Analysis
-
max time kernel
151s -
max time network
134s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
07-11-2021 01:49
Static task
static1
Behavioral task
behavioral1
Sample
D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe
Resource
win7-en-20211014
General
-
Target
D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe
-
Size
1.3MB
-
MD5
ec7f6620c82becd13651a358f408bf72
-
SHA1
d66e726b99a648f705a8ab82308c52cad9ca275d
-
SHA256
d3a9543fae305405220ac1f627327074dc1bde573789452a2f0e62429db87987
-
SHA512
1efc9ab3bf16f434c67d6904ecae70ec3d9811958d758401672a6c062f3f4fc8627049cb884cee0e5b8dd40946d14e96716f4bd8c1210373df49a4533e1f5d4d
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
alice2019.myftp.biz:5552
28ac71370f2e4
-
reg_key
28ac71370f2e4
-
splitter
@!#&^%$
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
Topaz Gigapixel AI.exesdff.exexwobhs.pifRegSvcs.exepid process 1044 Topaz Gigapixel AI.exe 824 sdff.exe 1084 xwobhs.pif 1408 RegSvcs.exe -
Loads dropped DLL 12 IoCs
Processes:
D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exesdff.exexwobhs.pifpid process 468 D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe 468 D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe 468 D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe 468 D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe 1276 1276 824 sdff.exe 824 sdff.exe 824 sdff.exe 824 sdff.exe 1276 1084 xwobhs.pif -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
xwobhs.pifdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xwobhs.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "c:\\52830064\\xwobhs.pif c:\\52830064\\AQKWBT~1.IKB" xwobhs.pif -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
xwobhs.pifdescription pid process target process PID 1084 set thread context of 1408 1084 xwobhs.pif RegSvcs.exe -
autoit_exe 6 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule \Program Files (x86)\Company\NewProduct\Topaz Gigapixel AI.exe autoit_exe C:\Program Files (x86)\Company\NewProduct\Topaz Gigapixel AI.exe autoit_exe C:\Program Files (x86)\Company\NewProduct\Topaz Gigapixel AI.exe autoit_exe \Program Files (x86)\Company\NewProduct\Topaz Gigapixel AI.exe autoit_exe \Program Files (x86)\Company\NewProduct\Topaz Gigapixel AI.exe autoit_exe \Program Files (x86)\Company\NewProduct\Topaz Gigapixel AI.exe autoit_exe -
Drops file in Program Files directory 3 IoCs
Processes:
D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exedescription ioc process File opened for modification C:\Program Files (x86)\Company\NewProduct\Topaz Gigapixel AI.exe D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Topaz Gigapixel AI.exexwobhs.pifRegSvcs.exepid process 1044 Topaz Gigapixel AI.exe 1044 Topaz Gigapixel AI.exe 1084 xwobhs.pif 1408 RegSvcs.exe 1408 RegSvcs.exe 1408 RegSvcs.exe 1408 RegSvcs.exe 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif 1084 xwobhs.pif -
