Analysis
-
max time kernel
110s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2023 13:50
Static task
static1
General
-
Target
a373356377baa29111c9c78123b35689f35dd91d6b440262646078d6571cecf1.exe
-
Size
637KB
-
MD5
a675f21ed8587c21390beb96b60816f3
-
SHA1
b57e1a63111ae7fcfc4f76b8ebb4c3abc78d8076
-
SHA256
a373356377baa29111c9c78123b35689f35dd91d6b440262646078d6571cecf1
-
SHA512
25beffdd5433ae2b54468b40914b1905f608570cc300866279e8fabfb0b1034085c1ee419ce944aaaef78387ff9a535170be3e97d7ff0b2861737bbad5ec25bc
-
SSDEEP
12288:FMrqy90OQc6rIHCucz5xOybkJZeud59tjR/jdP002YcJ:3yaDpmzeaLtjR/jdMbnJ
Malware Config
Extracted
amadey
3.66
62.204.41.5/Bu58Ngs/index.php
Signatures
-
Processes:
mika.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection mika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" mika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" mika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" mika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" mika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" mika.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
vona.exemnolyk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation vona.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation mnolyk.exe -
Executes dropped EXE 7 IoCs
Processes:
cltn.exealtx.exemika.exevona.exemnolyk.exemnolyk.exemnolyk.exepid process 4588 cltn.exe 1328 altx.exe 2636 mika.exe 3816 vona.exe 3328 mnolyk.exe 4972 mnolyk.exe 620 mnolyk.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4856 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
mika.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" mika.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
a373356377baa29111c9c78123b35689f35dd91d6b440262646078d6571cecf1.execltn.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a373356377baa29111c9c78123b35689f35dd91d6b440262646078d6571cecf1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a373356377baa29111c9c78123b35689f35dd91d6b440262646078d6571cecf1.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cltn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" cltn.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5040 1328 WerFault.exe altx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
altx.exemika.exepid process 1328 altx.exe 1328 altx.exe 2636 mika.exe 2636 mika.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
altx.exemika.exedescription pid process Token: SeDebugPrivilege 1328 altx.exe Token: SeDebugPrivilege 2636 mika.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
a373356377baa29111c9c78123b35689f35dd91d6b440262646078d6571cecf1.execltn.exevona.exemnolyk.execmd.exedescription pid process target process PID 4576 wrote to memory of 4588 4576 a373356377baa29111c9c78123b35689f35dd91d6b440262646078d6571cecf1.exe cltn.exe PID 4576 wrote to memory of 4588 4576 a373356377baa29111c9c78123b35689f35dd91d6b440262646078d6571cecf1.exe cltn.exe PID 4576 wrote to memory of 4588 4576 a373356377baa29111c9c78123b35689f35dd91d6b440262646078d6571cecf1.exe cltn.exe PID 4588 wrote to memory of 1328 4588 cltn.exe altx.exe PID 4588 wrote to memory of 1328 4588 cltn.exe altx.exe PID 4588 wrote to memory of 1328 4588 cltn.exe altx.exe PID 4588 wrote to memory of 2636 4588 cltn.exe mika.exe PID 4588 wrote to memory of 2636 4588 cltn.exe mika.exe PID 4576 wrote to memory of 3816 4576 a373356377baa29111c9c78123b35689f35dd91d6b440262646078d6571cecf1.exe vona.exe PID 4576 wrote to memory of 3816 4576 a373356377baa29111c9c78123b35689f35dd91d6b440262646078d6571cecf1.exe vona.exe PID 4576 wrote to memory of 3816 4576 a373356377baa29111c9c78123b35689f35dd91d6b440262646078d6571cecf1.exe vona.exe PID 3816 wrote to memory of 3328 3816 vona.exe mnolyk.exe PID 3816 wrote to memory of 3328 3816 vona.exe mnolyk.exe PID 3816 wrote to memory of 3328 3816 vona.exe mnolyk.exe PID 3328 wrote to memory of 428 3328 mnolyk.exe schtasks.exe PID 3328 wrote to