Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
15-05-2021 06:53
Static task
static1
Behavioral task
behavioral1
Sample
513fc6732361895ddf4477f737f3bcc12c514257415021eecf1117453fcacd5b.exe
Resource
win7v20210408
General
-
Target
513fc6732361895ddf4477f737f3bcc12c514257415021eecf1117453fcacd5b.exe
-
Size
4.1MB
-
MD5
2a13baea0cf11e3e7eb303649d46d6be
-
SHA1
0c0c8002304e1fd5a08adf1d51958eab9c9ff0f6
-
SHA256
513fc6732361895ddf4477f737f3bcc12c514257415021eecf1117453fcacd5b
-
SHA512
50cbe15785eb43524873f161be7fdb35abb7a394c18074adf240ac305dd99e6e404f20a9fc3b229e7dbe5f1e83e0b2929fec1caa5b57548a6ffdc35d8a60e73a
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
Processes:
rutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exepid process 1072 rutserv.exe 852 rutserv.exe 324 rutserv.exe 1608 rutserv.exe 1976 rfusclient.exe 664 rfusclient.exe 1596 rfusclient.exe -
Loads dropped DLL 5 IoCs
Processes:
cmd.exerutserv.exepid process 1940 cmd.exe 1940 cmd.exe 1940 cmd.exe 1608 rutserv.exe 1608 rutserv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 3 IoCs
Processes:
timeout.exetimeout.exetimeout.exepid process 1140 timeout.exe 1560 timeout.exe 576 timeout.exe -
Runs .reg file with regedit 1 IoCs
Processes:
regedit.exepid process 1488 regedit.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
rutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exepid process 1072 rutserv.exe 1072 rutserv.exe 1072 rutserv.exe 1072 rutserv.exe 852 rutserv.exe 852 rutserv.exe 324 rutserv.exe 324 rutserv.exe 1608 rutserv.exe 1608 rutserv.exe 1608 rutserv.exe 1608 rutserv.exe 1976 rfusclient.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
rfusclient.exepid process 1596 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
rutserv.exerutserv.exerutserv.exedescription pid process Token: SeDebugPrivilege 1072 rutserv.exe Token: SeDebugPrivilege 324 rutserv.exe Token: SeTakeOwnershipPrivilege 1608 rutserv.exe Token: SeTcbPrivilege 1608 rutserv.exe Token: SeTcbPrivilege 1608 rutserv.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
rutserv.exerutserv.exerutserv.exerutserv.exepid process 1072 rutserv.exe 852 rutserv.exe 324 rutserv.exe 1608 rutserv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
513fc6732361895ddf4477f737f3bcc12c514257415021eecf1117453fcacd5b.exeWScript.execmd.exedescription pid process target process PID 1776 wrote to memory of 1168 1776 513fc6732361895ddf4477f737f3bcc12c514257415021eecf1117453fcacd5b.exe WScript.exe PID 1776 wrote to memory of 1168 1776 513fc6732361895ddf4477f737f3bcc12c514257415021eecf1117453fcacd5b.exe WScript.exe PID 1776 wrote to memory of 1168 1776 513fc6732361895ddf4477f737f3bcc12c514257415021eecf1117453fcacd5b.exe WScript.exe PID 1776 wrote to memory of 1168 1776 513fc6732361895ddf4477f737f3bcc12c514257415021eecf1117453fcacd5b.exe WScript.exe PID 1776 wrote to memory of 1168 1776 513fc6732361895ddf4477f737f3bcc12c514257415021eecf1117453fcacd5b.exe WScript.exe PID 1776 wrote to memory of 1168 1776 513fc6732361895ddf4477f737f3bcc12c514257415021eecf1117453fcacd5b.exe WScript.exe PID 1776 wrote to memory