVFcHaaq3J:kPZjcnxh4eIvFMIQ6PrCVkaaq5
Malware Config
Extracted
pony
http://orangeisabitch.net16.net/gate.php
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
pndoPx.exepid process 944 pndoPx.exe -
Processes:
resource yara_rule behavioral1/memory/1596-64-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1596-66-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1596-67-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1596-70-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1596-71-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1984-84-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1984-86-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1984-87-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1596-89-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1984-91-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1984-94-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1984-104-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1596-105-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1984-108-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/1960-109-0x0000000000400000-0x000000000041D000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 592 cmd.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs
Processes:
svchost.exesvchost.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts svchost.exe Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts svchost.exe -
Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
Processes:
svchost.exesvchost.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook svchost.exe Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook svchost.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
pndoPx.exesvchost.exedescription pid process target process PID 944 set thread context of 1596 944 pndoPx.exe svchost.exe PID 1596 set thread context of 1984 1596 svchost.exe svchost.exe PID 1596 set thread context of 1960 1596 svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
pndoPx.exesvchost.exepid process 944 pndoPx.exe 944 pndoPx.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe 1596 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svchost.exesvchost.exedescription pid process Token: SeImpersonatePrivilege 1984 svchost.exe Token: SeTcbPrivilege 1984 svchost.exe Token: SeChangeNotifyPrivilege 1984 svchost.exe Token: SeCreateTokenPrivilege 1984 svchost.exe Token: SeBackupPrivilege 1984 svchost.exe Token: SeRestorePrivilege 1984 svchost.exe Token: SeIncreaseQuotaPrivilege 1984 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1984 svchost.exe Token: SeImpersonatePrivilege 1960 svchost.exe Token: SeTcbPrivilege 1960 svchost.exe Token: SeChangeNotifyPrivilege 1960 svchost.exe Token: SeCreateTokenPrivilege 1960 svchost.exe Token: SeBackupPrivilege 1960 svchost.exe Token: SeRestorePrivilege 1960 svchost.exe Token: SeIncreaseQuotaPrivilege 1960 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1960 svchost.exe Token: SeImpersonatePrivilege 1984 svchost.exe Token: SeTcbPrivilege 1984 svchost.exe Token: SeChangeNotifyPrivilege 1984 svchost.exe Token: SeCreateTokenPrivilege 1984 svchost.exe Token: SeBackupPrivilege 1984 svchost.exe Token: SeRestorePrivilege 1984 svchost.exe Token: SeIncreaseQuotaPrivilege 1984 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1984 svchost.exe Token: SeImpersonatePrivilege 1984 svchost.exe Token: SeTcbPrivilege 1984 svchost.exe Token: SeChangeNotifyPrivilege 1984 svchost.exe Token: SeCreateTokenPrivilege 1984 svchost.exe Token: SeBackupPrivilege 1984 svchost.exe Token: SeRestorePrivilege 1984 svchost.exe Token: SeIncreaseQuotaPrivilege 1984 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1984 svchost.exe Token: SeImpersonatePrivilege 1984 svchost.exe Token: SeTcbPrivilege 1984 svchost.exe