Analysis
-
max time kernel
135s -
max time network
138s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-11-2020 15:31
Behavioral task
behavioral1
Sample
detectiv_1.exe
Resource
win7v20201028
General
-
Target
detectiv_1.exe
-
Size
2.0MB
-
MD5
fdb6187536274ff2890d75909d2b05c5
-
SHA1
c8be850f5e198618768c7065fb4b2610739a7138
-
SHA256
00734aaab14a7f28395144dc472490d84cdc3e1931ebdee35ddd6411221cff18
-
SHA512
25cb745ece3534fbfb84927a0b1286eb0e0087ac40c7c74525aaa67d04f2393f9edd8c850687ffd09fc3c22c0c2add2adc80f11c7e1d89a4461e6d5c798a969f
Malware Config
Extracted
qakbot
spx112
1588678797
81.133.234.36:2222
31.5.21.66:443
41.233.43.51:995
96.37.113.36:443
86.233.4.153:2222
98.118.156.172:443
89.34.214.130:443
79.116.237.126:443
72.16.212.107:465
72.36.59.46:2222
5.74.188.119:995
67.209.195.198:3389
98.32.60.217:443
24.46.40.189:2222
77.159.149.74:443
174.30.24.61:443
98.115.138.61:443
189.159.82.203:995
108.21.54.174:443
81.103.144.77:443
116.202.36.62:21
71.187.170.235:443
216.201.162.158:443
73.226.220.56:443
75.87.161.32:995
216.163.4.91:443
24.110.96.149:443
172.78.87.180:443
121.122.68.145:443
75.110.250.89:443
98.22.234.245:443
24.228.7.174:443
46.214.86.217:443
71.213.29.14:995
209.182.121.133:2222
96.227.122.123:443
51.223.115.34:443
109.177.170.150:443
72.240.124.46:443
173.3.132.17:995
207.255.161.8:443
79.113.219.75:443
41.228.220.8:443
107.5.252.194:443
47.205.231.60:443
216.152.7.12:443
72.204.242.138:465
97.96.51.117:443
70.57.15.187:993
76.15.41.32:443
108.54.103.234:443
71.163.225.75:443
24.90.160.91:443
31.5.189.71:443
64.19.74.29:995
68.46.142.48:443
63.230.2.205:2083
188.25.163.53:443
178.137.232.136:443
94.53.113.43:443
45.46.175.21:443
79.127.76.238:995
172.87.134.226:443
24.55.152.50:995
107.2.148.99:443
24.226.137.154:443
67.141.143.110:443
108.183.200.239:443
72.204.242.138:32102
58.108.188.231:443
47.202.98.230:443
76.170.77.99:443
72.183.129.56:443
67.170.137.8:443
72.204.242.138:20
81.245.66.237:995
72.204.242.138:80
72.204.242.138:2087
94.52.124.226:443
199.241.223.66:443
24.184.5.251:2222
178.193.33.121:2222
200.75.197.193:443
98.219.77.197:443
97.127.144.203:2222
73.210.114.187:443
89.34.231.30:443
184.21.151.81:995
5.193.175.12:2078
74.90.76.128:2222
86.124.111.91:443
188.25.223.107:2222
173.173.68.41:443
75.183.171.155:3389
50.108.212.180:443
108.227.161.27:995
207.255.161.8:32103
59.96.167.242:443
47.155.19.205:443
2.190.226.125:443
39.36.135.113:995
203.33.139.134:443
47.180.66.10:443
49.191.9.180:995
72.209.191.27:443
70.62.160.186:6883
136.228.103.44:443
72.204.242.138:443
96.57.42.130:443
50.247.230.33:995
67.131.59.17:443
83.25.18.252:2222
71.29.180.113:22
24.201.79.208:2078
72.190.101.70:443
50.244.112.10:443
203.213.104.25:995
50.246.229.50:443
50.104.186.71:443
137.99.224.198:443
47.232.26.181:443
72.45.14.185:443
74.96.151.6:443
173.172.205.216:443
208.126.142.17:443
76.187.8.160:443
76.173.145.112:443
72.204.242.138:6881
184.98.104.7:995
94.176.128.176:443
73.137.187.150:443
95.77.204.208:443
201.146.188.44:443
5.182.39.156:443
47.214.144.253:443
47.146.169.85:443
64.121.114.87:443
71.193.126.206:443
75.161.36.21:2222
47.40.244.237:443
96.244.227.176:443
78.97.145.242:443
203.198.96.218:443
84.117.176.32:443
74.215.201.51:443
70.174.3.241:443
184.180.157.203:2222
71.220.191.200:443
73.163.242.114:443
39.32.171.83:993
Signatures
