Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2023 19:30
Static task
static1
Behavioral task
behavioral1
Sample
8cbedf5e7a71c53ffec3a2be561325fe40132731259b5b8c23307c748fe079d5.exe
Resource
win10v2004-20221111-en
General
-
Target
8cbedf5e7a71c53ffec3a2be561325fe40132731259b5b8c23307c748fe079d5.exe
-
Size
558KB
-
MD5
049e5452c86ce3dc224233dde4c4d2ae
-
SHA1
8e2d42a417b9e9ac1a34ac2f610ada9d8c97055e
-
SHA256
8cbedf5e7a71c53ffec3a2be561325fe40132731259b5b8c23307c748fe079d5
-
SHA512
067754cf797786f6f13056224d4de6ec58fcdb2b2fb20a5c3546f7e0057658ba17a154df91cb38af8fe532b9b079c68a302c355a40c76db72aebe580b5260896
-
SSDEEP
12288:hMrly90LnONaNstwiQsZW89mZBlUK6uYCv4Tc53Vpa0S+bV9KKSW:AyAOAaYst9mhDHvwGFd
Malware Config
Extracted
amadey
3.66
62.204.41.4/Gol478Ns/index.php
Signatures
-
Processes:
aSxf.exenika.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" aSxf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" aSxf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" nika.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection aSxf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" aSxf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" aSxf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" aSxf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" nika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" nika.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mnolyk.exexriv.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation mnolyk.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation xriv.exe -
Executes dropped EXE 7 IoCs
Processes:
bSxg.exeaSxf.exenika.exexriv.exemnolyk.exemnolyk.exemnolyk.exepid process 516 bSxg.exe 60 aSxf.exe 2436 nika.exe 708 xriv.exe 4396 mnolyk.exe 1260 mnolyk.exe 4088 mnolyk.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4448 rundll32.exe -
Processes:
aSxf.exenika.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features aSxf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" aSxf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" nika.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
8cbedf5e7a71c53ffec3a2be561325fe40132731259b5b8c23307c748fe079d5.exebSxg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 8cbedf5e7a71c53ffec3a2be561325fe40132731259b5b8c23307c748fe079d5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8cbedf5e7a71c53ffec3a2be561325fe40132731259b5b8c23307c748fe079d5.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bSxg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" bSxg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2880 60 WerFault.exe aSxf.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
aSxf.exenika.exepid process 60 aSxf.exe 60 aSxf.exe 2436 nika.exe 2436 nika.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
aSxf.exenika.exedescription pid process Token: SeDebugPrivilege 60 aSxf.exe Token: SeDebugPrivilege 2436 nika.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
8cbedf5e7a71c53ffec3a2be561325fe40132731259b5b8c23307c748fe079d5.exebSxg.exexriv.exemnolyk.execmd.exedescription pid process target process PID 4272 wrote to memory of 516 4272 8cbedf5e7a71c53ffec3a2be561325fe40132731259b5b8c23307c748fe079d5.exe bSxg.exe PID 4272 wrote to memory of 516 4272 8cbedf5e7a71c53ffec3a2be561325fe40132731259b5b8c23307c748fe079d5.exe bSxg.exe PID 4272 wrote to memory of 516 4272 8cbedf5e7a71c53ffec3a2be561325fe40132731259b5b8c23307c748fe079d5.exe bSxg.exe PID 516 wrote to memory of 60 516 bSxg.exe aSxf.exe PID 516 wrote to memory of 60 516 bSxg.exe aSxf.exe PID 516 wrote to memory of 60 516 bSxg.exe aSxf.exe PID 516 wrote to memory of 2436 516 bSxg.exe nika.exe PID 516 wrote to memory of 2436 516 bSxg.exe nika.exe PID 4272 wrote to memory of 708 4272 8cbedf5e7a71c53ffec3a2be561325fe40132731259b5b8c23307c748fe079d5.exe xriv.exe PID 4272 wrote to memory of 708 4272 8cbedf5e7a71c53ffec3a2be561325fe40132731259b5b8c23307c748fe079d5.exe xriv.exe PID 4272 wrote to memory of 708 4272 8cbedf5e7a71c53ffec3a2be561325fe40132731259b5b8c23307c748fe079d5.exe xriv.exe PID 708 wrote to memory of 4396 708 xriv.exe mnolyk.exe PID 708 wrote to memory of 4396 708 xriv.exe mnolyk.exe PID 708 wrote to memory of 4396 708 xriv.exe mnolyk.exe PID 4396 wrote to memory of 3484 4396 mnolyk.exe schtasks.exe PID 4396 wrote to memory of 3484 4396 mnolyk.exe schtasks.exe PID 4396 wrote to memory of 3484 4396 mnolyk.exe schtasks.exe PID 4396 wrote to memory of 1576 4396 mnolyk.exe cmd.exe PID 4396 wrote to memory of 1576 4396 mnolyk.exe cmd.exe PID 4396 wrote to memory of 1576 4396 mnolyk.exe cmd.exe PID 1576 wrote to memory of 3444 1576 cmd.exe cmd.exe PID 1576 wrote to memory of 3444 1576 cmd.exe cmd.exe PID 1576 wrote to memory of 3444 1576 cmd.exe cmd.exe PID 1576 wrote to memory of 3900 1576 cmd.exe cacls.exe PID 1576 wrote to memory of 3900 1576 cmd.exe cacls.exe PID 1576 wrote to memory of 3900 1576 cmd.exe cacls.exe PID 1576 wrote to memory of 4892 1576 cmd.exe cacls.exe PID 1576 wrote to memory of 4892 1576 cmd.exe cacls.exe PID 1576 wrote to memory of 4892 1576 cmd.exe cacls.exe PID 1576 wrote to memory of 4884 1576 cmd.exe cmd.exe PID 1576 wrote to memory of 4884 1576 cmd.exe cmd.exe PID 1576 wrote to memory of 4884 1576 cmd.exe cmd.exe PID 1576 wrote to memory of 4568 1576 cmd.exe cacls.exe PID 1576 wrote to memory of 4568 1576 cmd.exe cacls.exe PID 1576 wrote to memory of 4568 1576 cmd.exe cacls.exe PID 1576 wrote to memory of 1596 1576 cmd.exe cacls.exe PID 1576 wrote to memory of 1596 1576 cmd.exe cacls.exe PID 1576 wrote to memory of 1596 1576 cmd.exe cacls.exe PID 4396 wrote to memory of 4448 4396 mnolyk.exe rundll32.exe PID 4396 wrote to memory of 4448 4396 mnolyk.exe rundll32.exe PID 4396 wrote to memory of 4448 4396 mnolyk.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cbedf5e7a71c53ffec3a2be561325fe40132731259b5b8c23307c748fe079d5.exe"C:\Users\Admin\AppData\Local\Temp\8cbedf5e7a71c53ffec3a2be561325fe40132731259b5b8c23307c748fe079d5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bSxg.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bSxg.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aSxf.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aSxf.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4b9a106e76" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 60 -ip 601⤵
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exeFilesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bSxg.exeFilesize
371KB
MD596f527edb9248fc8c3bbc2db72fef637
SHA1688514f73ba632ecf11f2dc9a1ef63e9b3d938e0
SHA256c99e070ea292a818821feb025f45898872efb3ca86cd1295bc126cafbe85dfb6
SHA512448c4604f5b24e8cc22e4206216ab62b2a65e2b9928a213cbfa7d6281615295b6d7347d20b0cb528aa21d419daac38a4ab9ca82edd6e4b52bdd6c6b4d7fc1fc8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bSxg.exeFilesize
371KB
MD596f527edb9248fc8c3bbc2db72fef637
SHA1688514f73ba632ecf11f2dc9a1ef63e9b3d938e0
