Analysis

  • max time kernel
    146s
  • max time network
    63s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08/06/2023, 10:32

General

  • Target

    LB3.exe

  • Size

    146KB

  • MD5

    33228a20a7e985f02e2ddd73cccde729

  • SHA1

    58ab960e629a609d135e1988c72f2991e5f76e30

  • SHA256

    0845a8c3be602a72e23a155b23ad554495bd558fa79e1bb849aa75f79d069194

  • SHA512

    075002dd1b0f8e536c1ff99d30368f5adfc90a2f3e7a74c9770119e7b54a5851236657b7edcb735d457e78a7e67b7c285b6ceaa6ca2907542ac208dfc8c9aabe

  • SSDEEP

    3072:36glyuxE4GsUPnliByocWepqFPUBwrqveV84:36gDBGpvEByocWe8MB4G

Malware Config

Signatures

  • Renames multiple (674) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 2 IoCs
  • Modifies registry class 5 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\LB3.exe
    "C:\Users\Admin\AppData\Local\Temp\LB3.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\ProgramData\6A7.tmp
      "C:\ProgramData\6A7.tmp"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:752
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\6A7.tmp >> NUL
        3⤵
          PID:4940
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1324
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
      1⤵
      • Drops file in Windows directory
      PID:3660
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\AFfGduKAp.README.txt
      1⤵
      • Opens file in notepad (likely ransom note)
      • Suspicious use of FindShellTrayWindow
      PID:4276

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\AAAAAAAAAAA

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\BBBBBBBBBBB

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\CCCCCCCCCCC

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\DDDDDDDDDDD

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\DDDDDDDDDDD

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\EEEEEEEEEEE

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\FFFFFFFFFFF

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\GGGGGGGGGGG

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\HHHHHHHHHHH

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\IIIIIIIIIII

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\JJJJJJJJJJJ

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\KKKKKKKKKKK

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\LLLLLLLLLLL

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\MMMMMMMMMMM

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\NNNNNNNNNNN

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\OOOOOOOOOOO

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\PPPPPPPPPPP

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\QQQQQQQQQQQ

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\RRRRRRRRRRR

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\SSSSSSSSSSS

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\TTTTTTTTTTT

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\UUUUUUUUUUU

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\VVVVVVVVVVV

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\WWWWWWWWWWW

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\XXXXXXXXXXX

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\YYYYYYYYYYY

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\$Recycle.Bin\S-1-5-21-1311743041-1167936498-546579926-1000\desktop.ini

      Filesize

      129B

      MD5

      bb89ec888cb1e37f8bb07cf0d66a0619

      SHA1

      dda1cb969cbca298e247e8204ed6d870e6800918

      SHA256

      de53344d69b433dd9c45bc1e2d56f59f6f670f7caea05b9860899a73dc874406

      SHA512

      7a636ef76e95e46dcbd363bf39b87f68a2f9af7f942cee416ead3040645616d7d618d409597159ed42cf2770a9d7cfcaa97ad12ede5837e9a2faee9422bf8a63

    • C:\AFfGduKAp.README.txt

      Filesize

      388B

      MD5

      63471181fb3bc1372662cbd2b84749f1

      SHA1

      a0601231e2267619e35c675f232802953903a2a5

      SHA256

      2e63ff921dcff75f50aeada02ca7db429c2c5a66dab90b5cb106511224adad73

      SHA512

      4c55938c4466763ea7fe397432ba92a1377b03715bd0fcf75527683eb24947eb6dc5a1a86df0c371f48542cc386540c4f709e18262618849c9718014fec2060d

    • C:\ProgramData\6A7.tmp

      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

    • C:\ProgramData\6A7.tmp

      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDD

      Filesize

      146KB

      MD5

      13b119f05765ff36bde231ff20e0486e

      SHA1

      167340096ef2fdc8c8f18abf005c108b4754893c

      SHA256

      bad6c0de2e871484343ac96d94d3a400408495d171ff0f912bcef77c2cac3cc7

      SHA512

      bacc2a7d7bf8a6a286bb8c396be5577e587ebafc407bfd8c6839295d86d4292d14a308873f9ea0f393ff5d6f5ca8d73612b2082b07fbc0cc007ab85e1c7c708d

    • C:\Users\Admin\Desktop\AFfGduKAp.README.txt

      Filesize

      388B

      MD5

      63471181fb3bc1372662cbd2b84749f1

      SHA1

      a0601231e2267619e35c675f232802953903a2a5

      SHA256

      2e63ff921dcff75f50aeada02ca7db429c2c5a66dab90b5cb106511224adad73

      SHA512

      4c55938c4466763ea7fe397432ba92a1377b03715bd0fcf75527683eb24947eb6dc5a1a86df0c371f48542cc386540c4f709e18262618849c9718014fec2060d

    • memory/2132-178-0x0000000000D40000-0x0000000000D50000-memory.dmp

      Filesize

      64KB

    • memory/2132-3233-0x0000000000D40000-0x0000000000D50000-memory.dmp

      Filesize

      64KB

    • memory/2132-3234-0x0000000000D40000-0x0000000000D50000-memory.dmp

      Filesize

      64KB

    • memory/2132-3235-0x0000000000D40000-0x0000000000D50000-memory.dmp

      Filesize

      64KB

    • memory/2132-177-0x0000000000D40000-0x0000000000D50000-memory.dmp

      Filesize

      64KB

    • memory/2132-176-0x0000000000D40000-0x0000000000D50000-memory.dmp

      Filesize

      64KB

    • memory/3660-2329-0x000001747EE50000-0x000001747EE51000-memory.dmp

      Filesize

      4KB

    • memory/3660-2393-0x000001747EEE0000-0x000001747EEE1000-memory.dmp

      Filesize

      4KB

    • memory/3660-2423-0x000001747F560000-0x000001747F561000-memory.dmp

      Filesize

      4KB

    • memory/3660-2518-0x000001747F580000-0x000001747F581000-memory.dmp

      Filesize

      4KB

    • memory/3660-2238-0x000001747EDD0000-0x000001747EDE0000-memory.dmp

      Filesize

      64KB

    • memory/3660-2222-0x000001747E690000-0x000001747E6A0000-memory.dmp

      Filesize

      64KB