Analysis
-
max time kernel
127s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
07-02-2023 01:04
Static task
static1
Behavioral task
behavioral1
Sample
afcec96b357e86bfc538037b06a1b689c01f778168ccd295bbcaf2ddd251eeec.exe
Resource
win10v2004-20221111-en
General
-
Target
afcec96b357e86bfc538037b06a1b689c01f778168ccd295bbcaf2ddd251eeec.exe
-
Size
558KB
-
MD5
93341046fdb031bed3bb653619576cd3
-
SHA1
bbcab870d6a7ee5c3cb0e2f50975a94924b8344a
-
SHA256
afcec96b357e86bfc538037b06a1b689c01f778168ccd295bbcaf2ddd251eeec
-
SHA512
faf092716d99ef8c46a63959a715d9ee01b01b0c472b4e5c9d1475f109fb88817cc202a1f2303c1e96363019c5d17c49934a413f27358afab2ffcdd9f1706bfb
-
SSDEEP
12288:ZMrPy90tUlYcC6XpBvlO1pCCIZsOQ/xuCSm:qy1lA6XpBvlyICIZsO3m
Malware Config
Extracted
amadey
3.66
62.204.41.5/Bu58Ngs/index.php
Signatures
-
Processes:
mika.exeaCYx.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" mika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" mika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" mika.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection aCYx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" aCYx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" aCYx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" mika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" mika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" aCYx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" aCYx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" aCYx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection mika.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
vona.exemnolyk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation vona.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation mnolyk.exe -
Executes dropped EXE 7 IoCs
Processes:
cCYn.exeaCYx.exemika.exevona.exemnolyk.exemnolyk.exemnolyk.exepid process 2496 cCYn.exe 1828 aCYx.exe 1632 mika.exe 4360 vona.exe 1160 mnolyk.exe 1480 mnolyk.exe 2760 mnolyk.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3252 rundll32.exe -
Processes:
mika.exeaCYx.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" mika.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features aCYx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" aCYx.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
afcec96b357e86bfc538037b06a1b689c01f778168ccd295bbcaf2ddd251eeec.execCYn.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce afcec96b357e86bfc538037b06a1b689c01f778168ccd295bbcaf2ddd251eeec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" afcec96b357e86bfc538037b06a1b689c01f778168ccd295bbcaf2ddd251eeec.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cCYn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" cCYn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 404 1828 WerFault.exe aCYx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
aCYx.exemika.exepid process 1828 aCYx.exe 1828 aCYx.exe 1632 mika.exe 1632 mika.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
aCYx.exemika.exedescription pid process Token: SeDebugPrivilege 1828 aCYx.exe Token: SeDebugPrivilege 1632 mika.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
afcec96b357e86bfc538037b06a1b689c01f778168ccd295bbcaf2ddd251eeec.execCYn.exevona.exemnolyk.execmd.exedescription pid process target process PID 2780 wrote to memory of 2496 2780 afcec96b357e86bfc538037b06a1b689c01f778168ccd295bbcaf2ddd251eeec.exe cCYn.exe PID 2780 wrote to memory of 2496 2780 afcec96b357e86bfc538037b06a1b689c01f778168ccd295bbcaf2ddd251eeec.exe cCYn.exe PID 2780 wrote to memory of 2496 2780 afcec96b357e86bfc538037b06a1b689c01f778168ccd295bbcaf2ddd251eeec.exe cCYn.exe PID 2496 wrote to memory of 1828 2496 cCYn.exe aCYx.exe PID 2496 wrote to memory of 1828 2496 cCYn.exe aCYx.exe PID 2496 wrote to memory of 1828 2496 cCYn.exe aCYx.exe PID 2496 wrote to memory of 1632 2496 cCYn.exe mika.exe PID 2496 wrote to memory of 1632 2496 cCYn.exe mika.exe PID 2780 wrote to memory of 4360 2780 afcec96b357e86bfc538037b06a1b689c01f778168ccd295bbcaf2ddd251eeec.exe vona.exe PID 2780 wrote to memory of 4360 2780 afcec96b357e86bfc538037b06a1b689c01f778168ccd295bbcaf2ddd251eeec.exe vona.exe PID 2780 wrote to memory of 4360 2780 afcec96b357e86bfc538037b06a1b689c01f778168ccd295bbcaf2ddd251eeec.exe vona.exe PID 4360 wrote to memory of 1160 4360 vona.exe mnolyk.exe PID 4360 wrote to memory of 1160 4360 vona.exe mnolyk.exe PID 4360 wrote to memory of 1160 4360 vona.exe mnolyk.exe PID 1160 wrote to memory of 3296 1160 mnolyk.exe schtasks.exe PID 1160 wrote to memory of 3296 1160 mnolyk.exe schtasks.exe PID 1160 wrote to memory of 3296 1160 mnolyk.exe schtasks.exe PID 1160 wrote to memory of 1740 1160 mnolyk.exe cmd.exe PID 1160 wrote to memory of 1740 1160 mnolyk.exe cmd.exe PID 1160 wrote to memory of 1740 1160 mnolyk.exe cmd.exe PID 1740 wrote to memory of 4144 1740 cmd.exe cmd.exe PID 1740 wrote to memory of 4144 1740 cmd.exe cmd.exe PID 1740 wrote to memory of 4144 1740 cmd.exe cmd.exe PID 1740 wrote to memory of 1468 1740 cmd.exe cacls.exe PID 1740 wrote to memory of 1468 1740 cmd.exe cacls.exe PID 1740 wrote to memory of 1468 1740 cmd.exe cacls.exe PID 1740 wrote to memory of 4132 1740 cmd.exe cacls.exe PID 1740 wrote to memory of 4132 1740 cmd.exe cacls.exe PID 1740 wrote to memory of 4132 1740 cmd.exe cacls.exe PID 1740 wrote to memory of 4148 1740 cmd.exe cmd.exe PID 1740 wrote to memory of 4148 1740 cmd.exe cmd.exe PID 1740 wrote to memory of 4148 1740 cmd.exe cmd.exe PID 1740 wrote to memory of 3452 1740 cmd.exe cacls.exe PID 1740 wrote to memory of 3452 1740 cmd.exe cacls.exe PID 1740 wrote to memory of 3452 1740 cmd.exe cacls.exe PID 1740 wrote to memory of 4632 1740 cmd.exe cacls.exe PID 1740 wrote to memory of 4632 1740 cmd.exe cacls.exe PID 1740 wrote to memory of 4632 1740 cmd.exe cacls.exe PID 1160 wrote to memory of 3252 1160 mnolyk.exe rundll32.exe PID 1160 wrote to memory of 3252 1160 mnolyk.exe rundll32.exe PID 1160 wrote to memory of 3252 1160 mnolyk.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\afcec96b357e86bfc538037b06a1b689c01f778168ccd295bbcaf2ddd251eeec.exe"C:\Users\Admin\AppData\Local\Temp\afcec96b357e86bfc538037b06a1b689c01f778168ccd295bbcaf2ddd251eeec.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cCYn.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cCYn.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aCYx.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aCYx.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1828 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 10964⤵
- Program crash
PID:404 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mika.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mika.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vona.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vona.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe" /F4⤵
- Creates scheduled task(s)
PID:3296 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4144
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"5⤵PID:1468
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E5⤵PID:4132
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4148
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:N"5⤵PID:3452
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:R" /E5⤵PID:4632
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:3252
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1828 -ip 18281⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe1⤵
- Executes dropped EXE
PID:1480
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe1⤵
- Executes dropped EXE
PID:2760
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeFilesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeFilesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeFilesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeFilesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cCYn.exeFilesize
