Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-10-2022 21:55
Behavioral task
behavioral1
Sample
8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe
Resource
win10v2004-20220812-en
General
-
Target
8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe
-
Size
3.0MB
-
MD5
9301f1da68cccfa053da550107f0365c
-
SHA1
39a92e81e6669611b8e494c3ca2853283316d801
-
SHA256
8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e
-
SHA512
1206145a834315b385b19d3cf58abc8d7b6cc46b9315db26e671ab598faf6eb3fa0aa5a932005f8f2f16832a84dfa9bf9593a907a256b6d9155a944753b5d494
-
SSDEEP
49152:c2lp5nsO1lERGmC7vK9y+QXMR1UEhLdPMRG4OU09Q1IFOUCGExQPr/E+Vm5tPXXq:/p9vjHp+QAUyGG4oQ1Ib1Yxt/Xq
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5100-3883-0x0000000010000000-0x0000000010017000-memory.dmp unk_chinese_botnet -
Executes dropped EXE 5 IoCs
Processes:
rs1.exeFTvrst.exeaudidog.exespolsvt.exeaudidog.exepid process 4560 rs1.exe 1968 FTvrst.exe 5044 audidog.exe 5100 spolsvt.exe 3160 audidog.exe -
Processes:
resource yara_rule behavioral2/memory/4800-132-0x0000000000400000-0x0000000000A85000-memory.dmp vmprotect behavioral2/memory/4800-133-0x0000000000400000-0x0000000000A85000-memory.dmp vmprotect behavioral2/memory/4800-138-0x0000000000400000-0x0000000000A85000-memory.dmp vmprotect behavioral2/memory/5100-3883-0x0000000010000000-0x0000000010017000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
FTvrst.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Therecontinuous = "C:\\WINDOWS\\DNomb\\FTvrst.exe" FTvrst.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
spolsvt.exedescription ioc process File opened (read-only) \??\B: spolsvt.exe File opened (read-only) \??\F: spolsvt.exe File opened (read-only) \??\I: spolsvt.exe File opened (read-only) \??\L: spolsvt.exe File opened (read-only) \??\S: spolsvt.exe File opened (read-only) \??\V: spolsvt.exe File opened (read-only) \??\G: spolsvt.exe File opened (read-only) \??\J: spolsvt.exe File opened (read-only) \??\P: spolsvt.exe File opened (read-only) \??\U: spolsvt.exe File opened (read-only) \??\Y: spolsvt.exe File opened (read-only) \??\E: spolsvt.exe File opened (read-only) \??\H: spolsvt.exe File opened (read-only) \??\M: spolsvt.exe File opened (read-only) \??\X: spolsvt.exe File opened (read-only) \??\K: spolsvt.exe File opened (read-only) \??\N: spolsvt.exe File opened (read-only) \??\O: spolsvt.exe File opened (read-only) \??\Q: spolsvt.exe File opened (read-only) \??\R: spolsvt.exe File opened (read-only) \??\T: spolsvt.exe File opened (read-only) \??\W: spolsvt.exe File opened (read-only) \??\Z: spolsvt.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 31 IoCs
Processes:
rs1.exeFTvrst.exeaudidog.exeaudidog.exepid process 4560 rs1.exe 4560 rs1.exe 4560 rs1.exe 4560 rs1.exe 1968 FTvrst.exe 1968 FTvrst.exe 1968 FTvrst.exe 1968 FTvrst.exe 5044 audidog.exe 5044 audidog.exe 5044 audidog.exe 3160 audidog.exe 3160 audidog.exe 5044 audidog.exe 5044 audidog.exe 5044 audidog.exe 5044 audidog.exe 5044 audidog.exe 5044 audidog.exe 5044 audidog.exe 5044 audidog.exe 5044 audidog.exe 5044 audidog.exe 5044 audidog.exe 5044 audidog.exe 5044 audidog.exe 5044 audidog.exe 5044 audidog.exe 5044 audidog.exe 5044 audidog.exe 5044 audidog.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
FTvrst.exedescription pid process target process PID 1968 set thread context of 5100 1968 FTvrst.exe spolsvt.exe -
Drops file in Windows directory 10 IoCs
Processes:
