Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-06-2022 03:37
Static task
static1
Behavioral task
behavioral1
Sample
117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exe
Resource
win10v2004-20220414-en
General
-
Target
117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exe
-
Size
654KB
-
MD5
0b40a2fff66d3c7f728b2d0e9ae861a6
-
SHA1
91f89d87f92ba4f96d16a96c35e56e039adf6979
-
SHA256
117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2
-
SHA512
dec02943bb4dfae04c0fcce7cb644aa60277f33cd4747270b4a2d3feb5ca53cf6a5d037eb618bc4c27e3ea266089a2fa8b0ae1fb68f9180fb9b4a15522834c5a
Malware Config
Signatures
-
Locky (Lukitus variant)
Variant of the Locky ransomware seen in the wild since late 2017.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exedescription ioc process File opened for modification \??\c:\Users\Admin\Pictures\ConnectRemove.tiff 117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exemsedge.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\opt321 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exe" 117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\lukitus.bmp" 117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\39cab103-46ac-4faf-bb6a-e9c2b4e7879c.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220604055520.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 4808 vssadmin.exe -
Modifies Control Panel 2 IoCs
Processes:
117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\Desktop\WallpaperStyle = "0" 117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\Desktop\TileWallpaper = "0" 117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 4628 msedge.exe 4628 msedge.exe 3360 msedge.exe 3360 msedge.exe 4420 identity_helper.exe 4420 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
msedge.exepid process 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1260 vssvc.exe Token: SeRestorePrivilege 1260 vssvc.exe Token: SeAuditPrivilege 1260 vssvc.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 3360 msedge.exe 3360 msedge.exe 3360 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exemsedge.exedescription pid process target process PID 5084 wrote to memory of 3360 5084 117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exe msedge.exe PID 5084 wrote to memory of 3360 5084 117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exe msedge.exe PID 5084 wrote to memory of 3252 5084 117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exe cmd.exe PID 5084 wrote to memory of 3252 5084 117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exe cmd.exe PID 5084 wrote to memory of 3252 5084 117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exe cmd.exe PID 3360 wrote to memory of 4944 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4944 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4324 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4628 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 4628 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2680 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2680 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2680 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2680 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2680 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2680 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2680 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2680 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2680 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2680 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2680 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2680 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2680 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2680 3360 msedge.exe msedge.exe PID 3360 wrote to memory of 2680 3360 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exe"C:\Users\Admin\AppData\Local\Temp\117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\lukitus.htm2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffa589846f8,0x7ffa58984708,0x7ffa589847183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,901637458303900619,12457391557403740544,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,901637458303900619,12457391557403740544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,901637458303900619,12457391557403740544,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,901637458303900619,12457391557403740544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,901637458303900619,12457391557403740544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,901637458303900619,12457391557403740544,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5176 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,901637458303900619,12457391557403740544,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5352 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,901637458303900619,12457391557403740544,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,901637458303900619,12457391557403740544,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,901637458303900619,12457391557403740544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7f4075460,0x7ff7f4075470,0x7ff7f40754804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,901637458303900619,12457391557403740544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,901637458303900619,12457391557403740544,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2388 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,901637458303900619,12457391557403740544,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2416 /prefetch:83⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\117da274f4076bdd7f3aa6e6b1d96c44100ccaef59194202fc166ee5f4be78b2.exe"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /Quiet /All1⤵
- Interacts with shadow copies
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\lukitus.htmFilesize
8KB
MD53a2f3a42a633e42eaf137339b3dbe086
SHA1a330b28bf9ed2b87cfec9783d06bda974bf83daf
SHA256b049e4f09fa91379566f2a66dbb8f1cc870e6f0e0c174b2496829bc179c1d749
SHA5129fff64009b4e33845eec479d3665e5b1b5125c058dae21b8cd08e872228d8523e3bbfe0a829f7100582a64e4a02e56dd391dbd0536a48e41c51e59a0c82fd7ad
-
\??\pipe\LOCAL\crashpad_3360_QYMSFFPKBTUGXXWUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/884-152-0x0000000000000000-mapping.dmp
-
memory/1440-156-0x0000000000000000-mapping.dmp
-
memory/1444-150-0x0000000000000000-mapping.dmp
-
memory/1560-163-0x0000000000000000-mapping.dmp
-
memory/2096-144-0x0000000000000000-mapping.dmp
-
memory/2288-154-0x0000000000000000-mapping.dmp
-
memory/2672-147-0x0000000000000000-mapping.dmp
-
memory/2680-142-0x0000000000000000-mapping.dmp
-
memory/2700-157-0x0000000000000000-mapping.dmp
-
memory/3088-158-0x0000000000000000-mapping.dmp
-
memory/3252-136-0x0000000000000000-mapping.dmp
-
memory/3360-135-0x0000000000000000-mapping.dmp
-
memory/3908-161-0x0000000000000000-mapping.dmp
-
memory/4324-139-0x0000000000000000-mapping.dmp
-
memory/4420-159-0x0000000000000000-mapping.dmp
-
memory/4628-140-0x0000000000000000-mapping.dmp
-
memory/4944-137-0x0000000000000000-mapping.dmp
-
memory/5084-133-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/5084-134-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB