Analysis
-
max time kernel
152s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 14:59
Static task
static1
Behavioral task
behavioral1
Sample
63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe
Resource
win10v2004-20221111-en
General
-
Target
63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe
-
Size
1016KB
-
MD5
4fcf858d501c24cdb9b14dadc906f5c2
-
SHA1
d5cf9a07cbc8d1640db4a3d0cfcf6c38905ee104
-
SHA256
63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868
-
SHA512
704a32765906226c442074c36159756d11db0020d407ca5b2c61f8b01926dd9c46919531450c9593c5bdfb10c269dfef4e8ff2c00ecf8e5f9432aacfba632878
-
SSDEEP
24576:5yXqa5T1mYh3HZbalXpaQTJUOcsNQwIkWpD13q4UQ+dU:EBTfHZmlXpewQwIkWr3q41+d
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.execsrss.exepid process 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe 1636 csrss.exe -
Loads dropped DLL 3 IoCs
Processes:
63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exepid process 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 whatismyipaddress.com 5 whatismyipaddress.com 6 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exedescription pid process target process PID 1672 set thread context of 1716 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe PID 1716 set thread context of 768 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 set thread context of 1524 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 3 IoCs
Processes:
cmd.exe63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe:ZONE.identifier cmd.exe File created C:\Users\Admin\AppData\Local\Temp\csrss.exe\:ZONE.identifier:$DATA 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe File created C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe\:ZONE.identifier:$DATA 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
csrss.exe63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exepid process 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe 1636 csrss.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
csrss.exe63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exevbc.exevbc.exedescription pid process Token: SeDebugPrivilege 1636 csrss.exe Token: SeDebugPrivilege 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe Token: SeDebugPrivilege 768 vbc.exe Token: SeDebugPrivilege 1524 vbc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exepid process 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exedescription pid process target process PID 1672 wrote to memory of 1868 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe cmd.exe PID 1672 wrote to memory of 1868 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe cmd.exe PID 1672 wrote to memory of 1868 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe cmd.exe PID 1672 wrote to memory of 1868 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe cmd.exe PID 1672 wrote to memory of 1716 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe PID 1672 wrote to memory of 1716 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe PID 1672 wrote to memory of 1716 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe PID 1672 wrote to memory of 1716 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe PID 1672 wrote to memory of 1716 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe PID 1672 wrote to memory of 1716 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe PID 1672 wrote to memory of 1716 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe PID 1672 wrote to memory of 1716 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe PID 1672 wrote to memory of 1716 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe PID 1672 wrote to memory of 1636 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe csrss.exe PID 1672 wrote to memory of 1636 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe csrss.exe PID 1672 wrote to memory of 1636 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe csrss.exe PID 1672 wrote to memory of 1636 1672 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe csrss.exe PID 1716 wrote to memory of 768 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 768 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 768 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 768 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 768 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 768 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 768 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 768 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 768 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 768 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 1524 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 1524 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 1524 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 1524 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 1524 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 1524 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 1524 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 1524 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 1524 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe PID 1716 wrote to memory of 1524 1716 63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe"C:\Users\Admin\AppData\Local\Temp\63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\Users\Admin\AppData\Local\Temp\63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe":ZONE.identifier & exit2⤵
- NTFS ADS
-
C:\Users\Admin\AppData\Local\Temp\63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe"C:\Users\Admin\AppData\Local\Temp\63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss.exe"C:\Users\Admin\AppData\Local\Temp\csrss.exe" -proc 1716 C:\Users\Admin\AppData\Local\Temp\63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exeFilesize
1016KB
MD54fcf858d501c24cdb9b14dadc906f5c2
SHA1d5cf9a07cbc8d1640db4a3d0cfcf6c38905ee104
SHA25663f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868
SHA512704a32765906226c442074c36159756d11db0020d407ca5b2c61f8b01926dd9c46919531450c9593c5bdfb10c269dfef4e8ff2c00ecf8e5f9432aacfba632878
-
C:\Users\Admin\AppData\Local\Temp\63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exeFilesize
1016KB
MD54fcf858d501c24cdb9b14dadc906f5c2
SHA1d5cf9a07cbc8d1640db4a3d0cfcf6c38905ee104
SHA25663f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868
SHA512704a32765906226c442074c36159756d11db0020d407ca5b2c61f8b01926dd9c46919531450c9593c5bdfb10c269dfef4e8ff2c00ecf8e5f9432aacfba632878
-
C:\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
1016KB
MD54fcf858d501c24cdb9b14dadc906f5c2
SHA1d5cf9a07cbc8d1640db4a3d0cfcf6c38905ee104
SHA25663f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868
SHA512704a32765906226c442074c36159756d11db0020d407ca5b2c61f8b01926dd9c46919531450c9593c5bdfb10c269dfef4e8ff2c00ecf8e5f9432aacfba632878
-
C:\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
1016KB
MD54fcf858d501c24cdb9b14dadc906f5c2
SHA1d5cf9a07cbc8d1640db4a3d0cfcf6c38905ee104
SHA25663f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868
SHA512704a32765906226c442074c36159756d11db0020d407ca5b2c61f8b01926dd9c46919531450c9593c5bdfb10c269dfef4e8ff2c00ecf8e5f9432aacfba632878
-
C:\Users\Admin\AppData\Local\Temp\holdermail.txtFilesize
346B
MD5bb9abd3bb64d59d1d53c31e692393855
SHA18cd1fc197abb980d1f0e762c53cd49cc9a7d4abf
SHA256c6aad7f9a9d0f9a3ee369074c014d01b20c3088c1cfebb7f07bd405d175cbcb2
SHA5120dcafab20d0b7ebbd5057cbb6119566e1ed6d124bdd999cacdd00641193dc93033b9d066e13a9e40ba29ab973ebbbe2303e7eaa9b1a6a85aa2a0d56c863c112d
-
C:\Users\Admin\AppData\Local\Temp\holdermail.txtFilesize
327B
MD5e4f3273432f9167e5f8bd2048206773d
SHA1139b6566c6f8c6a359dd7e6063f88be24f701c8d
SHA256b620b529c43ed1dab8db9c63b402958e1a0b65c9110029b92ac8ae2c21c0acb2
SHA512e1bf722b627cd5f1e1678549d51f9556a1d31c8e5f47dfbe343c81aef7bac279ca2b062751666d650b2c196785a84b0d2edca09d1a04b829f4ae869e513e6941
-
\Users\Admin\AppData\Local\Temp\63f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868.exeFilesize
1016KB
MD54fcf858d501c24cdb9b14dadc906f5c2
SHA1d5cf9a07cbc8d1640db4a3d0cfcf6c38905ee104
SHA25663f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868
SHA512704a32765906226c442074c36159756d11db0020d407ca5b2c61f8b01926dd9c46919531450c9593c5bdfb10c269dfef4e8ff2c00ecf8e5f9432aacfba632878
-
\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
1016KB
MD54fcf858d501c24cdb9b14dadc906f5c2
SHA1d5cf9a07cbc8d1640db4a3d0cfcf6c38905ee104
SHA25663f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868
SHA512704a32765906226c442074c36159756d11db0020d407ca5b2c61f8b01926dd9c46919531450c9593c5bdfb10c269dfef4e8ff2c00ecf8e5f9432aacfba632878
-
\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
1016KB
MD54fcf858d501c24cdb9b14dadc906f5c2
SHA1d5cf9a07cbc8d1640db4a3d0cfcf6c38905ee104
SHA25663f204b8435481126056af777f85462f0bdc4f5c40c850eeba1df60e56ab7868
SHA512704a32765906226c442074c36159756d11db0020d407ca5b2c61f8b01926dd9c46919531450c9593c5bdfb10c269dfef4e8ff2c00ecf8e5f9432aacfba632878
-
memory/768-98-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/768-100-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/768-94-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/768-88-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/768-90-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/768-92-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/768-87-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/768-102-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/768-96-0x000000000040582F-mapping.dmp
-
memory/768-95-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1524-110-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/1524-117-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/1524-115-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/1524-112-0x0000000000442872-mapping.dmp
-
memory/1524-111-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/1524-108-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/1524-103-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/1524-104-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/1524-106-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/1636-85-0x00000000744F0000-0x0000000074A9B000-memory.dmpFilesize
5.7MB
-
memory/1636-78-0x0000000000000000-mapping.dmp
-
memory/1636-83-0x00000000744F0000-0x0000000074A9B000-memory.dmpFilesize
5.7MB
-
memory/1672-82-0x00000000744F0000-0x0000000074A9B000-memory.dmpFilesize
5.7MB
-
memory/1672-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmpFilesize
8KB
-
memory/1672-55-0x00000000744F0000-0x0000000074A9B000-memory.dmpFilesize
5.7MB
-
memory/1716-72-0x0000000000400000-0x000000000049C000-memory.dmpFilesize
624KB
-
memory/1716-99-0x0000000000D05000-0x0000000000D16000-memory.dmpFilesize
68KB
-
memory/1716-74-0x0000000000400000-0x000000000049C000-memory.dmpFilesize
624KB
-
memory/1716-86-0x00000000744F0000-0x0000000074A9B000-memory.dmpFilesize
5.7MB
-
memory/1716-69-0x0000000000494F8E-mapping.dmp
-
memory/1716-67-0x0000000000400000-0x000000000049C000-memory.dmpFilesize
624KB
-
memory/1716-65-0x0000000000400000-0x000000000049C000-memory.dmpFilesize
624KB
-
memory/1716-62-0x0000000000400000-0x000000000049C000-memory.dmpFilesize
624KB
-
memory/1716-60-0x0000000000400000-0x000000000049C000-memory.dmpFilesize
624KB
-
memory/1716-59-0x0000000000400000-0x000000000049C000-memory.dmpFilesize
624KB
-
memory/1716-84-0x00000000744F0000-0x0000000074A9B000-memory.dmpFilesize
5.7MB
-
memory/1716-118-0x0000000000D05000-0x0000000000D16000-memory.dmpFilesize
68KB
-
memory/1868-56-0x0000000000000000-mapping.dmp