Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 10:12
Static task
static1
Behavioral task
behavioral1
Sample
f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe
Resource
win10v2004-20220812-en
General
-
Target
f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe
-
Size
1.2MB
-
MD5
6966f74e9d8f1a376ea379f9fcc206a2
-
SHA1
3686d3a9a07ed9f9bda256df9cd2e5604c84de2f
-
SHA256
f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52
-
SHA512
0cf914ae8cf954000a526584c01028409188a19ed4b2910618ed458fa76e3fcf5f0df6fb32b8e9b256535f2d07ebee834c7e5357fd3e597b6803bbd0dd1e0336
-
SSDEEP
12288:C+0Qo6Vv9vkeeP2d+1bmXlZeGB3EHPiiyPP+Mxb1:C+0Z6Vdkeea+1i0iiyPFxZ
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
WScript.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\System\\Windows Defencler-DoOoMs.vbs\"" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\System\\Windows Defencler-DoOoMs.vbs\"" WScript.exe -
Executes dropped EXE 2 IoCs
Processes:
FB_E49A.tmp.exeFB_E49A.tmp.exepid process 4896 FB_E49A.tmp.exe 5088 FB_E49A.tmp.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe -
Drops startup file 5 IoCs
Processes:
WScript.exeWScript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FB_E44B.tmp.vbs WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FB_E44B.tmp.vbs WScript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defencler-DoOoM.lnk WScript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defencler-DoOoMs.lnk WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defencler-DoOoM.url WScript.exe -
Adds Run key to start application 2 TTPs 10 IoCs
Processes:
WScript.exeWScript.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defencler-DoOoMs = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft Office\\Windows Defencler-DoOoMp.lnk\"" WScript.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defencler-DoOoMs = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft Office\\Windows Defencler-DoOoMp.lnk\"" WScript.exe Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FB_E44B = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\FB_E44B.tmp.vbs\"" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defencler-DoOoM = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft Office\\Windows Defencler-DoOoM.lnk\"" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defencler-DoOoM = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft Office\\Windows Defencler-DoOoM.lnk\"" WScript.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\software\microsoft\windows\currentversion\run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FB_E44B = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\FB_E44B.tmp.vbs\"" WScript.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
FB_E49A.tmp.exedescription pid process target process PID 4896 set thread context of 5088 4896 FB_E49A.tmp.exe FB_E49A.tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3672 5088 WerFault.exe FB_E49A.tmp.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 828 schtasks.exe 3480 schtasks.exe 396 schtasks.exe 2972 schtasks.exe 1984 schtasks.exe -
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid process 4452 taskkill.exe 1832 taskkill.exe 760 taskkill.exe -
Modifies registry class 12 IoCs
Processes:
f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exeWScript.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hlpfile\shell\open WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command = "%SystemRoot%\\regedit.EXE, wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\System\\Windows Defencler-DoOoMs.vbs\"" WScript.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings OpenWith.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hlpfile\shell\open\command = "%SystemRoot%\\SysWow64\\winhlp32.exe, wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\System\\Windows Defencler-DoOoMs.vbs\"" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command = "%SystemRoot%\\SysWow64\\NOTEPAD.EXE, wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\System\\Windows Defencler-DoOoMs.vbs\"" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open WScript.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
