Analysis
-
max time kernel
138s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-02-2021 08:16
Static task
static1
Behavioral task
behavioral1
Sample
FedEx's AWB#5305323204643.exe
Resource
win7v20201028
General
-
Target
FedEx's AWB#5305323204643.exe
-
Size
20KB
-
MD5
b3e24269e8f4d613dab013ba26e08f8a
-
SHA1
81adf63b98379e81b82925ccc64c7a219b81a7fd
-
SHA256
3dfc4c40e95c69c2f87baf8ce364a350823404e78bb4ed97807330f398753f76
-
SHA512
477d9eefcd769cceb181df5d11038b8d9ca6b8a42d027b15cdb0c7eb0999e228041b0a86fa746ed26b1adf1e2bc73a83acff9751fba9816570945ca0d23176ea
Malware Config
Extracted
nanocore
1.2.2.0
185.157.160.233:2212
annapro.linkpc.net:2212
5c958888-f81c-42a4-939d-31983a2cd9ba
-
activate_away_mode
true
-
backup_connection_host
annapro.linkpc.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-10-24T06:39:59.095270636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2212
-
default_group
wuzzy122
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
5c958888-f81c-42a4-939d-31983a2cd9ba
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
185.157.160.233
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Nirsoft 7 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\AdvancedRun.exe Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepid process 1008 AdvancedRun.exe 1112 AdvancedRun.exe -
Loads dropped DLL 4 IoCs
Processes:
FedEx's AWB#5305323204643.exeAdvancedRun.exepid process 1044 FedEx's AWB#5305323204643.exe 1044 FedEx's AWB#5305323204643.exe 1008 AdvancedRun.exe 1008 AdvancedRun.exe -
Processes:
FedEx's AWB#5305323204643.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe = "0" FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" FedEx's AWB#5305323204643.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Resources\Themes\OGQgtbhjcqQVstkulzRPyghcHKV\svchost.exe = "0" FedEx's AWB#5305323204643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" FedEx's AWB#5305323204643.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
FedEx's AWB#5305323204643.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lAKVROuKlb = "explorer.exe \"C:\\Windows\\Resources\\Themes\\OGQgtbhjcqQVstkulzRPyghcHKV\\svchost.exe\"" FedEx's AWB#5305323204643.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
Processes:
FedEx's AWB#5305323204643.exepid process 1044 FedEx's AWB#5305323204643.exe 1044 FedEx's AWB#5305323204643.exe 1044 FedEx's AWB#5305323204643.exe 1044 FedEx's AWB#5305323204643.exe 1044 FedEx's AWB#5305323204643.exe 1044 FedEx's AWB#5305323204643.exe 1044 FedEx's AWB#5305323204643.exe 1044 FedEx's AWB#5305323204643.exe 1044 FedEx's AWB#5305323204643.exe 1044 FedEx's AWB#5305323204643.exe 1044 FedEx's AWB#5305323204643.exe 1044 FedEx's AWB#5305323204643.exe 1044 FedEx's AWB#5305323204643.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
FedEx's AWB#5305323204643.exedescription pid process target process PID 1044 set thread context of 1816 1044 FedEx's AWB#5305323204643.exe installutil.exe -
Drops file in Windows directory 2 IoCs
Processes:
FedEx's AWB#5305323204643.exedescription ioc process File created C:\Windows\Resources\Themes\OGQgtbhjcqQVstkulzRPyghcHKV\svchost.exe FedEx's AWB#5305323204643.exe File opened for modification C:\Windows\Resources\Themes\OGQgtbhjcqQVstkulzRPyghcHKV\svchost.exe FedEx's AWB#5305323204643.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1280 1044 WerFault.exe FedEx's AWB#5305323204643.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1744 timeout.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepowershell.exepowershell.exeFedEx's AWB#5305323204643.exeWerFault.exeinstallutil.exepid process 1008 AdvancedRun.exe 1008 AdvancedRun.exe 1112 AdvancedRun.exe 1112 AdvancedRun.exe 1568 powershell.exe 1568 powershell.exe 1476 powershell.exe 1476 powershell.exe 1044 FedEx's AWB#5305323204643.exe 1044 FedEx's AWB#5305323204643.exe 1044 FedEx's AWB#5305323204643.exe 1280 WerFault.exe 1280 WerFault.exe 1280 WerFault.exe 1280 WerFault.exe 1280 WerFault.exe 1816 installutil.exe 1816 installutil.exe 1816 installutil.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
