Analysis
-
max time kernel
61s -
max time network
60s -
platform
windows7_x64 -
resource
win7 -
submitted
03-08-2020 10:02
Static task
static1
Behavioral task
behavioral1
Sample
ragnar_locker_EDP (2).exe
Resource
win7
Behavioral task
behavioral2
Sample
ragnar_locker_EDP (2).exe
Resource
win10v200722
General
-
Target
ragnar_locker_EDP (2).exe
-
Size
47KB
-
MD5
f7c48ee1f3ee1b18d255ad98703a5896
-
SHA1
7c3a082237504d3bf36e47b986e02e014a2b8abc
-
SHA256
c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6
-
SHA512
5d5dd72488555f937aa23e674b69a0fc1eaeda38f66450858f3e9b8fe55160a02ece08ed4b6475a62810ebd24b2e2d83ae08ebf2df54b39c174f05027bb608ce
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_F0C1BF83.txt
ragnarlocker
http://p6o7m73ujalhgkiv.onion/?p=171
http://mykgoj7uvqtgl367.onion/client/?6bECA2b2AFFfBC1Dff0aa0EaaAd468bec0903b5e4Ea58ecde3C264bC55c7389E
http://p6o7m73ujalhgkiv.onion/?page_id=171
Signatures
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
ragnar_locker_EDP (2).exedescription ioc process File opened for modification C:\Users\Admin\Pictures\SendSwitch.tiff ragnar_locker_EDP (2).exe File renamed C:\Users\Admin\Pictures\SendSwitch.tiff => C:\Users\Admin\Pictures\SendSwitch.tiff.ragnar_F0C1BF83 ragnar_locker_EDP (2).exe File opened for modification C:\Users\Admin\Pictures\WriteConvert.tiff ragnar_locker_EDP (2).exe File renamed C:\Users\Admin\Pictures\WriteConvert.tiff => C:\Users\Admin\Pictures\WriteConvert.tiff.ragnar_F0C1BF83 ragnar_locker_EDP (2).exe File renamed C:\Users\Admin\Pictures\DebugApprove.png => C:\Users\Admin\Pictures\DebugApprove.png.ragnar_F0C1BF83 ragnar_locker_EDP (2).exe File renamed C:\Users\Admin\Pictures\MoveInitialize.png => C:\Users\Admin\Pictures\MoveInitialize.png.ragnar_F0C1BF83 ragnar_locker_EDP (2).exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
notepad.exepid process 1752 notepad.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1940 vssadmin.exe -
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
wmic.exevssvc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1952 wmic.exe Token: SeSecurityPrivilege 1952 wmic.exe Token: SeTakeOwnershipPrivilege 1952 wmic.exe Token: SeLoadDriverPrivilege 1952 wmic.exe Token: SeSystemProfilePrivilege 1952 wmic.exe Token: SeSystemtimePrivilege 1952 wmic.exe Token: SeProfSingleProcessPrivilege 1952 wmic.exe Token: SeIncBasePriorityPrivilege 1952 wmic.exe Token: SeCreatePagefilePrivilege 1952 wmic.exe Token: SeBackupPrivilege 1952 wmic.exe Token: SeRestorePrivilege 1952 wmic.exe Token: SeShutdownPrivilege 1952 wmic.exe Token: SeDebugPrivilege 1952 wmic.exe Token: SeSystemEnvironmentPrivilege 1952 wmic.exe Token: SeRemoteShutdownPrivilege 1952 wmic.exe Token: SeUndockPrivilege 1952 wmic.exe Token: SeManageVolumePrivilege 1952 wmic.exe Token: 33 1952 wmic.exe Token: 34 1952 wmic.exe Token: 35 1952 wmic.exe Token: SeBackupPrivilege 2024 vssvc.exe Token: SeRestorePrivilege 2024 vssvc.exe Token: SeAuditPrivilege 2024 vssvc.exe Token: SeIncreaseQuotaPrivilege 1952 wmic.exe Token: SeSecurityPrivilege 1952 wmic.exe Token: SeTakeOwnershipPrivilege 1952 wmic.exe Token: SeLoadDriverPrivilege 1952 wmic.exe Token: SeSystemProfilePrivilege 1952 wmic.exe Token: SeSystemtimePrivilege 1952 wmic.exe Token: SeProfSingleProcessPrivilege 1952 wmic.exe Token: SeIncBasePriorityPrivilege 1952 wmic.exe Token: SeCreatePagefilePrivilege 1952 wmic.exe Token: SeBackupPrivilege 1952 wmic.exe Token: SeRestorePrivilege 1952 wmic.exe Token: SeShutdownPrivilege 1952 wmic.exe Token: SeDebugPrivilege 1952 wmic.exe Token: SeSystemEnvironmentPrivilege 1952 wmic.exe Token: SeRemoteShutdownPrivilege 1952 wmic.exe Token: SeUndockPrivilege 1952 wmic.exe Token: SeManageVolumePrivilege 1952 wmic.exe Token: 33 1952 wmic.exe Token: 34 1952 wmic.exe Token: 35 1952 wmic.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ragnar_locker_EDP (2).exedescription pid process target process PID 1144 wrote to memory of 1952 1144 ragnar_locker_EDP (2).exe wmic.exe PID 1144 wrote to memory of 1952 1144 ragnar_locker_EDP (2).exe wmic.exe PID 1144 wrote to memory of 1952 1144 ragnar_locker_EDP (2).exe wmic.exe PID 1144 wrote to memory of 1952 1144 ragnar_locker_EDP (2).exe wmic.exe PID 1144 wrote to memory of 1940 1144 ragnar_locker_EDP (2).exe vssadmin.exe PID 1144 wrote to memory of 1940 1144 ragnar_locker_EDP (2).exe vssadmin.exe PID 1144 wrote to memory of 1940 1144 ragnar_locker_EDP (2).exe vssadmin.exe PID 1144 wrote to memory of 1940 1144 ragnar_locker_EDP (2).exe vssadmin.exe PID 1144 wrote to memory of 1752 1144 ragnar_locker_EDP (2).exe notepad.exe PID 1144 wrote to memory of 1752 1144 ragnar_locker_EDP (2).exe notepad.exe PID 1144 wrote to memory of 1752 1144 ragnar_locker_EDP (2).exe notepad.exe PID 1144 wrote to memory of 1752 1144 ragnar_locker_EDP (2).exe notepad.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
ragnar_locker_EDP (2).exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 ragnar_locker_EDP (2).exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe -
Drops file in Program Files directory 10154 IoCs
Processes:
