Analysis
-
max time kernel
116s -
max time network
141s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
06-02-2023 23:54
Static task
static1
Behavioral task
behavioral1
Sample
7e560e2cfc52f5a519abff856b0b4a5cc00dc691715f887c8d6a0076d47708c2.exe
Resource
win10-20220812-en
General
-
Target
7e560e2cfc52f5a519abff856b0b4a5cc00dc691715f887c8d6a0076d47708c2.exe
-
Size
558KB
-
MD5
87c5580719b631037d0c7108b518c1e5
-
SHA1
90d32fc01804dbd39a39027fc940ddd16e406280
-
SHA256
7e560e2cfc52f5a519abff856b0b4a5cc00dc691715f887c8d6a0076d47708c2
-
SHA512
f678ccb5f67ceffb55394aaf4c0154d6174074c6613a904c64d0f8f78978297778f129327c9659295d3f7b792b819124525eee3371eb98c39f9d93c31d68101c
-
SSDEEP
12288:iMrby90Fnkb3kkeDjEtOGUw0EDqjXiRG0Bi1kquEVa:pyyAkkFtCwbqjUBieug
Malware Config
Extracted
amadey
3.66
62.204.41.5/Bu58Ngs/index.php
Signatures
-
Processes:
aDGx.exemika.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" aDGx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" aDGx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" mika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" mika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" mika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" mika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" aDGx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" aDGx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" mika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" aDGx.exe -
Executes dropped EXE 7 IoCs
Processes:
cDGn.exeaDGx.exemika.exevona.exemnolyk.exemnolyk.exemnolyk.exepid process 4584 cDGn.exe 1504 aDGx.exe 4156 mika.exe 3860 vona.exe 4132 mnolyk.exe 4520 mnolyk.exe 3184 mnolyk.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4036 rundll32.exe -
Processes:
aDGx.exemika.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features aDGx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" aDGx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" mika.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
cDGn.exe7e560e2cfc52f5a519abff856b0b4a5cc00dc691715f887c8d6a0076d47708c2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" cDGn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7e560e2cfc52f5a519abff856b0b4a5cc00dc691715f887c8d6a0076d47708c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7e560e2cfc52f5a519abff856b0b4a5cc00dc691715f887c8d6a0076d47708c2.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cDGn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
aDGx.exemika.exepid process 1504 aDGx.exe 1504 aDGx.exe 4156 mika.exe 4156 mika.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
aDGx.exemika.exedescription pid process Token: SeDebugPrivilege 1504 aDGx.exe Token: SeDebugPrivilege 4156 mika.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
7e560e2cfc52f5a519abff856b0b4a5cc00dc691715f887c8d6a0076d47708c2.execDGn.exevona.exemnolyk.execmd.exedescription pid process target process PID 1524 wrote to memory of 4584 1524 7e560e2cfc52f5a519abff856b0b4a5cc00dc691715f887c8d6a0076d47708c2.exe cDGn.exe PID 1524 wrote to memory of 4584 1524 7e560e2cfc52f5a519abff856b0b4a5cc00dc691715f887c8d6a0076d47708c2.exe cDGn.exe PID 1524 wrote to memory of 4584 1524 7e560e2cfc52f5a519abff856b0b4a5cc00dc691715f887c8d6a0076d47708c2.exe cDGn.exe PID 4584 wrote to memory of 1504 4584 cDGn.exe aDGx.exe PID 4584 wrote to memory of 1504 4584 cDGn.exe aDGx.exe PID 4584 wrote to memory of 1504 4584 cDGn.exe aDGx.exe PID 4584 wrote to memory of 4156 4584 cDGn.exe mika.exe PID 4584 wrote to memory of 4156 4584 cDGn.exe mika.exe PID 1524 wrote to memory of 3860 1524 7e560e2cfc52f5a519abff856b0b4a5cc00dc691715f887c8d6a0076d47708c2.exe vona.exe PID 1524 wrote to memory of 3860 1524 7e560e2cfc52f5a519abff856b0b4a5cc00dc691715f887c8d6a0076d47708c2.exe vona.exe PID 1524 wrote to memory of 3860 1524 7e560e2cfc52f5a519abff856b0b4a5cc00dc691715f887c8d6a0076d47708c2.exe vona.exe PID 3860 wrote to memory of 4132 3860 vona.exe mnolyk.exe PID 3860 wrote to memory of 4132 3860 vona.exe mnolyk.exe PID 3860 wrote to memory of 4132 3860 vona.exe mnolyk.exe PID 4132 wrote to memory of 2348 4132 mnolyk.exe schtasks.exe PID 4132 wrote to memory of 2348 4132 mnolyk.exe schtasks.exe PID 4132 wrote to memory of 2348 4132 mnolyk.exe schtasks.exe PID 4132 wrote to memory of 2260 4132 mnolyk.exe cmd.exe PID 4132 wrote to memory of 2260 4132 mnolyk.exe cmd.exe PID 4132 wrote to memory of 2260 4132 mnolyk.exe cmd.exe PID 2260 wrote to memory of 1516 2260 cmd.exe cmd.exe PID 2260 wrote to memory of 1516 2260 cmd.exe cmd.exe PID 2260 wrote to memory of 1516 2260 cmd.exe cmd.exe PID 2260 wrote to memory of 1260 2260 cmd.exe cacls.exe PID 2260 wrote to memory of 1260 2260 cmd.exe