Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 16:11
Behavioral task
behavioral1
Sample
Document.doc.scr
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Document.doc.scr
Resource
win10v2004-20240226-en
General
-
Target
Document.doc.scr
-
Size
194KB
-
MD5
b7b4c97132d03eead1fa9a9352dee6c2
-
SHA1
c9eb1bdc528076fa9c91668addf0723294ac1575
-
SHA256
1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2
-
SHA512
cb0023bc6783a94a27d2d4a67c214e8657fd334d1a94a7dba51277363dee2a67e7ecc5fc0788cead1c4e0e2dc7d9aa758203f89dce162184869d20a44d171903
-
SSDEEP
3072:v6glyuxE4GsUPnliByocWepXKD0/9Wy1Og/ZK99r:v6gDBGpvEByocWehKD0/EWfg3
Malware Config
Signatures
-
Renames multiple (632) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AA17.tmpdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation AA17.tmp -
Deletes itself 1 IoCs
Processes:
AA17.tmppid process 2796 AA17.tmp -
Executes dropped EXE 1 IoCs
Processes:
AA17.tmppid process 2796 AA17.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
Document.doc.scrdescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini Document.doc.scr File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini Document.doc.scr -
Drops file in System32 directory 4 IoCs
Processes:
printfilterpipelinesvc.exesplwow64.exedescription ioc process File created C:\Windows\system32\spool\PRINTERS\PPr0h_dek8iuym0timlzdnyvbrd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPadco03onugphtxgsxlfzyjxpb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP_ce6bc0h4xwtzwrfe0pasn8nc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
Document.doc.scrdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\te8ZzuVLn.bmp" Document.doc.scr Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\te8ZzuVLn.bmp" Document.doc.scr -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
Document.doc.scrAA17.tmppid process 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2796 AA17.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
Document.doc.scrdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop Document.doc.scr Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\WallpaperStyle = "10" Document.doc.scr -
Modifies registry class 5 IoCs
Processes:
Document.doc.scrdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.te8ZzuVLn Document.doc.scr Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.te8ZzuVLn\ = "te8ZzuVLn" Document.doc.scr Key created \REGISTRY\MACHINE\SOFTWARE\Classes\te8ZzuVLn\DefaultIcon Document.doc.scr Key created \REGISTRY\MACHINE\SOFTWARE\Classes\te8ZzuVLn Document.doc.scr Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\te8ZzuVLn\DefaultIcon\ = "C:\\ProgramData\\te8ZzuVLn.ico" Document.doc.scr -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Document.doc.scrpid process 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr 2456 Document.doc.scr -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
AA17.tmppid process 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp 2796 AA17.