Analysis
-
max time kernel
96s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2023 15:31
Static task
static1
Behavioral task
behavioral1
Sample
6a7abc798a6df3a71001a197a2d3768ec5c7d41c99ab97d0e1b7402b9bf11ce7.exe
Resource
win10v2004-20221111-en
General
-
Target
6a7abc798a6df3a71001a197a2d3768ec5c7d41c99ab97d0e1b7402b9bf11ce7.exe
-
Size
578KB
-
MD5
e0736622b9e43309634fbf94679aa2e8
-
SHA1
fddc24c7910cddef115a8f9a50eefa11bea78d9d
-
SHA256
6a7abc798a6df3a71001a197a2d3768ec5c7d41c99ab97d0e1b7402b9bf11ce7
-
SHA512
aabe9301a1ad4cdc4742679ea914a6af9e4ea0b2773e60af2a8f598bc88f9db249637e206c6ade4dc446d435ee1ea2b5b3e777990fa92a7819675f13d57798e9
-
SSDEEP
12288:EMr2y90tdnBqDVn0bHfB+wOFVAqGUrvijuxCGXm:Ky0dnBgV0bJ+w+TG+OuEG2
Malware Config
Extracted
amadey
3.66
62.204.41.4/Gol478Ns/index.php
Signatures
-
Processes:
aABf.exenika.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" aABf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" aABf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" nika.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection aABf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" aABf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" aABf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" aABf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" nika.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mnolyk.exexriv.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation mnolyk.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation xriv.exe -
Executes dropped EXE 7 IoCs
Processes:
bABg.exeaABf.exenika.exexriv.exemnolyk.exemnolyk.exemnolyk.exepid process 1488 bABg.exe 4876 aABf.exe 4688 nika.exe 1496 xriv.exe 4136 mnolyk.exe 4444 mnolyk.exe 4220 mnolyk.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3200 rundll32.exe -
Processes:
aABf.exenika.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features aABf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" aABf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" nika.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
6a7abc798a6df3a71001a197a2d3768ec5c7d41c99ab97d0e1b7402b9bf11ce7.exebABg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6a7abc798a6df3a71001a197a2d3768ec5c7d41c99ab97d0e1b7402b9bf11ce7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6a7abc798a6df3a71001a197a2d3768ec5c7d41c99ab97d0e1b7402b9bf11ce7.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bABg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" bABg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2680 4876 WerFault.exe aABf.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
aABf.exenika.exepid process 4876 aABf.exe 4876 aABf.exe 4688 nika.exe 4688 nika.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
aABf.exenika.exedescription pid process Token: SeDebugPrivilege 4876 aABf.exe Token: SeDebugPrivilege 4688 nika.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