371KB
MD5a64430a6e009f6e60d6cc282f040f56e
SHA1781e2732bfdf0d51582c14fea5349b9dbcfc0ea6
SHA256580f1eb395cc89f15c7c35511106f00f26c0eecb407ba5805dfe1e929d52a3fe
SHA512920f753a956ae35e7951afeb1349574f0ba53f8a19e239ca062de8f4af33c99818071c7e6dd14ef171ecd9f59d0cf8f63a3743a9901fcdd93ea310d77c0cb037
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cCYn.exeFilesize
371KB
MD5a64430a6e009f6e60d6cc282f040f56e
SHA1781e2732bfdf0d51582c14fea5349b9dbcfc0ea6
SHA256580f1eb395cc89f15c7c35511106f00f26c0eecb407ba5805dfe1e929d52a3fe
SHA512920f753a956ae35e7951afeb1349574f0ba53f8a19e239ca062de8f4af33c99818071c7e6dd14ef171ecd9f59d0cf8f63a3743a9901fcdd93ea310d77c0cb037
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vona.exeFilesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vona.exeFilesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aCYx.exeFilesize
341KB
MD5153833d9864a4194e1a8e2aa434195f8
SHA197aa030d9853b360e77c566fd8e1c04aa08c993e
SHA2560e55ddcf51453954e5140e9dc8c2d8f3c3666fd980beff61c7265e159e55742f
SHA512ba98ec2a2c7bb26c3f70c9c79ddd6ad332ffb8ee05533cb1b5be573a508c8e60ec50143a18a31c72947440202ea07aeab761a418672f3057465c4b669545b3ce
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aCYx.exeFilesize
341KB
MD5153833d9864a4194e1a8e2aa434195f8
SHA197aa030d9853b360e77c566fd8e1c04aa08c993e
SHA2560e55ddcf51453954e5140e9dc8c2d8f3c3666fd980beff61c7265e159e55742f
SHA512ba98ec2a2c7bb26c3f70c9c79ddd6ad332ffb8ee05533cb1b5be573a508c8e60ec50143a18a31c72947440202ea07aeab761a418672f3057465c4b669545b3ce
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mika.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mika.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD59221a421a3e777eb7d4ce55e474bcc4a
SHA1c96d7bd7ccbf9352d50527bff472595b3dc5298e
SHA25610ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8
SHA51263ac172cb19c7c020676937cb35e853710d08e99e06e8cdcb410c37e0c9056af409a50fdec0c90a3c532edcf5e0f128fa1e2181063e1208d4fc4643b1b5736f3
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD59221a421a3e777eb7d4ce55e474bcc4a
SHA1c96d7bd7ccbf9352d50527bff472595b3dc5298e
SHA25610ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8
SHA51263ac172cb19c7c020676937cb35e853710d08e99e06e8cdcb410c37e0c9056af409a50fdec0c90a3c532edcf5e0f128fa1e2181063e1208d4fc4643b1b5736f3
-
memory/1160-154-0x0000000000000000-mapping.dmp
-
memory/1468-160-0x0000000000000000-mapping.dmp
-
memory/1632-145-0x0000000000000000-mapping.dmp
-
memory/1632-148-0x0000000000570000-0x000000000057A000-memory.dmpFilesize
40KB
-
memory/1632-149-0x00007FFA49C10000-0x00007FFA4A6D1000-memory.dmpFilesize
10.8MB
-
memory/1632-150-0x00007FFA49C10000-0x00007FFA4A6D1000-memory.dmpFilesize
10.8MB
-
memory/1740-158-0x0000000000000000-mapping.dmp
-
memory/1828-141-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/1828-140-0x0000000000760000-0x000000000078D000-memory.dmpFilesize
180KB
-
memory/1828-144-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/1828-143-0x0000000000844000-0x0000000000864000-memory.dmpFilesize
128KB
-
memory/1828-135-0x0000000000000000-mapping.dmp
-
memory/1828-142-0x0000000000844000-0x0000000000864000-memory.dmpFilesize
128KB
-
memory/1828-138-0x0000000004A60000-0x0000000005004000-memory.dmpFilesize
5.6MB
-
memory/1828-139-0x0000000000844000-0x0000000000864000-memory.dmpFilesize
128KB
-
memory/2496-132-0x0000000000000000-mapping.dmp
-
memory/3252-166-0x0000000000000000-mapping.dmp
-
memory/3296-157-0x0000000000000000-mapping.dmp
-
memory/3452-163-0x0000000000000000-mapping.dmp
-
memory/4132-161-0x0000000000000000-mapping.dmp
-
memory/4144-159-0x0000000000000000-mapping.dmp
-
memory/4148-162-0x0000000000000000-mapping.dmp
-
memory/4360-151-0x0000000000000000-mapping.dmp
-
memory/4632-164-0x0000000000000000-mapping.dmp