Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 12:39
Static task
static1
Behavioral task
behavioral1
Sample
16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe
Resource
win10v2004-20220812-en
General
-
Target
16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe
-
Size
745KB
-
MD5
8175a45a52cc73b7b70b6273002b42ac
-
SHA1
5fcec6b0370fec12f7b1e010953ac8cfa221c2d2
-
SHA256
16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f
-
SHA512
87f88d50b0b7ed7f7cb42cf8de552ebdb98e2eef13c9afa8ed9a3354695659dfc4f0c43755698e999753746ae69d304eb9086275feac29fbcf66e8cd4eb0c94c
-
SSDEEP
12288:MLeFnCkSSTOejcBTKDHkcyYFfKzm+XGkLT5+bDUUZMbV0mLdQ:MaRdOfhS2YFjD6mD7MbVn
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\tmp.exe family_isrstealer C:\Users\Admin\AppData\Local\Temp\tmp.exe family_isrstealer C:\Users\Admin\AppData\Local\Temp\tmp.exe family_isrstealer behavioral2/memory/3448-152-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer C:\Users\Admin\AppData\Local\Temp\tmp.exe family_isrstealer -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\adobe\\file.exe" reg.exe -
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/3792-168-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral2/memory/3792-169-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral2/memory/3792-170-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
Nirsoft 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3792-168-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral2/memory/3792-169-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral2/memory/3792-170-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft -
Executes dropped EXE 4 IoCs
Processes:
tmp.exetmp.exe.exetmp.exepid process 5056 tmp.exe 4980 tmp.exe 3448 .exe 3792 tmp.exe -
Processes:
resource yara_rule behavioral2/memory/4980-145-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4980-148-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4980-150-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4980-154-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/3792-164-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3792-167-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3792-168-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3792-169-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3792-170-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exewscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation wscript.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
tmp.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts tmp.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.exe16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exedescription pid process target process PID 5056 set thread context of 4980 5056 tmp.exe tmp.exe PID 1556 set thread context of 3448 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe .exe PID 5056 set thread context of 3792 5056 tmp.exe tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 324 3448 WerFault.exe .exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2260 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exepid process 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exedescription pid process Token: SeDebugPrivilege 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe Token: 33 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe Token: SeIncBasePriorityPrivilege 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
tmp.exepid process 5056 tmp.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.execmd.exewscript.exetmp.execmd.execmd.exedescription pid process target process PID 1556 wrote to memory of 1432 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe cmd.exe PID 1556 wrote to memory of 1432 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe cmd.exe PID 1556 wrote to memory of 1432 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe cmd.exe PID 1432 wrote to memory of 1896 1432 cmd.exe wscript.exe PID 1432 wrote to memory of 1896 1432 cmd.exe wscript.exe PID 1432 wrote to memory of 1896 1432 cmd.exe wscript.exe PID 1556 wrote to memory of 5056 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe tmp.exe PID 1556 wrote to memory of 5056 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe tmp.exe PID 1556 wrote to memory of 5056 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe tmp.exe PID 1896 wrote to memory of 1376 