FB_E49A.tmp.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 4896 FB_E49A.tmp.exe Token: SeDebugPrivilege 760 taskkill.exe Token: SeDebugPrivilege 1832 taskkill.exe Token: SeDebugPrivilege 4452 taskkill.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 4948 OpenWith.exe -
Suspicious use of WriteProcessMemory 47 IoCs
Processes:
f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exeFB_E49A.tmp.exeWScript.exedescription pid process target process PID 4856 wrote to memory of 4980 4856 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe WScript.exe PID 4856 wrote to memory of 4980 4856 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe WScript.exe PID 4856 wrote to memory of 4980 4856 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe WScript.exe PID 4856 wrote to memory of 4124 4856 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe WScript.exe PID 4856 wrote to memory of 4124 4856 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe WScript.exe PID 4856 wrote to memory of 4124 4856 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe WScript.exe PID 4856 wrote to memory of 4896 4856 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe FB_E49A.tmp.exe PID 4856 wrote to memory of 4896 4856 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe FB_E49A.tmp.exe PID 4856 wrote to memory of 4896 4856 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe FB_E49A.tmp.exe PID 4896 wrote to memory of 5088 4896 FB_E49A.tmp.exe FB_E49A.tmp.exe PID 4896 wrote to memory of 5088 4896 FB_E49A.tmp.exe FB_E49A.tmp.exe PID 4896 wrote to memory of 5088 4896 FB_E49A.tmp.exe FB_E49A.tmp.exe PID 4896 wrote to memory of 5088 4896 FB_E49A.tmp.exe FB_E49A.tmp.exe PID 4896 wrote to memory of 5088 4896 FB_E49A.tmp.exe FB_E49A.tmp.exe PID 4896 wrote to memory of 5088 4896 FB_E49A.tmp.exe FB_E49A.tmp.exe PID 4896 wrote to memory of 5088 4896 FB_E49A.tmp.exe FB_E49A.tmp.exe PID 4896 wrote to memory of 5088 4896 FB_E49A.tmp.exe FB_E49A.tmp.exe PID 4896 wrote to memory of 5088 4896 FB_E49A.tmp.exe FB_E49A.tmp.exe PID 4896 wrote to memory of 5088 4896 FB_E49A.tmp.exe FB_E49A.tmp.exe PID 4896 wrote to memory of 5088 4896 FB_E49A.tmp.exe FB_E49A.tmp.exe PID 4896 wrote to memory of 5088 4896 FB_E49A.tmp.exe FB_E49A.tmp.exe PID 4896 wrote to memory of 5088 4896 FB_E49A.tmp.exe FB_E49A.tmp.exe PID 4896 wrote to memory of 5088 4896 FB_E49A.tmp.exe FB_E49A.tmp.exe PID 4980 wrote to memory of 4452 4980 WScript.exe taskkill.exe PID 4980 wrote to memory of 4452 4980 WScript.exe taskkill.exe PID 4980 wrote to memory of 4452 4980 WScript.exe taskkill.exe PID 4980 wrote to memory of 1832 4980 WScript.exe taskkill.exe PID 4980 wrote to memory of 1832 4980 WScript.exe taskkill.exe PID 4980 wrote to memory of 1832 4980 WScript.exe taskkill.exe PID 4980 wrote to memory of 760 4980 WScript.exe taskkill.exe PID 4980 wrote to memory of 760 4980 WScript.exe taskkill.exe PID 4980 wrote to memory of 760 4980 WScript.exe taskkill.exe PID 4980 wrote to memory of 828 4980 WScript.exe schtasks.exe PID 4980 wrote to memory of 828 4980 WScript.exe schtasks.exe PID 4980 wrote to memory of 828 4980 WScript.exe schtasks.exe PID 4980 wrote to memory of 3480 4980 WScript.exe schtasks.exe PID 4980 wrote to memory of 3480 4980 WScript.exe schtasks.exe PID 4980 wrote to memory of 3480 4980 WScript.exe schtasks.exe PID 4980 wrote to memory of 396 4980 WScript.exe schtasks.exe PID 4980 wrote to memory of 396 4980 WScript.exe schtasks.exe PID 4980 wrote to memory of 396 4980 WScript.exe schtasks.exe PID 4980 wrote to memory of 2972 4980 WScript.exe schtasks.exe PID 4980 wrote to memory of 2972 4980 WScript.exe schtasks.exe PID 4980 wrote to memory of 2972 4980 WScript.exe schtasks.exe PID 4980 wrote to memory of 1984 4980 WScript.exe schtasks.exe PID 4980 wrote to memory of 1984 4980 WScript.exe schtasks.exe PID 4980 wrote to memory of 1984 4980 WScript.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe"C:\Users\Admin\AppData\Local\Temp\f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FB_98E9.tmp.vbs"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM SpyTheSpy.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4452 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM TiGeR-Firewall.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1832 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM bavtray.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:760 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /RL HIGHEST /tn Windows Defencler-DoOoM.vbe /tr "C:\Users\Admin\AppData\Roaming\System\Windows Defencler-DoOoMs.vbs"3⤵