ragnar_locker_EDP (2).exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial.png ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\divider-vertical.png ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0298897.WMF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14790_.GIF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\TAB_OFF.GIF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107446.WMF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0287643.JPG ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7FR.dub ragnar_locker_EDP (2).exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_foggy.png ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02740G.GIF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02045_.WMF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\1033\OFFICE10.MML ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21413_.GIF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\vstoee90.tlb ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\THMBNAIL.PNG ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Adelaide ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS01080_.WMF ragnar_locker_EDP (2).exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\RGNR_F0C1BF83.txt ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_fr.jar ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Puerto_Rico ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02862_.WMF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\macroprogress.gif ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_bkg.png ragnar_locker_EDP (2).exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msadomd28.tlb ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\COMPASS.INF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0195320.WMF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-11 ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePageBlank.gif ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00202_.WMF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0217872.WMF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0205466.WMF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\SAVE.GIF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo ragnar_locker_EDP (2).exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\RGNR_F0C1BF83.txt ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\blafdoc.css ragnar_locker_EDP (2).exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\RGNR_F0C1BF83.txt ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\SendPush.midi ragnar_locker_EDP (2).exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\vstoee100.tlb ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Hovd ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Nauru ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01761_.WMF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Java\jre7\lib\resources.jar ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\MedianReport.Dotx ragnar_locker_EDP (2).exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.IDX ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\NEWS11.POC ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00414_.WMF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21482_.GIF ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02040U.BMP ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME07.CSS ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Sts2.css ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\32.png ragnar_locker_EDP (2).exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\redStateIcon.png ragnar_locker_EDP (2).exe -
Drops startup file 1 IoCs
Processes:
ragnar_locker_EDP (2).exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_F0C1BF83.txt ragnar_locker_EDP (2).exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
ragnar_locker_EDP (2).exepid process 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe 1144 ragnar_locker_EDP (2).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ragnar_locker_EDP (2).exe"C:\Users\Admin\AppData\Local\Temp\ragnar_locker_EDP (2).exe"1⤵
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Wbem\wmic.exewmic.exe shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Users\Public\Documents\RGNR_F0C1BF83.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Documents\RGNR_F0C1BF83.txt
-
memory/1144-43-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-7-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-47-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-5-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-49-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-9-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-15-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-19-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-23-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-29-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-33-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-51-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-41-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-0-0x0000000002240000-0x0000000002251000-memory.dmpFilesize
68KB
-
memory/1144-3-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-2-0x0000000002240000-0x0000000002251000-memory.dmpFilesize
68KB
-
memory/1144-37-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-55-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-61-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-65-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-69-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-79-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-87-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-89-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-97-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1144-1-0x0000000002650000-0x0000000002661000-memory.dmpFilesize
68KB
-
memory/1752-102-0x0000000000000000-mapping.dmp
-
memory/1940-101-0x0000000000000000-mapping.dmp
-
memory/1952-100-0x0000000000000000-mapping.dmp