1896 wscript.exe cmd.exe PID 1896 wrote to memory of 1376 1896 wscript.exe cmd.exe PID 1896 wrote to memory of 1376 1896 wscript.exe cmd.exe PID 5056 wrote to memory of 4980 5056 tmp.exe tmp.exe PID 5056 wrote to memory of 4980 5056 tmp.exe tmp.exe PID 5056 wrote to memory of 4980 5056 tmp.exe tmp.exe PID 5056 wrote to memory of 4980 5056 tmp.exe tmp.exe PID 5056 wrote to memory of 4980 5056 tmp.exe tmp.exe PID 5056 wrote to memory of 4980 5056 tmp.exe tmp.exe PID 5056 wrote to memory of 4980 5056 tmp.exe tmp.exe PID 5056 wrote to memory of 4980 5056 tmp.exe tmp.exe PID 1376 wrote to memory of 4132 1376 cmd.exe reg.exe PID 1376 wrote to memory of 4132 1376 cmd.exe reg.exe PID 1376 wrote to memory of 4132 1376 cmd.exe reg.exe PID 1556 wrote to memory of 3448 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe .exe PID 1556 wrote to memory of 3448 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe .exe PID 1556 wrote to memory of 3448 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe .exe PID 1556 wrote to memory of 3448 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe .exe PID 1556 wrote to memory of 3448 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe .exe PID 1556 wrote to memory of 3448 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe .exe PID 1556 wrote to memory of 3448 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe .exe PID 1556 wrote to memory of 3448 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe .exe PID 1556 wrote to memory of 368 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe cmd.exe PID 1556 wrote to memory of 368 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe cmd.exe PID 1556 wrote to memory of 368 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe cmd.exe PID 1556 wrote to memory of 4156 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe cmd.exe PID 1556 wrote to memory of 4156 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe cmd.exe PID 1556 wrote to memory of 4156 1556 16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe cmd.exe PID 368 wrote to memory of 2260 368 cmd.exe timeout.exe PID 368 wrote to memory of 2260 368 cmd.exe timeout.exe PID 368 wrote to memory of 2260 368 cmd.exe timeout.exe PID 5056 wrote to memory of 3792 5056 tmp.exe tmp.exe PID 5056 wrote to memory of 3792 5056 tmp.exe tmp.exe PID 5056 wrote to memory of 3792 5056 tmp.exe tmp.exe PID 5056 wrote to memory of 3792 5056 tmp.exe tmp.exe PID 5056 wrote to memory of 3792 5056 tmp.exe tmp.exe PID 5056 wrote to memory of 3792 5056 tmp.exe tmp.exe PID 5056 wrote to memory of 3792 5056 tmp.exe tmp.exe PID 5056 wrote to memory of 3792 5056 tmp.exe tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe"C:\Users\Admin\AppData\Local\Temp\16afbfa442d5e729727c81949be86287e95c46cedf0d1c7a86459ec2136f352f.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\f\1.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\f\vbs.vbs" "C:\Users\Admin\AppData\Local\Temp\f\2.bat"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\f\2.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\adobe\file.exe" /f5⤵
- Modifies WinLogon for persistence
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe/scomma "C:\Users\Admin\AppData\Local\Temp\qgyBwQrHY3.ini"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe/scomma "C:\Users\Admin\AppData\Local\Temp\6AS342jjdi.ini"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
-
C:\Users\Admin\AppData\Local\Temp\.exeC:\Users\Admin\AppData\Local\Temp\.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 123⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\adobe\.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 3003⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\adobe\melt.bat2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3448 -ip 34481⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\.exeFilesize
57KB
MD5454501a66ad6e85175a6757573d79f8b
SHA18ca96c61f26a640a5b1b1152d055260b9d43e308
SHA2567fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8
SHA5129dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7
-
C:\Users\Admin\AppData\Local\Temp\adobe\.batFilesize
182B
MD5e64b9484dfca1d19c8075a9be73af203
SHA1136fa2c731bde6c26b129b95547be7a480ca23a9
SHA25641722031d15fd73fb865e55819319e7d7aa7300e9539c882a8df932666bdf400
SHA5128b942c9a57f96c15e744c7ea06f8f08da1373716f135fe8df3a5b4a938f668f2b33ec696d0a9ad3092232be8a74e2c635fc2082283b472aee7498d167c07cbc6
