Analysis
-
max time kernel
298s -
max time network
300s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
10-01-2023 13:45
Static task
static1
Behavioral task
behavioral1
Sample
Invoice NO 22073895.exe
Resource
win7-20221111-en
General
-
Target
Invoice NO 22073895.exe
-
Size
486KB
-
MD5
85cd688a9fee95b88b94b6879039201f
-
SHA1
0843488b993fd26651cff415ac5a43c593defa25
-
SHA256
4d3261b30e45d9577916b421a9b829836e955a9be539866aa29d21aad01283c1
-
SHA512
9ed65a00f4e6c276b18778feac6140759ebbc159d15c4c20280ff13b1887c73ec4fc88a38abe0f8e0d75ec0e5a5acf82478472b761247bee1357d130bf80ab45
-
SSDEEP
12288:AYn68Ex+E5Z8kJqeKPMwwOfGo5KNfhtDuCytMi4zaaKL:AYn6DAEgIqecuo5KbsCy6igbG
Malware Config
Extracted
formbook
poub
WY0eksfISzRg4O6c+opnGL6gaw==
moRjn9ExtYi8UmUo+Tya
2vME+GedoxzFnuLXesUoVj4=
EvW4JWJ1NQ8nN3tA3SM=
2mK9efMZMgN1VOs=
8d0jua5b0J6AQEW7
/2cyThOd37DSTYMASDye4Q0t/Vs=
ral+tbIh2KKAQEW7
YLY9jsPtYB/FRmMo+Tya
R1WcElWAMtFxFrVqtZT2ZpIS9xRZNho=
KFXGg/T1pCC9GjrxUPTcjw==
8mMlK5nDwjjPFTP5jMtAtQ0t/Vs=
c7am8nhhlCo=
UW91trZj6dENxuRdpxOvW1Cf
sjOMUcvq6lYJCZEfV4euFzY=
62nBgPjdmWQkmWElww==
64E8JqA1aruSUvw=
NqI1reXpcR+REye0
8+y1oOsbjgSyEhjXUPTcjw==
Rx9by8gNBwN1VOs=
Muif0yE4CQN1VOs=
VEt6//SsIukFo46EOTs=
Z8su52MYL67C
usDwuHRs8/KlWg==
idmltXXu7XAgHLE/UPTcjw==
QPrxO2shWNiGexGboHDSRqBQ1TBd
hq9rqBND8/KlWg==
QS9iHFx08/KlWg==
v1soVFoThEdt/B/dK0v4+6Wb
7rqJytN13KKAQEW7
OWbeN2SDJwonsI6EOTs=
aqQrrKZDm16GMlAtvxavW1Cf
imnEZWIEbC4M8Q+i
Bry3oQg5+6ZaUNxzwg==
B3vYmyxPQS5XYvmCsqQXX8X948Zf
KbGBmwwCyKTKsUcRUNN6CD61aw==
2WpDae4P+W4cdqc8kPBcjqg0wS1X
MvkZLPRY25jI
Alr0VZGxYxG3dR/zSNjBhQ==
ZJkdjczlrF+8l0Os
dcmMkFm+QhFD4OM=
fMdUrd4J1n4mmWElww==
Gat+k1fHg11vTQ==
sn+7Q4uxaAu9FyGv7k24F1DWaBEvmRI=
CjvGRTnXOhtN6QSNxhmvW1Cf
CpHvP2VSxaKAQEW7
qQWkEUJYFKhPttOZ4MarX8KKLl+/Jg==
GNVP4yIy8/KlWg==
pqfVAERhYxN7YPM=
9nS5b/AGCpZNAfZj1A==
a3GcpSND8/KlWg==
fin6NmQXayreIOrzPyw=
EjdROfeTsDPVH+rzPyw=
DO4xD8nURBwM8Q+i
+p/LQHFh0KOAQEW7
iNos10QpwjvjvFrXJYtYFiuHdA==
SX//aFP4Yi5T6NbcKQr07J6e
2NKh0dNr52sTdH4OSNjBhQ==
ZMSJmgsxFrlp5fnecrgeVYcP4xRZNho=
oXmlavAJ+3IbFbl3Gm4H+iKG
ijjWRYCaXiTcigreSNjBhQ==
ZqpH49I4XPu1k+rzPyw=
ZZUh+4FrrBbKukgJWoeuFzY=
lLnTxHn7rq/W9G8rzjsgCnyBYw==
drzjup.space
Signatures
-
Xloader payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1188-65-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/788-72-0x0000000000080000-0x00000000000AC000-memory.dmp xloader behavioral1/memory/788-77-0x0000000000080000-0x00000000000AC000-memory.dmp xloader -
Executes dropped EXE 3 IoCs
Processes:
pvwuec.exepvwuec.exemsxrnhgb.exepid process 1432 pvwuec.exe 1188 pvwuec.exe 1956 msxrnhgb.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
pvwuec.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\Geo\Nation pvwuec.exe -
