Analysis
-
max time kernel
186s -
max time network
230s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 18:40
Static task
static1
Behavioral task
behavioral1
Sample
d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe
Resource
win10v2004-20221111-en
General
-
Target
d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe
-
Size
116KB
-
MD5
47b059248a97e2cbc4d28070100c3e10
-
SHA1
0f65e03a0bea15be580fcdc492e2c98ba7229108
-
SHA256
d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2
-
SHA512
64e9eb05ca8f48ef3c64573e43d17fd8eae0f53a16e872d56820da75c5d33891c7042e1c529ba28aca6573983d1097976b1cc4e88fa19188261ff07a17f4dd73
-
SSDEEP
1536:pMVAH0FThCKSwXsr9iNN7Touxknseofc7nySqDo6xa9BhvHz5jboEl3K9MEApleh:iZhC9gsUXTDkKansivlf3KEeec
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exesnruay.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" snruay.exe -
Executes dropped EXE 2 IoCs
Processes:
snruay.exesnruay.exepid process 1916 snruay.exe 1632 snruay.exe -
Loads dropped DLL 2 IoCs
Processes:
d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exepid process 2020 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe 2020 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe -
Adds Run key to start application 2 TTPs 29 IoCs
Processes:
snruay.exed16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /h" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /b" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /e" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /f" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /x" snruay.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /a" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /d" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /u" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /p" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /j" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /g" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /i" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /t" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /y" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /c" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /o" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /w" snruay.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /v" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /m" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /s" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /l" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /r" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /q" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /w" d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /n" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /k" snruay.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\snruay = "C:\\Users\\Admin\\snruay.exe /z" snruay.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exesnruay.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum snruay.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 snruay.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
snruay.exedescription ioc process File created C:\Users\Admin\c\autorun.inf snruay.exe File opened for modification C:\Users\Admin\c\autorun.inf snruay.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exesnruay.exedescription pid process target process PID 1256 set thread context of 2020 1256 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe PID 1916 set thread context of 1632 1916 snruay.exe snruay.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exesnruay.exepid process 2020 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe 1632 snruay.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exed16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exesnruay.exesnruay.exepid process 1256 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe 2020 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe 1916 snruay.exe 1632 snruay.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exed16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exesnruay.exedescription pid process target process PID 1256 wrote to memory of 2020 1256 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe PID 1256 wrote to memory of 2020 1256 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe PID 1256 wrote to memory of 2020 1256 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe PID 1256 wrote to memory of 2020 1256 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe PID 1256 wrote to memory of 2020 1256 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe PID 1256 wrote to memory of 2020 1256 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe PID 1256 wrote to memory of 2020 1256 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe PID 1256 wrote to memory of 2020 1256 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe PID 1256 wrote to memory of 2020 1256 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe PID 1256 wrote to memory of 2020 1256 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe PID 2020 wrote to memory of 1916 2020 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe snruay.exe PID 2020 wrote to memory of 1916 2020 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe snruay.exe PID 2020 wrote to memory of 1916 2020 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe snruay.exe PID 2020 wrote to memory of 1916 2020 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe snruay.exe PID 2020 wrote to memory of 1328 2020 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe PhotoScreensaver.scr PID 2020 wrote to memory of 1328 2020 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe PhotoScreensaver.scr PID 2020 wrote to memory of 1328 2020 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe PhotoScreensaver.scr PID 2020 wrote to memory of 1328 2020 d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe PhotoScreensaver.scr PID 1916 wrote to memory of 1632 1916 snruay.exe snruay.exe PID 1916 wrote to memory of 1632 1916 snruay.exe snruay.exe PID 1916 wrote to memory of 1632 1916 snruay.exe snruay.exe PID 1916 wrote to memory of 1632 1916 snruay.exe snruay.exe PID 1916 wrote to memory of 1632 1916 snruay.exe snruay.exe PID 1916 wrote to memory of 1632 1916 snruay.exe snruay.exe PID 1916 wrote to memory of 1632 1916 snruay.exe snruay.exe PID 1916 wrote to memory of 1632 1916 snruay.exe snruay.exe PID 1916 wrote to memory of 1632 1916 snruay.exe snruay.exe PID 1916 wrote to memory of 1632 1916 snruay.exe snruay.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe"C:\Users\Admin\AppData\Local\Temp\d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe"C:\Users\Admin\AppData\Local\Temp\d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2.exe"712⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\snruay.exe"C:\Users\Admin\snruay.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\snruay.exe"C:\Users\Admin\snruay.exe" 714⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\PhotoScreensaver.scr"C:\Windows\System32\PhotoScreensaver.scr" /S3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\snruay.exeFilesize
116KB
MD547b059248a97e2cbc4d28070100c3e10
SHA10f65e03a0bea15be580fcdc492e2c98ba7229108
SHA256d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2
SHA51264e9eb05ca8f48ef3c64573e43d17fd8eae0f53a16e872d56820da75c5d33891c7042e1c529ba28aca6573983d1097976b1cc4e88fa19188261ff07a17f4dd73
-
C:\Users\Admin\snruay.exeFilesize
116KB
MD547b059248a97e2cbc4d28070100c3e10
SHA10f65e03a0bea15be580fcdc492e2c98ba7229108
SHA256d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2
SHA51264e9eb05ca8f48ef3c64573e43d17fd8eae0f53a16e872d56820da75c5d33891c7042e1c529ba28aca6573983d1097976b1cc4e88fa19188261ff07a17f4dd73
-
C:\Users\Admin\snruay.exeFilesize
116KB
MD547b059248a97e2cbc4d28070100c3e10
SHA10f65e03a0bea15be580fcdc492e2c98ba7229108
SHA256d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2
SHA51264e9eb05ca8f48ef3c64573e43d17fd8eae0f53a16e872d56820da75c5d33891c7042e1c529ba28aca6573983d1097976b1cc4e88fa19188261ff07a17f4dd73
-
\Users\Admin\snruay.exeFilesize
116KB
MD547b059248a97e2cbc4d28070100c3e10
SHA10f65e03a0bea15be580fcdc492e2c98ba7229108
SHA256d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2
SHA51264e9eb05ca8f48ef3c64573e43d17fd8eae0f53a16e872d56820da75c5d33891c7042e1c529ba28aca6573983d1097976b1cc4e88fa19188261ff07a17f4dd73
-
\Users\Admin\snruay.exeFilesize
116KB
MD547b059248a97e2cbc4d28070100c3e10
SHA10f65e03a0bea15be580fcdc492e2c98ba7229108
SHA256d16164e49fd72cc4bf5edd59526b09f4b3f0733af30941432a9920f2a33f79d2
SHA51264e9eb05ca8f48ef3c64573e43d17fd8eae0f53a16e872d56820da75c5d33891c7042e1c529ba28aca6573983d1097976b1cc4e88fa19188261ff07a17f4dd73
-
memory/1328-71-0x0000000000000000-mapping.dmp
-
memory/1632-83-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/1632-80-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/1632-74-0x00000000004010E0-mapping.dmp
-
memory/1916-66-0x0000000000000000-mapping.dmp
-
memory/2020-57-0x00000000004010E0-mapping.dmp
-
memory/2020-62-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/2020-56-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/2020-59-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/2020-82-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/2020-63-0x0000000075C41000-0x0000000075C43000-memory.dmpFilesize
8KB