cacls.exe PID 2260 wrote to memory of 1260 2260 cmd.exe cacls.exe PID 2260 wrote to memory of 3756 2260 cmd.exe cacls.exe PID 2260 wrote to memory of 3756 2260 cmd.exe cacls.exe PID 2260 wrote to memory of 3756 2260 cmd.exe cacls.exe PID 2260 wrote to memory of 3580 2260 cmd.exe cmd.exe PID 2260 wrote to memory of 3580 2260 cmd.exe cmd.exe PID 2260 wrote to memory of 3580 2260 cmd.exe cmd.exe PID 2260 wrote to memory of 4052 2260 cmd.exe cacls.exe PID 2260 wrote to memory of 4052 2260 cmd.exe cacls.exe PID 2260 wrote to memory of 4052 2260 cmd.exe cacls.exe PID 2260 wrote to memory of 4480 2260 cmd.exe cacls.exe PID 2260 wrote to memory of 4480 2260 cmd.exe cacls.exe PID 2260 wrote to memory of 4480 2260 cmd.exe cacls.exe PID 4132 wrote to memory of 4036 4132 mnolyk.exe rundll32.exe PID 4132 wrote to memory of 4036 4132 mnolyk.exe rundll32.exe PID 4132 wrote to memory of 4036 4132 mnolyk.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e560e2cfc52f5a519abff856b0b4a5cc00dc691715f887c8d6a0076d47708c2.exe"C:\Users\Admin\AppData\Local\Temp\7e560e2cfc52f5a519abff856b0b4a5cc00dc691715f887c8d6a0076d47708c2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cDGn.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cDGn.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aDGx.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aDGx.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mika.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mika.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vona.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vona.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeFilesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeFilesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeFilesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeFilesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cDGn.exeFilesize
371KB
MD5414c9a91bd5e93ff667a6e64bb140d9a
SHA190e575bfc6d20fe0c68ae180392aa67f200b66dd
SHA25643f5e68847ba04d9c23189a6f8a316c42bef4f0387bef5c65a997ac9ed4dc97d
SHA512070873428e24736d72b2bc9ae8e3c9e0c0a80e5ccc8e4e3ef63696e825fb1b9979db90fb8b5b81e03f491bd6670f3472e73cde7a500cb4f837c00847a36e4070
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cDGn.exeFilesize
371KB
MD5414c9a91bd5e93ff667a6e64bb140d9a
SHA190e575bfc6d20fe0c68ae180392aa67f200b66dd
SHA25643f5e68847ba04d9c23189a6f8a316c42bef4f0387bef5c65a997ac9ed4dc97d
SHA512070873428e24736d72b2bc9ae8e3c9e0c0a80e5ccc8e4e3ef63696e825fb1b9979db90fb8b5b81e03f491bd6670f3472e73cde7a500cb4f837c00847a36e4070
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vona.exeFilesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vona.exeFilesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aDGx.exeFilesize
342KB
MD5afabf6e3f56058c045d2a761979137e6
SHA1bf8d36a2f0498c22f710b36cb1205eb3037b5849
SHA256542722a47ab88cece204c80420d5c4cc30437fd6ee90dcd70d1730f6d87439ea
SHA512560b3b03e5f4b20f9786349ef083006ae8db3746785c69fca81ade1e5e343e6e8fb47edd1dfef54897edb98903b06ca6b6062de750eba0e119c29a4690f4eb6a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aDGx.exeFilesize
342KB
MD5afabf6e3f56058c045d2a761979137e6
SHA1bf8d36a2f0498c22f710b36cb1205eb3037b5849
SHA256542722a47ab88cece204c80420d5c4cc30437fd6ee90dcd70d1730f6d87439ea
SHA512560b3b03e5f4b20f9786349ef083006ae8db3746785c69fca81ade1e5e343e6e8fb47edd1dfef54897edb98903b06ca6b6062de750eba0e119c29a4690f4eb6a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mika.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mika.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD59221a421a3e777eb7d4ce55e474bcc4a
SHA1c96d7bd7ccbf9352d50527bff472595b3dc5298e
SHA25610ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8
SHA51263ac172cb19c7c020676937cb35e853710d08e99e06e8cdcb410c37e0c9056af409a50fdec0c90a3c532edcf5e0f128fa1e2181063e1208d4fc4643b1b5736f3
-
\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD59221a421a3e777eb7d4ce55e474bcc4a
SHA1c96d7bd7ccbf9352d50527bff472595b3dc5298e
SHA25610ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8
SHA51263ac172cb19c7c020676937cb35e853710d08e99e06e8cdcb410c37e0c9056af409a50fdec0c90a3c532edcf5e0f128fa1e2181063e1208d4fc4643b1b5736f3
-
memory/1260-461-0x0000000000000000-mapping.dmp
-
memory/1504-266-0x0000000000400000-0x00000000004D2000-memory.dmpFilesize
840KB
-
memory/1504-275-0x0000000004CB0000-0x00000000051AE000-memory.dmpFilesize
5.0MB
-
memory/1504-271-0x00000000020E0000-0x00000000020FA000-memory.dmpFilesize
104KB
-
memory/1504-277-0x0000000002220000-0x0000000002238000-memory.dmpFilesize
96KB
-
memory/1504-265-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/1504-264-0x00000000004E0000-0x000000000058E000-memory.dmpFilesize
696KB