Loads dropped DLL 7 IoCs
Processes:
Invoice NO 22073895.exepvwuec.exeWerFault.exepid process 1532 Invoice NO 22073895.exe 1532 Invoice NO 22073895.exe 1432 pvwuec.exe 1552 WerFault.exe 1552 WerFault.exe 1552 WerFault.exe 1552 WerFault.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
mstsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\XZZX3TBPDH = "C:\\Program Files (x86)\\Xcbcxn6v\\msxrnhgb.exe" mstsc.exe Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run mstsc.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
pvwuec.exepvwuec.exemstsc.exedescription pid process target process PID 1432 set thread context of 1188 1432 pvwuec.exe pvwuec.exe PID 1188 set thread context of 1284 1188 pvwuec.exe Explorer.EXE PID 788 set thread context of 1284 788 mstsc.exe Explorer.EXE -
Drops file in Program Files directory 2 IoCs
Processes:
mstsc.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Xcbcxn6v\msxrnhgb.exe mstsc.exe File created C:\Program Files (x86)\Xcbcxn6v\msxrnhgb.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1552 1956 WerFault.exe msxrnhgb.exe -
Processes:
mstsc.exedescription ioc process Key created \Registry\User\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 mstsc.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
Processes:
pvwuec.exemstsc.exepid process 1188 pvwuec.exe 1188 pvwuec.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
pvwuec.exepvwuec.exemstsc.exepid process 1432 pvwuec.exe 1188 pvwuec.exe 1188 pvwuec.exe 1188 pvwuec.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe 788 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pvwuec.exemstsc.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1188 pvwuec.exe Token: SeDebugPrivilege 788 mstsc.exe Token: SeShutdownPrivilege 1284 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
Invoice NO 22073895.exepvwuec.exeExplorer.EXEmstsc.exemsxrnhgb.exedescription pid process target process PID 1532 wrote to memory of 1432 1532 Invoice NO 22073895.exe pvwuec.exe PID 1532 wrote to memory of 1432 1532 Invoice NO 22073895.exe pvwuec.exe PID 1532 wrote to memory of 1432 1532 Invoice NO 22073895.exe pvwuec.exe PID 1532 wrote to memory of 1432 1532 Invoice NO 22073895.exe pvwuec.exe PID 1432 wrote to memory of 1188 1432 pvwuec.exe pvwuec.exe PID 1432 wrote to memory of 1188 1432 pvwuec.exe pvwuec.exe PID 1432 wrote to memory of 1188 1432 pvwuec.exe pvwuec.exe PID 1432 wrote to memory of 1188 1432 pvwuec.exe pvwuec.exe PID 1432 wrote to memory of 1188 1432 pvwuec.exe pvwuec.exe PID 1284 wrote to memory of 788 1284 Explorer.EXE mstsc.exe PID 1284 wrote to memory of 788 1284 Explorer.EXE mstsc.exe PID 1284 wrote to memory of 788 1284 Explorer.EXE mstsc.exe PID 1284 wrote to memory of 788 1284 Explorer.EXE mstsc.exe PID 788 wrote to memory of 1368 788 mstsc.exe cmd.exe PID 788 wrote to memory of 1368 788 mstsc.exe cmd.exe PID 788 wrote to memory of 1368 788 mstsc.exe cmd.exe PID 788 wrote to memory of 1368 788 mstsc.exe cmd.exe PID 788 wrote to memory of 1080 788 mstsc.exe Firefox.exe PID 788 wrote to memory of 1080 788 mstsc.exe Firefox.exe PID 788 wrote to memory of 1080 788 mstsc.exe Firefox.exe PID 788 wrote to memory of 1080 788 mstsc.exe Firefox.exe PID 788 wrote to memory of 1080 788 mstsc.exe Firefox.exe PID 1284 wrote to memory of 1956 1284 Explorer.EXE msxrnhgb.exe PID 1284 wrote to memory of 1956 1284 Explorer.EXE msxrnhgb.exe PID 1284 wrote to memory of 1956 1284 Explorer.EXE msxrnhgb.exe PID 1284 wrote to memory of 1956 1284 Explorer.EXE msxrnhgb.exe PID 1956 wrote to memory of 1552 1956 msxrnhgb.exe WerFault.exe PID 1956 wrote to memory of 1552 1956 msxrnhgb.exe WerFault.exe PID 1956 wrote to memory of 1552 1956 msxrnhgb.exe WerFault.exe PID 1956 wrote to memory of 1552 1956 msxrnhgb.exe WerFault.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Invoice NO 22073895.exe"C:\Users\Admin\AppData\Local\Temp\Invoice NO 22073895.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pvwuec.exe"C:\Users\Admin\AppData\Local\Temp\pvwuec.exe" C:\Users\Admin\AppData\Local\Temp\eeelcb.fn3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pvwuec.exe"C:\Users\Admin\AppData\Local\Temp\pvwuec.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\pvwuec.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Xcbcxn6v\msxrnhgb.exe"C:\Program Files (x86)\Xcbcxn6v\msxrnhgb.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 1603⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Xcbcxn6v\msxrnhgb.exeFilesize
84KB
MD5e87c6c672ec024582ffb00811abf747e
SHA105921c941ed33b6e0e4cd35c20a452d0659d04dd
SHA25617a23dd9b5a1b36f5db90ea4e102a03a8dd14557b60f4c19c17e62e53ac19f86
SHA5125d09656b375b7cb2a3e3062e4a4af3c77663cc454e79a7be59f2996b4db54e8609f6de7b0ad27432e42b45f2e544a22ba43096b61be6d06d36ff1b20b1e49cb5
-
C:\Program Files (x86)\Xcbcxn6v\msxrnhgb.exeFilesize
84KB
MD5e87c6c672ec024582ffb00811abf747e
SHA105921c941ed33b6e0e4cd35c20a452d0659d04dd
SHA25617a23dd9b5a1b36f5db90ea4e102a03a8dd14557b60f4c19c17e62e53ac19f86
SHA5125d09656b375b7cb2a3e3062e4a4af3c77663cc454e79a7be59f2996b4db54e8609f6de7b0ad27432e42b45f2e544a22ba43096b61be6d06d36ff1b20b1e49cb5
-
C:\Users\Admin\AppData\Local\Temp\eeelcb.fnFilesize
5KB
MD5c4ee853696ad5db212cd6ae2bb8a0fe1
SHA1840ccd25c091a082be426b35386ce7ab8f5d0631
SHA2566c92c5b0c148c513174215823f3ba3f7f53adbaae077553219826b35553edba1
SHA5127527d4792d58829f38ed4509a37cc248a02aaeeddf747d3afe3c3f380f8fdad0ebe39e9c989bf1d224f54fab0d187379a93eb9a61800fd7d1f52eb4e6ec9e8c3