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Document.doc.scrdescription pid process Token: SeAssignPrimaryTokenPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeDebugPrivilege 2456 Document.doc.scr Token: 36 2456 Document.doc.scr Token: SeImpersonatePrivilege 2456 Document.doc.scr Token: SeIncBasePriorityPrivilege 2456 Document.doc.scr Token: SeIncreaseQuotaPrivilege 2456 Document.doc.scr Token: 33 2456 Document.doc.scr Token: SeManageVolumePrivilege 2456 Document.doc.scr Token: SeProfSingleProcessPrivilege 2456 Document.doc.scr Token: SeRestorePrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeSystemProfilePrivilege 2456 Document.doc.scr Token: SeTakeOwnershipPrivilege 2456 Document.doc.scr Token: SeShutdownPrivilege 2456 Document.doc.scr Token: SeDebugPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeBackupPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr Token: SeSecurityPrivilege 2456 Document.doc.scr -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
ONENOTE.EXEpid process 4332 ONENOTE.EXE 4332 ONENOTE.EXE 4332 ONENOTE.EXE 4332 ONENOTE.EXE 4332 ONENOTE.EXE 4332 ONENOTE.EXE 4332 ONENOTE.EXE 4332 ONENOTE.EXE 4332 ONENOTE.EXE 4332 ONENOTE.EXE 4332 ONENOTE.EXE 4332 ONENOTE.EXE 4332 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Document.doc.scrprintfilterpipelinesvc.exeAA17.tmpdescription pid process target process PID 2456 wrote to memory of 2136 2456 Document.doc.scr splwow64.exe PID 2456 wrote to memory of 2136 2456 Document.doc.scr splwow64.exe PID 4784 wrote to memory of 4332 4784 printfilterpipelinesvc.exe ONENOTE.EXE PID 4784 wrote to memory of 4332 4784 printfilterpipelinesvc.exe ONENOTE.EXE PID 2456 wrote to memory of 2796 2456 Document.doc.scr AA17.tmp PID 2456 wrote to memory of 2796 2456 Document.doc.scr AA17.tmp PID 2456 wrote to memory of 2796 2456 Document.doc.scr AA17.tmp PID 2456 wrote to memory of 2796 2456 Document.doc.scr AA17.tmp PID 2796 wrote to memory of 3616 2796 AA17.tmp cmd.exe PID 2796 wrote to memory of 3616 2796 AA17.tmp cmd.exe PID 2796 wrote to memory of 3616 2796 AA17.tmp cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document.doc.scr"C:\Users\Admin\AppData\Local\Temp\Document.doc.scr" /S1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
C:\ProgramData\AA17.tmp"C:\ProgramData\AA17.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\AA17.tmp >> NUL3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{4554DCFF-4E21-4EC7-8F71-84A544AD0C42}.xps" 1335853510742200002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\PPPPPPPPPPPFilesize
129B
MD5c34c62b885a489b5cfa654f226bcb744
SHA1ce8a7bed5e966832744019044a289904c248f4c7
SHA256c433ba70a33214c60274543e99888d02c14a942b2a84a9c86b330c85adaf74d2
SHA512bd17144d57b29ddffd187a854069beb22a32b68e316b60345c56babacecbf3f0b35aee0e10c187a277954f729fec5c23201ac90bf4dcfaafe6e5acda2ee8db6b
-
C:\ProgramData\AA17.tmpFilesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDFilesize
194KB
MD597375aeb1307f531411ce0dcaf88c72e
SHA1123b26d65af7d2935676e2fa0148d3cb9b77e752
SHA2569f1fefe2addd4db7498f1afabfc45d68b21f2799a3af81962a8406678880b850
SHA512e66b4515747da47944930fa0af6322739ccb7e4b4c5af5615c73fcfeb79967ae1dbc59dd89fbd7a2e49e7094615c09ab68601aa7f9515970f01a4469cd0bc117
-
C:\Users\Admin\AppData\Local\Temp\{E871C486-8910-4B66-A217-A76E52B543AD}Filesize
4KB
MD50b371ae346accac47dc0eb3f8d103462
SHA14e8c02a71e2ca3ff551a574b2e478cade84b3ab5
SHA2569164ec2d85d6f6d1744038c303e1e57365ebcfff4bbed0bec9c8b069a1411786
SHA512016abb3bc952fb871212396aded79a51622ede5a2f323264b399d4d9dd6bf857dfbbdac9be8fcac6346befc66b0da046772433f32517518d99fc6ff5543458f3
-
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2Filesize
4KB
MD524b730c3fb136eb467a6ad2a3212aac6
SHA1f8811585f55d24bd33eefc64e6e1ee7eeaa6268f
SHA25603efe75a6e0c559e5abd9106b6132209cce0414af19b45f68b232cdf619027f2