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1408 RegSvcs.exe Token: 33 1408 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1408 RegSvcs.exe Token: 33 1408 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1408 RegSvcs.exe Token: 33 1408 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1408 RegSvcs.exe Token: 33 1408 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1408 RegSvcs.exe Token: 33 1408 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1408 RegSvcs.exe Token: 33 1408 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1408 RegSvcs.exe Token: 33 1408 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1408 RegSvcs.exe Token: 33 1408 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1408 RegSvcs.exe Token: 33 1408 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1408 RegSvcs.exe Token: 33 1408 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1408 RegSvcs.exe Token: 33 1408 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1408 RegSvcs.exe Token: 33 1408 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1408 RegSvcs.exe Token: 33 1408 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1408 RegSvcs.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exesdff.exexwobhs.pifdescription pid process target process PID 468 wrote to memory of 1044 468 D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe Topaz Gigapixel AI.exe PID 468 wrote to memory of 1044 468 D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe Topaz Gigapixel AI.exe PID 468 wrote to memory of 1044 468 D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe Topaz Gigapixel AI.exe PID 468 wrote to memory of 1044 468 D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe Topaz Gigapixel AI.exe PID 468 wrote to memory of 824 468 D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe sdff.exe PID 468 wrote to memory of 824 468 D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe sdff.exe PID 468 wrote to memory of 824 468 D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe sdff.exe PID 468 wrote to memory of 824 468 D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe sdff.exe PID 824 wrote to memory of 1084 824 sdff.exe xwobhs.pif PID 824 wrote to memory of 1084 824 sdff.exe xwobhs.pif PID 824 wrote to memory of 1084 824 sdff.exe xwobhs.pif PID 824 wrote to memory of 1084 824 sdff.exe xwobhs.pif PID 1084 wrote to memory of 1408 1084 xwobhs.pif RegSvcs.exe PID 1084 wrote to memory of 1408 1084 xwobhs.pif RegSvcs.exe PID 1084 wrote to memory of 1408 1084 xwobhs.pif RegSvcs.exe PID 1084 wrote to memory of 1408 1084 xwobhs.pif RegSvcs.exe PID 1084 wrote to memory of 1408 1084 xwobhs.pif RegSvcs.exe PID 1084 wrote to memory of 1408 1084 xwobhs.pif RegSvcs.exe PID 1084 wrote to memory of 1408 1084 xwobhs.pif RegSvcs.exe PID 1084 wrote to memory of 1408 1084 xwobhs.pif RegSvcs.exe PID 1084 wrote to memory of 1408 1084 xwobhs.pif RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe"C:\Users\Admin\AppData\Local\Temp\D3A9543FAE305405220AC1F627327074DC1BDE573789452A2F0E62429DB87987.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Company\NewProduct\Topaz Gigapixel AI.exe"C:\Program Files (x86)\Company\NewProduct\Topaz Gigapixel AI.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\sdff.exe"C:\Users\Admin\AppData\Roaming\sdff.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\52830064\xwobhs.pif"C:\52830064\xwobhs.pif" aqkwbthvr.ikb3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\52830064\aqkwbthvr.ikbMD5
1f4c7f94e81f5676cac726fa32a4267b
SHA1916104ff346ab10620f0926c241cf248d4b25b90
SHA256cc535eaa9283d61eda11015e006ae054ccd331a70ad96baeccad61f22efa624b
SHA512006f7ae411969c304b492e733cfcee22de4aca0d07873a95cbb0195f3d322697acd20e3c4c53e67f2db8388ed6b089b634e5bbdd3406619b0ec40ad77ca93841
-
C:\52830064\brvhbiro.binMD5
34dc4be1960b4ac6aaff64726d0af2ec
SHA11fdf27bacfb1b6134c4c08773374485855ece15b
SHA2562f2ac6f0e36134f2166e0232b64637dc7f2e33812d38e577f8c944b3f87edcda
SHA5122d441101e828a9766be8df35ae923c0a16fa2b690b40bef6f0a27a22b2061bf53571aa09e35fc93af3e2e2df214f14dac7e73b14e86c59b9dfd1e0cb642e5eff
-
C:\52830064\xwobhs.pifMD5
957fcff5374f7a5ee128d32c976adaa5
SHA172a4cc77337d22b5c23335538c62bea7ed9cbb93
SHA256699534a988a6aa7c8c5ff4eb01ac28292be257b0312e6d7351fb4cacaa4124d5
SHA512e9dc65fbb964cb64cfcbb1c9b5c53595b0f0304a7179710ddac5aefa2f0f40bb67271b7aeb39654254c2fe68fcd62b77a94674b8e9c3a57ad3497197ede87ca9
-
C:\Program Files (x86)\Company\NewProduct\Topaz Gigapixel AI.exeMD5
9abc52b7dc79d4641d7a2773d9bd6999
SHA17fb26b7ae31e80a6aad297c3191ec175dfc23142
SHA256eeb84edf9569c645b112a1f7d75f608d2dc54ddb66e63d1d0327b761f3eb85fd
SHA5127a9f5b5eceecc1ac4090f3324e9533f7eec5bffee63c626e0f09f50e800f10308e0cf4ce1ca3e8e0ad6c75fdd8914d5d4ba2afc32d6992d38c83fe9a672b2de4
-
C:\Program Files (x86)\Company\NewProduct\Topaz Gigapixel AI.exeMD5
9abc52b7dc79d4641d7a2773d9bd6999
SHA17fb26b7ae31e80a6aad297c3191ec175dfc23142
SHA256eeb84edf9569c645b112a1f7d75f608d2dc54ddb66e63d1d0327b761f3eb85fd
SHA5127a9f5b5eceecc1ac4090f3324e9533f7eec5bffee63c626e0f09f50e800f10308e0cf4ce1ca3e8e0ad6c75fdd8914d5d4ba2afc32d6992d38c83fe9a672b2de4
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\sdff.exeMD5
de3d6958f101e3b252f18168f240480d
SHA14a2ff6b9018df0b31db61ce4f5a6d844c05dc3ce
SHA2561e73294675f42df94d101ece8c550fcfa2746ae6f8bf3261e16d315c5d8de832
SHA512ca26091630e7509e79b386cbc1024446d51bc1ff0763b14aa1e8d03b0ec815d2484beccc905d1694db87a5b1dc8a8e95971c25dd5cd51abe9cbd000aea13f1f7
-
C:\Users\Admin\AppData\Roaming\sdff.exeMD5
de3d6958f101e3b252f18168f240480d
SHA14a2ff6b9018df0b31db61ce4f5a6d844c05dc3ce
SHA2561e73294675f42df94d101ece8c550fcfa2746ae6f8bf3261e16d315c5d8de832
SHA512ca26091630e7509e79b386cbc1024446d51bc1ff0763b14aa1e8d03b0ec815d2484beccc905d1694db87a5b1dc8a8e95971c25dd5cd51abe9cbd000aea13f1f7
-
\52830064\xwobhs.pifMD5
957fcff5374f7a5ee128d32c976adaa5
SHA172a4cc77337d22b5c23335538c62bea7ed9cbb93
SHA256699534a988a6aa7c8c5ff4eb01ac28292be257b0312e6d7351fb4cacaa4124d5
SHA512e9dc65fbb964cb64cfcbb1c9b5c53595b0f0304a7179710ddac5aefa2f0f40bb67271b7aeb39654254c2fe68fcd62b77a94674b8e9c3a57ad3497197ede87ca9
-
\52830064\xwobhs.pifMD5
957fcff5374f7a5ee128d32c976adaa5
SHA172a4cc77337d22b5c23335538c62bea7ed9cbb93
SHA256699534a988a6aa7c8c5ff4eb01ac28292be257b0312e6d7351fb4cacaa4124d5
SHA512e9dc65fbb964cb64cfcbb1c9b5c53595b0f0304a7179710ddac5aefa2f0f40bb67271b7aeb39654254c2fe68fcd62b77a94674b8e9c3a57ad3497197ede87ca9
-
\52830064\xwobhs.pifMD5
957fcff5374f7a5ee128d32c976adaa5
SHA172a4cc77337d22b5c23335538c62bea7ed9cbb93
SHA256699534a988a6aa7c8c5ff4eb01ac28292be257b0312e6d7351fb4cacaa4124d5
SHA512e9dc65fbb964cb64cfcbb1c9b5c53595b0f0304a7179710ddac5aefa2f0f40bb67271b7aeb39654254c2fe68fcd62b77a94674b8e9c3a57ad3497197ede87ca9
-
\52830064\xwobhs.pifMD5
957fcff5374f7a5ee128d32c976adaa5
SHA172a4cc77337d22b5c23335538c62bea7ed9cbb93
SHA256699534a988a6aa7c8c5ff4eb01ac28292be257b0312e6d7351fb4cacaa4124d5