of 1168 1776 513fc6732361895ddf4477f737f3bcc12c514257415021eecf1117453fcacd5b.exe WScript.exe PID 1168 wrote to memory of 1940 1168 WScript.exe cmd.exe PID 1168 wrote to memory of 1940 1168 WScript.exe cmd.exe PID 1168 wrote to memory of 1940 1168 WScript.exe cmd.exe PID 1168 wrote to memory of 1940 1168 WScript.exe cmd.exe PID 1168 wrote to memory of 1940 1168 WScript.exe cmd.exe PID 1168 wrote to memory of 1940 1168 WScript.exe cmd.exe PID 1168 wrote to memory of 1940 1168 WScript.exe cmd.exe PID 1940 wrote to memory of 760 1940 cmd.exe reg.exe PID 1940 wrote to memory of 760 1940 cmd.exe reg.exe PID 1940 wrote to memory of 760 1940 cmd.exe reg.exe PID 1940 wrote to memory of 760 1940 cmd.exe reg.exe PID 1940 wrote to memory of 760 1940 cmd.exe reg.exe PID 1940 wrote to memory of 760 1940 cmd.exe reg.exe PID 1940 wrote to memory of 760 1940 cmd.exe reg.exe PID 1940 wrote to memory of 1160 1940 cmd.exe reg.exe PID 1940 wrote to memory of 1160 1940 cmd.exe reg.exe PID 1940 wrote to memory of 1160 1940 cmd.exe reg.exe PID 1940 wrote to memory of 1160 1940 cmd.exe reg.exe PID 1940 wrote to memory of 1160 1940 cmd.exe reg.exe PID 1940 wrote to memory of 1160 1940 cmd.exe reg.exe PID 1940 wrote to memory of 1160 1940 cmd.exe reg.exe PID 1940 wrote to memory of 108 1940 cmd.exe attrib.exe PID 1940 wrote to memory of 108 1940 cmd.exe attrib.exe PID 1940 wrote to memory of 108 1940 cmd.exe attrib.exe PID 1940 wrote to memory of 108 1940 cmd.exe attrib.exe PID 1940 wrote to memory of 108 1940 cmd.exe attrib.exe PID 1940 wrote to memory of 108 1940 cmd.exe attrib.exe PID 1940 wrote to memory of 108 1940 cmd.exe attrib.exe PID 1940 wrote to memory of 1652 1940 cmd.exe attrib.exe PID 1940 wrote to memory of 1652 1940 cmd.exe attrib.exe PID 1940 wrote to memory of 1652 1940 cmd.exe attrib.exe PID 1940 wrote to memory of 1652 1940 cmd.exe attrib.exe PID 1940 wrote to memory of 1652 1940 cmd.exe attrib.exe PID 1940 wrote to memory of 1652 1940 cmd.exe attrib.exe PID 1940 wrote to memory of 1652 1940 cmd.exe attrib.exe PID 1940 wrote to memory of 1488 1940 cmd.exe regedit.exe PID 1940 wrote to memory of 1488 1940 cmd.exe regedit.exe PID 1940 wrote to memory of 1488 1940 cmd.exe regedit.exe PID 1940 wrote to memory of 1488 1940 cmd.exe regedit.exe PID 1940 wrote to memory of 1488 1940 cmd.exe regedit.exe PID 1940 wrote to memory of 1488 1940 cmd.exe regedit.exe PID 1940 wrote to memory of 1488 1940 cmd.exe regedit.exe PID 1940 wrote to memory of 1140 1940 cmd.exe timeout.exe PID 1940 wrote to memory of 1140 1940 cmd.exe timeout.exe PID 1940 wrote to memory of 1140 1940 cmd.exe timeout.exe PID 1940 wrote to memory of 1140 1940 cmd.exe timeout.exe PID 1940 wrote to memory of 1140 1940 cmd.exe timeout.exe PID 1940 wrote to memory of 1140 1940 cmd.exe timeout.exe PID 1940 wrote to memory of 1140 1940 cmd.exe timeout.exe PID 1940 wrote to memory of 1560 1940 cmd.exe timeout.exe PID 1940 wrote to memory of 1560 1940 cmd.exe timeout.exe PID 1940 wrote to memory of 1560 1940 cmd.exe timeout.exe PID 1940 wrote to memory of 1560 1940 cmd.exe timeout.exe PID 1940 wrote to memory of 1560 1940 cmd.exe timeout.exe PID 1940 wrote to memory of 1560 1940 cmd.exe timeout.exe PID 1940 wrote to memory of 1560 1940 cmd.exe timeout.exe PID 1940 wrote to memory of 240 1940 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 5 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 108 attrib.exe 1652 attrib.exe 240 attrib.exe 1000 attrib.exe 1708 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\513fc6732361895ddf4477f737f3bcc12c514257415021eecf1117453fcacd5b.exe"C:\Users\Admin\AppData\Local\Temp\513fc6732361895ddf4477f737f3bcc12c514257415021eecf1117453fcacd5b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Log\install.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Log\Windows\hiscomponent\install.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SYSTEM\Remote Manipulator System" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\DEVICEMAP" /f4⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "D:\Remote Manipulator System"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\Log"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\regedit.exeregedit /s "Windows\hiscomponent\regedit.reg"4⤵
- Runs .reg file with regedit
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\timeout.exetimeout 24⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "D:\Remote Manipulator System\*.*"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "D:\Remote Manipulator System\rfusclient.exe"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "D:\Remote Manipulator System\rutserv.exe"4⤵
- Views/modifies file attributes
-
C:\Log\rutserv.exerutserv.exe /silentinstall4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Log\rutserv.exerutserv.exe /firewall4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Log\rutserv.exerutserv.exe /start4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\timeout.exetimeout 24⤵
- Delays execution with timeout.exe
-
C:\Log\rutserv.exeC:\Log\rutserv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Log\rfusclient.exeC:\Log\rfusclient.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Log\rfusclient.exeC:\Log\rfusclient.exe /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
-
C:\Log\rfusclient.exeC:\Log\rfusclient.exe /tray2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Log\Windows\hiscomponent\install.batMD5
2ae74c01b89deada073a8bfa04412608
SHA1a0f2c77961bcc44754a0ce20ba7126d5a36cc412
SHA2567a13e8b3271addf2e0a4cd0f284f0eabb21572d3bc9dac914ca35acce52ab8f4
SHA5126e7e288cd58b630a6b5aabade0980d08c7a95c4aa316a825fbd7fb3d26e375ca56b586b69a5f57aebe50b31512b6ed815cabf9a1ae6b9597c78dc6d9b86cc24d
-
C:\Log\Windows\hiscomponent\regedit.regMD5
6c3b1d116c4d37e1d40ece244436669c
SHA138e3641d727a49217b45eb75eff586e8ced62d55
SHA2560f38e2c56e54e3996cf1d461b924fcfbf8df8708cae2ba61983b9ace70b2971c
SHA512079ba24964c535fe1552b795758489336494d50f2dd52eac76456d550f62ab9f1489529043c57249d6f7101e201994cd41e4b45556941f32f54c29701821358b
-
C:\Log\install.vbsMD5
bc5fa1fff095d50d252cb327ccd6661b
SHA18263ea4ab762f188df0f2902297cc46baf816c5c
SHA256e8bd8b6ff5f0653e82c7239bfdb2894fbd509b45e581c2458bd84c2fd3d84886
