Analysis
-
max time kernel
8s -
max time network
43s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
16-11-2022 06:50
Static task
static1
Behavioral task
behavioral1
Sample
0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe
Resource
win10v2004-20221111-en
General
-
Target
0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe
-
Size
356KB
-
MD5
354d20e21be15dd24eb8a9b2b18a8407
-
SHA1
f3c9182f5a8a45ee8f9cbcf2e4584c38ff670533
-
SHA256
0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44
-
SHA512
7bcfd0d2bca8a7bc3f0836c012438125cabdac11e7978f3d8a55ace928fe98ceac8ddf7cab146847ad9c9299c9231711df5b52cb0e429bcb5f519fae7353edb5
-
SSDEEP
6144:XBlALeoB8aMc2d4XPRSdUGACTse5kjVPqpc2NgqDIZYm8dDb1tqisSc85AjPdA4/:XkqGofP/HRLRoveIP95TDKkg30XS
Malware Config
Extracted
blacknet
v3.7.0 Public
Round3
http://zee.zight.ru
BN[d396d077ee81b07d64cc8bbff27bbccb]
-
antivm
true
-
elevate_uac
false
-
install_name
GPUpdate.exe
-
splitter
|BN|
-
start_name
e162b1333458a713bc6916cc8ac4110c
-
startup
false
-
usb_spread
false
Signatures
-
BlackNET payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2300-138-0x0000000000770000-0x0000000000792000-memory.dmp family_blacknet -
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral1/memory/2300-138-0x0000000000770000-0x0000000000792000-memory.dmp disable_win_def -
Processes:
0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe -
Processes:
0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e162b1333458a713bc6916cc8ac4110c = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\MyClient\\GPUpdate.exe" 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exedescription pid process target process PID 3384 set thread context of 2300 3384 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4148 2300 WerFault.exe 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exepowershell.exepid process 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 1352 powershell.exe 1352 powershell.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exepowershell.exedescription pid process Token: SeDebugPrivilege 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe Token: SeDebugPrivilege 1352 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exepid process 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.execmd.exe0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exedescription pid process target process PID 3384 wrote to memory of 2300 3384 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe PID 3384 wrote to memory of 2300 3384 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe PID 3384 wrote to memory of 2300 3384 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe PID 3384 wrote to memory of 2300 3384 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe PID 3384 wrote to memory of 2300 3384 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe PID 3384 wrote to memory of 2300 3384 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe PID 3384 wrote to memory of 2300 3384 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe PID 3384 wrote to memory of 2300 3384 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe PID 3384 wrote to memory of 4676 3384 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe cmd.exe PID 3384 wrote to memory of 4676 3384 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe cmd.exe PID 3384 wrote to memory of 4676 3384 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe cmd.exe PID 3384 wrote to memory of 1712 3384 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe cmd.exe PID 3384 wrote to memory of 1712 3384 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe cmd.exe PID 3384 wrote to memory of 1712 3384 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe cmd.exe PID 3384 wrote to memory of 3260 3384 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe cmd.exe PID 3384 wrote to memory of 3260 3384 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe cmd.exe PID 3384 wrote to memory of 3260 3384 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe cmd.exe PID 1712 wrote to memory of 4064 1712 cmd.exe schtasks.exe PID 1712 wrote to memory of 4064 1712 cmd.exe schtasks.exe PID 1712 wrote to memory of 4064 1712 cmd.exe schtasks.exe PID 2300 wrote to memory of 1352 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe powershell.exe PID 2300 wrote to memory of 1352 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe powershell.exe PID 2300 wrote to memory of 1352 2300 0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe"C:\Users\Admin\AppData\Local\Temp\0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe"C:\Users\Admin\AppData\Local\Temp\0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 16443⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\RegStart"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\RegStart\RegStart.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\RegStart\RegStart.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\0cfd96c0bef9061e95adbc2f00f6e0bd39c1103ca4761c9af850528d28455b44.exe" "C:\Users\Admin\AppData\Roaming\RegStart\RegStart.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2300 -ip 23001⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1352-157-0x0000000006E50000-0x0000000006E5A000-memory.dmpFilesize
40KB
-
memory/1352-156-0x0000000006DE0000-0x0000000006DFA000-memory.dmpFilesize
104KB
-
memory/1352-165-0x0000000007100000-0x0000000007108000-memory.dmpFilesize
32KB
-
memory/1352-149-0x0000000004A10000-0x0000000004A32000-memory.dmpFilesize
136KB
-
memory/1352-164-0x0000000007120000-0x000000000713A000-memory.dmpFilesize
104KB
-
memory/1352-163-0x0000000007010000-0x000000000701E000-memory.dmpFilesize
56KB
-
memory/1352-152-0x00000000060A0000-0x00000000060D2000-memory.dmpFilesize
200KB
-
memory/1352-150-0x0000000004BB0000-0x0000000004C16000-memory.dmpFilesize
408KB
-
memory/1352-158-0x0000000007060000-0x00000000070F6000-memory.dmpFilesize
600KB
-
memory/1352-146-0x0000000000000000-mapping.dmp
-
memory/1352-155-0x0000000007420000-0x0000000007A9A000-memory.dmpFilesize
6.5MB
-
memory/1352-154-0x0000000006080000-0x000000000609E000-memory.dmpFilesize
120KB
-
memory/1352-153-0x000000006E840000-0x000000006E88C000-memory.dmpFilesize
304KB
-
memory/1352-151-0x0000000005AE0000-0x0000000005AFE000-memory.dmpFilesize
120KB
-
memory/1352-147-0x0000000000D50000-0x0000000000D86000-memory.dmpFilesize
216KB
-
memory/1352-148-0x0000000004DF0000-0x0000000005418000-memory.dmpFilesize
6.2MB
-
memory/1712-139-0x0000000000000000-mapping.dmp
-
memory/2300-142-0x0000000004D80000-0x0000000004E12000-memory.dmpFilesize
584KB
-
memory/2300-160-0x000000000A350000-0x000000000A354000-memory.dmpFilesize
16KB
-
memory/2300-135-0x0000000000000000-mapping.dmp
-
memory/2300-145-0x0000000004E20000-0x0000000004E76000-memory.dmpFilesize
344KB
-
memory/2300-144-0x0000000004C40000-0x0000000004C4A000-memory.dmpFilesize
40KB
-
memory/2300-138-0x0000000000770000-0x0000000000792000-memory.dmpFilesize
136KB
-
memory/2300-162-0x000000000A357000-0x000000000A35A000-memory.dmpFilesize
12KB
-
memory/2300-161-0x000000000A354000-0x000000000A357000-memory.dmpFilesize
12KB
-
memory/2300-140-0x0000000004CE0000-0x0000000004D7C000-memory.dmpFilesize
624KB
-
memory/2300-159-0x0000000004D80000-0x0000000005324000-memory.dmpFilesize
5.6MB
-
memory/3260-141-0x0000000000000000-mapping.dmp
-
memory/3384-132-0x0000000000940000-0x000000000099E000-memory.dmpFilesize
376KB
-
memory/3384-133-0x00000000057A0000-0x0000000005D44000-memory.dmpFilesize
5.6MB
-
memory/3384-134-0x00000000051F0000-0x0000000005256000-memory.dmpFilesize
408KB
-
memory/4064-143-0x0000000000000000-mapping.dmp
-
memory/4676-137-0x0000000000000000-mapping.dmp