Analysis
-
max time kernel
106s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2023 15:03
Static task
static1
Behavioral task
behavioral1
Sample
f2c6d9872d46d42dc51f547c51a305841dddcfce39aec28caa131c8ae8600cfe.exe
Resource
win10v2004-20220812-en
General
-
Target
f2c6d9872d46d42dc51f547c51a305841dddcfce39aec28caa131c8ae8600cfe.exe
-
Size
578KB
-
MD5
0961271837492f523ff3d6dd88db7017
-
SHA1
dfd97dbe29a1c30de545b67a625414efafa5d84e
-
SHA256
f2c6d9872d46d42dc51f547c51a305841dddcfce39aec28caa131c8ae8600cfe
-
SHA512
76cc75a9f52ae13b16933680b8b7dc7350753df3aa39a5b958e291805c9d891304b0dcf4ea34d41e33581756bbdf150c80dfb4a40d421f038c44dd53b560efb7
-
SSDEEP
12288:rMrVy90ADToudzs4VdFVwqGUfviVrylUzqn21COyzT:Syuum8vrGiW+lwDwNzT
Malware Config
Extracted
amadey
3.66
62.204.41.4/Gol478Ns/index.php
Signatures
-
Processes:
aGff.exenika.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" aGff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" aGff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" aGff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" aGff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" aGff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" nika.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection aGff.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
xriv.exemnolyk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation xriv.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation mnolyk.exe -
Executes dropped EXE 7 IoCs
Processes:
bGfg.exeaGff.exenika.exexriv.exemnolyk.exemnolyk.exemnolyk.exepid process 4100 bGfg.exe 2120 aGff.exe 1952 nika.exe 220 xriv.exe 2788 mnolyk.exe 5064 mnolyk.exe 4164 mnolyk.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 544 rundll32.exe -
Processes:
aGff.exenika.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features aGff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" aGff.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" nika.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
f2c6d9872d46d42dc51f547c51a305841dddcfce39aec28caa131c8ae8600cfe.exebGfg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f2c6d9872d46d42dc51f547c51a305841dddcfce39aec28caa131c8ae8600cfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f2c6d9872d46d42dc51f547c51a305841dddcfce39aec28caa131c8ae8600cfe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bGfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" bGfg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4328 2120 WerFault.exe aGff.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
aGff.exenika.exepid process 2120 aGff.exe 2120 aGff.exe 1952 nika.exe 1952 nika.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
aGff.exenika.exedescription pid process Token: SeDebugPrivilege 2120 aGff.exe Token: SeDebugPrivilege 1952 nika.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
f2c6d9872d46d42dc51f547c51a305841dddcfce39aec28caa131c8ae8600cfe.exebGfg.exexriv.exemnolyk.execmd.exedescription pid process target process PID 4816 wrote to memory of 4100 4816 f2c6d9872d46d42dc51f547c51a305841dddcfce39aec28caa131c8ae8600cfe.exe bGfg.exe PID 4816 wrote to memory of 4100 4816 f2c6d9872d46d42dc51f547c51a305841dddcfce39aec28caa131c8ae8600cfe.exe bGfg.exe PID 4816 wrote to memory of 4100 4816 f2c6d9872d46d42dc51f547c51a305841dddcfce39aec28caa131c8ae8600cfe.exe bGfg.exe PID 4100 wrote to memory of 2120 4100 bGfg.exe aGff.exe PID 4100 wrote to memory of 2120 4100 bGfg.exe aGff.exe PID 4100 wrote to memory of 2120 4100 bGfg.exe aGff.exe PID 4100 wrote to memory of 1952 4100 bGfg.exe nika.exe PID 4100 wrote to memory of 1952 4100 bGfg.exe nika.exe PID 4816 wrote to memory of 220 4816 f2c6d9872d46d42dc51f547c51a305841dddcfce39aec28caa131c8ae8600cfe.exe xriv.exe PID 4816 wrote to memory of 220 4816 f2c6d9872d46d42dc51f547c51a305841dddcfce39aec28caa131c8ae8600cfe.exe xriv.exe PID 4816 wrote to memory of 220 4816 f2c6d9872d46d42dc51f547c51a305841dddcfce39aec28caa131c8ae8600cfe.exe xriv.exe PID 220 wrote to memory of 2788 220 xriv.exe mnolyk.exe PID 220 wrote to memory of 2788 220 xriv.exe mnolyk.exe PID 220 wrote to memory of 2788 220 xriv.exe mnolyk.exe PID 2788 wrote to memory of 4000 2788 mnolyk.exe schtasks.exe PID 2788 wrote to memory of 4000 2788 mnolyk.exe schtasks.exe PID 2788 wrote to memory of 4000 2788 mnolyk.exe schtasks.exe PID 2788 wrote to memory of 1356 2788 mnolyk.exe cmd.exe PID 2788 wrote to memory of 1356 2788 mnolyk.exe cmd.exe PID 2788 wrote to memory of 1356 2788 mnolyk.exe cmd.exe PID 1356 wrote to memory of 1828 1356 cmd.exe cmd.exe PID 1356 wrote to memory of 1828 1356 cmd.exe cmd.exe PID 1356 wrote to memory of 1828 1356 cmd.exe cmd.exe PID 1356 wrote to memory of 3044 1356 cmd.exe cacls.exe PID 1356 wrote to memory of 3044 1356 cmd.exe cacls.exe PID 1356 wrote to memory of 3044 1356 cmd.exe cacls.exe PID 1356 wrote to memory of 4840 1356 cmd.exe cacls.exe PID 1356 wrote to memory of 4840 1356 cmd.exe cacls.exe PID 1356 wrote to memory of 4840 1356 cmd.exe cacls.exe PID 1356 wrote to memory of 4896 1356 cmd.exe cmd.exe PID 1356 wrote to memory of 4896 1356 cmd.exe cmd.exe PID 1356 wrote to memory of 4896 1356 cmd.exe cmd.exe PID 1356 wrote to memory of 4688 1356 cmd.exe cacls.exe PID 1356 wrote to memory of 4688 1356 cmd.exe cacls.exe PID 1356 wrote to memory of 4688 1356 cmd.exe cacls.exe PID 1356 wrote to memory of 2280 1356 cmd.exe cacls.exe PID 1356 wrote to memory of 2280 1356 cmd.exe cacls.exe PID 1356 wrote to memory of 2280 1356 cmd.exe cacls.exe PID 2788 wrote to memory of 544 2788 mnolyk.exe rundll32.exe PID 2788 wrote to memory of 544 2788 mnolyk.exe rundll32.exe PID 2788 wrote to memory of 544 2788 mnolyk.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2c6d9872d46d42dc51f547c51a305841dddcfce39aec28caa131c8ae8600cfe.exe"C:\Users\Admin\AppData\Local\Temp\f2c6d9872d46d42dc51f547c51a305841dddcfce39aec28caa131c8ae8600cfe.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bGfg.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bGfg.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aGff.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aGff.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2120 -ip 21201⤵
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bGfg.exeFilesize
391KB
MD5b428d1be27fba7990a0f79bbda7b2daa
SHA1122764a7190acf16a98318368f9edb3d3c81df51
SHA2560eb12599382811dc44462ae4cea96d35df24a3f96366bec5f7430227428fd24a
SHA512ba7bd15960581b7221120399ada0f2d21315b6f29cc9ceca06473f0697a4ac81653dff0a830532123fbb953c570b3c75584b4062ffa02d1e037dd3bcbb38da19
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bGfg.exeFilesize