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe cryptone \Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe cryptone C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe cryptone C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe cryptone C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe cryptone \Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe cryptone C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe cryptone C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe cryptone -
Executes dropped EXE 4 IoCs
Processes:
ibaossr.exeibaossr.exeibaossr.exeibaossr.exepid process 924 ibaossr.exe 324 ibaossr.exe 1528 ibaossr.exe 892 ibaossr.exe -
Loads dropped DLL 3 IoCs
Processes:
detectiv_1.exedetectiv_1.exepid process 1704 detectiv_1.exe 1704 detectiv_1.exe 1916 detectiv_1.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
detectiv_1.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ detectiv_1.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" detectiv_1.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" detectiv_1.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
detectiv_1.exedetectiv_1.exeibaossr.exeibaossr.exeexplorer.exedetectiv_1.exeibaossr.exeibaossr.exepid process 1704 detectiv_1.exe 1304 detectiv_1.exe 1304 detectiv_1.exe 924 ibaossr.exe 324 ibaossr.exe 324 ibaossr.exe 412 explorer.exe 412 explorer.exe 1916 detectiv_1.exe 1528 ibaossr.exe 892 ibaossr.exe 892 ibaossr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ibaossr.exepid process 924 ibaossr.exe -
Suspicious use of WriteProcessMemory 80 IoCs
Processes:
detectiv_1.exeibaossr.exetaskeng.exedetectiv_1.exedescription pid process target process PID 1704 wrote to memory of 1304 1704 detectiv_1.exe detectiv_1.exe PID 1704 wrote to memory of 1304 1704 detectiv_1.exe detectiv_1.exe PID 1704 wrote to memory of 1304 1704 detectiv_1.exe detectiv_1.exe PID 1704 wrote to memory of 1304 1704 detectiv_1.exe detectiv_1.exe PID 1704 wrote to memory of 924 1704 detectiv_1.exe ibaossr.exe PID 1704 wrote to memory of 924 1704 detectiv_1.exe ibaossr.exe PID 1704 wrote to memory of 924 1704 detectiv_1.exe ibaossr.exe PID 1704 wrote to memory of 924 1704 detectiv_1.exe ibaossr.exe PID 1704 wrote to memory of 1444 1704 detectiv_1.exe schtasks.exe PID 1704 wrote to memory of 1444 1704 detectiv_1.exe schtasks.exe PID 1704 wrote to memory of 1444 1704 detectiv_1.exe schtasks.exe PID 1704 wrote to memory of 1444 1704 detectiv_1.exe schtasks.exe PID 924 wrote to memory of 324 924 ibaossr.exe ibaossr.exe PID 924 wrote to memory of 324 924 ibaossr.exe ibaossr.exe PID 924 wrote to memory of 324 924 ibaossr.exe ibaossr.exe PID 924 wrote to memory of 324 924 ibaossr.exe ibaossr.exe PID 924 wrote to memory of 412 924 ibaossr.exe explorer.exe PID 924 wrote to memory of 412 924 ibaossr.exe explorer.exe PID 924 wrote to memory of 412 924 ibaossr.exe explorer.exe PID 924 wrote to memory of 412 924 ibaossr.exe explorer.exe PID 924 wrote to memory of 412 924 ibaossr.exe explorer.exe PID 588 wrote to memory of 1916 588 taskeng.exe detectiv_1.exe PID 588 wrote to memory of 1916 588 taskeng.exe detectiv_1.exe PID 588 wrote to memory of 1916 588 taskeng.exe detectiv_1.exe PID 588 wrote to memory of 1916 588 taskeng.exe detectiv_1.exe PID 1916 wrote to memory of 316 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 316 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 316 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 316 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 608 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 608 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 608 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 608 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1180 