Analysis
-
max time kernel
189s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 04:08
Static task
static1
Behavioral task
behavioral1
Sample
eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe
Resource
win10v2004-20221111-en
General
-
Target
eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe
-
Size
134KB
-
MD5
0e087a29f6694524e66020d9454ccdb9
-
SHA1
10e5050f1975938399827be5dab35e5d01cb0c89
-
SHA256
eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c
-
SHA512
9e9c8bb4c3c577a41d930356c8b2d0a9eba0f0692b7e654053b2af478471c1b36db78cd33d2d5b800e661d5a5752e53448fbd299bdc670da5091e704ec10a1af
-
SSDEEP
3072:LlMyoAdZDhDOdtgXwDEi5xZgrdkkeRQHadg/wb:pvomDhi8wgiXZgrulk/
Malware Config
Extracted
pony
http://d-mmoney.favcc1.com/gate.php
-
payload_url
http://d-mmoney.favcc1.com/shit.exe
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
IpOverUsbSvrc.exeatiesrx.exepid process 544 IpOverUsbSvrc.exe 1480 atiesrx.exe -
Processes:
resource yara_rule behavioral1/memory/1268-58-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1268-60-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1268-61-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1268-65-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1268-66-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1268-77-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/1268-83-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exeIpOverUsbSvrc.exepid process 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 544 IpOverUsbSvrc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
IpOverUsbSvrc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Multimedia Class Scheduler = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\IpOverUsbSvrc.exe" IpOverUsbSvrc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exedescription pid process target process PID 2024 set thread context of 1268 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exeIpOverUsbSvrc.exeatiesrx.exepid process 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 544 IpOverUsbSvrc.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 544 IpOverUsbSvrc.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 544 IpOverUsbSvrc.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 544 IpOverUsbSvrc.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 544 IpOverUsbSvrc.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 544 IpOverUsbSvrc.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 544 IpOverUsbSvrc.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 544 IpOverUsbSvrc.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 544 IpOverUsbSvrc.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 1480 atiesrx.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 544 IpOverUsbSvrc.exe 1480 atiesrx.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 1480 atiesrx.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 1480 atiesrx.exe 544 IpOverUsbSvrc.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 1480 atiesrx.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 1480 atiesrx.exe 544 IpOverUsbSvrc.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe 1480 atiesrx.exe 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exeIpOverUsbSvrc.exevbc.exeatiesrx.exedescription pid process Token: SeDebugPrivilege 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe Token: SeDebugPrivilege 544 IpOverUsbSvrc.exe Token: SeImpersonatePrivilege 1268 vbc.exe Token: SeTcbPrivilege 1268 vbc.exe Token: SeChangeNotifyPrivilege 1268 vbc.exe Token: SeCreateTokenPrivilege 1268 vbc.exe Token: SeBackupPrivilege 1268 vbc.exe Token: SeRestorePrivilege 1268 vbc.exe Token: SeIncreaseQuotaPrivilege 1268 vbc.exe Token: SeAssignPrimaryTokenPrivilege 1268 vbc.exe Token: SeImpersonatePrivilege 1268 vbc.exe Token: SeTcbPrivilege 1268 vbc.exe Token: SeChangeNotifyPrivilege 1268 vbc.exe Token: SeCreateTokenPrivilege 1268 vbc.exe Token: SeBackupPrivilege 1268 vbc.exe Token: SeRestorePrivilege 1268 vbc.exe Token: SeIncreaseQuotaPrivilege 1268 vbc.exe Token: SeAssignPrimaryTokenPrivilege 1268 vbc.exe Token: SeImpersonatePrivilege 1268 vbc.exe Token: SeTcbPrivilege 1268 vbc.exe Token: SeChangeNotifyPrivilege 1268 vbc.exe Token: SeCreateTokenPrivilege 1268 vbc.exe Token: SeBackupPrivilege 1268 vbc.exe Token: SeRestorePrivilege 1268 vbc.exe Token: SeIncreaseQuotaPrivilege 1268 vbc.exe Token: SeAssignPrimaryTokenPrivilege 1268 vbc.exe Token: SeImpersonatePrivilege 1268 vbc.exe Token: SeTcbPrivilege 1268 vbc.exe Token: SeChangeNotifyPrivilege 1268 vbc.exe Token: SeCreateTokenPrivilege 1268 vbc.exe Token: SeBackupPrivilege 1268 vbc.exe Token: SeRestorePrivilege 1268 vbc.exe Token: SeIncreaseQuotaPrivilege 1268 vbc.exe Token: SeAssignPrimaryTokenPrivilege 1268 vbc.exe Token: SeDebugPrivilege 1480 atiesrx.