391KB
MD5b428d1be27fba7990a0f79bbda7b2daa
SHA1122764a7190acf16a98318368f9edb3d3c81df51
SHA2560eb12599382811dc44462ae4cea96d35df24a3f96366bec5f7430227428fd24a
SHA512ba7bd15960581b7221120399ada0f2d21315b6f29cc9ceca06473f0697a4ac81653dff0a830532123fbb953c570b3c75584b4062ffa02d1e037dd3bcbb38da19
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exeFilesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exeFilesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aGff.exeFilesize
363KB
MD5a1766f3464e706cabd3e6f6b5e476dfb
SHA1b8d413d50f3662963ae3f4c7f293a7ceb860055a
SHA2563da6c10c84ba21f105fdd1f753dabf249cf66c14ef9f786ee1215c7af1e23c84
SHA512178354c9ec0d4297a7ccfae7905c071081e9b4c1e032147f8281acb7212c14cc003a4a369848a62c16495c8aad63eaeaa0c94bf77da769f189bcc900742a89cd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aGff.exeFilesize
363KB
MD5a1766f3464e706cabd3e6f6b5e476dfb
SHA1b8d413d50f3662963ae3f4c7f293a7ceb860055a
SHA2563da6c10c84ba21f105fdd1f753dabf249cf66c14ef9f786ee1215c7af1e23c84
SHA512178354c9ec0d4297a7ccfae7905c071081e9b4c1e032147f8281acb7212c14cc003a4a369848a62c16495c8aad63eaeaa0c94bf77da769f189bcc900742a89cd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
89KB
MD5c79b74d8fec5e7e2ba2f1789fd582a15
SHA178a1e5d99dbaccc5e07b125e1dfb280112cb3128
SHA256b5bd049d32f0faeea6ce65a0f0d326de5bc4427a7c1ad24bfb0ea050c1dec7d3
SHA5120debfc54904fd538cfb1fc648d18f90a991337200b3decf74b28ac2f341843fb3bab4f45bc92cfec333b18dfff9cc136854462e79054a39926a7bd8ee2e057ba
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
89KB
MD5c79b74d8fec5e7e2ba2f1789fd582a15
SHA178a1e5d99dbaccc5e07b125e1dfb280112cb3128
SHA256b5bd049d32f0faeea6ce65a0f0d326de5bc4427a7c1ad24bfb0ea050c1dec7d3
SHA5120debfc54904fd538cfb1fc648d18f90a991337200b3decf74b28ac2f341843fb3bab4f45bc92cfec333b18dfff9cc136854462e79054a39926a7bd8ee2e057ba
-
memory/220-150-0x0000000000000000-mapping.dmp
-
memory/544-166-0x0000000000000000-mapping.dmp
-
memory/1356-157-0x0000000000000000-mapping.dmp
-
memory/1828-158-0x0000000000000000-mapping.dmp
-
memory/1952-145-0x0000000000000000-mapping.dmp
-
memory/1952-160-0x00007FF8CFFB0000-0x00007FF8D0A71000-memory.dmpFilesize
10.8MB
-
memory/1952-148-0x0000000000860000-0x000000000086A000-memory.dmpFilesize
40KB
-
memory/1952-149-0x00007FF8CFFB0000-0x00007FF8D0A71000-memory.dmpFilesize
10.8MB
-
memory/2120-141-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/2120-140-0x00000000004C0000-0x00000000004ED000-memory.dmpFilesize
180KB
-
memory/2120-135-0x0000000000000000-mapping.dmp
-
memory/2120-144-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/2120-143-0x0000000000514000-0x0000000000534000-memory.dmpFilesize
128KB
-
memory/2120-138-0x0000000004B10000-0x00000000050B4000-memory.dmpFilesize
5.6MB
-
memory/2120-142-0x0000000000514000-0x0000000000534000-memory.dmpFilesize
128KB
-
memory/2120-139-0x0000000000514000-0x0000000000534000-memory.dmpFilesize
128KB
-
memory/2280-164-0x0000000000000000-mapping.dmp
-
memory/2788-153-0x0000000000000000-mapping.dmp
-
memory/3044-159-0x0000000000000000-mapping.dmp
-
memory/4000-156-0x0000000000000000-mapping.dmp
-
memory/4100-132-0x0000000000000000-mapping.dmp
-
memory/4688-163-0x0000000000000000-mapping.dmp
-
memory/4840-161-0x0000000000000000-mapping.dmp
-
memory/4896-162-0x0000000000000000-mapping.dmp