SHA5121eb5a0bc2b3c3ffa6f0967803239313110cd1c3293ecbb6a1f1c2d9d717a2f5aaf042dd28af8520ef63639f291e083c511527515489a45732e6191ad521f544d
-
C:\Log\rfusclient.exeMD5
caea06010be1fd215c89276a78064c79
SHA18f89c8d6b90b75385dacb83821f750bbc1325274
SHA256e53966fbb8d23f56a6c9d215ac51e9a58578f7c17e4122b3b892f587d30bd479
SHA51224a8453d5bb46dd4c3dba3e8419b0aae62f20491da26b06a6de17ab286578bd4832e309455de230814756446ae845ccf97acc27bd7db02142cdf6da48f877af6
-
C:\Log\rfusclient.exeMD5
caea06010be1fd215c89276a78064c79
SHA18f89c8d6b90b75385dacb83821f750bbc1325274
SHA256e53966fbb8d23f56a6c9d215ac51e9a58578f7c17e4122b3b892f587d30bd479
SHA51224a8453d5bb46dd4c3dba3e8419b0aae62f20491da26b06a6de17ab286578bd4832e309455de230814756446ae845ccf97acc27bd7db02142cdf6da48f877af6
-
C:\Log\rfusclient.exeMD5
caea06010be1fd215c89276a78064c79
SHA18f89c8d6b90b75385dacb83821f750bbc1325274
SHA256e53966fbb8d23f56a6c9d215ac51e9a58578f7c17e4122b3b892f587d30bd479
SHA51224a8453d5bb46dd4c3dba3e8419b0aae62f20491da26b06a6de17ab286578bd4832e309455de230814756446ae845ccf97acc27bd7db02142cdf6da48f877af6
-
C:\Log\rfusclient.exeMD5
caea06010be1fd215c89276a78064c79
SHA18f89c8d6b90b75385dacb83821f750bbc1325274
SHA256e53966fbb8d23f56a6c9d215ac51e9a58578f7c17e4122b3b892f587d30bd479
SHA51224a8453d5bb46dd4c3dba3e8419b0aae62f20491da26b06a6de17ab286578bd4832e309455de230814756446ae845ccf97acc27bd7db02142cdf6da48f877af6
-
C:\Log\rutserv.exeMD5
0a6ff2d35e08f6ab51de1e08ac1c00e9
SHA17cc1b01aa1bfaa43265b6b8142fb0d7f5b31aa76
SHA256e5ec03622ffabb1a05c38b8b5bb79d03ebd7aab448582ab2f5a4b27725d7aa90
SHA5129ac53f4ac7722e8a15112460d97dc3cea3189660ed51a25fb6b4694bec5433c58dc9cdfffaffa78bf93fd1a53625fc38745bfb4f89c9bc999d16a063c9cfb887
-
C:\Log\rutserv.exeMD5
0a6ff2d35e08f6ab51de1e08ac1c00e9
SHA17cc1b01aa1bfaa43265b6b8142fb0d7f5b31aa76
SHA256e5ec03622ffabb1a05c38b8b5bb79d03ebd7aab448582ab2f5a4b27725d7aa90
SHA5129ac53f4ac7722e8a15112460d97dc3cea3189660ed51a25fb6b4694bec5433c58dc9cdfffaffa78bf93fd1a53625fc38745bfb4f89c9bc999d16a063c9cfb887
-
C:\Log\rutserv.exeMD5
0a6ff2d35e08f6ab51de1e08ac1c00e9
SHA17cc1b01aa1bfaa43265b6b8142fb0d7f5b31aa76
SHA256e5ec03622ffabb1a05c38b8b5bb79d03ebd7aab448582ab2f5a4b27725d7aa90
SHA5129ac53f4ac7722e8a15112460d97dc3cea3189660ed51a25fb6b4694bec5433c58dc9cdfffaffa78bf93fd1a53625fc38745bfb4f89c9bc999d16a063c9cfb887
-
C:\Log\rutserv.exeMD5
0a6ff2d35e08f6ab51de1e08ac1c00e9
SHA17cc1b01aa1bfaa43265b6b8142fb0d7f5b31aa76
SHA256e5ec03622ffabb1a05c38b8b5bb79d03ebd7aab448582ab2f5a4b27725d7aa90
SHA5129ac53f4ac7722e8a15112460d97dc3cea3189660ed51a25fb6b4694bec5433c58dc9cdfffaffa78bf93fd1a53625fc38745bfb4f89c9bc999d16a063c9cfb887
-
C:\Log\rutserv.exeMD5
0a6ff2d35e08f6ab51de1e08ac1c00e9
SHA17cc1b01aa1bfaa43265b6b8142fb0d7f5b31aa76
SHA256e5ec03622ffabb1a05c38b8b5bb79d03ebd7aab448582ab2f5a4b27725d7aa90
SHA5129ac53f4ac7722e8a15112460d97dc3cea3189660ed51a25fb6b4694bec5433c58dc9cdfffaffa78bf93fd1a53625fc38745bfb4f89c9bc999d16a063c9cfb887
-
C:\Log\vp8decoder.dllMD5
d43fa82fab5337ce20ad14650085c5d9
SHA1678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d
-
C:\Log\vp8encoder.dllMD5
