Analysis
-
max time kernel
129s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 17:19
Static task
static1
Behavioral task
behavioral1
Sample
f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe
Resource
win7-20220812-en
General
-
Target
f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe
-
Size
818KB
-
MD5
6062dc511ee11c084d877c618b6f637e
-
SHA1
e26c5ec4e5998664fdc76b53328edba1ae68dd9c
-
SHA256
f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986
-
SHA512
9047075cbd1cd82e177daa56c187bc8b4a61a21c0c9cd13f2538e7630aef55a270a7852c063f4264dd6dcb73718f8a914eed05a0916404702107a5ce890b7cfd
-
SSDEEP
12288:R8zibupKhPNNIyREr8N4fl59u9CXBLBCi34bK:uWYwHyPl5HXBLCbK
Malware Config
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
kennedey.isaac@yandex.com - Password:
jozo2018
Signatures
-
NirSoft MailPassView 9 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1456-66-0x0000000002660000-0x00000000026F0000-memory.dmp MailPassView behavioral1/memory/1456-69-0x00000000775C0000-0x0000000077740000-memory.dmp MailPassView behavioral1/memory/1220-98-0x0000000006840000-0x00000000068D0000-memory.dmp MailPassView behavioral1/memory/1220-100-0x00000000775C0000-0x0000000077740000-memory.dmp MailPassView behavioral1/memory/1904-106-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1904-107-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/1904-111-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1904-115-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1904-117-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 8 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1456-66-0x0000000002660000-0x00000000026F0000-memory.dmp WebBrowserPassView behavioral1/memory/1456-69-0x00000000775C0000-0x0000000077740000-memory.dmp WebBrowserPassView behavioral1/memory/1220-98-0x0000000006840000-0x00000000068D0000-memory.dmp WebBrowserPassView behavioral1/memory/1220-100-0x00000000775C0000-0x0000000077740000-memory.dmp WebBrowserPassView behavioral1/memory/1624-118-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1624-119-0x0000000000442628-mapping.dmp WebBrowserPassView behavioral1/memory/1624-122-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1624-125-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 13 IoCs
Processes:
resource yara_rule behavioral1/memory/1456-66-0x0000000002660000-0x00000000026F0000-memory.dmp Nirsoft behavioral1/memory/1456-69-0x00000000775C0000-0x0000000077740000-memory.dmp Nirsoft behavioral1/memory/1220-98-0x0000000006840000-0x00000000068D0000-memory.dmp Nirsoft behavioral1/memory/1220-100-0x00000000775C0000-0x0000000077740000-memory.dmp Nirsoft behavioral1/memory/1904-106-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1904-107-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/1904-111-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1904-115-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1904-117-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1624-118-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1624-119-0x0000000000442628-mapping.dmp Nirsoft behavioral1/memory/1624-122-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1624-125-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
Windows Update.exeWindows Update.exepid process 1356 Windows Update.exe 1220 Windows Update.exe -
Deletes itself 1 IoCs
Processes:
Windows Update.exepid process 1220 Windows Update.exe -
Loads dropped DLL 8 IoCs
Processes:
f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exeWindows Update.exeWindows Update.exepid process 1456 f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe 1356 Windows Update.exe 1356 Windows Update.exe 1356 Windows Update.exe 1356 Windows Update.exe 1220 Windows Update.exe 1220 Windows Update.exe 1220 Windows Update.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
Suspicious use of SetThreadContext 4 IoCs
Processes:
f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exeWindows Update.exeWindows Update.exedescription pid process target process PID 1112 set thread context of 1456 1112 f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe PID 1356 set thread context of 1220 1356 Windows Update.exe Windows Update.exe PID 1220 set thread context of 1904 1220 Windows Update.exe vbc.exe PID 1220 set thread context of 1624 1220 Windows Update.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Windows Update.exedescription pid process Token: SeDebugPrivilege 1220 Windows Update.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exeWindows Update.exeWindows Update.exepid process 1112 f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe 1356 Windows Update.exe 1220 Windows Update.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exeWindows Update.exepid process 1456 f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe 1220 Windows Update.