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1180 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1180 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1180 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 856 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 856 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 856 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 856 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 932 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 932 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 932 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 932 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1352 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1352 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1352 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1352 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1720 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1720 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1720 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1720 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1240 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1240 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1240 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1240 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1896 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1896 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1896 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1896 1916 detectiv_1.exe reg.exe PID 1916 wrote to memory of 1528 1916 detectiv_1.exe ibaossr.exe PID 1916 wrote to memory of 1528 1916 detectiv_1.exe ibaossr.exe PID 1916 wrote to memory of 1528 1916 detectiv_1.exe ibaossr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\detectiv_1.exe"C:\Users\Admin\AppData\Local\Temp\detectiv_1.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\detectiv_1.exeC:\Users\Admin\AppData\Local\Temp\detectiv_1.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe /C3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn yymkzhdznt /tr "\"C:\Users\Admin\AppData\Local\Temp\detectiv_1.exe\" /I yymkzhdznt" /SC ONCE /Z /ST 15:36 /ET 15:482⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {0E957DEC-4EC3-4A58-88A0-C52B8AF5C348} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\detectiv_1.exeC:\Users\Admin\AppData\Local\Temp\detectiv_1.exe /I yymkzhdznt2⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa" /d "0"3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exe /C4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\detectiv_1.exe"3⤵
-
C:\Windows\system32\PING.EXEping.exe -n 6 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /DELETE /F /TN yymkzhdznt3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.datMD5
adb83bf35f45250607481cadb02ceb23
SHA1cb41d302fb8a7de419e4b936dea144939320d11d
SHA256df4f992891d1fe7b77967fa535d767a3a61414874ef0076cb43e1522649318a0
SHA51293715f6f1174f5fd1954711e786b0a82e022ba100c0814ba2501f02f548165b2e85709031f98ff69148a8a3282a34e91436a7e922c45c9a6fdd8863d6dfbc54c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exeMD5
fdb6187536274ff2890d75909d2b05c5
SHA1c8be850f5e198618768c7065fb4b2610739a7138
SHA25600734aaab14a7f28395144dc472490d84cdc3e1931ebdee35ddd6411221cff18
SHA51225cb745ece3534fbfb84927a0b1286eb0e0087ac40c7c74525aaa67d04f2393f9edd8c850687ffd09fc3c22c0c2add2adc80f11c7e1d89a4461e6d5c798a969f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exeMD5
fdb6187536274ff2890d75909d2b05c5
SHA1c8be850f5e198618768c7065fb4b2610739a7138
SHA25600734aaab14a7f28395144dc472490d84cdc3e1931ebdee35ddd6411221cff18
SHA51225cb745ece3534fbfb84927a0b1286eb0e0087ac40c7c74525aaa67d04f2393f9edd8c850687ffd09fc3c22c0c2add2adc80f11c7e1d89a4461e6d5c798a969f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exeMD5
fdb6187536274ff2890d75909d2b05c5
SHA1c8be850f5e198618768c7065fb4b2610739a7138
SHA25600734aaab14a7f28395144dc472490d84cdc3e1931ebdee35ddd6411221cff18
SHA51225cb745ece3534fbfb84927a0b1286eb0e0087ac40c7c74525aaa67d04f2393f9edd8c850687ffd09fc3c22c0c2add2adc80f11c7e1d89a4461e6d5c798a969f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exeMD5
fdb6187536274ff2890d75909d2b05c5
SHA1c8be850f5e198618768c7065fb4b2610739a7138
SHA25600734aaab14a7f28395144dc472490d84cdc3e1931ebdee35ddd6411221cff18
SHA51225cb745ece3534fbfb84927a0b1286eb0e0087ac40c7c74525aaa67d04f2393f9edd8c850687ffd09fc3c22c0c2add2adc80f11c7e1d89a4461e6d5c798a969f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exeMD5
fdb6187536274ff2890d75909d2b05c5
SHA1c8be850f5e198618768c7065fb4b2610739a7138
SHA25600734aaab14a7f28395144dc472490d84cdc3e1931ebdee35ddd6411221cff18
SHA51225cb745ece3534fbfb84927a0b1286eb0e0087ac40c7c74525aaa67d04f2393f9edd8c850687ffd09fc3c22c0c2add2adc80f11c7e1d89a4461e6d5c798a969f
-
\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exeMD5
fdb6187536274ff2890d75909d2b05c5
SHA1c8be850f5e198618768c7065fb4b2610739a7138
SHA25600734aaab14a7f28395144dc472490d84cdc3e1931ebdee35ddd6411221cff18
SHA51225cb745ece3534fbfb84927a0b1286eb0e0087ac40c7c74525aaa67d04f2393f9edd8c850687ffd09fc3c22c0c2add2adc80f11c7e1d89a4461e6d5c798a969f
-
\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exeMD5
fdb6187536274ff2890d75909d2b05c5
SHA1c8be850f5e198618768c7065fb4b2610739a7138
SHA25600734aaab14a7f28395144dc472490d84cdc3e1931ebdee35ddd6411221cff18
SHA51225cb745ece3534fbfb84927a0b1286eb0e0087ac40c7c74525aaa67d04f2393f9edd8c850687ffd09fc3c22c0c2add2adc80f11c7e1d89a4461e6d5c798a969f
-
\Users\Admin\AppData\Roaming\Microsoft\Ohzsa\ibaossr.exeMD5
fdb6187536274ff2890d75909d2b05c5
SHA1c8be850f5e198618768c7065fb4b2610739a7138
SHA25600734aaab14a7f28395144dc472490d84cdc3e1931ebdee35ddd6411221cff18
SHA51225cb745ece3534fbfb84927a0b1286eb0e0087ac40c7c74525aaa67d04f2393f9edd8c850687ffd09fc3c22c0c2add2adc80f11c7e1d89a4461e6d5c798a969f
-
memory/316-15-0x0000000000000000-mapping.dmp
-
memory/324-8-0x0000000000000000-mapping.dmp
-
memory/324-10-0x00000000023B0000-0x00000000023C1000-memory.dmpFilesize
68KB
-
memory/412-12-0x0000000000000000-mapping.dmp
-
memory/608-16-0x0000000000000000-mapping.dmp
-
memory/856-18-0x0000000000000000-mapping.dmp
-
memory/892-32-0x00000000025E0000-0x00000000025F1000-memory.dmpFilesize
68KB
-
memory/892-30-0x0000000000000000-mapping.dmp
-
memory/924-4-0x0000000000000000-mapping.dmp
-
memory/924-11-0x0000000001FA0000-0x0000000001FDA000-memory.dmpFilesize
232KB
-
memory/932-19-0x0000000000000000-mapping.dmp
-
memory/1180-17-0x0000000000000000-mapping.dmp
-
memory/1240-22-0x0000000000000000-mapping.dmp
-
memory/1304-0-0x0000000000000000-mapping.dmp
-
memory/1304-1-0x0000000002580000-0x0000000002591000-memory.dmpFilesize
68KB
-
memory/1352-20-0x0000000000000000-mapping.dmp
-
memory/1396-29-0x0000000000000000-mapping.dmp
-
memory/1444-6-0x0000000000000000-mapping.dmp
-
memory/1524-28-0x0000000000000000-mapping.dmp
-
memory/1528-25-0x0000000000000000-mapping.dmp
-
memory/1592-27-0x0000000000000000-mapping.dmp
-
memory/1720-21-0x0000000000000000-mapping.dmp
-
memory/1896-23-0x0000000000000000-mapping.dmp
-
memory/1916-14-0x0000000000000000-mapping.dmp