SHA256c99e070ea292a818821feb025f45898872efb3ca86cd1295bc126cafbe85dfb6
SHA512448c4604f5b24e8cc22e4206216ab62b2a65e2b9928a213cbfa7d6281615295b6d7347d20b0cb528aa21d419daac38a4ab9ca82edd6e4b52bdd6c6b4d7fc1fc8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exeFilesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xriv.exeFilesize
236KB
MD58bb923c4d81284daef7896e5682df6c6
SHA167e34a96b77e44b666c5479f540995bdeacf5de2
SHA2569b0410052289a8416a458401fbb9a74d6361f4769465431b209f32151d7c6f21
SHA5122daed03277a343db5fcb22e26baea5cda41de39dc825fe0aad51f6ec181b8f38f09427f27fb58ffd179f37032600d107ef772cc6275f7d0d62899c6cd3f8aff7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aSxf.exeFilesize
341KB
MD53e992824465f02894e443cc255fff678
SHA10c95d1a78a548c60da4f2c15465efd2e122bb8da
SHA25644946a180522e0a95656ed6be0cdb70acf648b7c3eae27850762ac344b05f8d0
SHA512becd6d844a43ad48d6c0b9af2cbf15b7f6085c5bab5c4eae4bd909b0064c7fca22a6601b94416f86a9e51a4a6f88cdbe73723a2862ff25c222b2f75809d3b9a3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aSxf.exeFilesize
341KB
MD53e992824465f02894e443cc255fff678
SHA10c95d1a78a548c60da4f2c15465efd2e122bb8da
SHA25644946a180522e0a95656ed6be0cdb70acf648b7c3eae27850762ac344b05f8d0
SHA512becd6d844a43ad48d6c0b9af2cbf15b7f6085c5bab5c4eae4bd909b0064c7fca22a6601b94416f86a9e51a4a6f88cdbe73723a2862ff25c222b2f75809d3b9a3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nika.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
89KB
MD5c79b74d8fec5e7e2ba2f1789fd582a15
SHA178a1e5d99dbaccc5e07b125e1dfb280112cb3128
SHA256b5bd049d32f0faeea6ce65a0f0d326de5bc4427a7c1ad24bfb0ea050c1dec7d3
SHA5120debfc54904fd538cfb1fc648d18f90a991337200b3decf74b28ac2f341843fb3bab4f45bc92cfec333b18dfff9cc136854462e79054a39926a7bd8ee2e057ba
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
89KB
MD5c79b74d8fec5e7e2ba2f1789fd582a15
SHA178a1e5d99dbaccc5e07b125e1dfb280112cb3128
SHA256b5bd049d32f0faeea6ce65a0f0d326de5bc4427a7c1ad24bfb0ea050c1dec7d3
SHA5120debfc54904fd538cfb1fc648d18f90a991337200b3decf74b28ac2f341843fb3bab4f45bc92cfec333b18dfff9cc136854462e79054a39926a7bd8ee2e057ba
-
memory/60-142-0x00000000007A4000-0x00000000007C4000-memory.dmpFilesize
128KB
-
memory/60-143-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/60-141-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/60-140-0x0000000000600000-0x000000000062D000-memory.dmpFilesize
180KB
-
memory/60-139-0x00000000007A4000-0x00000000007C4000-memory.dmpFilesize
128KB
-
memory/60-138-0x0000000004B00000-0x00000000050A4000-memory.dmpFilesize
5.6MB
-
memory/60-135-0x0000000000000000-mapping.dmp
-
memory/516-132-0x0000000000000000-mapping.dmp
-
memory/708-150-0x0000000000000000-mapping.dmp
-
memory/1576-157-0x0000000000000000-mapping.dmp
-
memory/1596-163-0x0000000000000000-mapping.dmp
-
memory/2436-149-0x00007FFAF2C50000-0x00007FFAF3711000-memory.dmpFilesize
10.8MB
-
memory/2436-144-0x0000000000000000-mapping.dmp
-
memory/2436-147-0x00000000002A0000-0x00000000002AA000-memory.dmpFilesize
40KB
-
memory/2436-148-0x00007FFAF2C50000-0x00007FFAF3711000-memory.dmpFilesize
10.8MB
-
memory/3444-158-0x0000000000000000-mapping.dmp
-
memory/3484-156-0x0000000000000000-mapping.dmp
-
memory/3900-159-0x0000000000000000-mapping.dmp
-
memory/4396-153-0x0000000000000000-mapping.dmp
-
memory/4448-164-0x0000000000000000-mapping.dmp
-
memory/4568-162-0x0000000000000000-mapping.dmp
-
memory/4884-161-0x0000000000000000-mapping.dmp
-
memory/4892-160-0x0000000000000000-mapping.dmp