6a7abc798a6df3a71001a197a2d3768ec5c7d41c99ab97d0e1b7402b9bf11ce7.exebABg.exexriv.exemnolyk.execmd.exedescription pid process target process PID 3048 wrote to memory of 1488 3048 6a7abc798a6df3a71001a197a2d3768ec5c7d41c99ab97d0e1b7402b9bf11ce7.exe bABg.exe PID 3048 wrote to memory of 1488 3048 6a7abc798a6df3a71001a197a2d3768ec5c7d41c99ab97d0e1b7402b9bf11ce7.exe bABg.exe PID 3048 wrote to memory of 1488 3048 6a7abc798a6df3a71001a197a2d3768ec5c7d41c99ab97d0e1b7402b9bf11ce7.exe bABg.exe PID 1488 wrote to memory of 4876 1488 bABg.exe aABf.exe PID 1488 wrote to memory of 4876 1488 bABg.exe aABf.exe PID 1488 wrote to memory of 4876 1488 bABg.exe aABf.exe PID 1488 wrote to memory of 4688 1488 bABg.exe nika.exe PID 1488 wrote to memory of 4688 1488 bABg.exe nika.exe PID 3048 wrote to memory of 1496 3048 6a7abc798a6df3a71001a197a2d3768ec5c7d41c99ab97d0e1b7402b9bf11ce7.exe xriv.exe PID 3048 wrote to memory of 1496 3048 6a7abc798a6df3a71001a197a2d3768ec5c7d41c99ab97d0e1b7402b9bf11ce7.exe xriv.exe PID 3048 wrote to memory of 1496 3048 6a7abc798a6df3a71001a197a2d3768ec5c7d41c99ab97d0e1b7402b9bf11ce7.exe xriv.exe PID 1496 wrote to memory of 4136 1496 xriv.exe mnolyk.exe PID 1496 wrote to memory of 4136 1496 xriv.exe mnolyk.exe PID 1496 wrote to memory of 4136 1496 xriv.exe mnolyk.exe PID 4136 wrote to memory of 4940 4136 mnolyk.exe schtasks.exe PID 4136 wrote to memory of 4940 4136 mnolyk.exe schtasks.exe PID 4136 wrote to memory of 4940 4136 mnolyk.exe schtasks.exe PID 4136 wrote to memory of 2912 4136 mnolyk.exe cmd.exe PID 4136 wrote to memory of 2912 4136 mnolyk.exe cmd.exe PID 4136 wrote to memory of 2912 4136 mnolyk.exe cmd.exe PID 2912 wrote to memory of 220 2912 cmd.exe cmd.exe PID 2912 wrote to memory of 220 2912 cmd.exe cmd.exe PID 2912 wrote to memory of 220 2912 cmd.exe cmd.exe PID 2912 wrote to memory of 3556 2912 cmd.exe cacls.exe PID 2912 wrote to memory of 3556 2912 cmd.exe cacls.exe PID 2912 wrote to memory of 3556 2912 cmd.exe cacls.exe PID 2912 wrote to memory of 3696 2912 cmd.exe cacls.exe PID 2912 wrote to memory of 3696 2912 cmd.exe cacls.exe PID 2912 wrote to memory of 3696 2912 cmd.exe cacls.exe PID 2912 wrote to memory of 2548 2912 cmd.exe cmd.exe PID 2912 wrote to memory of 2548 2912 cmd.exe cmd.exe PID 2912 wrote to memory of 2548 2912 cmd.exe cmd.exe PID 2912 wrote to memory of 3884 2912 cmd.exe cacls.exe PID 2912 wrote to memory of 3884 2912 cmd.exe cacls.exe PID 2912 wrote to memory of 3884 2912 cmd.exe cacls.exe PID 2912 wrote to memory of 2220 2912 cmd.exe cacls.exe PID 2912 wrote to memory of 2220 2912 cmd.exe cacls.exe PID 2912 wrote to memory of 2220 2912 cmd.exe cacls.exe PID 4136 wrote to memory of 3200 4136 mnolyk.exe rundll32.exe PID 4136 wrote to memory of 3200 4136 mnolyk.exe rundll32.exe PID 4136 wrote to memory of 3200 4136 mnolyk.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a7abc798a6df3a71001a197a2d3768ec5c7d41c99ab97d0e1b7402b9bf11ce7.exe"C:\Users\Admin\AppData\Local\Temp\6a7abc798a6df3a71001a197a2d3768ec5c7d41c99ab97d0e1b7402b9bf11ce7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bABg.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bABg.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aABf.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aABf.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4876 -ip 48761⤵
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bABg.exeFilesize
391KB
MD5d850ef3fafcdce7e2695ece29ea05fa4
SHA1e6b7e66663af8c18e38a28287879eb8688e6513e
SHA25685a260e7e9febab120c8b8e5e4d5bc798c9b765a540c8db4b3f3f80edddf8818
SHA512c6c08967adb86f3c8b75fac2e621a699f2ffc7677ba487d30ed9ef25597a6906f9469fd1459b2b8504bf2b53e7dd6e721b009917b44000ec106b34d3189936a6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bABg.exeFilesize