-
C:\Users\Admin\AppData\Local\Temp\pvwuec.exeFilesize
84KB
MD5e87c6c672ec024582ffb00811abf747e
SHA105921c941ed33b6e0e4cd35c20a452d0659d04dd
SHA25617a23dd9b5a1b36f5db90ea4e102a03a8dd14557b60f4c19c17e62e53ac19f86
SHA5125d09656b375b7cb2a3e3062e4a4af3c77663cc454e79a7be59f2996b4db54e8609f6de7b0ad27432e42b45f2e544a22ba43096b61be6d06d36ff1b20b1e49cb5
-
C:\Users\Admin\AppData\Local\Temp\pvwuec.exeFilesize
84KB
MD5e87c6c672ec024582ffb00811abf747e
SHA105921c941ed33b6e0e4cd35c20a452d0659d04dd
SHA25617a23dd9b5a1b36f5db90ea4e102a03a8dd14557b60f4c19c17e62e53ac19f86
SHA5125d09656b375b7cb2a3e3062e4a4af3c77663cc454e79a7be59f2996b4db54e8609f6de7b0ad27432e42b45f2e544a22ba43096b61be6d06d36ff1b20b1e49cb5
-
C:\Users\Admin\AppData\Local\Temp\pvwuec.exeFilesize
84KB
MD5e87c6c672ec024582ffb00811abf747e
SHA105921c941ed33b6e0e4cd35c20a452d0659d04dd
SHA25617a23dd9b5a1b36f5db90ea4e102a03a8dd14557b60f4c19c17e62e53ac19f86
SHA5125d09656b375b7cb2a3e3062e4a4af3c77663cc454e79a7be59f2996b4db54e8609f6de7b0ad27432e42b45f2e544a22ba43096b61be6d06d36ff1b20b1e49cb5
-
C:\Users\Admin\AppData\Local\Temp\serrf.pFilesize
196KB
MD5f33a9bba9a07130a2662f4f14e696e7c
SHA16fd979cbec5aaa33f8276ca0825a8c0e71768499
SHA256ea5fe369ca49d659b7cf129def53fd7a1589c9ccdf16a7270354897e885d730c
SHA5128df1c084b2dcf922faa9ae404642ab9e417b50bdafbf88ce14f1df1d3c3894d7e2f23e5e83ac4362edec3aa0d5a898af9087dac3680731a8dc8960a43b33cdfb
-
\Program Files (x86)\Xcbcxn6v\msxrnhgb.exeFilesize
84KB
MD5e87c6c672ec024582ffb00811abf747e
SHA105921c941ed33b6e0e4cd35c20a452d0659d04dd
SHA25617a23dd9b5a1b36f5db90ea4e102a03a8dd14557b60f4c19c17e62e53ac19f86
SHA5125d09656b375b7cb2a3e3062e4a4af3c77663cc454e79a7be59f2996b4db54e8609f6de7b0ad27432e42b45f2e544a22ba43096b61be6d06d36ff1b20b1e49cb5
-
\Program Files (x86)\Xcbcxn6v\msxrnhgb.exeFilesize
84KB
MD5e87c6c672ec024582ffb00811abf747e
SHA105921c941ed33b6e0e4cd35c20a452d0659d04dd
SHA25617a23dd9b5a1b36f5db90ea4e102a03a8dd14557b60f4c19c17e62e53ac19f86
SHA5125d09656b375b7cb2a3e3062e4a4af3c77663cc454e79a7be59f2996b4db54e8609f6de7b0ad27432e42b45f2e544a22ba43096b61be6d06d36ff1b20b1e49cb5
-
\Program Files (x86)\Xcbcxn6v\msxrnhgb.exeFilesize
84KB
MD5e87c6c672ec024582ffb00811abf747e
SHA105921c941ed33b6e0e4cd35c20a452d0659d04dd
SHA25617a23dd9b5a1b36f5db90ea4e102a03a8dd14557b60f4c19c17e62e53ac19f86
SHA5125d09656b375b7cb2a3e3062e4a4af3c77663cc454e79a7be59f2996b4db54e8609f6de7b0ad27432e42b45f2e544a22ba43096b61be6d06d36ff1b20b1e49cb5
-
\Program Files (x86)\Xcbcxn6v\msxrnhgb.exeFilesize
84KB
MD5e87c6c672ec024582ffb00811abf747e
SHA105921c941ed33b6e0e4cd35c20a452d0659d04dd
SHA25617a23dd9b5a1b36f5db90ea4e102a03a8dd14557b60f4c19c17e62e53ac19f86
SHA5125d09656b375b7cb2a3e3062e4a4af3c77663cc454e79a7be59f2996b4db54e8609f6de7b0ad27432e42b45f2e544a22ba43096b61be6d06d36ff1b20b1e49cb5
-
\Users\Admin\AppData\Local\Temp\pvwuec.exeFilesize
84KB
MD5e87c6c672ec024582ffb00811abf747e
SHA105921c941ed33b6e0e4cd35c20a452d0659d04dd
SHA25617a23dd9b5a1b36f5db90ea4e102a03a8dd14557b60f4c19c17e62e53ac19f86
SHA5125d09656b375b7cb2a3e3062e4a4af3c77663cc454e79a7be59f2996b4db54e8609f6de7b0ad27432e42b45f2e544a22ba43096b61be6d06d36ff1b20b1e49cb5
-
\Users\Admin\AppData\Local\Temp\pvwuec.exeFilesize
84KB
MD5e87c6c672ec024582ffb00811abf747e
SHA105921c941ed33b6e0e4cd35c20a452d0659d04dd
SHA25617a23dd9b5a1b36f5db90ea4e102a03a8dd14557b60f4c19c17e62e53ac19f86
SHA5125d09656b375b7cb2a3e3062e4a4af3c77663cc454e79a7be59f2996b4db54e8609f6de7b0ad27432e42b45f2e544a22ba43096b61be6d06d36ff1b20b1e49cb5
-
\Users\Admin\AppData\Local\Temp\pvwuec.exeFilesize
84KB
MD5e87c6c672ec024582ffb00811abf747e
SHA105921c941ed33b6e0e4cd35c20a452d0659d04dd
SHA25617a23dd9b5a1b36f5db90ea4e102a03a8dd14557b60f4c19c17e62e53ac19f86
SHA5125d09656b375b7cb2a3e3062e4a4af3c77663cc454e79a7be59f2996b4db54e8609f6de7b0ad27432e42b45f2e544a22ba43096b61be6d06d36ff1b20b1e49cb5
-
memory/788-69-0x0000000000000000-mapping.dmp
-
memory/788-71-0x0000000000ED0000-0x0000000000FD4000-memory.dmpFilesize
1.0MB
-
memory/788-72-0x0000000000080000-0x00000000000AC000-memory.dmpFilesize
176KB
-
memory/788-74-0x00000000023E0000-0x00000000026E3000-memory.dmpFilesize
3.0MB
-
memory/788-75-0x0000000000660000-0x00000000006F0000-memory.dmpFilesize
576KB
-
memory/788-77-0x0000000000080000-0x00000000000AC000-memory.dmpFilesize
176KB
-
memory/1188-63-0x000000000041FF10-mapping.dmp
-
memory/1188-67-0x0000000000350000-0x0000000000361000-memory.dmpFilesize
68KB
-
memory/1188-66-0x0000000000920000-0x0000000000C23000-memory.dmpFilesize
3.0MB
-
memory/1188-65-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1284-82-0x000007FF204A0000-0x000007FF204AA000-memory.dmpFilesize
40KB
-
memory/1284-80-0x0000000006210000-0x0000000006330000-memory.dmpFilesize
1.1MB
-
memory/1284-81-0x000007FEF5CB0000-0x000007FEF5DF3000-memory.dmpFilesize
1.3MB
-
memory/1284-79-0x000007FF204A0000-0x000007FF204AA000-memory.dmpFilesize
40KB
-
memory/1284-78-0x000007FEF5CB0000-0x000007FEF5DF3000-memory.dmpFilesize
1.3MB
-
memory/1284-76-0x0000000006210000-0x0000000006330000-memory.dmpFilesize
1.1MB
-
memory/1284-68-0x0000000006040000-0x000000000617E000-memory.dmpFilesize
1.2MB
-
memory/1368-73-0x0000000000000000-mapping.dmp
-
memory/1432-57-0x0000000000000000-mapping.dmp
-
memory/1532-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmpFilesize
8KB
-
memory/1552-86-0x0000000000000000-mapping.dmp
-
memory/1956-83-0x0000000000000000-mapping.dmp