memory of 428 3328 mnolyk.exe schtasks.exe PID 3328 wrote to memory of 428 3328 mnolyk.exe schtasks.exe PID 3328 wrote to memory of 2096 3328 mnolyk.exe cmd.exe PID 3328 wrote to memory of 2096 3328 mnolyk.exe cmd.exe PID 3328 wrote to memory of 2096 3328 mnolyk.exe cmd.exe PID 2096 wrote to memory of 4860 2096 cmd.exe cmd.exe PID 2096 wrote to memory of 4860 2096 cmd.exe cmd.exe PID 2096 wrote to memory of 4860 2096 cmd.exe cmd.exe PID 2096 wrote to memory of 3392 2096 cmd.exe cacls.exe PID 2096 wrote to memory of 3392 2096 cmd.exe cacls.exe PID 2096 wrote to memory of 3392 2096 cmd.exe cacls.exe PID 2096 wrote to memory of 1852 2096 cmd.exe cacls.exe PID 2096 wrote to memory of 1852 2096 cmd.exe cacls.exe PID 2096 wrote to memory of 1852 2096 cmd.exe cacls.exe PID 2096 wrote to memory of 5028 2096 cmd.exe cmd.exe PID 2096 wrote to memory of 5028 2096 cmd.exe cmd.exe PID 2096 wrote to memory of 5028 2096 cmd.exe cmd.exe PID 2096 wrote to memory of 4192 2096 cmd.exe cacls.exe PID 2096 wrote to memory of 4192 2096 cmd.exe cacls.exe PID 2096 wrote to memory of 4192 2096 cmd.exe cacls.exe PID 2096 wrote to memory of 4844 2096 cmd.exe cacls.exe PID 2096 wrote to memory of 4844 2096 cmd.exe cacls.exe PID 2096 wrote to memory of 4844 2096 cmd.exe cacls.exe PID 3328 wrote to memory of 4856 3328 mnolyk.exe rundll32.exe PID 3328 wrote to memory of 4856 3328 mnolyk.exe rundll32.exe PID 3328 wrote to memory of 4856 3328 mnolyk.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a373356377baa29111c9c78123b35689f35dd91d6b440262646078d6571cecf1.exe"C:\Users\Admin\AppData\Local\Temp\a373356377baa29111c9c78123b35689f35dd91d6b440262646078d6571cecf1.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cltn.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cltn.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\altx.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\altx.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1328 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 13364⤵
- Program crash
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mika.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mika.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vona.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vona.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe" /F4⤵
- Creates scheduled task(s)
PID:428 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4860
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"5⤵PID:3392
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E5⤵PID:1852
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:5028
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:N"5⤵PID:4192
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:R" /E5⤵PID:4844
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1328 -ip 13281⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe1⤵
- Executes dropped EXE
PID:4972
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe1⤵
- Executes dropped EXE
PID:620
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeFilesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeFilesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeFilesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeFilesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cltn.exeFilesize
449KB
MD51b52ce6423d8451abd80cb0b56733006
SHA150f06e57ed29ef613a6404b93295691fb4339281
SHA256b0d6c32557d4d61f6c44c4269c0f530412f1b9bc1a19111ad4cecac88bcbe431
SHA51213be9924d96d23a71b55e2238f681a3f1ff94351b534b801f4008aff796c2e7c3a5b1d4bcc5c7eb52be684964c8ba63459118306fe4e886d3c79d0452640499f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cltn.exeFilesize
449KB
MD51b52ce6423d8451abd80cb0b56733006
SHA150f06e57ed29ef613a6404b93295691fb4339281
SHA256b0d6c32557d4d61f6c44c4269c0f530412f1b9bc1a19111ad4cecac88bcbe431