SHA51263d50daf5ff58e1e98a70046ab65b70f17162c0259a74802c884b447e939983e78bb716689154e92cbb29d1df2355009f012991729d565cb7b69c22d22c44659
-
C:\te8ZzuVLn.README.txtFilesize
434B
MD5ad29bd8c66e114ff57c943d16c78f72a
SHA15ab070ee89a36f38facae4dfc8ec5ce3e59af46e
SHA2566fe668fe8bf69158d1fd08e90f3cff60c1df410bf752635bf152853b6112549c
SHA512a53121e2379aa9c3bc52d073498a54f26383834f6d6636b4b3831010565c80bf0da07511907eab7bd92f9796e559958b1c0ebea4c4b0f0d869e95b7deb5da7f1
-
F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\DDDDDDDDDDDFilesize
129B
MD547cb24349480cd6f6d8c7e99e8b0dae9
SHA1ce30e7b81ef8bd9ea7e2b3cb1ec21bd71bf7c00b
SHA2560906825d76a8785cff62941fbf353b3262630dc58fe4f1a17896642ecc528c58
SHA5129fe2c22fe6fb6c8451ee72723154615f59dd19266299aea336c3d8693678abfe9d27bbd425cf853ff976543b05644e265952dab1b3c53acb0759d6077377364e
-
memory/2456-2811-0x00000000029B0000-0x00000000029C0000-memory.dmpFilesize
64KB
-
memory/2456-2812-0x00000000029B0000-0x00000000029C0000-memory.dmpFilesize
64KB
-
memory/2456-2813-0x00000000029B0000-0x00000000029C0000-memory.dmpFilesize
64KB
-
memory/2456-2-0x00000000029B0000-0x00000000029C0000-memory.dmpFilesize
64KB
-
memory/2456-1-0x00000000029B0000-0x00000000029C0000-memory.dmpFilesize
64KB
-
memory/2456-0-0x00000000029B0000-0x00000000029C0000-memory.dmpFilesize
64KB
-
memory/2796-2876-0x0000000002490000-0x00000000024A0000-memory.dmpFilesize
64KB
-
memory/2796-2878-0x000000007FE20000-0x000000007FE21000-memory.dmpFilesize
4KB
-
memory/2796-2903-0x000000007FE20000-0x000000007FE21000-memory.dmpFilesize
4KB
-
memory/4332-2871-0x00007FFA12A30000-0x00007FFA12A40000-memory.dmpFilesize
64KB
-
memory/4332-2902-0x00007FFA54A10000-0x00007FFA54C05000-memory.dmpFilesize
2.0MB
-
memory/4332-2828-0x00007FFA54A10000-0x00007FFA54C05000-memory.dmpFilesize
2.0MB
-
memory/4332-2838-0x00007FFA54A10000-0x00007FFA54C05000-memory.dmpFilesize
2.0MB
-
memory/4332-2841-0x00007FFA54A10000-0x00007FFA54C05000-memory.dmpFilesize
2.0MB
-
memory/4332-2834-0x00007FFA54A10000-0x00007FFA54C05000-memory.dmpFilesize
2.0MB
-
memory/4332-2868-0x00007FFA54A10000-0x00007FFA54C05000-memory.dmpFilesize
2.0MB
-
memory/4332-2869-0x00007FFA54A10000-0x00007FFA54C05000-memory.dmpFilesize
2.0MB
-
memory/4332-2870-0x00007FFA54A10000-0x00007FFA54C05000-memory.dmpFilesize
2.0MB
-
memory/4332-2872-0x00007FFA54A10000-0x00007FFA54C05000-memory.dmpFilesize
2.0MB
-
memory/4332-2904-0x00007FFA54A10000-0x00007FFA54C05000-memory.dmpFilesize
2.0MB
-
memory/4332-2832-0x00007FFA54A10000-0x00007FFA54C05000-memory.dmpFilesize
2.0MB
-
memory/4332-2831-0x00007FFA14A90000-0x00007FFA14AA0000-memory.dmpFilesize
64KB
-
memory/4332-2875-0x00007FFA54A10000-0x00007FFA54C05000-memory.dmpFilesize
2.0MB
-
memory/4332-2874-0x00007FFA54A10000-0x00007FFA54C05000-memory.dmpFilesize
2.0MB
-
memory/4332-2835-0x00007FFA14A90000-0x00007FFA14AA0000-memory.dmpFilesize
64KB
-
memory/4332-2879-0x00007FFA54A10000-0x00007FFA54C05000-memory.dmpFilesize
2.0MB
-
memory/4332-2880-0x00007FFA54A10000-0x00007FFA54C05000-memory.dmpFilesize
2.0MB
-
memory/4332-2877-0x00007FFA12A30000-0x00007FFA12A40000-memory.dmpFilesize
64KB
-
memory/4332-2829-0x00007FFA14A90000-0x00007FFA14AA0000-memory.dmpFilesize
64KB
-
memory/4332-2825-0x00007FFA14A90000-0x00007FFA14AA0000-memory.dmpFilesize
64KB
-
memory/4332-2873-0x00007FFA54A10000-0x00007FFA54C05000-memory.dmpFilesize
2.0MB
-
memory/4332-2837-0x00007FFA14A90000-0x00007FFA14AA0000-memory.dmpFilesize
64KB
-
memory/4332-2836-0x00007FFA54A10000-0x00007FFA54C05000-memory.dmpFilesize
2.0MB