installutil.exepid process 1816 installutil.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
FedEx's AWB#5305323204643.exeAdvancedRun.exeAdvancedRun.exepowershell.exepowershell.exeWerFault.exeinstallutil.exedescription pid process Token: SeDebugPrivilege 1044 FedEx's AWB#5305323204643.exe Token: SeDebugPrivilege 1008 AdvancedRun.exe Token: SeImpersonatePrivilege 1008 AdvancedRun.exe Token: SeDebugPrivilege 1112 AdvancedRun.exe Token: SeImpersonatePrivilege 1112 AdvancedRun.exe Token: SeDebugPrivilege 1568 powershell.exe Token: SeDebugPrivilege 1476 powershell.exe Token: SeDebugPrivilege 1280 WerFault.exe Token: SeDebugPrivilege 1816 installutil.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
FedEx's AWB#5305323204643.exeAdvancedRun.execmd.exedescription pid process target process PID 1044 wrote to memory of 1568 1044 FedEx's AWB#5305323204643.exe powershell.exe PID 1044 wrote to memory of 1568 1044 FedEx's AWB#5305323204643.exe powershell.exe PID 1044 wrote to memory of 1568 1044 FedEx's AWB#5305323204643.exe powershell.exe PID 1044 wrote to memory of 1568 1044 FedEx's AWB#5305323204643.exe powershell.exe PID 1044 wrote to memory of 1008 1044 FedEx's AWB#5305323204643.exe AdvancedRun.exe PID 1044 wrote to memory of 1008 1044 FedEx's AWB#5305323204643.exe AdvancedRun.exe PID 1044 wrote to memory of 1008 1044 FedEx's AWB#5305323204643.exe AdvancedRun.exe PID 1044 wrote to memory of 1008 1044 FedEx's AWB#5305323204643.exe AdvancedRun.exe PID 1008 wrote to memory of 1112 1008 AdvancedRun.exe AdvancedRun.exe PID 1008 wrote to memory of 1112 1008 AdvancedRun.exe AdvancedRun.exe PID 1008 wrote to memory of 1112 1008 AdvancedRun.exe AdvancedRun.exe PID 1008 wrote to memory of 1112 1008 AdvancedRun.exe AdvancedRun.exe PID 1044 wrote to memory of 1476 1044 FedEx's AWB#5305323204643.exe powershell.exe PID 1044 wrote to memory of 1476 1044 FedEx's AWB#5305323204643.exe powershell.exe PID 1044 wrote to memory of 1476 1044 FedEx's AWB#5305323204643.exe powershell.exe PID 1044 wrote to memory of 1476 1044 FedEx's AWB#5305323204643.exe powershell.exe PID 1044 wrote to memory of 436 1044 FedEx's AWB#5305323204643.exe cmd.exe PID 1044 wrote to memory of 436 1044 FedEx's AWB#5305323204643.exe cmd.exe PID 1044 wrote to memory of 436 1044 FedEx's AWB#5305323204643.exe cmd.exe PID 1044 wrote to memory of 436 1044 FedEx's AWB#5305323204643.exe cmd.exe PID 436 wrote to memory of 1744 436 cmd.exe timeout.exe PID 436 wrote to memory of 1744 436 cmd.exe timeout.exe PID 436 wrote to memory of 1744 436 cmd.exe timeout.exe PID 436 wrote to memory of 1744 436 cmd.exe timeout.exe PID 1044 wrote to memory of 1816 1044 FedEx's AWB#5305323204643.exe installutil.exe PID 1044 wrote to memory of 1816 1044 FedEx's AWB#5305323204643.exe installutil.exe PID 1044 wrote to memory of 1816 1044 FedEx's AWB#5305323204643.exe installutil.exe PID 1044 wrote to memory of 1816 1044 FedEx's AWB#5305323204643.exe installutil.exe PID 1044 wrote to memory of 1816 1044 FedEx's AWB#5305323204643.exe installutil.exe PID 1044 wrote to memory of 1816 1044 FedEx's AWB#5305323204643.exe installutil.exe PID 1044 wrote to memory of 1816 1044 FedEx's AWB#5305323204643.exe installutil.exe PID 1044 wrote to memory of 1816 1044 FedEx's AWB#5305323204643.exe installutil.exe PID 1044 wrote to memory of 1816 1044 FedEx's AWB#5305323204643.exe installutil.exe PID 1044 wrote to memory of 1816 1044 FedEx's AWB#5305323204643.exe installutil.exe PID 1044 wrote to memory of 1816 1044 FedEx's AWB#5305323204643.exe installutil.exe PID 1044 wrote to memory of 1816 1044 FedEx's AWB#5305323204643.exe installutil.exe PID 1044 wrote to memory of 1280 1044 FedEx's AWB#5305323204643.exe WerFault.exe PID 1044 wrote to memory of 1280 1044 FedEx's AWB#5305323204643.exe WerFault.exe PID 1044 wrote to memory of 1280 1044 FedEx's AWB#5305323204643.exe WerFault.exe PID 1044 wrote to memory of 1280 1044 FedEx's AWB#5305323204643.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe"C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe"1⤵
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\OGQgtbhjcqQVstkulzRPyghcHKV\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\AdvancedRun.exe" /SpecialRun 4101d8 10083⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FedEx's AWB#5305323204643.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 15082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
17244216cf60be4875a3d62451ff64e9
SHA177f0541ef7f5163207ea8a218da58251bb0df4ce
SHA2563310fc1440034f3e54223984d816b674422698cb7e6a424fc2b1cd060e8d2a38
SHA51249578dd68d2e29b6884789bf8cbc9df52d55d0244dff6c12da49ea61ec1365b3b3f4c6e522ebfbe8e4818ea87a7cef0cb03af0a8b4036776bb5cf7e9ec599dd7
-
\Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\35b74b73-f4c5-40ea-accd-0eec8b037dac\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
memory/436-30-0x0000000000000000-mapping.dmp
-
memory/1008-11-0x0000000000000000-mapping.dmp
-
memory/1044-6-0x0000000000950000-0x00000000009F9000-memory.dmpFilesize
676KB
-
memory/1044-2-0x0000000074110000-0x00000000747FE000-memory.dmpFilesize
6.9MB
-
memory/1044-5-0x0000000000420000-0x0000000000421000-memory.dmpFilesize
4KB
-
memory/1044-3-0x0000000000D70000-0x0000000000D71000-memory.dmpFilesize
4KB
-
memory/1112-20-0x0000000000000000-mapping.dmp
-
memory/1280-78-0x0000000001E90000-0x0000000001EA1000-memory.dmpFilesize
68KB
-
memory/1280-75-0x0000000000000000-mapping.dmp
-
memory/1280-80-0x00000000005C0000-0x00000000005C1000-memory.dmpFilesize
4KB
-
memory/1476-46-0x00000000049C2000-0x00000000049C3000-memory.dmpFilesize
4KB
-
memory/1476-45-0x00000000049C0000-0x00000000049C1000-memory.dmpFilesize
4KB
-
memory/1476-31-0x0000000074110000-0x00000000747FE000-memory.dmpFilesize
6.9MB
-
memory/1476-27-0x0000000000000000-mapping.dmp
-
memory/1568-15-0x0000000074110000-0x00000000747FE000-memory.dmpFilesize
6.9MB
-
memory/1568-70-0x00000000065C0000-0x00000000065C1000-memory.dmpFilesize
4KB
-
memory/1568-25-0x00000000011E0000-0x00000000011E1000-memory.dmpFilesize
4KB
-
memory/1568-24-0x00000000049F2000-0x00000000049F3000-memory.dmpFilesize
4KB
-
memory/1568-7-0x0000000000000000-mapping.dmp
-
memory/1568-38-0x0000000006070000-0x0000000006071000-memory.dmpFilesize
4KB
-
memory/1568-44-0x00000000060B0000-0x00000000060B1000-memory.dmpFilesize
4KB
-
memory/1568-23-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB
-
memory/1568-19-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/1568-47-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1568-48-0x00000000061A0000-0x00000000061A1000-memory.dmpFilesize
4KB
-
memory/1568-55-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/1568-56-0x00000000062B0000-0x00000000062B1000-memory.dmpFilesize
4KB
-
memory/1568-26-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/1568-71-0x00000000065D0000-0x00000000065D1000-memory.dmpFilesize
4KB
-
memory/1568-8-0x00000000760A1000-0x00000000760A3000-memory.dmpFilesize
8KB
-
memory/1568-18-0x00000000009B0000-0x00000000009B1000-memory.dmpFilesize
4KB
-
memory/1744-34-0x0000000000000000-mapping.dmp
-
memory/1816-74-0x0000000074110000-0x00000000747FE000-memory.dmpFilesize
6.9MB
-
memory/1816-73-0x000000000041E792-mapping.dmp
-
memory/1816-76-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1816-72-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1816-79-0x0000000004810000-0x0000000004811000-memory.dmpFilesize
4KB
-
memory/1816-81-0x00000000003C0000-0x00000000003C5000-memory.dmpFilesize
20KB
-
memory/1816-82-0x00000000003D0000-0x00000000003E9000-memory.dmpFilesize
100KB
-
memory/1816-83-0x00000000003F0000-0x00000000003F3000-memory.dmpFilesize
12KB
-
memory/1816-84-0x0000000004815000-0x0000000004826000-memory.dmpFilesize
68KB