Analysis
-
max time kernel
159s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 18:23
Static task
static1
Behavioral task
behavioral1
Sample
85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe
Resource
win10v2004-20220812-en
General
-
Target
85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe
-
Size
1.0MB
-
MD5
f57badc10bac48c5b4ac8da6ecd297ea
-
SHA1
dbb74f81c2c2b2d735e42c6d65501cf72aad111b
-
SHA256
85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db
-
SHA512
7b1df820025aeac5d6034e499087823876c23a17beea460d3859b9035374ac4bdee76830c352965014d22a77cbfc6e9541e35e77fbd1e2eae9f166f11a2a8ab1
-
SSDEEP
24576:fnmDRWtd3k1v69CRYwDVyqFYfhPaRV+Qb1OwGT:fnmDSd3jqDAQMhSRV+Qb1Of
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
paymasterall@gmail.com - Password:
qwerty@12
Signatures
-
NirSoft MailPassView 4 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/216-134-0x0000000000000000-mapping.dmp MailPassView behavioral2/memory/216-135-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/216-137-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/216-138-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 5 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/2292-139-0x0000000000000000-mapping.dmp WebBrowserPassView behavioral2/memory/2292-140-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView behavioral2/memory/2292-142-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView behavioral2/memory/2292-143-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView behavioral2/memory/2292-145-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView -
Nirsoft 17 IoCs
Processes:
resource yara_rule behavioral2/memory/216-134-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/216-135-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/216-137-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/216-138-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/2292-139-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/2292-140-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral2/memory/2292-142-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral2/memory/2292-143-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral2/memory/2292-145-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral2/memory/4280-146-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/4280-147-0x0000000000400000-0x0000000000415000-memory.dmp Nirsoft behavioral2/memory/4280-149-0x0000000000400000-0x0000000000415000-memory.dmp Nirsoft behavioral2/memory/4280-151-0x0000000000400000-0x0000000000415000-memory.dmp Nirsoft behavioral2/memory/2916-152-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/2916-153-0x0000000000400000-0x000000000044F000-memory.dmp Nirsoft behavioral2/memory/2916-155-0x0000000000400000-0x000000000044F000-memory.dmp Nirsoft behavioral2/memory/2916-157-0x0000000000400000-0x000000000044F000-memory.dmp Nirsoft -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0vlb4R33cbUV8Ajl = "C:\\Users\\Admin\\AppData\\Roaming\\01AJ8SMGPhzQCi81\\dtEJvlmJhP4E.exe" 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 13 whatismyipaddress.com -
Suspicious use of SetThreadContext 4 IoCs
Processes:
85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exedescription pid process target process PID 4232 set thread context of 216 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 set thread context of 2292 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 set thread context of 4280 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 set thread context of 2916 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exepid process 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exedescription pid process Token: SeDebugPrivilege 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exepid process 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exedescription pid process target process PID 4232 wrote to memory of 216 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 216 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 216 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 216 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 216 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 216 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 216 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 216 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 216 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 2292 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 2292 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 2292 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 2292 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 2292 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 2292 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 2292 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 2292 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 2292 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 4280 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 4280 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 4280 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 4280 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 4280 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 4280 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 4280 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 4280 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 4280 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 2916 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 2916 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 2916 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 2916 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 2916 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 2916 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 2916 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 2916 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe PID 4232 wrote to memory of 2916 4232 85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe"C:\Users\Admin\AppData\Local\Temp\85dfdff027127abd9af70e5478c4741fc868ff759ea65ec89beb4defc47f57db.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"2⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderprodkey.txt"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderskypeview.txt"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\holderprodkey.txtFilesize
725B
MD5d7935a7a5bb8d5ba5f974dfef505ecc0
SHA19295374333edb25176fb7627d4e324c2b394d769
SHA25633a269eeaeb0e29ddc3b9f69020cef11cf30e0d0039abda20ed274651b0be718
SHA512f7529d172482230636e7b1994b7d86fe593f5e615c9973059d540c6b35811cbbee56c76cefe0f856a87026823d913af0628abef6d75e8de5f85b60a993b40b45
-
C:\Users\Admin\AppData\Local\Temp\holderskypeview.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
memory/216-135-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/216-137-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/216-138-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/216-134-0x0000000000000000-mapping.dmp
-
memory/2292-140-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/2292-139-0x0000000000000000-mapping.dmp
-
memory/2292-143-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/2292-142-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/2292-145-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/2916-152-0x0000000000000000-mapping.dmp
-
memory/2916-153-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/2916-155-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/2916-157-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4232-132-0x0000000074880000-0x0000000074E31000-memory.dmpFilesize
5.7MB
-
memory/4232-133-0x0000000074880000-0x0000000074E31000-memory.dmpFilesize
5.7MB
-
memory/4280-147-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/4280-149-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/4280-146-0x0000000000000000-mapping.dmp
-
memory/4280-151-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB