Analysis
-
max time kernel
79s -
max time network
156s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
14-10-2021 10:15
Static task
static1
Behavioral task
behavioral1
Sample
DHL_document11022020680908911.exe
Resource
win7v20210408
General
-
Target
DHL_document11022020680908911.exe
-
Size
215KB
-
MD5
f5740e959f892407f13054de42748917
-
SHA1
ff4f01986dae809ebfbb807fbc88301dd5e7a23a
-
SHA256
8bd97a0d17f61d747de38b520274c6afcb52cf89ce87a1818866428f1416ef1c
-
SHA512
8172375d875d13c37f47bef437eb7bb46c92c57fabe01b67976d557bfcca42ff142b2194b3a675dd4bb6808b73a454984963784741fe3e3a0763e3d7d52d7b60
Malware Config
Extracted
nanocore
1.2.2.0
195.133.18.136:3106
youngsouth.duckdns.org:3106
57234f5b-55f8-460c-8f66-69edf39e1138
-
activate_away_mode
true
-
backup_connection_host
youngsouth.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-07-23T14:15:23.128199136Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
true
-
connect_delay
4000
-
connection_port
3106
-
default_group
October
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
57234f5b-55f8-460c-8f66-69edf39e1138
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
195.133.18.136
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
suricata: ET MALWARE Possible NanoCore C2 60B
suricata: ET MALWARE Possible NanoCore C2 60B
-
Nirsoft 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\46357261-0e2a-4feb-8de0-b6cf15711ab0\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\46357261-0e2a-4feb-8de0-b6cf15711ab0\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\46357261-0e2a-4feb-8de0-b6cf15711ab0\AdvancedRun.exe Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepid process 1524 AdvancedRun.exe 684 AdvancedRun.exe -
Processes:
DHL_document11022020680908911.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" DHL_document11022020680908911.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions DHL_document11022020680908911.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet DHL_document11022020680908911.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" DHL_document11022020680908911.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" DHL_document11022020680908911.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" DHL_document11022020680908911.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features DHL_document11022020680908911.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths DHL_document11022020680908911.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\DHL_document11022020680908911.exe = "0" DHL_document11022020680908911.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection DHL_document11022020680908911.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
DHL_document11022020680908911.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Service = "C:\\Program Files (x86)\\SCSI Service\\scsisvc.exe" DHL_document11022020680908911.exe -
Processes:
DHL_document11022020680908911.exeDHL_document11022020680908911.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DHL_document11022020680908911.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DHL_document11022020680908911.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" DHL_document11022020680908911.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
Processes:
DHL_document11022020680908911.exepid process 2352 DHL_document11022020680908911.exe 2352 DHL_document11022020680908911.exe 2352 DHL_document11022020680908911.exe 2352 DHL_document11022020680908911.exe 2352 DHL_document11022020680908911.exe 2352 DHL_document11022020680908911.exe 2352 DHL_document11022020680908911.exe 2352 DHL_document11022020680908911.exe 2352 DHL_document11022020680908911.exe 2352 DHL_document11022020680908911.exe 2352 DHL_document11022020680908911.exe 2352 DHL_document11022020680908911.exe 2352 DHL_document11022020680908911.exe 2352 DHL_document11022020680908911.exe 2352 DHL_document11022020680908911.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