SHA512e9dc65fbb964cb64cfcbb1c9b5c53595b0f0304a7179710ddac5aefa2f0f40bb67271b7aeb39654254c2fe68fcd62b77a94674b8e9c3a57ad3497197ede87ca9
-
\Program Files (x86)\Company\NewProduct\Topaz Gigapixel AI.exeMD5
9abc52b7dc79d4641d7a2773d9bd6999
SHA17fb26b7ae31e80a6aad297c3191ec175dfc23142
SHA256eeb84edf9569c645b112a1f7d75f608d2dc54ddb66e63d1d0327b761f3eb85fd
SHA5127a9f5b5eceecc1ac4090f3324e9533f7eec5bffee63c626e0f09f50e800f10308e0cf4ce1ca3e8e0ad6c75fdd8914d5d4ba2afc32d6992d38c83fe9a672b2de4
-
\Program Files (x86)\Company\NewProduct\Topaz Gigapixel AI.exeMD5
9abc52b7dc79d4641d7a2773d9bd6999
SHA17fb26b7ae31e80a6aad297c3191ec175dfc23142
SHA256eeb84edf9569c645b112a1f7d75f608d2dc54ddb66e63d1d0327b761f3eb85fd
SHA5127a9f5b5eceecc1ac4090f3324e9533f7eec5bffee63c626e0f09f50e800f10308e0cf4ce1ca3e8e0ad6c75fdd8914d5d4ba2afc32d6992d38c83fe9a672b2de4
-
\Program Files (x86)\Company\NewProduct\Topaz Gigapixel AI.exeMD5
9abc52b7dc79d4641d7a2773d9bd6999
SHA17fb26b7ae31e80a6aad297c3191ec175dfc23142
SHA256eeb84edf9569c645b112a1f7d75f608d2dc54ddb66e63d1d0327b761f3eb85fd
SHA5127a9f5b5eceecc1ac4090f3324e9533f7eec5bffee63c626e0f09f50e800f10308e0cf4ce1ca3e8e0ad6c75fdd8914d5d4ba2afc32d6992d38c83fe9a672b2de4
-
\Program Files (x86)\Company\NewProduct\Topaz Gigapixel AI.exeMD5
9abc52b7dc79d4641d7a2773d9bd6999
SHA17fb26b7ae31e80a6aad297c3191ec175dfc23142
SHA256eeb84edf9569c645b112a1f7d75f608d2dc54ddb66e63d1d0327b761f3eb85fd
SHA5127a9f5b5eceecc1ac4090f3324e9533f7eec5bffee63c626e0f09f50e800f10308e0cf4ce1ca3e8e0ad6c75fdd8914d5d4ba2afc32d6992d38c83fe9a672b2de4
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeMD5
0e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Roaming\sdff.exeMD5
de3d6958f101e3b252f18168f240480d
SHA14a2ff6b9018df0b31db61ce4f5a6d844c05dc3ce
SHA2561e73294675f42df94d101ece8c550fcfa2746ae6f8bf3261e16d315c5d8de832
SHA512ca26091630e7509e79b386cbc1024446d51bc1ff0763b14aa1e8d03b0ec815d2484beccc905d1694db87a5b1dc8a8e95971c25dd5cd51abe9cbd000aea13f1f7
-
\Users\Admin\AppData\Roaming\sdff.exeMD5
de3d6958f101e3b252f18168f240480d
SHA14a2ff6b9018df0b31db61ce4f5a6d844c05dc3ce
SHA2561e73294675f42df94d101ece8c550fcfa2746ae6f8bf3261e16d315c5d8de832
SHA512ca26091630e7509e79b386cbc1024446d51bc1ff0763b14aa1e8d03b0ec815d2484beccc905d1694db87a5b1dc8a8e95971c25dd5cd51abe9cbd000aea13f1f7
-
\Users\Admin\AppData\Roaming\sdff.exeMD5
de3d6958f101e3b252f18168f240480d
SHA14a2ff6b9018df0b31db61ce4f5a6d844c05dc3ce
SHA2561e73294675f42df94d101ece8c550fcfa2746ae6f8bf3261e16d315c5d8de832
SHA512ca26091630e7509e79b386cbc1024446d51bc1ff0763b14aa1e8d03b0ec815d2484beccc905d1694db87a5b1dc8a8e95971c25dd5cd51abe9cbd000aea13f1f7
-
memory/468-55-0x0000000075D41000-0x0000000075D43000-memory.dmpFilesize
8KB
-
memory/824-66-0x0000000000000000-mapping.dmp
-
memory/1044-59-0x000007FEFC4B1000-0x000007FEFC4B3000-memory.dmpFilesize
8KB
-
memory/1044-57-0x0000000000000000-mapping.dmp
-
memory/1084-74-0x0000000000000000-mapping.dmp
-
memory/1408-81-0x00000000001D0000-0x000000000081D000-memory.dmpFilesize
6.3MB
-
memory/1408-82-0x00000000001D0000-0x000000000081D000-memory.dmpFilesize
6.3MB
-
memory/1408-83-0x00000000001D676E-mapping.dmp
-
memory/1408-86-0x00000000001D0000-0x000000000081D000-memory.dmpFilesize
6.3MB
-
memory/1408-88-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB