Analysis
-
max time kernel
136s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 18:24
Static task
static1
Behavioral task
behavioral1
Sample
c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe
Resource
win7-20220901-en
General
-
Target
c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe
-
Size
732KB
-
MD5
afa375e9ac70825064232b450f7842fb
-
SHA1
39da0f8088e1dc0f182af9acc11b1a208923f0b7
-
SHA256
c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0
-
SHA512
4fc96765ac09838703f50462cc22d8990ab38af336d636d7ba541244bf28ca443bf004ea8727fa08a6b0dfcddae0dffeb8f730a6fa7cc277ccb143a3cf241586
-
SSDEEP
12288:DAabfioeBJ3bChfWLMpiwcQmUMv/SajBCJNwcCq/mvB8pdm+DFETxP9:11y3uhf1m3nNjBkwcCq/hdD8P9
Malware Config
Signatures
-
NirSoft MailPassView 12 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/892-59-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/892-62-0x000000000047EA9E-mapping.dmp MailPassView behavioral1/memory/892-64-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/892-66-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/892-61-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/892-60-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral1/memory/1172-82-0x000000000047EA9E-mapping.dmp MailPassView behavioral1/memory/1928-91-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1928-92-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/1928-95-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1928-97-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1928-98-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 12 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/892-59-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/892-62-0x000000000047EA9E-mapping.dmp WebBrowserPassView behavioral1/memory/892-64-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/892-66-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/892-61-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/892-60-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral1/memory/1172-82-0x000000000047EA9E-mapping.dmp WebBrowserPassView behavioral1/memory/1280-112-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1280-113-0x0000000000442628-mapping.dmp WebBrowserPassView behavioral1/memory/1280-116-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1280-117-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1280-119-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 17 IoCs
Processes:
resource yara_rule behavioral1/memory/892-59-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/892-62-0x000000000047EA9E-mapping.dmp Nirsoft behavioral1/memory/892-64-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/892-66-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/892-61-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/892-60-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral1/memory/1172-82-0x000000000047EA9E-mapping.dmp Nirsoft behavioral1/memory/1928-91-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1928-92-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/1928-95-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1928-97-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1928-98-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1280-112-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1280-113-0x0000000000442628-mapping.dmp Nirsoft behavioral1/memory/1280-116-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1280-117-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1280-119-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Executes dropped EXE 1 IoCs
Processes:
Windows Update.exepid process 904 Windows Update.exe -
Loads dropped DLL 1 IoCs
Processes:
RegSvcs.exepid process 892 RegSvcs.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" RegSvcs.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 whatismyipaddress.com 5 whatismyipaddress.com 6 whatismyipaddress.com -
Suspicious use of SetThreadContext 5 IoCs
Processes:
c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exeRegSvcs.exedescription pid process target process PID 1308 set thread context of 892 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 set thread context of 1172 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1172 set thread context of 1928 1172 RegSvcs.exe vbc.exe PID 1308 set thread context of 1148 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1172 set thread context of 1280 1172 RegSvcs.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exeRegSvcs.exepid process 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe 1172 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe Token: SeDebugPrivilege 1172 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1172 RegSvcs.exe -
Suspicious use of WriteProcessMemory 63 IoCs
Processes:
c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exeRegSvcs.exeRegSvcs.exedescription pid process target process PID 1308 wrote to memory of 892 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 892 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 892 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 892 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 892 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 892 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 892 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 892 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 892 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 892 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 892 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 892 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 892 wrote to memory of 904 892 RegSvcs.exe Windows Update.exe PID 892 wrote to memory of 904 892 RegSvcs.exe Windows Update.exe PID 892 wrote to memory of 904 892 RegSvcs.exe Windows Update.exe PID 892 wrote to memory of 904 892 RegSvcs.exe Windows Update.exe PID 892 wrote to memory of 904 892 RegSvcs.exe Windows Update.exe PID 892 wrote to memory of 904 892 RegSvcs.exe Windows Update.exe PID 892 wrote to memory of 904 892 RegSvcs.exe Windows Update.exe PID 1308 wrote to memory of 1172 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1172 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1172 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1172 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1172 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1172 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1172 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1172 