Token: SeChangeNotifyPrivilege 1984 svchost.exe Token: SeCreateTokenPrivilege 1984 svchost.exe Token: SeBackupPrivilege 1984 svchost.exe Token: SeRestorePrivilege 1984 svchost.exe Token: SeIncreaseQuotaPrivilege 1984 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1984 svchost.exe Token: SeImpersonatePrivilege 1960 svchost.exe Token: SeTcbPrivilege 1960 svchost.exe Token: SeChangeNotifyPrivilege 1960 svchost.exe Token: SeCreateTokenPrivilege 1960 svchost.exe Token: SeBackupPrivilege 1960 svchost.exe Token: SeRestorePrivilege 1960 svchost.exe Token: SeIncreaseQuotaPrivilege 1960 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1960 svchost.exe Token: SeImpersonatePrivilege 1960 svchost.exe Token: SeTcbPrivilege 1960 svchost.exe Token: SeChangeNotifyPrivilege 1960 svchost.exe Token: SeCreateTokenPrivilege 1960 svchost.exe Token: SeBackupPrivilege 1960 svchost.exe Token: SeRestorePrivilege 1960 svchost.exe Token: SeIncreaseQuotaPrivilege 1960 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1960 svchost.exe Token: SeImpersonatePrivilege 1960 svchost.exe Token: SeTcbPrivilege 1960 svchost.exe Token: SeChangeNotifyPrivilege 1960 svchost.exe Token: SeCreateTokenPrivilege 1960 svchost.exe Token: SeBackupPrivilege 1960 svchost.exe Token: SeRestorePrivilege 1960 svchost.exe Token: SeIncreaseQuotaPrivilege 1960 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1960 svchost.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exepid process 1712 6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exe 1712 6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exe 1712 6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exe 1712 6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exepid process 1712 6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exe 1712 6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exe 1712 6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exe 1712 6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svchost.exepid process 1596 svchost.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.execmd.exepndoPx.exesvchost.execmd.exetaskeng.exedescription pid process target process PID 1712 wrote to memory of 592 1712 6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exe cmd.exe PID 1712 wrote to memory of 592 1712 6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exe cmd.exe PID 1712 wrote to memory of 592 1712 6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exe cmd.exe PID 1712 wrote to memory of 592 1712 6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exe cmd.exe PID 592 wrote to memory of 944 592 cmd.exe pndoPx.exe PID 592 wrote to memory of 944 592 cmd.exe pndoPx.exe PID 592 wrote to memory of 944 592 cmd.exe pndoPx.exe PID 592 wrote to memory of 944 592 cmd.exe pndoPx.exe PID 944 wrote to memory of 1596 944 pndoPx.exe svchost.exe PID 944 wrote to memory of 1596 944 pndoPx.exe svchost.exe PID 944 wrote to memory of 1596 944 pndoPx.exe svchost.exe PID 944 wrote to memory of 1596 944 pndoPx.exe svchost.exe PID 944 wrote to memory of 1596 944 pndoPx.exe svchost.exe PID 944 wrote to memory of 1596 944 pndoPx.exe svchost.exe PID 944 wrote to memory of 1596 944 pndoPx.exe svchost.exe PID 944 wrote to memory of 1596 944 pndoPx.exe svchost.exe PID 1596 wrote to memory of 1300 1596 svchost.exe schtasks.exe PID 1596 wrote to memory of 1300 1596 svchost.exe schtasks.exe PID 1596 wrote to memory of 1300 1596 svchost.exe schtasks.exe PID 1596 wrote to memory of 1300 1596 svchost.exe schtasks.exe PID 1596 wrote to memory of 1652 1596 svchost.exe schtasks.exe PID 1596 wrote to memory of 1652 1596 svchost.exe schtasks.exe PID 1596 wrote to memory of 1652 1596 svchost.exe schtasks.exe PID 1596 wrote to memory of 1652 1596 svchost.exe schtasks.exe PID 1596 wrote to memory of 1136 1596 svchost.exe cmd.exe PID 1596 wrote to memory of 1136 1596 svchost.exe cmd.exe PID 1596 wrote to memory of 1136 1596 svchost.exe cmd.exe PID 1596 wrote to memory of 1136 1596 svchost.exe cmd.exe PID 1136 wrote to memory of 2040 1136 cmd.exe icacls.exe PID 1136 wrote to memory of 2040 1136 cmd.exe icacls.exe PID 1136 wrote to memory of 2040 1136 cmd.exe icacls.exe PID 1136 wrote to memory of 2040 1136 cmd.exe icacls.exe PID 1596 wrote to memory of 1984 1596 svchost.exe svchost.exe PID 1596 wrote to memory of 1984 1596 svchost.exe svchost.exe PID 1596 wrote to memory of 1984 1596 svchost.exe svchost.exe PID 1596 wrote to memory of 1984 1596 svchost.exe svchost.exe PID 1596 wrote to memory of 1984 1596 svchost.exe svchost.exe PID 1596 wrote to memory of 1984 1596 svchost.exe svchost.exe PID 1596 wrote to memory of 1984 1596 svchost.exe svchost.exe PID 1596 wrote to memory of 1984 1596 svchost.exe svchost.exe PID 1596 wrote to memory of 1960 1596 svchost.exe svchost.exe PID 1596 wrote to memory of 1960 1596 svchost.exe svchost.exe PID 1596 wrote to memory of 1960 1596 svchost.exe svchost.exe PID 1596 wrote to memory of 1960 1596 svchost.exe svchost.exe PID 1596 wrote to memory of 1960 1596 svchost.exe svchost.exe PID 1596 wrote to memory of 1960 1596 svchost.exe svchost.exe PID 1596 wrote to memory of 1960 1596 svchost.exe svchost.exe PID 1596 wrote to memory of 1960 1596 svchost.exe svchost.exe PID 1016 wrote to memory of 564 1016 taskeng.exe WScript.exe PID 1016 wrote to memory of 564 1016 taskeng.exe WScript.exe PID 1016 wrote to memory of 564 1016 taskeng.exe WScript.exe -
outlook_win_path 1 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exe"C:\Users\Admin\AppData\Local\Temp\6bd85b343bc2343ff626f234b3fd067bb6807503856c90fea0f2916fc5b1ae1f.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\pndoPx.exe DVvUBu2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pndoPx.exeC:\Users\Admin\AppData\Local\Temp\pndoPx.exe DVvUBu3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn WindowsUpdatedvvubu0x84295245⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn WindowsUpdatedvvubu0x8429525 /tr "C:\ProgramData\dvvubu\ekGfyO.vbs" /RL HIGHEST5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c icacls "C:\ProgramData\dvvubu" /deny %username%:F5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\ProgramData\dvvubu" /deny Admin:F6⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"5⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"5⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
-
C:\Windows\system32\taskeng.exetaskeng.exe {211694BA-5662-45EF-84E3-E9C4F0BE84CA} S-1-5-21-1214520366-621468234-4062160515-1000:VDWSWJJD\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exeC:\Windows\System32\WScript.exe "C:\ProgramData\dvvubu\ekGfyO.vbs"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\dvvubu\DVvUBuFilesize
7KB
MD5e69f8f378670b6cc5dcef736f7c9d28a
SHA114e95c3814424dda20c258805ef8d37ba0faaf4f
SHA2560a4c04f3ebcc3821fbf4097070946e673e98b88cb41329a73dff93f05f03034e
SHA5121a7546e6a788924a320b6a06479b9c05ed54f9958f3960ef44359da6774357bb79c612d454c6d67333140a6e53244cef3d133768fc2ff57a9ca4f362c92efcff
-
C:\ProgramData\dvvubu\ekGfyO.vbsFilesize
274B
MD5c16fe837be0a28a31ba66c95deeead72
SHA13a8bcc5f317404041578a267aaee46b9d62b9771
SHA25670760377a257e09f3f549a1d199755fbedd4cc3cff89867374c31e759a8f7075
SHA5121a09fed5757a9bb86e060fe07e8740e24871ce8b158b05cafb124732af4a063eaaee449772a97c05fb948169ae9d9025ccd341c2b6a705ea960adaabaae3d15c
-
C:\ProgramData\dvvubu\pndoPx.exeFilesize
510KB
MD501d151ccd2a75bd713b8ce81d6509eb8
SHA1c751680d504bece45dc84e363e9e976fe77a8eac
SHA256a4d4dbf9e9124dbd055115706f2a2bfc8816b66cc5f52a148602f9fb0203b801
SHA5128d49a4d97ef38fe5c6bb875d3bc387fade75f9a5d06a494b6a8c9d87840aa3d7cd87343e6aad268a27a9a33390bef7cd8e10d8ebe1df9f7d1ba6a68fe844107d
-
C:\ProgramData\dvvubu\qDnAmR.txtFilesize
235KB
MD53ca3ec49e23945af994d0827c7414cad
SHA103136628d74327113a439a26b1a1a2c14dcd3383
SHA256e54ddd16d50cc0e27dab130bc42c8284d01fb46f516bbe60666811f779c8ea50
SHA5121e6bf8bd668fd95cac3c7f2e09b9cf7abff29a5ae70d58d17291e0f00b0d8c883b3df0a1575e754554243f0c227fdb1d64661eab7b7d3a61b44d1287900afe7f
-
C:\Users\Admin\AppData\Local\Temp\DVvUBuFilesize
7KB
MD5e69f8f378670b6cc5dcef736f7c9d28a
SHA114e95c3814424dda20c258805ef8d37ba0faaf4f
SHA2560a4c04f3ebcc3821fbf4097070946e673e98b88cb41329a73dff93f05f03034e
SHA5121a7546e6a788924a320b6a06479b9c05ed54f9958f3960ef44359da6774357bb79c612d454c6d67333140a6e53244cef3d133768fc2ff57a9ca4f362c92efcff
-
C:\Users\Admin\AppData\Local\Temp\pndoPx.exeFilesize
510KB
MD501d151ccd2a75bd713b8ce81d6509eb8
SHA1c751680d504bece45dc84e363e9e976fe77a8eac
SHA256a4d4dbf9e9124dbd055115706f2a2bfc8816b66cc5f52a148602f9fb0203b801
SHA5128d49a4d97ef38fe5c6bb875d3bc387fade75f9a5d06a494b6a8c9d87840aa3d7cd87343e6aad268a27a9a33390bef7cd8e10d8ebe1df9f7d1ba6a68fe844107d
-
C:\Users\Admin\AppData\Local\Temp\pndoPx.exeFilesize
510KB
MD501d151ccd2a75bd713b8ce81d6509eb8
SHA1c751680d504bece45dc84e363e9e976fe77a8eac
SHA256a4d4dbf9e9124dbd055115706f2a2bfc8816b66cc5f52a148602f9fb0203b801
SHA5128d49a4d97ef38fe5c6bb875d3bc387fade75f9a5d06a494b6a8c9d87840aa3d7cd87343e6aad268a27a9a33390bef7cd8e10d8ebe1df9f7d1ba6a68fe844107d
-
C:\Users\Admin\AppData\Local\Temp\qDnAmR.txtFilesize
235KB
MD53ca3ec49e23945af994d0827c7414cad
SHA103136628d74327113a439a26b1a1a2c14dcd3383
SHA256e54ddd16d50cc0e27dab130bc42c8284d01fb46f516bbe60666811f779c8ea50
SHA5121e6bf8bd668fd95cac3c7f2e09b9cf7abff29a5ae70d58d17291e0f00b0d8c883b3df0a1575e754554243f0c227fdb1d64661eab7b7d3a61b44d1287900afe7f
-
\Users\Admin\AppData\Local\Temp\pndoPx.exeFilesize
510KB
MD501d151ccd2a75bd713b8ce81d6509eb8
SHA1c751680d504bece45dc84e363e9e976fe77a8eac
SHA256a4d4dbf9e9124dbd055115706f2a2bfc8816b66cc5f52a148602f9fb0203b801
SHA5128d49a4d97ef38fe5c6bb875d3bc387fade75f9a5d06a494b6a8c9d87840aa3d7cd87343e6aad268a27a9a33390bef7cd8e10d8ebe1df9f7d1ba6a68fe844107d
-
memory/564-107-0x0000000000000000-mapping.dmp
-
memory/592-55-0x0000000000000000-mapping.dmp
-
memory/944-58-0x0000000000000000-mapping.dmp
-
memory/1016-106-0x000007FEFB741000-0x000007FEFB743000-memory.dmpFilesize
8KB
-
memory/1136-77-0x0000000000000000-mapping.dmp
-
memory/1300-75-0x0000000000000000-mapping.dmp
-
memory/1596-70-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1596-71-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1596-89-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1596-63-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1596-68-0x00000000004574F0-mapping.dmp
-
memory/1596-67-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1596-66-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1596-64-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1596-105-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1652-76-0x0000000000000000-mapping.dmp
-
memory/1712-54-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1960-109-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1960-98-0x000000000041AEF0-mapping.dmp
-
memory/1984-88-0x000000000041AEF0-mapping.dmp
-
memory/1984-91-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1984-94-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1984-87-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1984-104-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1984-86-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1984-84-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1984-83-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1984-108-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/2040-78-0x0000000000000000-mapping.dmp