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exeIpOverUsbSvrc.exevbc.exedescription pid process target process PID 2024 wrote to memory of 1268 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe vbc.exe PID 2024 wrote to memory of 1268 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe vbc.exe PID 2024 wrote to memory of 1268 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe vbc.exe PID 2024 wrote to memory of 1268 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe vbc.exe PID 2024 wrote to memory of 1268 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe vbc.exe PID 2024 wrote to memory of 1268 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe vbc.exe PID 2024 wrote to memory of 1268 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe vbc.exe PID 2024 wrote to memory of 1268 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe vbc.exe PID 2024 wrote to memory of 544 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe IpOverUsbSvrc.exe PID 2024 wrote to memory of 544 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe IpOverUsbSvrc.exe PID 2024 wrote to memory of 544 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe IpOverUsbSvrc.exe PID 2024 wrote to memory of 544 2024 eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe IpOverUsbSvrc.exe PID 544 wrote to memory of 1480 544 IpOverUsbSvrc.exe atiesrx.exe PID 544 wrote to memory of 1480 544 IpOverUsbSvrc.exe atiesrx.exe PID 544 wrote to memory of 1480 544 IpOverUsbSvrc.exe atiesrx.exe PID 544 wrote to memory of 1480 544 IpOverUsbSvrc.exe atiesrx.exe PID 1268 wrote to memory of 1936 1268 vbc.exe cmd.exe PID 1268 wrote to memory of 1936 1268 vbc.exe cmd.exe PID 1268 wrote to memory of 1936 1268 vbc.exe cmd.exe PID 1268 wrote to memory of 1936 1268 vbc.exe cmd.exe -
outlook_win_path 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe"C:\Users\Admin\AppData\Local\Temp\eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:1268 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7243360.bat" "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" "3⤵PID:1936
-
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exeC:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7243360.batFilesize
94B
MD53880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
-
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exeFilesize
8KB
MD554fbde415453f5c9089b49e65bd5f8e7
SHA1d77b86631f629b52bbebc6e08fbf60c78e8ceab0
SHA2567d31b70e949833d9f78199848b14307e41da511ca4915c20a8ca61ee8eeeedbf
SHA51290dbbb3986ab3f4dda4292b580bfac7c97bbf20f68d0be0af271b9bc5e22a4abc326baaf284be005c6460ecc2187b6ca5d015fab55be3b242122436fcf3ee5ed
-
C:\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exeFilesize
8KB
MD554fbde415453f5c9089b49e65bd5f8e7
SHA1d77b86631f629b52bbebc6e08fbf60c78e8ceab0
SHA2567d31b70e949833d9f78199848b14307e41da511ca4915c20a8ca61ee8eeeedbf
SHA51290dbbb3986ab3f4dda4292b580bfac7c97bbf20f68d0be0af271b9bc5e22a4abc326baaf284be005c6460ecc2187b6ca5d015fab55be3b242122436fcf3ee5ed
-
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exeFilesize
134KB
MD50e087a29f6694524e66020d9454ccdb9
SHA110e5050f1975938399827be5dab35e5d01cb0c89
SHA256eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c
SHA5129e9c8bb4c3c577a41d930356c8b2d0a9eba0f0692b7e654053b2af478471c1b36db78cd33d2d5b800e661d5a5752e53448fbd299bdc670da5091e704ec10a1af
-
C:\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exeFilesize
134KB
MD50e087a29f6694524e66020d9454ccdb9
SHA110e5050f1975938399827be5dab35e5d01cb0c89
SHA256eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c
SHA5129e9c8bb4c3c577a41d930356c8b2d0a9eba0f0692b7e654053b2af478471c1b36db78cd33d2d5b800e661d5a5752e53448fbd299bdc670da5091e704ec10a1af
-
\Users\Admin\AppData\Roaming\Microsoft\IpOverUsbSvrc.exeFilesize
8KB
MD554fbde415453f5c9089b49e65bd5f8e7
SHA1d77b86631f629b52bbebc6e08fbf60c78e8ceab0
SHA2567d31b70e949833d9f78199848b14307e41da511ca4915c20a8ca61ee8eeeedbf
SHA51290dbbb3986ab3f4dda4292b580bfac7c97bbf20f68d0be0af271b9bc5e22a4abc326baaf284be005c6460ecc2187b6ca5d015fab55be3b242122436fcf3ee5ed
-
\Users\Admin\AppData\Roaming\Microsoft\atiesrx.exeFilesize
134KB
MD50e087a29f6694524e66020d9454ccdb9
SHA110e5050f1975938399827be5dab35e5d01cb0c89
SHA256eb51fa64e6d1687abdd2e0ee8a0d49468ab2879007c094e3b351f505fff09e0c
SHA5129e9c8bb4c3c577a41d930356c8b2d0a9eba0f0692b7e654053b2af478471c1b36db78cd33d2d5b800e661d5a5752e53448fbd299bdc670da5091e704ec10a1af
-
memory/544-68-0x0000000000000000-mapping.dmp
-
memory/544-80-0x0000000074170000-0x000000007471B000-memory.dmpFilesize
5.7MB
-
memory/544-78-0x0000000074170000-0x000000007471B000-memory.dmpFilesize
5.7MB
-
memory/1268-61-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1268-57-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1268-65-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1268-62-0x000000000041A1F0-mapping.dmp
-
memory/1268-66-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1268-83-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1268-60-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1268-58-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1268-77-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1480-74-0x0000000000000000-mapping.dmp
-
memory/1480-79-0x0000000074170000-0x000000007471B000-memory.dmpFilesize
5.7MB
-
memory/1480-81-0x0000000074170000-0x000000007471B000-memory.dmpFilesize
5.7MB
-
memory/1936-82-0x0000000000000000-mapping.dmp
-
memory/2024-56-0x0000000074170000-0x000000007471B000-memory.dmpFilesize
5.7MB
-
memory/2024-54-0x00000000753F1000-0x00000000753F3000-memory.dmpFilesize
8KB
-
memory/2024-55-0x0000000074170000-0x000000007471B000-memory.dmpFilesize
5.7MB