-
C:\Users\Admin\AppData\Local\Temp\adobe\melt.batFilesize
120B
MD55f3506e7ef4b9d240e41647b2acc5b35
SHA1ace8f1a6893f41b92a8f4a5cd8f8352d30ca181e
SHA256f48b57399de545882c4eb7ad41e6aaa68173e80b6698a106c294a5d8372c5ff4
SHA51279c372fd9e80119b6cfebce86e66fc98b801a737009f76aab6408701dc3d3d52f5f8a68aff34dc4a32024bbc2f1eb8d6e9b040ee4aadbea0a50a8becb6fda664
-
C:\Users\Admin\AppData\Local\Temp\f\1.batFilesize
47B
MD5624373df2461660386e47113698fab32
SHA16f920b7128ef24a2e2da251cb1462d49bf275dc8
SHA256e00ac04f41983738840e5ca1d6946e03f23eaa788d0f7eeea6ed992b30900558
SHA512e794d05bd44bce25e877efb1a187af564a9de7f19458f6032f2ca8e8725b9d0c8e42b4c7ceb93e22367c61fd1ce9c8807b03da61982783c4400123f8d6dcdfa3
-
C:\Users\Admin\AppData\Local\Temp\f\2.batFilesize
254B
MD5caad1245c32e7a7bf59f12ab72f05db1
SHA1e8c454df16be7114acbb709426ed30758f90258e
SHA256f9c5705e9a2a0d57fbb337d81117f670fcabdc430f58bc4ecc77ff9113fbcd1c
SHA512a7126579e5cb00d3095ee22632c68c2e54badb8a2cad3b4f756579d45bb43528904a1754011d528b23bdf8c5f66b34161a64d3154c265448cffe34a47ce20bdb
-
C:\Users\Admin\AppData\Local\Temp\f\vbs.vbsFilesize
78B
MD5c578d9653b22800c3eb6b6a51219bbb8
SHA1a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA25620a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA5123ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d
-
C:\Users\Admin\AppData\Local\Temp\qgyBwQrHY3.iniFilesize
5B
MD5d1ea279fb5559c020a1b4137dc4de237
SHA1db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA256fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
SHA512720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
260KB
MD570695c18bb7bda720eb2ca0a2ce63e4d
SHA1ecd001f839c64564e0843a94bee2699c55a233b7
SHA256b5c299b40ad49b5a1f517eee305c1e0aa7a17c6304d66eddd12ef95a4b3c31ea
SHA512edca74cb0e8bffe9219085524fb82d1b1516dff1f296b027e58becbe0439afca584f93f1058f3d8d342a86d6be80ee8c0ad7a87edcdb0e9f101bc82de8187774
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
260KB
MD570695c18bb7bda720eb2ca0a2ce63e4d
SHA1ecd001f839c64564e0843a94bee2699c55a233b7
SHA256b5c299b40ad49b5a1f517eee305c1e0aa7a17c6304d66eddd12ef95a4b3c31ea
SHA512edca74cb0e8bffe9219085524fb82d1b1516dff1f296b027e58becbe0439afca584f93f1058f3d8d342a86d6be80ee8c0ad7a87edcdb0e9f101bc82de8187774
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
260KB
MD570695c18bb7bda720eb2ca0a2ce63e4d
SHA1ecd001f839c64564e0843a94bee2699c55a233b7
SHA256b5c299b40ad49b5a1f517eee305c1e0aa7a17c6304d66eddd12ef95a4b3c31ea
SHA512edca74cb0e8bffe9219085524fb82d1b1516dff1f296b027e58becbe0439afca584f93f1058f3d8d342a86d6be80ee8c0ad7a87edcdb0e9f101bc82de8187774
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
260KB
MD570695c18bb7bda720eb2ca0a2ce63e4d
SHA1ecd001f839c64564e0843a94bee2699c55a233b7
SHA256b5c299b40ad49b5a1f517eee305c1e0aa7a17c6304d66eddd12ef95a4b3c31ea
SHA512edca74cb0e8bffe9219085524fb82d1b1516dff1f296b027e58becbe0439afca584f93f1058f3d8d342a86d6be80ee8c0ad7a87edcdb0e9f101bc82de8187774
-
memory/368-156-0x0000000000000000-mapping.dmp
-
memory/1376-143-0x0000000000000000-mapping.dmp
-
memory/1432-133-0x0000000000000000-mapping.dmp
-
memory/1556-132-0x0000000075310000-0x00000000758C1000-memory.dmpFilesize
5.7MB
-
memory/1556-158-0x0000000075310000-0x00000000758C1000-memory.dmpFilesize
5.7MB
-
memory/1556-155-0x0000000075310000-0x00000000758C1000-memory.dmpFilesize
5.7MB
-
memory/1896-135-0x0000000000000000-mapping.dmp
-
memory/2260-161-0x0000000000000000-mapping.dmp
-
memory/3448-151-0x0000000000000000-mapping.dmp
-
memory/3448-152-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/3792-167-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3792-164-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3792-170-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3792-169-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3792-168-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3792-163-0x0000000000000000-mapping.dmp
-
memory/4132-149-0x0000000000000000-mapping.dmp
-
memory/4156-157-0x0000000000000000-mapping.dmp
-
memory/4980-144-0x0000000000000000-mapping.dmp
-
memory/4980-145-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4980-150-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4980-154-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/4980-148-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/5056-137-0x0000000000000000-mapping.dmp