Analysis
-
max time kernel
148s -
max time network
128s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-02-2021 10:26
Static task
static1
Behavioral task
behavioral1
Sample
e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exe
Resource
win7v20201028
General
-
Target
e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exe
-
Size
698KB
-
MD5
f3e344b63fd98041b0551c0a329e85fb
-
SHA1
ac086b6e0b21648088c8d098c68adfab38927e61
-
SHA256
e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901
-
SHA512
7ead065043f00dee8654f10c358448c9521a2825036cf4c09fbc9f334c9d3815f1cbaae722757968d1347f394da58fbd8aa35ac87c221079cdf0a765af0dfc5a
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe -
Executes dropped EXE 2 IoCs
Processes:
AudioSes.exeAudioSes.exepid process 1204 AudioSes.exe 1332 AudioSes.exe -
Sets file execution options in registry 2 TTPs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1748 cmd.exe -
Loads dropped DLL 3 IoCs
Processes:
e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exeAudioSes.exepid process 292 e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exe 1204 AudioSes.exe 1204 AudioSes.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\GoogIeUpdater = "C:\\ProgramData\\GoogIeUpdater\\79qqs9w1w1o91k7.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogIeUpdater = "\"C:\\ProgramData\\GoogIeUpdater\\79qqs9w1w1o91k7.exe\"" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe -
Processes:
AudioSes.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA AudioSes.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
Processes:
AudioSes.exeexplorer.exepid process 1332 AudioSes.exe 1584 explorer.exe 1584 explorer.exe 1584 explorer.exe 1584 explorer.exe 1584 explorer.exe 1584 explorer.exe 1584 explorer.exe 1584 explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
AudioSes.exedescription pid process target process PID 1204 set thread context of 1332 1204 AudioSes.exe AudioSes.exe -
NSIS installer 10 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\AudioSes.exe nsis_installer_1 \Users\Admin\AppData\Local\Temp\AudioSes.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\AudioSes.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\AudioSes.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\AudioSes.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\AudioSes.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\AudioSes.exe nsis_installer_1 \Users\Admin\AppData\Local\Temp\AudioSes.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\AudioSes.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\AudioSes.exe nsis_installer_2 -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
explorer.exeAudioSes.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AudioSes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AudioSes.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main explorer.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exeexplorer.exepid process 292 e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exe 1584 explorer.exe 1584 explorer.exe 1584 explorer.exe 1584 explorer.exe 1584 explorer.exe 1584 explorer.exe 1584 explorer.exe 1584 explorer.exe 1584 explorer.exe 1584 explorer.exe 1584 explorer.exe 1584 explorer.exe 1584 explorer.exe 1584 explorer.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
AudioSes.exeAudioSes.exeexplorer.exepid process 1204 AudioSes.exe 1332 AudioSes.exe 1332 AudioSes.exe 1584 explorer.exe 1584 explorer.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exeAudioSes.exeexplorer.exedescription pid process Token: SeDebugPrivilege 292 e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exe Token: SeDebugPrivilege 1332 AudioSes.exe Token: SeRestorePrivilege 1332 AudioSes.exe Token: SeBackupPrivilege 1332 AudioSes.exe Token: SeLoadDriverPrivilege 1332 AudioSes.exe Token: SeCreatePagefilePrivilege 1332 AudioSes.exe Token: SeShutdownPrivilege 1332 AudioSes.exe Token: SeTakeOwnershipPrivilege 1332 AudioSes.exe Token: SeChangeNotifyPrivilege 1332 AudioSes.exe Token: SeCreateTokenPrivilege 1332 AudioSes.exe Token: SeMachineAccountPrivilege 1332 AudioSes.exe Token: SeSecurityPrivilege 1332 AudioSes.exe