8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exers1.exeaudidog.exeaudidog.exedescription ioc process File created C:\Windows\DNomb\Mpec.mbt 8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe File created C:\WINDOWS\DNomb\Mpec.mbt rs1.exe File created C:\WINDOWS\DNomb\spolsvt.exe rs1.exe File created C:\WINDOWS\DNomb\audidog.exe rs1.exe File created C:\WINDOWS\DNombaudidog.exe audidog.exe File opened for modification C:\Windows\DNomb\Mpec.mbt 8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe File created C:\WINDOWS\Djltp.txt rs1.exe File created C:\WINDOWS\DNomb\FTvrst.exe rs1.exe File opened for modification C:\WINDOWS\DNomb\FTvrst.exe rs1.exe File created C:\WINDOWS\DNombaudidog.exe audidog.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
spolsvt.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 spolsvt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz spolsvt.exe -
Modifies registry class 1 IoCs
Processes:
8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings 8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
spolsvt.exepid process 5100 spolsvt.exe 5100 spolsvt.exe 5100 spolsvt.exe 5100 spolsvt.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exers1.exeFTvrst.exespolsvt.exeaudidog.exeaudidog.exepid process 4800 8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe 4800 8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe 4560 rs1.exe 4560 rs1.exe 1968 FTvrst.exe 1968 FTvrst.exe 5100 spolsvt.exe 5100 spolsvt.exe 5044 audidog.exe 5044 audidog.exe 3160 audidog.exe 3160 audidog.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exers1.exeFTvrst.exedescription pid process target process PID 4800 wrote to memory of 4344 4800 8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe cmd.exe PID 4800 wrote to memory of 4344 4800 8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe cmd.exe PID 4800 wrote to memory of 4344 4800 8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe cmd.exe PID 4560 wrote to memory of 1968 4560 rs1.exe FTvrst.exe PID 4560 wrote to memory of 1968 4560 rs1.exe FTvrst.exe PID 4560 wrote to memory of 1968 4560 rs1.exe FTvrst.exe PID 4560 wrote to memory of 5044 4560 rs1.exe audidog.exe PID 4560 wrote to memory of 5044 4560 rs1.exe audidog.exe PID 4560 wrote to memory of 5044 4560 rs1.exe audidog.exe PID 1968 wrote to memory of 5100 1968 FTvrst.exe spolsvt.exe PID 1968 wrote to memory of 5100 1968 FTvrst.exe spolsvt.exe PID 1968 wrote to memory of 5100 1968 FTvrst.exe spolsvt.exe PID 1968 wrote to memory of 5100 1968 FTvrst.exe spolsvt.exe PID 1968 wrote to memory of 5100 1968 FTvrst.exe spolsvt.exe PID 1968 wrote to memory of 5100 1968 FTvrst.exe spolsvt.exe PID 1968 wrote to memory of 5100 1968 FTvrst.exe spolsvt.exe PID 1968 wrote to memory of 5100 1968 FTvrst.exe spolsvt.exe PID 1968 wrote to memory of 5100 1968 FTvrst.exe spolsvt.exe PID 1968 wrote to memory of 3160 1968 FTvrst.exe audidog.exe PID 1968 wrote to memory of 3160 1968 FTvrst.exe audidog.exe PID 1968 wrote to memory of 3160 1968 FTvrst.exe audidog.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe"C:\Users\Admin\AppData\Local\Temp\8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe"1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del 8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe2⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Public\Documents\123\rs1.exe"C:\Users\Public\Documents\123\rs1.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\DNomb\FTvrst.exeC:\WINDOWS\DNomb\FTvrst.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\DNomb\spolsvt.exeC:\WINDOWS\DNomb\spolsvt.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\WINDOWS\DNomb\audidog.exeC:\WINDOWS\DNomb\audidog.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\WINDOWS\DNomb\audidog.exeC:\WINDOWS\DNomb\audidog.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Documents\123\rs1.exeFilesize
2.2MB
MD53a9c682b077bc044b21131216bdf6304
SHA1afdd419f084b56838c7eb07ff2b28ff9b960e27e
SHA2568beaa45a7ca8a10127ed2e359be90f856a4ac0b87ed31e57a59aadc58ad94cc8
SHA51299a2d2ce97a50791ddac4caa359bc335e404ad4f1ec3bdc5e3df6917e9c6eceba2d7c821eb0728e9d0989df1d021625db7ab962c1ebf705f8770090501d64b14
-
C:\Users\Public\Documents\123\rs1.exeFilesize
2.2MB
MD53a9c682b077bc044b21131216bdf6304
SHA1afdd419f084b56838c7eb07ff2b28ff9b960e27e
SHA2568beaa45a7ca8a10127ed2e359be90f856a4ac0b87ed31e57a59aadc58ad94cc8
SHA51299a2d2ce97a50791ddac4caa359bc335e404ad4f1ec3bdc5e3df6917e9c6eceba2d7c821eb0728e9d0989df1d021625db7ab962c1ebf705f8770090501d64b14
-
C:\WINDOWS\DNomb\FTvrst.exeFilesize
2.2MB
MD53a9c682b077bc044b21131216bdf6304
SHA1afdd419f084b56838c7eb07ff2b28ff9b960e27e
SHA2568beaa45a7ca8a10127ed2e359be90f856a4ac0b87ed31e57a59aadc58ad94cc8
SHA51299a2d2ce97a50791ddac4caa359bc335e404ad4f1ec3bdc5e3df6917e9c6eceba2d7c821eb0728e9d0989df1d021625db7ab962c1ebf705f8770090501d64b14
-
C:\WINDOWS\DNomb\Mpec.mbtFilesize
200KB
MD59fdc722f45023b3b9b1fa429511485a9
SHA1e07b0204b358e73af58ebf47e6d389ad012f78af
SHA2567be719b05ada2bdf82ea3367840b6b223012350519a97e3651b5b0c836f13144
SHA51218d9a054228d1b3c2e11c9474940d98f8576934cb27ccddcda5f4fb681350464012b01e463bea90baea2a77f6c3ac3b4267ace6656a08383f7ea31014474a4fb
-
C:\WINDOWS\DNomb\audidog.exeFilesize
2.2MB
MD53a9c682b077bc044b21131216bdf6304
SHA1afdd419f084b56838c7eb07ff2b28ff9b960e27e
SHA2568beaa45a7ca8a10127ed2e359be90f856a4ac0b87ed31e57a59aadc58ad94cc8
SHA51299a2d2ce97a50791ddac4caa359bc335e404ad4f1ec3bdc5e3df6917e9c6eceba2d7c821eb0728e9d0989df1d021625db7ab962c1ebf705f8770090501d64b14
-
C:\WINDOWS\DNomb\spolsvt.exeFilesize
9KB
MD5523d5c39f9d8d2375c3df68251fa2249
SHA1d4ed365c44bec9246fc1a65a32a7791792647a10
SHA25620e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4
-
C:\WINDOWS\Djltp.txtFilesize
37B
MD54f6cae09c7fd452990e28040f1d34b27
SHA1feea2cc9d7b63e57523e2031d886a5e2599561ad
SHA256cfa50edb62da7487915728a8cbb0c4a55e907fb70363234abaa6a4fb31565f6e
SHA5124201eabbba4d3ff8bdf7d089feb013bd587f6254f188fd7181ebdd6fc851f79f1150682211116736d568460de126da51bc013d04d69421098e71f087f1a4dd56
-
C:\Windows\DNomb\FTvrst.exeFilesize
2.2MB
MD53a9c682b077bc044b21131216bdf6304
SHA1afdd419f084b56838c7eb07ff2b28ff9b960e27e
SHA2568beaa45a7ca8a10127ed2e359be90f856a4ac0b87ed31e57a59aadc58ad94cc8
SHA51299a2d2ce97a50791ddac4caa359bc335e404ad4f1ec3bdc5e3df6917e9c6eceba2d7c821eb0728e9d0989df1d021625db7ab962c1ebf705f8770090501d64b14
-
C:\Windows\DNomb\audidog.exeFilesize
2.2MB
MD53a9c682b077bc044b21131216bdf6304
SHA1afdd419f084b56838c7eb07ff2b28ff9b960e27e
SHA2568beaa45a7ca8a10127ed2e359be90f856a4ac0b87ed31e57a59aadc58ad94cc8
SHA51299a2d2ce97a50791ddac4caa359bc335e404ad4f1ec3bdc5e3df6917e9c6eceba2d7c821eb0728e9d0989df1d021625db7ab962c1ebf705f8770090501d64b14
-
C:\Windows\DNomb\audidog.exeFilesize
2.2MB
MD53a9c682b077bc044b21131216bdf6304
SHA1afdd419f084b56838c7eb07ff2b28ff9b960e27e
SHA2568beaa45a7ca8a10127ed2e359be90f856a4ac0b87ed31e57a59aadc58ad94cc8
SHA51299a2d2ce97a50791ddac4caa359bc335e404ad4f1ec3bdc5e3df6917e9c6eceba2d7c821eb0728e9d0989df1d021625db7ab962c1ebf705f8770090501d64b14
-
C:\Windows\DNomb\spolsvt.exeFilesize
9KB
MD5523d5c39f9d8d2375c3df68251fa2249
SHA1d4ed365c44bec9246fc1a65a32a7791792647a10
SHA25620e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4
-
memory/1968-3829-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/1968-4077-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/1968-3832-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/1968-3846-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/1968-3826-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/1968-1492-0x0000000000000000-mapping.dmp
-
memory/1968-3824-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/1968-2345-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/1968-1495-0x0000000077500000-0x00000000776A3000-memory.dmpFilesize
1.6MB
-
memory/1968-1496-0x0000000075C20000-0x0000000075E35000-memory.dmpFilesize
2.1MB
-