SHA51213be9924d96d23a71b55e2238f681a3f1ff94351b534b801f4008aff796c2e7c3a5b1d4bcc5c7eb52be684964c8ba63459118306fe4e886d3c79d0452640499f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vona.exeFilesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vona.exeFilesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\altx.exeFilesize
422KB
MD5650e6abe9b67147a52f086f63d013b6c
SHA1bac5d29f1212be631051f03adec4b61d691e4ed8
SHA256eceade3ce86427080b0f4efe03d382ae3ae049cdcafef49cbd1365aab1918ec2
SHA512d026f1c361fcf2ef2240d4eda63cfcc7e069ab0b3b781875ab5c6dece912cc689f2e5f61470744e40094aeaa5fff19ac60cc42508e94be7544024b35c90a39d0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\altx.exeFilesize
422KB
MD5650e6abe9b67147a52f086f63d013b6c
SHA1bac5d29f1212be631051f03adec4b61d691e4ed8
SHA256eceade3ce86427080b0f4efe03d382ae3ae049cdcafef49cbd1365aab1918ec2
SHA512d026f1c361fcf2ef2240d4eda63cfcc7e069ab0b3b781875ab5c6dece912cc689f2e5f61470744e40094aeaa5fff19ac60cc42508e94be7544024b35c90a39d0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mika.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mika.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD59221a421a3e777eb7d4ce55e474bcc4a
SHA1c96d7bd7ccbf9352d50527bff472595b3dc5298e
SHA25610ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8
SHA51263ac172cb19c7c020676937cb35e853710d08e99e06e8cdcb410c37e0c9056af409a50fdec0c90a3c532edcf5e0f128fa1e2181063e1208d4fc4643b1b5736f3
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD59221a421a3e777eb7d4ce55e474bcc4a
SHA1c96d7bd7ccbf9352d50527bff472595b3dc5298e
SHA25610ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8
SHA51263ac172cb19c7c020676937cb35e853710d08e99e06e8cdcb410c37e0c9056af409a50fdec0c90a3c532edcf5e0f128fa1e2181063e1208d4fc4643b1b5736f3
-
memory/428-167-0x0000000000000000-mapping.dmp
-
memory/1328-144-0x0000000005860000-0x0000000005872000-memory.dmpFilesize
72KB
-
memory/1328-138-0x00000000005C4000-0x00000000005F3000-memory.dmpFilesize
188KB
-
memory/1328-149-0x0000000006510000-0x0000000006A3C000-memory.dmpFilesize
5.2MB
-
memory/1328-150-0x00000000005C4000-0x00000000005F3000-memory.dmpFilesize
188KB
-
memory/1328-151-0x0000000006C90000-0x0000000006D06000-memory.dmpFilesize
472KB
-
memory/1328-152-0x0000000006D10000-0x0000000006D60000-memory.dmpFilesize
320KB
-
memory/1328-153-0x00000000005C4000-0x00000000005F3000-memory.dmpFilesize
188KB
-
memory/1328-154-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1328-140-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1328-147-0x0000000005C10000-0x0000000005C76000-memory.dmpFilesize
408KB
-
memory/1328-146-0x0000000005B70000-0x0000000005C02000-memory.dmpFilesize
584KB
-
memory/1328-139-0x0000000000540000-0x000000000058B000-memory.dmpFilesize
300KB
-
memory/1328-141-0x0000000004B00000-0x00000000050A4000-memory.dmpFilesize
5.6MB
-
memory/1328-142-0x00000000050B0000-0x00000000056C8000-memory.dmpFilesize
6.1MB
-
memory/1328-135-0x0000000000000000-mapping.dmp
-
memory/1328-145-0x0000000005880000-0x00000000058BC000-memory.dmpFilesize
240KB
-
memory/1328-143-0x0000000005720000-0x000000000582A000-memory.dmpFilesize
1.0MB
-
memory/1328-148-0x0000000006330000-0x00000000064F2000-memory.dmpFilesize
1.8MB
-
memory/1852-171-0x0000000000000000-mapping.dmp
-
memory/2096-168-0x0000000000000000-mapping.dmp
-
memory/2636-160-0x00007FF8A60B0000-0x00007FF8A6B71000-memory.dmpFilesize
10.8MB
-
memory/2636-159-0x00007FF8A60B0000-0x00007FF8A6B71000-memory.dmpFilesize
10.8MB
-
memory/2636-158-0x0000000000020000-0x000000000002A000-memory.dmpFilesize
40KB
-
memory/2636-155-0x0000000000000000-mapping.dmp
-
memory/3328-164-0x0000000000000000-mapping.dmp
-
memory/3392-170-0x0000000000000000-mapping.dmp
-
memory/3816-161-0x0000000000000000-mapping.dmp
-
memory/4192-173-0x0000000000000000-mapping.dmp
-
memory/4588-132-0x0000000000000000-mapping.dmp
-
memory/4844-174-0x0000000000000000-mapping.dmp
-
memory/4856-176-0x0000000000000000-mapping.dmp
-
memory/4860-169-0x0000000000000000-mapping.dmp
-
memory/5028-172-0x0000000000000000-mapping.dmp