Token: SeAssignPrimaryTokenPrivilege 1332 AudioSes.exe Token: SeCreateGlobalPrivilege 1332 AudioSes.exe Token: 33 1332 AudioSes.exe Token: SeDebugPrivilege 1584 explorer.exe Token: SeRestorePrivilege 1584 explorer.exe Token: SeBackupPrivilege 1584 explorer.exe Token: SeLoadDriverPrivilege 1584 explorer.exe Token: SeCreatePagefilePrivilege 1584 explorer.exe Token: SeShutdownPrivilege 1584 explorer.exe Token: SeTakeOwnershipPrivilege 1584 explorer.exe Token: SeChangeNotifyPrivilege 1584 explorer.exe Token: SeCreateTokenPrivilege 1584 explorer.exe Token: SeMachineAccountPrivilege 1584 explorer.exe Token: SeSecurityPrivilege 1584 explorer.exe Token: SeAssignPrimaryTokenPrivilege 1584 explorer.exe Token: SeCreateGlobalPrivilege 1584 explorer.exe Token: 33 1584 explorer.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.execmd.exeAudioSes.exeAudioSes.exeexplorer.exedescription pid process target process PID 292 wrote to memory of 1204 292 e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exe AudioSes.exe PID 292 wrote to memory of 1204 292 e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exe AudioSes.exe PID 292 wrote to memory of 1204 292 e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exe AudioSes.exe PID 292 wrote to memory of 1204 292 e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exe AudioSes.exe PID 292 wrote to memory of 1748 292 e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exe cmd.exe PID 292 wrote to memory of 1748 292 e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exe cmd.exe PID 292 wrote to memory of 1748 292 e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exe cmd.exe PID 292 wrote to memory of 1748 292 e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exe cmd.exe PID 1748 wrote to memory of 1708 1748 cmd.exe PING.EXE PID 1748 wrote to memory of 1708 1748 cmd.exe PING.EXE PID 1748 wrote to memory of 1708 1748 cmd.exe PING.EXE PID 1748 wrote to memory of 1708 1748 cmd.exe PING.EXE PID 1748 wrote to memory of 1308 1748 cmd.exe PING.EXE PID 1748 wrote to memory of 1308 1748 cmd.exe PING.EXE PID 1748 wrote to memory of 1308 1748 cmd.exe PING.EXE PID 1748 wrote to memory of 1308 1748 cmd.exe PING.EXE PID 1204 wrote to memory of 1332 1204 AudioSes.exe AudioSes.exe PID 1204 wrote to memory of 1332 1204 AudioSes.exe AudioSes.exe PID 1204 wrote to memory of 1332 1204 AudioSes.exe AudioSes.exe PID 1204 wrote to memory of 1332 1204 AudioSes.exe AudioSes.exe PID 1204 wrote to memory of 1332 1204 AudioSes.exe AudioSes.exe PID 1332 wrote to memory of 1584 1332 AudioSes.exe explorer.exe PID 1332 wrote to memory of 1584 1332 AudioSes.exe explorer.exe PID 1332 wrote to memory of 1584 1332 AudioSes.exe explorer.exe PID 1332 wrote to memory of 1584 1332 AudioSes.exe explorer.exe PID 1332 wrote to memory of 1584 1332 AudioSes.exe explorer.exe PID 1332 wrote to memory of 1584 1332 AudioSes.exe explorer.exe PID 1332 wrote to memory of 1584 1332 AudioSes.exe explorer.exe PID 1584 wrote to memory of 1232 1584 explorer.exe Dwm.exe PID 1584 wrote to memory of 1232 1584 explorer.exe Dwm.exe PID 1584 wrote to memory of 1232 1584 explorer.exe Dwm.exe PID 1584 wrote to memory of 1232 1584 explorer.exe Dwm.exe PID 1584 wrote to memory of 1232 1584 explorer.exe Dwm.exe PID 1584 wrote to memory of 1232 1584 explorer.exe Dwm.exe PID 1584 wrote to memory of 1268 1584 explorer.exe Explorer.EXE PID 1584 wrote to memory of 1268 1584 explorer.exe Explorer.EXE PID 1584 wrote to memory of 1268 1584 explorer.exe Explorer.EXE PID 1584 wrote to memory of 1268 1584 explorer.exe Explorer.EXE PID 1584 wrote to memory of 1268 1584 explorer.exe Explorer.EXE PID 1584 wrote to memory of 1268 1584 explorer.exe Explorer.EXE
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exe"C:\Users\Admin\AppData\Local\Temp\e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AudioSes.exe"C:\Users\Admin\AppData\Local\Temp\AudioSes.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AudioSes.exe"C:\Users\Admin\AppData\Local\Temp\AudioSes.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe5⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 1004⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 9004⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AudioSes.exeMD5
043af181d5788fae0a7bc3faf74c287e
SHA1f2a20f5ffd9d2a0cff50c9a030c88e3943a0c65f
SHA25621e58ba4dddbb85983c87192bd76812f06bec3c48582fde844aaf7c16fcbb196
SHA51299108600ca35f217f2cf118ffdf01f983cea903d3bca94d085dfd40e1a91f32eed66a4e8d2655678ee9580c91be2de78a8da4c321c2fae26a7705fcf0d57dda5
-
C:\Users\Admin\AppData\Local\Temp\AudioSes.exeMD5
043af181d5788fae0a7bc3faf74c287e
SHA1f2a20f5ffd9d2a0cff50c9a030c88e3943a0c65f
SHA25621e58ba4dddbb85983c87192bd76812f06bec3c48582fde844aaf7c16fcbb196
SHA51299108600ca35f217f2cf118ffdf01f983cea903d3bca94d085dfd40e1a91f32eed66a4e8d2655678ee9580c91be2de78a8da4c321c2fae26a7705fcf0d57dda5
-
C:\Users\Admin\AppData\Local\Temp\AudioSes.exeMD5
043af181d5788fae0a7bc3faf74c287e
SHA1f2a20f5ffd9d2a0cff50c9a030c88e3943a0c65f
SHA25621e58ba4dddbb85983c87192bd76812f06bec3c48582fde844aaf7c16fcbb196
SHA51299108600ca35f217f2cf118ffdf01f983cea903d3bca94d085dfd40e1a91f32eed66a4e8d2655678ee9580c91be2de78a8da4c321c2fae26a7705fcf0d57dda5
-
\Users\Admin\AppData\Local\Temp\AudioSes.exeMD5
043af181d5788fae0a7bc3faf74c287e
SHA1f2a20f5ffd9d2a0cff50c9a030c88e3943a0c65f
SHA25621e58ba4dddbb85983c87192bd76812f06bec3c48582fde844aaf7c16fcbb196
SHA51299108600ca35f217f2cf118ffdf01f983cea903d3bca94d085dfd40e1a91f32eed66a4e8d2655678ee9580c91be2de78a8da4c321c2fae26a7705fcf0d57dda5
-
\Users\Admin\AppData\Local\Temp\AudioSes.exeMD5
043af181d5788fae0a7bc3faf74c287e
SHA1f2a20f5ffd9d2a0cff50c9a030c88e3943a0c65f
SHA25621e58ba4dddbb85983c87192bd76812f06bec3c48582fde844aaf7c16fcbb196
SHA51299108600ca35f217f2cf118ffdf01f983cea903d3bca94d085dfd40e1a91f32eed66a4e8d2655678ee9580c91be2de78a8da4c321c2fae26a7705fcf0d57dda5
-
\Users\Admin\AppData\Local\Temp\nsi175A.tmp\System.dllMD5
3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA256fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
SHA5120a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
-
memory/292-6-0x0000000004A01000-0x0000000004A02000-memory.dmpFilesize
4KB
-
memory/292-7-0x0000000004A02000-0x0000000004A03000-memory.dmpFilesize
4KB
-
memory/292-12-0x0000000001FC0000-0x0000000001FC1000-memory.dmpFilesize
4KB
-
memory/292-2-0x0000000001F10000-0x0000000001F21000-memory.dmpFilesize
68KB
-
memory/292-8-0x0000000004A03000-0x0000000004A04000-memory.dmpFilesize
4KB
-
memory/292-13-0x0000000004A0A000-0x0000000004A1B000-memory.dmpFilesize
68KB
-
memory/292-3-0x00000000748A0000-0x0000000074F8E000-memory.dmpFilesize
6.9MB
-
memory/292-9-0x0000000004A04000-0x0000000004A06000-memory.dmpFilesize
8KB
-
memory/292-5-0x0000000004810000-0x000000000489B000-memory.dmpFilesize
556KB
-
memory/292-4-0x00000000048A0000-0x000000000492D000-memory.dmpFilesize
564KB
-
memory/1204-15-0x0000000076861000-0x0000000076863000-memory.dmpFilesize
8KB
-
memory/1204-11-0x0000000000000000-mapping.dmp
-
memory/1204-21-0x0000000009490000-0x00000000094C7000-memory.dmpFilesize
220KB
-
memory/1268-44-0x0000000002640000-0x0000000002646000-memory.dmpFilesize
24KB
-
memory/1308-20-0x0000000000000000-mapping.dmp
-
memory/1332-41-0x00000000024E0000-0x00000000024E1000-memory.dmpFilesize
4KB
-
memory/1332-30-0x00000000024F0000-0x00000000024FC000-memory.dmpFilesize
48KB
-
memory/1332-26-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1332-27-0x0000000000310000-0x0000000000376000-memory.dmpFilesize
408KB
-
memory/1332-31-0x00000000005E0000-0x00000000005ED000-memory.dmpFilesize
52KB
-
memory/1332-28-0x00000000005D0000-0x00000000005D1000-memory.dmpFilesize
4KB
-
memory/1332-23-0x00000000004015C6-mapping.dmp
-
memory/1332-29-0x0000000001D70000-0x0000000001D71000-memory.dmpFilesize
4KB
-
memory/1584-32-0x0000000000000000-mapping.dmp
-
memory/1584-34-0x0000000075481000-0x0000000075483000-memory.dmpFilesize
8KB
-
memory/1584-35-0x0000000077E40000-0x0000000077FC1000-memory.dmpFilesize
1.5MB
-
memory/1584-36-0x0000000000090000-0x0000000000166000-memory.dmpFilesize
856KB
-
memory/1584-40-0x0000000000750000-0x000000000075C000-memory.dmpFilesize
48KB
-
memory/1584-43-0x0000000000810000-0x0000000000812000-memory.dmpFilesize
8KB
-
memory/1708-19-0x0000000000000000-mapping.dmp
-
memory/1748-16-0x0000000000000000-mapping.dmp