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1172 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1172 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1172 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1172 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1172 wrote to memory of 1928 1172 RegSvcs.exe vbc.exe PID 1172 wrote to memory of 1928 1172 RegSvcs.exe vbc.exe PID 1172 wrote to memory of 1928 1172 RegSvcs.exe vbc.exe PID 1172 wrote to memory of 1928 1172 RegSvcs.exe vbc.exe PID 1172 wrote to memory of 1928 1172 RegSvcs.exe vbc.exe PID 1172 wrote to memory of 1928 1172 RegSvcs.exe vbc.exe PID 1172 wrote to memory of 1928 1172 RegSvcs.exe vbc.exe PID 1172 wrote to memory of 1928 1172 RegSvcs.exe vbc.exe PID 1172 wrote to memory of 1928 1172 RegSvcs.exe vbc.exe PID 1172 wrote to memory of 1928 1172 RegSvcs.exe vbc.exe PID 1308 wrote to memory of 1148 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1148 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1148 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1148 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1148 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1148 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1148 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1148 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1148 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1148 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1148 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1308 wrote to memory of 1148 1308 c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe RegSvcs.exe PID 1172 wrote to memory of 1280 1172 RegSvcs.exe vbc.exe PID 1172 wrote to memory of 1280 1172 RegSvcs.exe vbc.exe PID 1172 wrote to memory of 1280 1172 RegSvcs.exe vbc.exe PID 1172 wrote to memory of 1280 1172 RegSvcs.exe vbc.exe PID 1172 wrote to memory of 1280 1172 RegSvcs.exe vbc.exe PID 1172 wrote to memory of 1280 1172 RegSvcs.exe vbc.exe PID 1172 wrote to memory of 1280 1172 RegSvcs.exe vbc.exe PID 1172 wrote to memory of 1280 1172 RegSvcs.exe vbc.exe PID 1172 wrote to memory of 1280 1172 RegSvcs.exe vbc.exe PID 1172 wrote to memory of 1280 1172 RegSvcs.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe"C:\Users\Admin\AppData\Local\Temp\c14608ff1f941233ce40b6315883c297c40301643ccef1b36ee25cf1d27438b0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"3⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" /O1kFkwnM /C:\Users\Admin\AppData\Roaming\O1kFkwnM\O1kFkwnM.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SysInfo.txtFilesize
57B
MD5d685103573539b7e9fdbf5f1d7dd96ce
SHA14b2fe6b5c0b37954b314fcaee1f12237a9b02d07
SHA256d78bc23b0ca3eddf52d56ab85cdc30a71b3756569cb32aa2f6c28dbc23c76e8e
SHA51217769a5944e8929323a34269abeef0861d5c6799b0a27f5545fbfadc80e5ab684a471ad6f6a7fc623002385154ea89de94013051e09120ab94362e542ab0f1dd
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
32KB
MD5d79f070423fdd3f01ce8c2ba3fbbc8ed
SHA12f8ed26eb714b4efbe5d7a3167e33ade82c51fd8
SHA25697bd627ebfc4d40b21ebaaed916a1ba53859520edc99537b37d042a0d5425a5a
SHA51247bdc8cce5cd308053d9429a512924448e65023d154b798668d1ee8f628c1b548651e968e7c03db4a6770705f382b9e96db246c39f838000924985b53ccaa3db
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
32KB
MD5d79f070423fdd3f01ce8c2ba3fbbc8ed
SHA12f8ed26eb714b4efbe5d7a3167e33ade82c51fd8
SHA25697bd627ebfc4d40b21ebaaed916a1ba53859520edc99537b37d042a0d5425a5a
SHA51247bdc8cce5cd308053d9429a512924448e65023d154b798668d1ee8f628c1b548651e968e7c03db4a6770705f382b9e96db246c39f838000924985b53ccaa3db
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
32KB
MD5d79f070423fdd3f01ce8c2ba3fbbc8ed
SHA12f8ed26eb714b4efbe5d7a3167e33ade82c51fd8
SHA25697bd627ebfc4d40b21ebaaed916a1ba53859520edc99537b37d042a0d5425a5a
SHA51247bdc8cce5cd308053d9429a512924448e65023d154b798668d1ee8f628c1b548651e968e7c03db4a6770705f382b9e96db246c39f838000924985b53ccaa3db
-
memory/892-61-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/892-64-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/892-66-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/892-62-0x000000000047EA9E-mapping.dmp
-
memory/892-60-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/892-68-0x0000000074180000-0x000000007472B000-memory.dmpFilesize
5.7MB
-
memory/892-59-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/892-74-0x0000000074180000-0x000000007472B000-memory.dmpFilesize
5.7MB
-
memory/892-57-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/892-56-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/904-70-0x0000000000000000-mapping.dmp
-
memory/904-75-0x0000000074180000-0x000000007472B000-memory.dmpFilesize
5.7MB
-
memory/1148-109-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1148-100-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1148-121-0x0000000074180000-0x000000007472B000-memory.dmpFilesize
5.7MB
-
memory/1148-111-0x0000000074180000-0x000000007472B000-memory.dmpFilesize
5.7MB
-
memory/1148-107-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1148-104-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1148-105-0x00000000004026FA-mapping.dmp
-
memory/1148-102-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1148-101-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1172-96-0x0000000000D06000-0x0000000000D17000-memory.dmpFilesize
68KB
-
memory/1172-89-0x0000000074180000-0x000000007472B000-memory.dmpFilesize
5.7MB
-
memory/1172-120-0x0000000000D06000-0x0000000000D17000-memory.dmpFilesize
68KB
-
memory/1172-82-0x000000000047EA9E-mapping.dmp
-
memory/1172-99-0x0000000074180000-0x000000007472B000-memory.dmpFilesize
5.7MB
-
memory/1280-112-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1280-119-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1280-117-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1280-116-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1280-113-0x0000000000442628-mapping.dmp
-
memory/1308-90-0x0000000074180000-0x000000007472B000-memory.dmpFilesize
5.7MB
-
memory/1308-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmpFilesize
8KB
-
memory/1308-55-0x0000000074180000-0x000000007472B000-memory.dmpFilesize
5.7MB
-
memory/1928-91-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1928-92-0x0000000000411654-mapping.dmp
-
memory/1928-95-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1928-97-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1928-98-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB