Analysis
-
max time kernel
166s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2022 06:35
Static task
static1
Behavioral task
behavioral1
Sample
73e529c3e1192fc1a487b6064dbd0e6cb8b0086808bf771b39f8520669ae388f.dll
Resource
win7-20220901-en
General
-
Target
73e529c3e1192fc1a487b6064dbd0e6cb8b0086808bf771b39f8520669ae388f.dll
-
Size
144KB
-
MD5
259c8e3668a6bbe348afaf426fca0930
-
SHA1
e2ae0c8e9b5a43eca42735251ea35d3bfff2b71f
-
SHA256
73e529c3e1192fc1a487b6064dbd0e6cb8b0086808bf771b39f8520669ae388f
-
SHA512
0cbc094dd6136a1b9dcf1ea06002bb13136202c0bff38389e1ae0005f4bf2b88367af01210c569bed3f255707a6b454a1266b06adcd2582b9d0781379a9b26e0
-
SSDEEP
3072:1NEqkap78EbW7N1jv1VEfiZ4k/MGjYWL3aeX8:fEqkE4txv8iZlkGzms8
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
rundll32mgr.exeWaterMark.exepid process 1996 rundll32mgr.exe 4280 WaterMark.exe -
Processes:
resource yara_rule behavioral2/memory/1996-140-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1996-141-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1996-142-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1996-143-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1996-144-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1996-145-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1996-146-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1996-147-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1996-150-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4280-156-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4280-157-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4280-158-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4280-159-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4280-162-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4280-163-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4280-164-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4280-165-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Drops file in Program Files directory 3 IoCs
Processes:
rundll32mgr.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\pxF571.tmp rundll32mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe rundll32mgr.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1744 4872 WerFault.exe svchost.exe -
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3122076654" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2745827073" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000590" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CEEAA124-7401-11ED-BF5F-5695DBFAB5D8} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000590" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376943661" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CEE5D9BF-7401-11ED-BF5F-5695DBFAB5D8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000590" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3122076654" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000590" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2745827073" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
WaterMark.exepid process 4280 WaterMark.exe 4280 WaterMark.exe 4280 WaterMark.exe 4280 WaterMark.exe 4280 WaterMark.exe 4280 WaterMark.exe 4280 WaterMark.exe 4280 WaterMark.exe 4280 WaterMark.exe 4280 WaterMark.exe 4280 WaterMark.exe 4280 WaterMark.exe 4280 WaterMark.exe 4280 WaterMark.exe 4280 WaterMark.exe 4280 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WaterMark.exedescription pid process Token: SeDebugPrivilege 4280 WaterMark.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 4284 iexplore.exe 1608 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 4284 iexplore.exe 4284 iexplore.exe 1608 iexplore.exe 1608 iexplore.exe 1896 IEXPLORE.EXE 1896 IEXPLORE.EXE 4464 IEXPLORE.EXE 4464 IEXPLORE.EXE 1896 IEXPLORE.EXE 1896 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
rundll32mgr.exeWaterMark.exepid process 1996 rundll32mgr.exe 4280 WaterMark.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
rundll32.exerundll32.exerundll32mgr.exeWaterMark.exeiexplore.exeiexplore.exedescription pid process target process PID 5088 wrote to memory of 3492 5088 rundll32.exe rundll32.exe PID 5088 wrote to memory of 3492 5088 rundll32.exe rundll32.exe PID 5088 wrote to memory of 3492 5088 rundll32.exe rundll32.exe PID 3492 wrote to memory of 1996 3492 rundll32.exe rundll32mgr.exe PID 3492 wrote to memory of 1996 3492 rundll32.exe rundll32mgr.exe PID 3492 wrote to memory of 1996 3492 rundll32.exe rundll32mgr.exe PID 1996 wrote to memory of 4280 1996 rundll32mgr.exe WaterMark.exe PID 1996 wrote to memory of 4280 1996 rundll32mgr.exe WaterMark.exe PID 1996 wrote to memory of 4280 1996 rundll32mgr.exe WaterMark.exe PID 4280 wrote to memory of 4872 4280 WaterMark.exe svchost.exe PID 4280 wrote to memory of 4872 4280 WaterMark.exe svchost.exe PID 4280 wrote to memory of 4872 4280 WaterMark.exe svchost.exe PID 4280 wrote to memory of 4872 4280 WaterMark.exe svchost.exe PID 4280 wrote to memory of 4872 4280 WaterMark.exe svchost.exe PID 4280 wrote to memory of 4872 4280 WaterMark.exe svchost.exe PID 4280 wrote to memory of 4872 4280 WaterMark.exe svchost.exe PID 4280 wrote to memory of 4872 4280 WaterMark.exe svchost.exe PID 4280 wrote to memory of 4872 4280 WaterMark.exe svchost.exe PID 4280 wrote to memory of 1608 4280 WaterMark.exe iexplore.exe PID 4280 wrote to memory of 1608 4280 WaterMark.exe iexplore.exe PID 4280 wrote to memory of 4284 4280 WaterMark.exe iexplore.exe PID 4280 wrote to memory of 4284 4280 WaterMark.exe iexplore.exe PID 4284 wrote to memory of 1896 4284 iexplore.exe IEXPLORE.EXE PID 4284 wrote to memory of 1896 4284 iexplore.exe IEXPLORE.EXE PID 4284 wrote to memory of 1896 4284 iexplore.exe IEXPLORE.EXE PID 1608 wrote to memory of 4464 1608 iexplore.exe IEXPLORE.EXE PID 1608 wrote to memory of 4464 1608 iexplore.exe IEXPLORE.EXE PID 1608 wrote to memory of 4464 1608 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\73e529c3e1192fc1a487b6064dbd0e6cb8b0086808bf771b39f8520669ae388f.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\73e529c3e1192fc1a487b6064dbd0e6cb8b0086808bf771b39f8520669ae388f.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 2086⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1608 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4284 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4872 -ip 48721⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
96KB
MD5617f9327ee304a9db6bb3a8a5dccfefc
SHA1fc6b07010521d72f1ea20978bb3a98b15cf07d0e
SHA256fb0d039f3bb02f9976395bd44364114ade00c9b55d5850bf1d420f1eca509661
SHA512cef1f5a310b61822a9d59e8a8f6995473711e28151f821f732da3e6669de8644305718d9f79eaa6dd9326a5fe2b349524b88c9151eca52e6336bb553b7920f90
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
96KB
MD5617f9327ee304a9db6bb3a8a5dccfefc
SHA1fc6b07010521d72f1ea20978bb3a98b15cf07d0e
SHA256fb0d039f3bb02f9976395bd44364114ade00c9b55d5850bf1d420f1eca509661
SHA512cef1f5a310b61822a9d59e8a8f6995473711e28151f821f732da3e6669de8644305718d9f79eaa6dd9326a5fe2b349524b88c9151eca52e6336bb553b7920f90
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CEE5D9BF-7401-11ED-BF5F-5695DBFAB5D8}.datFilesize
3KB
MD56965fa0037082fc2808eacd93bf3763b
SHA1a62374653ac116f1102a934f260121a7b01842db
SHA2564adb67e28641b307b22557e72e06e7826afc8b224f933c2e4d5d4b067fb92f23
SHA512bd5e633b7f491cbec2d3bae6e8b354f5ef5377ca6796d3692e0dde5fc8dccc5b85de30c09f625f63751192353ef8358b2284e56c3e4b375f59096d3a861ed674
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CEEAA124-7401-11ED-BF5F-5695DBFAB5D8}.datFilesize
5KB
MD545b226b76f4fa6f46a656974804250fa
SHA1c587aaa6dd5cd2bffa7b2cdec534132d751faf9d
SHA2566b1fbc72f728fd1d7fe2d9c69eb8fab109aac392ff426ed51baef0fbd95c4b69
SHA51250f5a70233ee221f0ca8ed3a6cc16176a96e8cc561467ead26769665d9d84c2089a8a1ab293d1a330b5b965e8fa3e2313597483a47ca40145780f7fb642ee1a6
-
C:\Windows\SysWOW64\rundll32mgr.exeFilesize
96KB
MD5617f9327ee304a9db6bb3a8a5dccfefc
SHA1fc6b07010521d72f1ea20978bb3a98b15cf07d0e
SHA256fb0d039f3bb02f9976395bd44364114ade00c9b55d5850bf1d420f1eca509661
SHA512cef1f5a310b61822a9d59e8a8f6995473711e28151f821f732da3e6669de8644305718d9f79eaa6dd9326a5fe2b349524b88c9151eca52e6336bb553b7920f90
-
C:\Windows\SysWOW64\rundll32mgr.exeFilesize
96KB
MD5617f9327ee304a9db6bb3a8a5dccfefc
SHA1fc6b07010521d72f1ea20978bb3a98b15cf07d0e
SHA256fb0d039f3bb02f9976395bd44364114ade00c9b55d5850bf1d420f1eca509661
SHA512cef1f5a310b61822a9d59e8a8f6995473711e28151f821f732da3e6669de8644305718d9f79eaa6dd9326a5fe2b349524b88c9151eca52e6336bb553b7920f90
-
memory/1996-150-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1996-142-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/1996-143-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/1996-144-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/1996-145-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/1996-146-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/1996-147-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/1996-140-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1996-137-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/1996-141-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1996-133-0x0000000000000000-mapping.dmp
-
memory/3492-136-0x000000006D040000-0x000000006D064000-memory.dmpFilesize
144KB
-
memory/3492-132-0x0000000000000000-mapping.dmp
-
memory/4280-148-0x0000000000000000-mapping.dmp
-
memory/4280-158-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/4280-159-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/4280-162-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/4280-163-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/4280-164-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/4280-165-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4280-157-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/4280-156-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/4872-161-0x0000000000000000-mapping.dmp