391KB
MD5d850ef3fafcdce7e2695ece29ea05fa4
SHA1e6b7e66663af8c18e38a28287879eb8688e6513e
SHA25685a260e7e9febab120c8b8e5e4d5bc798c9b765a540c8db4b3f3f80edddf8818
SHA512c6c08967adb86f3c8b75fac2e621a699f2ffc7677ba487d30ed9ef25597a6906f9469fd1459b2b8504bf2b53e7dd6e721b009917b44000ec106b34d3189936a6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exeFilesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exeFilesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aABf.exeFilesize
363KB
MD5a1766f3464e706cabd3e6f6b5e476dfb
SHA1b8d413d50f3662963ae3f4c7f293a7ceb860055a
SHA2563da6c10c84ba21f105fdd1f753dabf249cf66c14ef9f786ee1215c7af1e23c84
SHA512178354c9ec0d4297a7ccfae7905c071081e9b4c1e032147f8281acb7212c14cc003a4a369848a62c16495c8aad63eaeaa0c94bf77da769f189bcc900742a89cd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aABf.exeFilesize
363KB
MD5a1766f3464e706cabd3e6f6b5e476dfb
SHA1b8d413d50f3662963ae3f4c7f293a7ceb860055a
SHA2563da6c10c84ba21f105fdd1f753dabf249cf66c14ef9f786ee1215c7af1e23c84
SHA512178354c9ec0d4297a7ccfae7905c071081e9b4c1e032147f8281acb7212c14cc003a4a369848a62c16495c8aad63eaeaa0c94bf77da769f189bcc900742a89cd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
89KB
MD5c79b74d8fec5e7e2ba2f1789fd582a15
SHA178a1e5d99dbaccc5e07b125e1dfb280112cb3128
SHA256b5bd049d32f0faeea6ce65a0f0d326de5bc4427a7c1ad24bfb0ea050c1dec7d3
SHA5120debfc54904fd538cfb1fc648d18f90a991337200b3decf74b28ac2f341843fb3bab4f45bc92cfec333b18dfff9cc136854462e79054a39926a7bd8ee2e057ba
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
89KB
MD5c79b74d8fec5e7e2ba2f1789fd582a15
SHA178a1e5d99dbaccc5e07b125e1dfb280112cb3128
SHA256b5bd049d32f0faeea6ce65a0f0d326de5bc4427a7c1ad24bfb0ea050c1dec7d3
SHA5120debfc54904fd538cfb1fc648d18f90a991337200b3decf74b28ac2f341843fb3bab4f45bc92cfec333b18dfff9cc136854462e79054a39926a7bd8ee2e057ba
-
memory/220-159-0x0000000000000000-mapping.dmp
-
memory/1488-132-0x0000000000000000-mapping.dmp
-
memory/1496-151-0x0000000000000000-mapping.dmp
-
memory/2220-164-0x0000000000000000-mapping.dmp
-
memory/2548-162-0x0000000000000000-mapping.dmp
-
memory/2912-158-0x0000000000000000-mapping.dmp
-
memory/3200-166-0x0000000000000000-mapping.dmp
-
memory/3556-160-0x0000000000000000-mapping.dmp
-
memory/3696-161-0x0000000000000000-mapping.dmp
-
memory/3884-163-0x0000000000000000-mapping.dmp
-
memory/4136-154-0x0000000000000000-mapping.dmp
-
memory/4688-149-0x00007FF896420000-0x00007FF896EE1000-memory.dmpFilesize
10.8MB
-
memory/4688-148-0x0000000000A50000-0x0000000000A5A000-memory.dmpFilesize
40KB
-
memory/4688-145-0x0000000000000000-mapping.dmp
-
memory/4688-150-0x00007FF896420000-0x00007FF896EE1000-memory.dmpFilesize
10.8MB
-
memory/4876-144-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/4876-143-0x0000000000570000-0x0000000000670000-memory.dmpFilesize
1024KB
-
memory/4876-142-0x0000000004AC0000-0x0000000005064000-memory.dmpFilesize
5.6MB
-
memory/4876-141-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/4876-140-0x00000000020B0000-0x00000000020DD000-memory.dmpFilesize
180KB
-
memory/4876-139-0x0000000000570000-0x0000000000670000-memory.dmpFilesize
1024KB
-
memory/4876-135-0x0000000000000000-mapping.dmp
-
memory/4940-157-0x0000000000000000-mapping.dmp