DHL_document11022020680908911.exedescription pid process target process PID 2352 set thread context of 604 2352 DHL_document11022020680908911.exe DHL_document11022020680908911.exe -
Drops file in Program Files directory 2 IoCs
Processes:
DHL_document11022020680908911.exedescription ioc process File opened for modification C:\Program Files (x86)\SCSI Service\scsisvc.exe DHL_document11022020680908911.exe File created C:\Program Files (x86)\SCSI Service\scsisvc.exe DHL_document11022020680908911.exe -
Drops file in Windows directory 1 IoCs
Processes:
WerFault.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3296 2352 WerFault.exe DHL_document11022020680908911.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exeDHL_document11022020680908911.exepowershell.exepowershell.exeDHL_document11022020680908911.exeWerFault.exepid process 1524 AdvancedRun.exe 1524 AdvancedRun.exe 1524 AdvancedRun.exe 1524 AdvancedRun.exe 684 AdvancedRun.exe 684 AdvancedRun.exe 684 AdvancedRun.exe 684 AdvancedRun.exe 2352 DHL_document11022020680908911.exe 2352 DHL_document11022020680908911.exe 2352 DHL_document11022020680908911.exe 2352 DHL_document11022020680908911.exe 2352 DHL_document11022020680908911.exe 1900 powershell.exe 3540 powershell.exe 3540 powershell.exe 1900 powershell.exe 604 DHL_document11022020680908911.exe 604 DHL_document11022020680908911.exe 604 DHL_document11022020680908911.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 3296 WerFault.exe 604 DHL_document11022020680908911.exe 604 DHL_document11022020680908911.exe 604 DHL_document11022020680908911.exe 3540 powershell.exe 1900 powershell.exe 604 DHL_document11022020680908911.exe 604 DHL_document11022020680908911.exe 604 DHL_document11022020680908911.exe 604 DHL_document11022020680908911.exe 604 DHL_document11022020680908911.exe 604 DHL_document11022020680908911.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
DHL_document11022020680908911.exepid process 604 DHL_document11022020680908911.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
DHL_document11022020680908911.exeAdvancedRun.exeAdvancedRun.exepowershell.exepowershell.exeWerFault.exeDHL_document11022020680908911.exedescription pid process Token: SeDebugPrivilege 2352 DHL_document11022020680908911.exe Token: SeDebugPrivilege 1524 AdvancedRun.exe Token: SeImpersonatePrivilege 1524 AdvancedRun.exe Token: SeDebugPrivilege 684 AdvancedRun.exe Token: SeImpersonatePrivilege 684 AdvancedRun.exe Token: SeDebugPrivilege 1900 powershell.exe Token: SeDebugPrivilege 3540 powershell.exe Token: SeRestorePrivilege 3296 WerFault.exe Token: SeBackupPrivilege 3296 WerFault.exe Token: SeBackupPrivilege 3296 WerFault.exe Token: SeDebugPrivilege 604 DHL_document11022020680908911.exe Token: SeDebugPrivilege 3296 WerFault.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
DHL_document11022020680908911.exeAdvancedRun.exedescription pid process target process PID 2352 wrote to memory of 1524 2352 DHL_document11022020680908911.exe AdvancedRun.exe PID 2352 wrote to memory of 1524 2352 DHL_document11022020680908911.exe AdvancedRun.exe PID 2352 wrote to memory of 1524 2352 DHL_document11022020680908911.exe AdvancedRun.exe PID 1524 wrote to memory of 684 1524 AdvancedRun.exe AdvancedRun.exe PID 1524 wrote to memory of 684 1524 AdvancedRun.exe AdvancedRun.exe PID 1524 wrote to memory of 684 1524 AdvancedRun.exe AdvancedRun.exe PID 2352 wrote to memory of 3540 2352 DHL_document11022020680908911.exe powershell.exe PID 2352 wrote to memory of 3540 2352 DHL_document11022020680908911.exe powershell.exe PID 2352 wrote to memory of 3540 2352 DHL_document11022020680908911.exe powershell.exe PID 2352 wrote to memory of 1900 2352 DHL_document11022020680908911.exe powershell.exe PID 2352 wrote to memory of 1900 2352 DHL_document11022020680908911.exe powershell.exe PID 2352 wrote to memory of 1900 2352 DHL_document11022020680908911.exe powershell.exe PID 2352 wrote to memory of 396 2352 DHL_document11022020680908911.exe DHL_document11022020680908911.exe PID 2352 wrote to memory of 396 2352 DHL_document11022020680908911.exe DHL_document11022020680908911.exe PID 2352 wrote to memory of 396 2352 DHL_document11022020680908911.exe DHL_document11022020680908911.exe PID 2352 wrote to memory of 604 2352 DHL_document11022020680908911.exe DHL_document11022020680908911.exe PID 2352 wrote to memory of 604 2352 DHL_document11022020680908911.exe DHL_document11022020680908911.exe PID 2352 wrote to memory of 604 2352 DHL_document11022020680908911.exe DHL_document11022020680908911.exe PID 2352 wrote to memory of 604 2352 DHL_document11022020680908911.exe DHL_document11022020680908911.exe PID 2352 wrote to memory of 604 2352 DHL_document11022020680908911.exe DHL_document11022020680908911.exe PID 2352 wrote to memory of 604 2352 DHL_document11022020680908911.exe DHL_document11022020680908911.exe PID 2352 wrote to memory of 604 2352 DHL_document11022020680908911.exe DHL_document11022020680908911.exe PID 2352 wrote to memory of 604 2352 DHL_document11022020680908911.exe DHL_document11022020680908911.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
DHL_document11022020680908911.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" DHL_document11022020680908911.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL_document11022020680908911.exe"C:\Users\Admin\AppData\Local\Temp\DHL_document11022020680908911.exe"1⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\46357261-0e2a-4feb-8de0-b6cf15711ab0\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\46357261-0e2a-4feb-8de0-b6cf15711ab0\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\46357261-0e2a-4feb-8de0-b6cf15711ab0\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\46357261-0e2a-4feb-8de0-b6cf15711ab0\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\46357261-0e2a-4feb-8de0-b6cf15711ab0\AdvancedRun.exe" /SpecialRun 4101d8 15243⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DHL_document11022020680908911.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DHL_document11022020680908911.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\DHL_document11022020680908911.exe"C:\Users\Admin\AppData\Local\Temp\DHL_document11022020680908911.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL_document11022020680908911.exe"C:\Users\Admin\AppData\Local\Temp\DHL_document11022020680908911.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 21962⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
f791fb6b292bb51cafc1b6c3a450eef3
SHA1405ab7cef15bae77d6bbd11d53af7ae786fc305e
SHA25658ac81debdbd5801d97a3ab6d581f8e925ca88c6954c47616e6a2009b3d0a823
SHA5122bdfaa9b23017008d5114b6866b4443f2efea80c5fb3fc2ac79f39c21a8ab31686129b6809fa48e5b11aadbf96422d81864f6f01e76819275005a9987b0a99aa
-
C:\Users\Admin\AppData\Local\Temp\46357261-0e2a-4feb-8de0-b6cf15711ab0\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\46357261-0e2a-4feb-8de0-b6cf15711ab0\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\46357261-0e2a-4feb-8de0-b6cf15711ab0\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
memory/604-157-0x0000000004E00000-0x00000000052FE000-memory.dmpFilesize
5.0MB
-
memory/604-173-0x00000000061C0000-0x00000000061CF000-memory.dmpFilesize
60KB
-
memory/604-171-0x00000000061A0000-0x00000000061AD000-memory.dmpFilesize
52KB
-
memory/604-169-0x0000000006180000-0x0000000006186000-memory.dmpFilesize
24KB
-
memory/604-151-0x0000000004D20000-0x0000000004D21000-memory.dmpFilesize
4KB
-
memory/604-167-0x0000000006150000-0x0000000006156000-memory.dmpFilesize
24KB
-
memory/604-168-0x0000000006170000-0x000000000617C000-memory.dmpFilesize
48KB
-
memory/604-166-0x0000000006120000-0x0000000006135000-memory.dmpFilesize
84KB
-
memory/604-165-0x0000000006110000-0x000000000611D000-memory.dmpFilesize
52KB
-
memory/604-172-0x00000000061B0000-0x00000000061B9000-memory.dmpFilesize
36KB
-
memory/604-175-0x00000000061F0000-0x0000000006219000-memory.dmpFilesize
164KB
-
memory/604-176-0x0000000006230000-0x000000000623F000-memory.dmpFilesize
60KB
-
memory/604-160-0x0000000005AF0000-0x0000000005AF3000-memory.dmpFilesize
12KB
-
memory/604-135-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/604-136-0x000000000041E792-mapping.dmp
-
memory/604-159-0x0000000005000000-0x0000000005019000-memory.dmpFilesize
100KB
-
memory/604-158-0x0000000004E90000-0x0000000004E95000-memory.dmpFilesize
20KB
-
memory/604-170-0x0000000006190000-0x0000000006197000-memory.dmpFilesize
28KB
-
memory/604-174-0x00000000061E0000-0x00000000061EA000-memory.dmpFilesize
40KB
-
memory/684-125-0x0000000000000000-mapping.dmp
-
memory/1524-122-0x0000000000000000-mapping.dmp
-
memory/1900-131-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/1900-252-0x0000000006A83000-0x0000000006A84000-memory.dmpFilesize
4KB
-
memory/1900-179-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/1900-140-0x0000000006A80000-0x0000000006A81000-memory.dmpFilesize
4KB
-
memory/1900-141-0x0000000006A82000-0x0000000006A83000-memory.dmpFilesize
4KB
-
memory/1900-192-0x0000000008E40000-0x0000000008E73000-memory.dmpFilesize
204KB
-
memory/1900-216-0x000000007F6C0000-0x000000007F6C1000-memory.dmpFilesize
4KB
-
memory/1900-148-0x0000000006FD0000-0x0000000006FD1000-memory.dmpFilesize
4KB
-
memory/1900-132-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/1900-128-0x0000000000000000-mapping.dmp
-
memory/2352-115-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/2352-117-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB
-
memory/2352-118-0x0000000004560000-0x00000000045F9000-memory.dmpFilesize
612KB
-
memory/2352-119-0x0000000007E80000-0x0000000007E81000-memory.dmpFilesize
4KB
-
memory/2352-120-0x0000000007980000-0x0000000007981000-memory.dmpFilesize
4KB
-
memory/2352-121-0x0000000007A20000-0x0000000007A21000-memory.dmpFilesize
4KB
-
memory/3540-129-0x0000000003300000-0x0000000003301000-memory.dmpFilesize
4KB
-
memory/3540-163-0x00000000089C0000-0x00000000089C1000-memory.dmpFilesize
4KB
-
memory/3540-161-0x0000000007EA0000-0x0000000007EA1000-memory.dmpFilesize
4KB
-
memory/3540-155-0x0000000008110000-0x0000000008111000-memory.dmpFilesize
4KB
-
memory/3540-153-0x0000000007EC0000-0x0000000007EC1000-memory.dmpFilesize
4KB
-
memory/3540-150-0x00000000080A0000-0x00000000080A1000-memory.dmpFilesize
4KB
-
memory/3540-177-0x0000000008860000-0x0000000008861000-memory.dmpFilesize
4KB
-
memory/3540-139-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/3540-181-0x0000000003300000-0x0000000003301000-memory.dmpFilesize
4KB
-
memory/3540-142-0x0000000004E22000-0x0000000004E23000-memory.dmpFilesize
4KB
-
memory/3540-138-0x00000000077C0000-0x00000000077C1000-memory.dmpFilesize
4KB
-
memory/3540-217-0x000000007F1B0000-0x000000007F1B1000-memory.dmpFilesize
4KB
-
memory/3540-254-0x0000000004E23000-0x0000000004E24000-memory.dmpFilesize
4KB
-
memory/3540-133-0x0000000004D70000-0x0000000004D71000-memory.dmpFilesize
4KB
-
memory/3540-130-0x0000000003300000-0x0000000003301000-memory.dmpFilesize
4KB
-
memory/3540-127-0x0000000000000000-mapping.dmp