Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 07:50
Static task
static1
Behavioral task
behavioral1
Sample
8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe
Resource
win10v2004-20221111-en
General
-
Target
8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe
-
Size
562KB
-
MD5
898ef852ab68d02e36300b2e07e696fe
-
SHA1
564e18049c7962e6f9640ac30eebd9906651432d
-
SHA256
8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25
-
SHA512
43d278784d2cbb7a0ce34e1b1023e2acc9da6d78cfa361fb126bd62edbb919b8e7a2e1a374a8631a9e16bd60d2fe91c38289cc05ebe0fa8e96dff0cb2f17bc89
-
SSDEEP
12288:4My9E1SnPKqz35dxs50H3yLs7C109Zoir1FkGsrsKfCEvHom+K/RHekSF5G2:4MUrX35dWmYmzuir1FGsMCvm7HG53
Malware Config
Signatures
-
NirSoft MailPassView 11 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1532-67-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1532-70-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1532-72-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1532-74-0x000000000047F00E-mapping.dmp MailPassView behavioral1/memory/1532-78-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1532-76-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/808-84-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/808-83-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/808-87-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/808-89-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/808-90-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 11 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1532-67-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1532-70-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1532-72-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1532-74-0x000000000047F00E-mapping.dmp WebBrowserPassView behavioral1/memory/1532-78-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1532-76-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1620-91-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1620-92-0x0000000000442628-mapping.dmp WebBrowserPassView behavioral1/memory/1620-95-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1620-96-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1620-98-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 16 IoCs
Processes:
resource yara_rule behavioral1/memory/1532-67-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1532-70-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1532-72-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1532-74-0x000000000047F00E-mapping.dmp Nirsoft behavioral1/memory/1532-78-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1532-76-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/808-84-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/808-83-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/808-87-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/808-89-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/808-90-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1620-91-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1620-92-0x0000000000442628-mapping.dmp Nirsoft behavioral1/memory/1620-95-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1620-96-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1620-98-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exereg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YoRlOTlf.exe" 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\YoRlOTlf.exe" reg.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 whatismyipaddress.com 8 whatismyipaddress.com 9 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exedescription pid process target process PID 2040 set thread context of 1532 2040 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe PID 1532 set thread context of 808 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 set thread context of 1620 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exepid process 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exedescription pid process Token: SeDebugPrivilege 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exepid process 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.execsc.execmd.exe8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exedescription pid process target process PID 2040 wrote to memory of 572 2040 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe csc.exe PID 2040 wrote to memory of 572 2040 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe csc.exe PID 2040 wrote to memory of 572 2040 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe csc.exe PID 2040 wrote to memory of 572 2040 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe csc.exe PID 572 wrote to memory of 1172 572 csc.exe cvtres.exe PID 572 wrote to memory of 1172 572 csc.exe cvtres.exe PID 572 wrote to memory of 1172 572 csc.exe cvtres.exe PID 572 wrote to memory of 1172 572 csc.exe cvtres.exe PID 2040 wrote to memory of 1532 2040 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe PID 2040 wrote to memory of 1532 2040 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe PID 2040 wrote to memory of 1532 2040 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe PID 2040 wrote to memory of 1532 2040 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe PID 2040 wrote to memory of 1532 2040 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe PID 2040 wrote to memory of 1532 2040 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe PID 2040 wrote to memory of 1532 2040 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe PID 2040 wrote to memory of 1532 2040 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe PID 2040 wrote to memory of 1532 2040 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe PID 2040 wrote to memory of 1700 2040 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe cmd.exe PID 2040 wrote to memory of 1700 2040 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe cmd.exe PID 2040 wrote to memory of 1700 2040 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe cmd.exe PID 2040 wrote to memory of 1700 2040 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe cmd.exe PID 1700 wrote to memory of 1128 1700 cmd.exe reg.exe PID 1700 wrote to memory of 1128 1700 cmd.exe reg.exe PID 1700 wrote to memory of 1128 1700 cmd.exe reg.exe PID 1700 wrote to memory of 1128 1700 cmd.exe reg.exe PID 1532 wrote to memory of 808 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 808 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 808 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 808 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 808 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 808 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 808 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 808 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 808 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 808 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 1620 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 1620 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 1620 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 1620 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 1620 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 1620 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 1620 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 1620 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 1620 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe PID 1532 wrote to memory of 1620 1532 8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe"C:\Users\Admin\AppData\Local\Temp\8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bwbom_sm.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6692.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6681.tmp"3⤵
-
C:\Users\Admin\AppData\Local\Temp\8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe"C:\Users\Admin\AppData\Local\Temp\8bbc573a3e24a5fb911e862638759a1dd1120b8cda5986ada98f92faac1a5f25.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YoRlOTlf.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\YoRlOTlf.exe3⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RES6692.tmpFilesize
1KB
MD5cfec1a0274d38ce454d4e8089ee9414b
SHA1991b0b3bced1df843802d0e98d648187e1a75add
SHA2569704b9a897f20a7fa394e65b74a4fa956fceb9de49e514454af910ec1bd380ca
SHA5126c19aa137954f4f87af8ca48052c4f9c8198e0bdd27966429618ac4325171d150624256340ac8ccf093c64985be61c72a7de452081a24da7f0ae9624b50c1db3
-
C:\Users\Admin\AppData\Local\Temp\bwbom_sm.dllFilesize
1.1MB
MD530a0dbe058d74bc96f13dbabf22895d9
SHA1eb837ff830b1d0e4f0926e46a29ee752746065b8
SHA2562862d54f381aab158e83c56e5aced48dc248e03ae7244d5fd368a058f5de59fa
SHA512bc6fc9f82523ca96e86db2fab77cf36463dd832de9e6ac3d6335e949853198511f74e7fd273ef524070782a3f0f8f67bde4b0a2d9c0b52f61ca51bc7e7bb7650
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
\??\c:\Users\Admin\AppData\Local\Temp\CSC6681.tmpFilesize
652B
MD54db4e737db24411fb66e9d7b4df79a5b
SHA1ae82fd485125ecc496b2d107414593b733ff7862
SHA256ae1ad175c33b107cc0c64cae1b43026fc08e19760fae019ead905ef4cc3844ed
SHA512d74fd70d7bc5ba934f40a2587c89b1601f67fb1cb2e0439d591bd34ec998546e89b5bbc5101756efc9101c6da9b8864cc73478ab62e950ccdc7b7aebee8b5d86
-
\??\c:\Users\Admin\AppData\Local\Temp\bwbom_sm.cmdlineFilesize
195B
MD5e752b63e8d59b1fb03d0ec4ae8011e67
SHA13d4aacb927553dd17d29cda6b6f53ed4f0d5d005
SHA256b8f661592d1a89c04990435eb22fbe3a69a4a84c7a4c2112bcdca54974e4dcc3
SHA5129616f2d7552ab1076173795570f850768acc88c2b6ad2cad63d4630e7c7c90ae744b40fdb1325915dd13097c0c69950533a5accd2c246ba902b2e075cc8d7d36
-
\??\c:\Users\Admin\AppData\Local\Temp\tmpA04.tmp.txtFilesize
551KB
MD501082166169ab352b62b7dfe5e40ce37
SHA1cf3cf6bf578afabb77f5f53960a6adebd6f9f37c
SHA256f5d003a70496052da6a8ae94c2a5da2f1ceced0ba0208f7db451a1ccc1dd6ca5
SHA5124838105ebb3a92ee02488da8abd5add8a9da108d57a3ee593562ad0766337db776860cf05d0085138dbdcedf5dd5b3372fa8a80b588384bed1caf82f315eb050
-
memory/572-57-0x0000000000000000-mapping.dmp
-
memory/808-90-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/808-89-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/808-87-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/808-83-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/808-84-0x0000000000411654-mapping.dmp
-
memory/1128-81-0x0000000000000000-mapping.dmp
-
memory/1172-60-0x0000000000000000-mapping.dmp
-
memory/1532-78-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1532-65-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1532-64-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1532-76-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1532-88-0x0000000074E00000-0x00000000753AB000-memory.dmpFilesize
5.7MB
-
memory/1532-72-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1532-82-0x0000000074E00000-0x00000000753AB000-memory.dmpFilesize
5.7MB
-
memory/1532-70-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1532-67-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1532-74-0x000000000047F00E-mapping.dmp
-
memory/1620-91-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1620-92-0x0000000000442628-mapping.dmp
-
memory/1620-95-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1620-96-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1620-98-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1700-80-0x0000000000000000-mapping.dmp
-
memory/2040-54-0x00000000760D1000-0x00000000760D3000-memory.dmpFilesize
8KB
-
memory/2040-56-0x0000000074E00000-0x00000000753AB000-memory.dmpFilesize
5.7MB
-
memory/2040-55-0x0000000074E00000-0x00000000753AB000-memory.dmpFilesize
5.7MB