dab4646806dfca6d0e0b4d80fa9209d6
SHA18244dfe22ec2090eee89dad103e6b2002059d16a
SHA256cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7
-
\Log\rfusclient.exeMD5
caea06010be1fd215c89276a78064c79
SHA18f89c8d6b90b75385dacb83821f750bbc1325274
SHA256e53966fbb8d23f56a6c9d215ac51e9a58578f7c17e4122b3b892f587d30bd479
SHA51224a8453d5bb46dd4c3dba3e8419b0aae62f20491da26b06a6de17ab286578bd4832e309455de230814756446ae845ccf97acc27bd7db02142cdf6da48f877af6
-
\Log\rfusclient.exeMD5
caea06010be1fd215c89276a78064c79
SHA18f89c8d6b90b75385dacb83821f750bbc1325274
SHA256e53966fbb8d23f56a6c9d215ac51e9a58578f7c17e4122b3b892f587d30bd479
SHA51224a8453d5bb46dd4c3dba3e8419b0aae62f20491da26b06a6de17ab286578bd4832e309455de230814756446ae845ccf97acc27bd7db02142cdf6da48f877af6
-
\Log\rutserv.exeMD5
0a6ff2d35e08f6ab51de1e08ac1c00e9
SHA17cc1b01aa1bfaa43265b6b8142fb0d7f5b31aa76
SHA256e5ec03622ffabb1a05c38b8b5bb79d03ebd7aab448582ab2f5a4b27725d7aa90
SHA5129ac53f4ac7722e8a15112460d97dc3cea3189660ed51a25fb6b4694bec5433c58dc9cdfffaffa78bf93fd1a53625fc38745bfb4f89c9bc999d16a063c9cfb887
-
\Log\rutserv.exeMD5
0a6ff2d35e08f6ab51de1e08ac1c00e9
SHA17cc1b01aa1bfaa43265b6b8142fb0d7f5b31aa76
SHA256e5ec03622ffabb1a05c38b8b5bb79d03ebd7aab448582ab2f5a4b27725d7aa90
SHA5129ac53f4ac7722e8a15112460d97dc3cea3189660ed51a25fb6b4694bec5433c58dc9cdfffaffa78bf93fd1a53625fc38745bfb4f89c9bc999d16a063c9cfb887
-
\Log\rutserv.exeMD5
0a6ff2d35e08f6ab51de1e08ac1c00e9
SHA17cc1b01aa1bfaa43265b6b8142fb0d7f5b31aa76
SHA256e5ec03622ffabb1a05c38b8b5bb79d03ebd7aab448582ab2f5a4b27725d7aa90
SHA5129ac53f4ac7722e8a15112460d97dc3cea3189660ed51a25fb6b4694bec5433c58dc9cdfffaffa78bf93fd1a53625fc38745bfb4f89c9bc999d16a063c9cfb887
-
memory/108-70-0x0000000000000000-mapping.dmp
-
memory/240-85-0x0000000000000000-mapping.dmp
-
memory/324-105-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/324-101-0x0000000000000000-mapping.dmp
-
memory/576-117-0x0000000000000000-mapping.dmp
-
memory/664-111-0x0000000000000000-mapping.dmp
-
memory/664-120-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/760-66-0x0000000000000000-mapping.dmp
-
memory/852-96-0x0000000000000000-mapping.dmp
-
memory/852-104-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/1000-87-0x0000000000000000-mapping.dmp
-
memory/1072-98-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1072-92-0x0000000000000000-mapping.dmp
-
memory/1140-77-0x0000000000000000-mapping.dmp
-
memory/1160-68-0x0000000000000000-mapping.dmp
-
memory/1168-60-0x0000000000000000-mapping.dmp
-
memory/1488-74-0x0000000000000000-mapping.dmp
-
memory/1560-79-0x0000000000000000-mapping.dmp
-
memory/1596-124-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1596-121-0x0000000000000000-mapping.dmp
-
memory/1608-112-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1652-72-0x0000000000000000-mapping.dmp
-
memory/1708-89-0x0000000000000000-mapping.dmp
-
memory/1776-59-0x0000000075C31000-0x0000000075C33000-memory.dmpFilesize
8KB
-
memory/1940-64-0x0000000000000000-mapping.dmp
-
memory/1976-119-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1976-110-0x0000000000000000-mapping.dmp