- Creates scheduled task(s)
PID:828 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /RL HIGHEST /tn Windows Defencler-DoOoM.vbe /tr "C:\Users\Admin\AppData\Roaming\System\Windows Defencler-DoOoMs.vbs"3⤵
- Creates scheduled task(s)
PID:3480 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /RL HIGHEST /tn Windows Defencler-DoOoM.vbe /tr "C:\Users\Admin\AppData\Roaming\System\Windows Defencler-DoOoMs.vbs"3⤵
- Creates scheduled task(s)
PID:396 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /RL HIGHEST /tn Windows Defencler-DoOoM.vbe /tr "C:\Users\Admin\AppData\Roaming\System\Windows Defencler-DoOoMs.vbs"3⤵
- Creates scheduled task(s)
PID:2972 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /RL HIGHEST /tn Windows Defencler-DoOoM.vbe /tr "C:\Users\Admin\AppData\Roaming\System\Windows Defencler-DoOoMs.vbs"3⤵
- Creates scheduled task(s)
PID:1984 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FB_E44B.tmp.vbs"2⤵
- Drops startup file
- Adds Run key to start application
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\FB_E49A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_E49A.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\FB_E49A.tmp.exeC:\Users\Admin\AppData\Local\Temp\FB_E49A.tmp.exe3⤵
- Executes dropped EXE
PID:5088 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 804⤵
- Program crash
PID:3672
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5088 -ip 50881⤵PID:4888
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FB_98E9.tmp.vbsFilesize
535KB
MD5c192fc4bc4e0fbd5aeb10a6dd1352d51
SHA1753144fbb384f7245ffb769d3bb35e0aa800d27d
SHA2564d1105930217a87b178d5d116b54d3bd94c1d8e61d258022e41232307c88c3fd
SHA5121dbae48badfb7d073b47d27f3dd953bb3b11f88b9517eb92c46499d5ec59a8f9c116689cede68966f39d366a85513bf109de8cfabacf7697f3f0a67b044a030e
-
C:\Users\Admin\AppData\Local\Temp\FB_E44B.tmp.vbsFilesize
208KB
MD5d5ede071cdc5b5ff7fad809976515ad0
SHA1f1141aefa5de1572442b66c14ce33448a3658017
SHA2565f9e6543647483d66f53e6ce296321e4ca649d806c26700fbd2da828f2788850
SHA512cc617f626bde4ce30d7639752c63e26b10ee2b4feb05c627d0b963e3d392f1546cedf2d508bec764f95f7e49158a55844d7c56a7c34f18c13ff27b2834facbd4
-
C:\Users\Admin\AppData\Local\Temp\FB_E49A.tmp.exeFilesize
479KB
MD5b529c526c39d32ee04e26e1769b2797f
SHA1236584b8cbcba90c1b331863725d028c3bfea2c2
SHA256e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62
SHA5120b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db
-
C:\Users\Admin\AppData\Local\Temp\FB_E49A.tmp.exeFilesize
479KB
MD5b529c526c39d32ee04e26e1769b2797f
SHA1236584b8cbcba90c1b331863725d028c3bfea2c2
SHA256e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62
SHA5120b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db
-
C:\Users\Admin\AppData\Local\Temp\FB_E49A.tmp.exeFilesize
479KB
MD5b529c526c39d32ee04e26e1769b2797f
SHA1236584b8cbcba90c1b331863725d028c3bfea2c2
SHA256e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62
SHA5120b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db
-
memory/396-149-0x0000000000000000-mapping.dmp
-
memory/760-145-0x0000000000000000-mapping.dmp
-
memory/828-146-0x0000000000000000-mapping.dmp
-
memory/1832-144-0x0000000000000000-mapping.dmp
-
memory/1984-151-0x0000000000000000-mapping.dmp
-
memory/2972-150-0x0000000000000000-mapping.dmp
-
memory/3480-148-0x0000000000000000-mapping.dmp
-
memory/4124-133-0x0000000000000000-mapping.dmp
-
memory/4452-143-0x0000000000000000-mapping.dmp
-
memory/4896-147-0x0000000073E60000-0x0000000074411000-memory.dmpFilesize
5.7MB
-
memory/4896-134-0x0000000000000000-mapping.dmp
-
memory/4896-142-0x0000000073E60000-0x0000000074411000-memory.dmpFilesize
5.7MB
-
memory/4980-132-0x0000000000000000-mapping.dmp
-
memory/5088-139-0x0000000000000000-mapping.dmp