-
memory/1504-280-0x00000000004E0000-0x000000000058E000-memory.dmpFilesize
696KB
-
memory/1504-282-0x0000000000400000-0x00000000004D2000-memory.dmpFilesize
840KB
-
memory/1504-211-0x0000000000000000-mapping.dmp
-
memory/1516-454-0x0000000000000000-mapping.dmp
-
memory/1524-143-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-127-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-146-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-148-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-149-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-150-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-151-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-152-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-153-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-147-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-145-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-141-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-139-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-154-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-155-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-156-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-157-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-158-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-159-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-160-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-116-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-117-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-118-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-119-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-120-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-121-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-122-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-123-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-124-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-125-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-126-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-144-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-128-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-130-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-129-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-131-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-132-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-133-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-134-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-142-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-135-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-161-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-140-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-138-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-137-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-136-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/2260-396-0x0000000000000000-mapping.dmp
-
memory/2348-393-0x0000000000000000-mapping.dmp
-
memory/3580-531-0x0000000000000000-mapping.dmp
-
memory/3756-515-0x0000000000000000-mapping.dmp
-
memory/3860-287-0x0000000000000000-mapping.dmp
-
memory/4036-632-0x0000000000000000-mapping.dmp
-
memory/4052-533-0x0000000000000000-mapping.dmp
-
memory/4132-340-0x0000000000000000-mapping.dmp
-
memory/4156-283-0x0000000000000000-mapping.dmp
-
memory/4156-286-0x0000000000260000-0x000000000026A000-memory.dmpFilesize
40KB
-
memory/4480-586-0x0000000000000000-mapping.dmp
-
memory/4584-180-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/4584-168-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/4584-173-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/4584-162-0x0000000000000000-mapping.dmp
-
memory/4584-172-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/4584-171-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/4584-178-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/4584-177-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/4584-169-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/4584-174-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/4584-182-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/4584-181-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/4584-179-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/4584-175-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/4584-167-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/4584-176-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/4584-166-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/4584-165-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/4584-164-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB