Analysis
-
max time kernel
138s -
max time network
16s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
03-08-2020 10:01
Static task
static1
Behavioral task
behavioral1
Sample
ragnar_locker_EDP (4).exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
ragnar_locker_EDP (4).exe
Resource
win10
General
-
Target
ragnar_locker_EDP (4).exe
-
Size
116KB
-
MD5
63241a7a39692f90328a72c0e9826afd
-
SHA1
016ef5b9e91eb9a90af39dbb2c66fe527de12f92
-
SHA256
30dcc7a8ae98e52ee5547379048ca1fc90925e09a2a81c055021ba225c1d064c
-
SHA512
6a758b525c665c45770b18d84f2cb8a38b45d8093558bf15f5e7f53283c0352bd9afd54cfdac21e3deaf146fb840ba5ba32b9da765902f36ef7aa126cc8287c1
Malware Config
Extracted
C:\Users\Public\Documents\RGNR_AC7AABB2.txt
ragnarlocker
http://p6o7m73ujalhgkiv.onion/?p=171
http://mykgoj7uvqtgl367.onion/client/?6bECA2b2AFFfBC1Dff0aa0EaaAd468bec0903b5e4Ea58ecde3C264bC55c7389E
http://p6o7m73ujalhgkiv.onion/?page_id=171
Signatures
-
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
-
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
ragnar_locker_EDP (4).exepid process 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe 108 ragnar_locker_EDP (4).exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
wmic.exevssvc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1408 wmic.exe Token: SeSecurityPrivilege 1408 wmic.exe Token: SeTakeOwnershipPrivilege 1408 wmic.exe Token: SeLoadDriverPrivilege 1408 wmic.exe Token: SeSystemProfilePrivilege 1408 wmic.exe Token: SeSystemtimePrivilege 1408 wmic.exe Token: SeProfSingleProcessPrivilege 1408 wmic.exe Token: SeIncBasePriorityPrivilege 1408 wmic.exe Token: SeCreatePagefilePrivilege 1408 wmic.exe Token: SeBackupPrivilege 1408 wmic.exe Token: SeRestorePrivilege 1408 wmic.exe Token: SeShutdownPrivilege 1408 wmic.exe Token: SeDebugPrivilege 1408 wmic.exe Token: SeSystemEnvironmentPrivilege 1408 wmic.exe Token: SeRemoteShutdownPrivilege 1408 wmic.exe Token: SeUndockPrivilege 1408 wmic.exe Token: SeManageVolumePrivilege 1408 wmic.exe Token: 33 1408 wmic.exe Token: 34 1408 wmic.exe Token: 35 1408 wmic.exe Token: SeBackupPrivilege 1620 vssvc.exe Token: SeRestorePrivilege 1620 vssvc.exe Token: SeAuditPrivilege 1620 vssvc.exe Token: SeIncreaseQuotaPrivilege 1408 wmic.exe Token: SeSecurityPrivilege 1408 wmic.exe Token: SeTakeOwnershipPrivilege 1408 wmic.exe Token: SeLoadDriverPrivilege 1408 wmic.exe Token: SeSystemProfilePrivilege 1408 wmic.exe Token: SeSystemtimePrivilege 1408 wmic.exe Token: SeProfSingleProcessPrivilege 1408 wmic.exe Token: SeIncBasePriorityPrivilege 1408 wmic.exe Token: SeCreatePagefilePrivilege 1408 wmic.exe Token: SeBackupPrivilege 1408 wmic.exe Token: SeRestorePrivilege 1408 wmic.exe Token: SeShutdownPrivilege 1408 wmic.exe Token: SeDebugPrivilege 1408 wmic.exe Token: SeSystemEnvironmentPrivilege 1408 wmic.exe Token: SeRemoteShutdownPrivilege 1408 wmic.exe Token: SeUndockPrivilege 1408 wmic.exe Token: SeManageVolumePrivilege 1408 wmic.exe Token: 33 1408 wmic.exe Token: 34 1408 wmic.exe Token: 35 1408 wmic.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
notepad.exepid process 1320 notepad.exe -
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
ragnar_locker_EDP (4).exedescription ioc process File renamed C:\Users\Admin\Pictures\ImportCompress.png => C:\Users\Admin\Pictures\ImportCompress.png.ragnar_AC7AABB2 ragnar_locker_EDP (4).exe File renamed C:\Users\Admin\Pictures\ExpandSearch.crw => C:\Users\Admin\Pictures\ExpandSearch.crw.ragnar_AC7AABB2 ragnar_locker_EDP (4).exe File renamed C:\Users\Admin\Pictures\ConvertFromFind.png => C:\Users\Admin\Pictures\ConvertFromFind.png.ragnar_AC7AABB2 ragnar_locker_EDP (4).exe File renamed C:\Users\Admin\Pictures\DebugTest.tif => C:\Users\Admin\Pictures\DebugTest.tif.ragnar_AC7AABB2 ragnar_locker_EDP (4).exe File opened for modification C:\Users\Admin\Pictures\RegisterDisconnect.tiff ragnar_locker_EDP (4).exe File renamed C:\Users\Admin\Pictures\EditFind.crw => C:\Users\Admin\Pictures\EditFind.crw.ragnar_AC7AABB2 ragnar_locker_EDP (4).exe File renamed C:\Users\Admin\Pictures\RegisterDisconnect.tiff => C:\Users\Admin\Pictures\RegisterDisconnect.tiff.ragnar_AC7AABB2 ragnar_locker_EDP (4).exe File renamed C:\Users\Admin\Pictures\StopRegister.crw => C:\Users\Admin\Pictures\StopRegister.crw.ragnar_AC7AABB2 ragnar_locker_EDP (4).exe File renamed C:\Users\Admin\Pictures\ApproveConvertFrom.crw => C:\Users\Admin\Pictures\ApproveConvertFrom.crw.ragnar_AC7AABB2 ragnar_locker_EDP (4).exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 980 vssadmin.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Drops file in Program Files directory 10170 IoCs
Processes:
ragnar_locker_EDP (4).exedescription ioc process File created C:\Program Files (x86)\Common Files\Adobe\Updater6\RGNR_AC7AABB2.txt ragnar_locker_EDP (4).exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider.png ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN01044_.WMF ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00305_.WMF ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10336_.GIF ragnar_locker_EDP (4).exe File created C:\Program Files\Microsoft Office\Office14\FORMS\RGNR_AC7AABB2.txt ragnar_locker_EDP (4).exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\RGNR_AC7AABB2.txt ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern.png ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup.jar ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0217262.WMF ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0238983.WMF ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD21370_.GIF ragnar_locker_EDP (4).exe File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\RGNR_AC7AABB2.txt ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_s.png ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_cloudy.png ragnar_locker_EDP (4).exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Soft Blue.htm ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\UnformattedNumeric.jpg ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Part\Issues.accdt ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent.png ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15060_.GIF ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\SETLANG.HXS ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\Office14\THOCR.PSP ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\BD15073_.GIF ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PROTTPLV.XLS ragnar_locker_EDP (4).exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\RGNR_AC7AABB2.txt ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\HideSend.wm ragnar_locker_EDP (4).exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\RGNR_AC7AABB2.txt ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png ragnar_locker_EDP (4).exe File created C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\RGNR_AC7AABB2.txt ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0157831.WMF ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0309664.JPG ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00941_.WMF ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\People\COUGH.WAV ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImages.jpg ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png ragnar_locker_EDP (4).exe File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\RGNR_AC7AABB2.txt ragnar_locker_EDP (4).exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\21.png ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\SPRING.INF ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00687_.WMF ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\REFINED.INF ragnar_locker_EDP (4).exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\RGNR_AC7AABB2.txt ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0216612.WMF ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\J0233312.WMF ragnar_locker_EDP (4).exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm ragnar_locker_EDP (4).exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\Client.xml ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Waveform.thmx ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BAN98.POC ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\EDGE.ELM ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0106208.WMF ragnar_locker_EDP (4).exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187849.WMF ragnar_locker_EDP (4).exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ragnar_locker_EDP (4).exedescription pid process target process PID 108 wrote to memory of 1408 108 ragnar_locker_EDP (4).exe wmic.exe PID 108 wrote to memory of 1408 108 ragnar_locker_EDP (4).exe wmic.exe PID 108 wrote to memory of 1408 108 ragnar_locker_EDP (4).exe wmic.exe PID 108 wrote to memory of 1408 108 ragnar_locker_EDP (4).exe wmic.exe PID 108 wrote to memory of 980 108 ragnar_locker_EDP (4).exe vssadmin.exe PID 108 wrote to memory of 980 108 ragnar_locker_EDP (4).exe vssadmin.exe PID 108 wrote to memory of 980 108 ragnar_locker_EDP (4).exe vssadmin.exe PID 108 wrote to memory of 980 108 ragnar_locker_EDP (4).exe vssadmin.exe PID 108 wrote to memory of 1320 108 ragnar_locker_EDP (4).exe notepad.exe PID 108 wrote to memory of 1320 108 ragnar_locker_EDP (4).exe notepad.exe PID 108 wrote to memory of 1320 108 ragnar_locker_EDP (4).exe notepad.exe PID 108 wrote to memory of 1320 108 ragnar_locker_EDP (4).exe notepad.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
ragnar_locker_EDP (4).exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 ragnar_locker_EDP (4).exe -
Drops startup file 1 IoCs
Processes:
ragnar_locker_EDP (4).exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_AC7AABB2.txt ragnar_locker_EDP (4).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ragnar_locker_EDP (4).exe"C:\Users\Admin\AppData\Local\Temp\ragnar_locker_EDP (4).exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- Writes to the Master Boot Record (MBR)
- Drops startup file
-
C:\Windows\System32\Wbem\wmic.exewmic.exe shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Users\Public\Documents\RGNR_AC7AABB2.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Documents\RGNR_AC7AABB2.txt
-
memory/108-39-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-3-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-47-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-5-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-7-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-9-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-13-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-17-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-21-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-25-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-29-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-31-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-35-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-0-0x00000000020C0000-0x00000000020D1000-memory.dmpFilesize
68KB
-
memory/108-1-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-2-0x00000000020C0000-0x00000000020D1000-memory.dmpFilesize
68KB
-
memory/108-51-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-55-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-59-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-63-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-71-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-79-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-87-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-89-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-97-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-43-0x00000000024D0000-0x00000000024E1000-memory.dmpFilesize
68KB
-
memory/108-101-0x00000000020C0000-0x00000000020D1000-memory.dmpFilesize
68KB
-
memory/980-102-0x0000000000000000-mapping.dmp
-
memory/1320-103-0x0000000000000000-mapping.dmp
-
memory/1408-100-0x0000000000000000-mapping.dmp