memory/1968-1498-0x00000000762F0000-0x0000000076490000-memory.dmpFilesize
1.6MB
-
memory/1968-1499-0x0000000075A00000-0x0000000075A7A000-memory.dmpFilesize
488KB
-
memory/1968-3849-0x0000000002C10000-0x0000000002D10000-memory.dmpFilesize
1024KB
-
memory/3160-3891-0x0000000075A00000-0x0000000075A7A000-memory.dmpFilesize
488KB
-
memory/3160-5579-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/3160-5581-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/3160-5582-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/3160-5580-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/3160-5578-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/3160-4324-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/3160-5577-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/3160-3877-0x0000000077500000-0x00000000776A3000-memory.dmpFilesize
1.6MB
-
memory/3160-3861-0x0000000000000000-mapping.dmp
-
memory/3160-3887-0x00000000762F0000-0x0000000076490000-memory.dmpFilesize
1.6MB
-
memory/3160-3881-0x0000000075C20000-0x0000000075E35000-memory.dmpFilesize
2.1MB
-
memory/3160-3875-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/4344-137-0x0000000000000000-mapping.dmp
-
memory/4560-1911-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/4560-139-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/4560-1489-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/4560-1888-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/4560-1490-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/4560-1488-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/4560-141-0x0000000075C20000-0x0000000075E35000-memory.dmpFilesize
2.1MB
-
memory/4560-143-0x00000000762F0000-0x0000000076490000-memory.dmpFilesize
1.6MB
-
memory/4560-144-0x0000000075A00000-0x0000000075A7A000-memory.dmpFilesize
488KB
-
memory/4560-1487-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/4560-140-0x0000000077500000-0x00000000776A3000-memory.dmpFilesize
1.6MB
-
memory/4560-1491-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/4800-138-0x0000000000400000-0x0000000000A85000-memory.dmpFilesize
6.5MB
-
memory/4800-133-0x0000000000400000-0x0000000000A85000-memory.dmpFilesize
6.5MB
-
memory/4800-132-0x0000000000400000-0x0000000000A85000-memory.dmpFilesize
6.5MB
-
memory/5044-1876-0x0000000075C20000-0x0000000075E35000-memory.dmpFilesize
2.1MB
-
memory/5044-1885-0x0000000075A00000-0x0000000075A7A000-memory.dmpFilesize
488KB
-
memory/5044-5584-0x0000000002BF0000-0x0000000002CF0000-memory.dmpFilesize
1024KB
-
memory/5044-5583-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/5044-1859-0x0000000000000000-mapping.dmp
-
memory/5044-1873-0x0000000077500000-0x00000000776A3000-memory.dmpFilesize
1.6MB
-
memory/5044-1883-0x00000000762F0000-0x0000000076490000-memory.dmpFilesize
1.6MB
-
memory/5044-1895-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/5044-4566-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/5044-4567-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/5044-4569-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/5044-4573-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/5044-4589-0x0000000000400000-0x0000000000C64000-memory.dmpFilesize
8.4MB
-
memory/5044-4601-0x0000000002BF0000-0x0000000002CF0000-memory.dmpFilesize
1024KB
-
memory/5100-3845-0x0000000000000000-mapping.dmp
-
memory/5100-3848-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/5100-3865-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/5100-3851-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/5100-3853-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/5100-3855-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/5100-3862-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/5100-3883-0x0000000010000000-0x0000000010017000-memory.dmpFilesize
92KB