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exef377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exeWindows Update.exeWindows Update.exedescription pid process target process PID 1112 wrote to memory of 1456 1112 f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe PID 1112 wrote to memory of 1456 1112 f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe PID 1112 wrote to memory of 1456 1112 f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe PID 1112 wrote to memory of 1456 1112 f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe PID 1456 wrote to memory of 1356 1456 f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe Windows Update.exe PID 1456 wrote to memory of 1356 1456 f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe Windows Update.exe PID 1456 wrote to memory of 1356 1456 f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe Windows Update.exe PID 1456 wrote to memory of 1356 1456 f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe Windows Update.exe PID 1456 wrote to memory of 1356 1456 f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe Windows Update.exe PID 1456 wrote to memory of 1356 1456 f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe Windows Update.exe PID 1456 wrote to memory of 1356 1456 f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe Windows Update.exe PID 1356 wrote to memory of 1220 1356 Windows Update.exe Windows Update.exe PID 1356 wrote to memory of 1220 1356 Windows Update.exe Windows Update.exe PID 1356 wrote to memory of 1220 1356 Windows Update.exe Windows Update.exe PID 1356 wrote to memory of 1220 1356 Windows Update.exe Windows Update.exe PID 1356 wrote to memory of 1220 1356 Windows Update.exe Windows Update.exe PID 1356 wrote to memory of 1220 1356 Windows Update.exe Windows Update.exe PID 1356 wrote to memory of 1220 1356 Windows Update.exe Windows Update.exe PID 1220 wrote to memory of 1904 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1904 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1904 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1904 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1904 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1904 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1904 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1904 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1904 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1904 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1904 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1904 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1904 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1624 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1624 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1624 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1624 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1624 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1624 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1624 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1624 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1624 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1624 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1624 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1624 1220 Windows Update.exe vbc.exe PID 1220 wrote to memory of 1624 1220 Windows Update.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe"C:\Users\Admin\AppData\Local\Temp\f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exeC:\Users\Admin\AppData\Local\Temp\f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986.exe"2⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exe"C:\Users\Admin\AppData\Roaming\Windows Update.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeC:\Users\Admin\AppData\Roaming\Windows Update.exe"4⤵
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"5⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SysInfo.txtFilesize
102B
MD57e29fd778f687f6d25f960a23f513445
SHA19959c6bbd29ec671830c1df4248afae2e29bec08
SHA256c29d4b40e9009d928dca0d15daff985dd908d1940a65a2247aa2c23232f89966
SHA51252c2f8bb94cd1d7944bfaa83adb12181a1108c37fe307e137150cfc569c71dd1f21c06ebad7e338b9407aca5e03294ab49d15b0e44e130b28a4a8cb6f46a0bba
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
818KB
MD56062dc511ee11c084d877c618b6f637e
SHA1e26c5ec4e5998664fdc76b53328edba1ae68dd9c
SHA256f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986
SHA5129047075cbd1cd82e177daa56c187bc8b4a61a21c0c9cd13f2538e7630aef55a270a7852c063f4264dd6dcb73718f8a914eed05a0916404702107a5ce890b7cfd
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
818KB
MD56062dc511ee11c084d877c618b6f637e
SHA1e26c5ec4e5998664fdc76b53328edba1ae68dd9c
SHA256f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986
SHA5129047075cbd1cd82e177daa56c187bc8b4a61a21c0c9cd13f2538e7630aef55a270a7852c063f4264dd6dcb73718f8a914eed05a0916404702107a5ce890b7cfd
-
C:\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
818KB
MD56062dc511ee11c084d877c618b6f637e
SHA1e26c5ec4e5998664fdc76b53328edba1ae68dd9c
SHA256f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986
SHA5129047075cbd1cd82e177daa56c187bc8b4a61a21c0c9cd13f2538e7630aef55a270a7852c063f4264dd6dcb73718f8a914eed05a0916404702107a5ce890b7cfd
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
818KB
MD56062dc511ee11c084d877c618b6f637e
SHA1e26c5ec4e5998664fdc76b53328edba1ae68dd9c
SHA256f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986
SHA5129047075cbd1cd82e177daa56c187bc8b4a61a21c0c9cd13f2538e7630aef55a270a7852c063f4264dd6dcb73718f8a914eed05a0916404702107a5ce890b7cfd
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
818KB
MD56062dc511ee11c084d877c618b6f637e
SHA1e26c5ec4e5998664fdc76b53328edba1ae68dd9c
SHA256f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986
SHA5129047075cbd1cd82e177daa56c187bc8b4a61a21c0c9cd13f2538e7630aef55a270a7852c063f4264dd6dcb73718f8a914eed05a0916404702107a5ce890b7cfd
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
818KB
MD56062dc511ee11c084d877c618b6f637e
SHA1e26c5ec4e5998664fdc76b53328edba1ae68dd9c
SHA256f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986
SHA5129047075cbd1cd82e177daa56c187bc8b4a61a21c0c9cd13f2538e7630aef55a270a7852c063f4264dd6dcb73718f8a914eed05a0916404702107a5ce890b7cfd
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
818KB
MD56062dc511ee11c084d877c618b6f637e
SHA1e26c5ec4e5998664fdc76b53328edba1ae68dd9c
SHA256f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986
SHA5129047075cbd1cd82e177daa56c187bc8b4a61a21c0c9cd13f2538e7630aef55a270a7852c063f4264dd6dcb73718f8a914eed05a0916404702107a5ce890b7cfd
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
818KB
MD56062dc511ee11c084d877c618b6f637e
SHA1e26c5ec4e5998664fdc76b53328edba1ae68dd9c
SHA256f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986
SHA5129047075cbd1cd82e177daa56c187bc8b4a61a21c0c9cd13f2538e7630aef55a270a7852c063f4264dd6dcb73718f8a914eed05a0916404702107a5ce890b7cfd
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
818KB
MD56062dc511ee11c084d877c618b6f637e
SHA1e26c5ec4e5998664fdc76b53328edba1ae68dd9c
SHA256f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986
SHA5129047075cbd1cd82e177daa56c187bc8b4a61a21c0c9cd13f2538e7630aef55a270a7852c063f4264dd6dcb73718f8a914eed05a0916404702107a5ce890b7cfd
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
818KB
MD56062dc511ee11c084d877c618b6f637e
SHA1e26c5ec4e5998664fdc76b53328edba1ae68dd9c
SHA256f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986
SHA5129047075cbd1cd82e177daa56c187bc8b4a61a21c0c9cd13f2538e7630aef55a270a7852c063f4264dd6dcb73718f8a914eed05a0916404702107a5ce890b7cfd
-
\Users\Admin\AppData\Roaming\Windows Update.exeFilesize
818KB
MD56062dc511ee11c084d877c618b6f637e
SHA1e26c5ec4e5998664fdc76b53328edba1ae68dd9c
SHA256f377b662db76cfcf5509a41f8e09674c55bd71e251745e5ff5d1328a2c015986
SHA5129047075cbd1cd82e177daa56c187bc8b4a61a21c0c9cd13f2538e7630aef55a270a7852c063f4264dd6dcb73718f8a914eed05a0916404702107a5ce890b7cfd
-
memory/1112-56-0x0000000000280000-0x0000000000287000-memory.dmpFilesize
28KB
-
memory/1112-57-0x0000000075B11000-0x0000000075B13000-memory.dmpFilesize
8KB
-
memory/1112-59-0x00000000775C0000-0x0000000077740000-memory.dmpFilesize
1.5MB
-
memory/1220-114-0x00000000775C0000-0x0000000077740000-memory.dmpFilesize
1.5MB
-
memory/1220-102-0x00000000775C0000-0x0000000077740000-memory.dmpFilesize
1.5MB
-
memory/1220-104-0x00000000743E0000-0x000000007498B000-memory.dmpFilesize
5.7MB
-
memory/1220-85-0x00000000004A9355-mapping.dmp
-
memory/1220-116-0x00000000743E0000-0x000000007498B000-memory.dmpFilesize
5.7MB
-
memory/1220-113-0x00000000775C0000-0x0000000077740000-memory.dmpFilesize
1.5MB
-
memory/1220-109-0x0000000006D75000-0x0000000006D86000-memory.dmpFilesize
68KB
-
memory/1220-126-0x0000000006D75000-0x0000000006D86000-memory.dmpFilesize
68KB
-
memory/1220-103-0x0000000008DB0000-0x00000000098A8000-memory.dmpFilesize
11.0MB
-
memory/1220-94-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/1220-98-0x0000000006840000-0x00000000068D0000-memory.dmpFilesize
576KB
-
memory/1220-100-0x00000000775C0000-0x0000000077740000-memory.dmpFilesize
1.5MB
-
memory/1356-73-0x0000000000000000-mapping.dmp
-
memory/1356-88-0x00000000775C0000-0x0000000077740000-memory.dmpFilesize
1.5MB
-
memory/1456-66-0x0000000002660000-0x00000000026F0000-memory.dmpFilesize
576KB
-
memory/1456-69-0x00000000775C0000-0x0000000077740000-memory.dmpFilesize
1.5MB
-
memory/1456-63-0x0000000000400000-0x0000000000477000-memory.dmpFilesize
476KB
-
memory/1456-70-0x00000000775C0000-0x0000000077740000-memory.dmpFilesize
1.5MB
-
memory/1456-58-0x00000000004A9355-mapping.dmp
-
memory/1456-71-0x0000000074780000-0x0000000074D2B000-memory.dmpFilesize
5.7MB
-
memory/1456-77-0x0000000074780000-0x0000000074D2B000-memory.dmpFilesize
5.7MB
-
memory/1456-76-0x00000000775C0000-0x0000000077740000-memory.dmpFilesize
1.5MB
-
memory/1624-118-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1624-119-0x0000000000442628-mapping.dmp
-
memory/1624-122-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1624-125-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1904-115-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1904-117-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1904-106-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1904-111-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1904-107-0x0000000000411654-mapping.dmp