Overview

overview

10

Static

static

3

AntivirusD...t3.exe

windows7-x64

6

AntivirusD...t3.exe

windows10-2004-x64

6

AntivirusD...t4.exe

windows7-x64

10

AntivirusD...t4.exe

windows10-2004-x64

10

AntivirusD...te.exe

windows7-x64

1

AntivirusD...te.exe

windows10-2004-x64

1

AntivirusD...er.exe

windows7-x64

10

AntivirusD...er.exe

windows10-2004-x64

AntivirusD...er.exe

windows7-x64

10

AntivirusD...er.exe

windows10-2004-x64

10

AntivirusD...er.exe

windows7-x64

AntivirusD...er.exe

windows10-2004-x64

AntivirusD....2.bat

windows7-x64

10

AntivirusD....2.bat

windows10-2004-x64

8

AntivirusD...re.exe

windows7-x64

1

AntivirusD...re.exe

windows10-2004-x64

10

AntivirusD...st.exe

windows7-x64

1

AntivirusD...st.exe

windows10-2004-x64

1

AntivirusD...re.exe

windows7-x64

10

AntivirusD...re.exe

windows10-2004-x64

10

AntivirusD...t3.exe

windows7-x64

6

AntivirusD...t3.exe

windows10-2004-x64

6

AntivirusD...t3.exe

windows7-x64

6

AntivirusD...t3.exe

windows10-2004-x64

6

AntivirusD...re.exe

windows7-x64

10

AntivirusD...re.exe

windows10-2004-x64

10

AntivirusD...us.exe

windows7-x64

9

AntivirusD...us.exe

windows10-2004-x64

9

AntivirusD.../c.exe

windows7-x64

1

AntivirusD.../c.exe

windows10-2004-x64

1

AntivirusD.../f.exe

windows7-x64

1

AntivirusD.../f.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    127s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28-04-2024 03:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    AntivirusDefender-main/AntivirusDefender/AntivirusDefender/Resources/antivirusfalsepositivetest4.exe

  • Size

    10.1MB

  • MD5

    97f44c7df82adc19ce025cfc8958245c

  • SHA1

    699fb553ea85db7c6c5fc5118ab7a1a0c3b19602

  • SHA256

    0fc9a98ed6bad1f94e0357b6bb833b4eca20bea119abc0cdfa3bb4caeeddcda1

  • SHA512

    e2da423ba4eee8f4e836f5eeed82bfe9cf482a911200f805dcdff20d41901c73b40faf187c66ef2e32f9ec8f6d565c43f38229c026285dd0411d4c1c8c22c27e

  • SSDEEP

    196608:QbxNMGrnhzvYf9EfmiAf1qkB8I9r1UhraBMBMBR:kMGr4+BAf1qC1caBMWBR

Score
10/10
jigsawdiscoveryevasionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw
  • Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Renames multiple (2133) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops file in Drivers directory 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 13 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 1 IoCs

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\antivirusfalsepositivetest4.exe
    "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\antivirusfalsepositivetest4.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\thirdpartyclamavinstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\thirdpartyclamavinstaller.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2572
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\thirdpartyclamavinstaller.exe" "C:\Users\Admin\thirdpartyclamavinstaller.exe" & pause
      2⤵
        PID:2648
      • C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\thirdpartyclamavinstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\thirdpartyclamavinstaller.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2564
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\thirdpartyclamavinstaller.exe" "C:\Users\Admin\thirdpartyclamavinstaller.exe" & pause
        2⤵
          PID:2656
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\thirdpartyclamavinstaller0.exe" "C:\Users\Admin\thirdpartyclamavinstaller0.exe" & pause
          2⤵
            PID:2004
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\jigsaw.exe" "C:\Users\Admin\jigsaw_backup.exe" & pause
            2⤵
              PID:2664
            • C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\jigsaw.exe
              "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\jigsaw.exe"
              2⤵
              • Executes dropped EXE
              • Adds Run key to start application
              PID:2028
              • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
                "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\jigsaw.exe
                3⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                PID:2060
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\a.exe" "C:\Users\Admin\a_backup.exe" & pause
              2⤵
                PID:2436
              • C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\a.exe
                "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\a.exe"
                2⤵
                • Enumerates VirtualBox registry keys
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Looks for VirtualBox Guest Additions in registry
                • Looks for VMWare Tools registry key
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Checks system information in the registry
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of WriteProcessMemory
                PID:2544
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -u -p 2544 -s 16
                  3⤵
                  • Loads dropped DLL
                  PID:1028
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\b.exe" "C:\Users\Admin\b_backup.exe" & pause
                2⤵
                  PID:1164
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\c.exe" "C:\Users\Admin\c_backup.exe" & pause
                  2⤵
                    PID:240
                  • C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\c.exe
                    "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\c.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:1396
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\f.exe" "C:\Users\Admin\f_backup.exe" & pause
                    2⤵
                      PID:964
                    • C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\f.exe
                      "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\f.exe"
                      2⤵
                      • Executes dropped EXE
                      • Modifies Internet Explorer settings
                      • Suspicious use of SetWindowsHookEx
                      PID:1880
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\l.exe" "C:\Users\Admin\l_backup.exe" & pause
                      2⤵
                        PID:1992
                      • C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\l.exe
                        "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\l.exe"
                        2⤵
                        • Drops file in Drivers directory
                        • Executes dropped EXE
                        PID:812
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\m.exe" "C:\Users\Admin\m_backup.exe" & pause
                        2⤵
                          PID:764
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\z.exe" "C:\Users\Admin\z_backup.exe" & pause
                          2⤵
                            PID:2484
                          • C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\z.exe
                            "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\z.exe"
                            2⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            PID:1664
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\of.exe" "C:\Users\Admin\of_backup.exe" & pause
                            2⤵
                              PID:2288

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.fun
                            Filesize

                            160B

                            MD5

                            000e8c41d4a15fb34d0be0dbb56e3778

                            SHA1

                            00c4eae64ee6239d7c65d819c6ce1ac329224f8c

                            SHA256

                            8bdfa6a5b7de345cf0d4fe0e9c17d8b0e9db26d58b05b1b2ebbb3a05a068ff28

                            SHA512

                            775d832eb8ab73e4a93789917dca69edb6c91fbb426e02acf7c6e213ffb4575776187209d1c471fbf57c4621ea3c23d9850f6dfc2770d62c17de9d66710800af

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\b.exe
                            Filesize

                            96KB

                            MD5

                            ddfe44f87fac7daeeb1b681dea3300e9

                            SHA1

                            9a7291fc90f56d8c46cc78397a6f36bb23c60f66

                            SHA256

                            951f74882c1873bfe56e0bff225e3cd5d8964af4f7334182bc1bf0ec9e987a0a

                            SHA512

                            775a17e879e23262b3102c88218de6c1adde8e3a8c7112937aa63cb159c52e280f30782d5c6925661b0e92c63472345fe1eaa0e354b9a14412fbbd6550b5487f

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\c.exe
                            Filesize

                            44KB

                            MD5

                            6d1a47574ef7598017c13d64769cccfb

                            SHA1

                            1d75bfb18ffc0b820cb36acf8707343fa6679863

                            SHA256

                            d61417d72a054d45ee33e395079e9d674f891a42ed0ec5357b5a8d91c69858a6

                            SHA512

                            7e4f90cd9f1c072089d626a51cffb3e89216e2ad5c55ade7b2c2f4f2d8106d5bc2030d2e1f6745cc47bf12180f566c2eb88dc0925f3040eb641e1fb1e6239f13

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\l.exe
                            Filesize

                            334KB

                            MD5

                            e00216958f15f1db6371b583a3ea438a

                            SHA1

                            4b9e71615b37aea1eaeb5b1cfa0eee048118ff72

                            SHA256

                            81e96c07e6c9cb02f72c0943a42ff9f8f09a09c508f8bbaa1142a9ee4f1326cf

                            SHA512

                            9d46b4fbf26c775929e95e145b390f0d12566e482920f629b342db2aaa37c5a40a789226ecfe51ba0f0b94fce827b9f53180232cda48bae510cce1e3b37bed16

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\thirdpartyclamavinstaller0.exe
                            Filesize

                            11KB

                            MD5

                            c406d8a0b58a59cfacbd41a267cec4bf

                            SHA1

                            84f496a9337aa2f8055fcbf5aa77b67d48bd0e21

                            SHA256

                            3e3950ea1bd00d98ceb91d7be28beb40772af548d32c9584fa631eda1db01642

                            SHA512

                            08a6a905f91faa40a116e071fe153bfd75e43dd47b2d21a56ebad8409102b078f79c854f9d72612d5a9bdc5e5ae9f05324d421334c35fc2402bbe9f9fb47bfa2

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\z.exe
                            Filesize

                            85KB

                            MD5

                            0d3da5adb9bb63c7fcb0185756601749

                            SHA1

                            72dbd9bc44173033b504dddc655b2082e99cf2b9

                            SHA256

                            f31034fffec424d6e4505318400ecc3b00f8c2107c1823510a037b11a49f0741

                            SHA512

                            12cb90877e442deb37ca64e911a9d699b3d799e89889f023458bf6f032eb2838b344bddb02cfed82aaae5af84b172d0acd95d84b9db469e2d4cb28586cd30e14

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\AntivirusDefender-main\JigsawRansomware\JigsawRansomware\packages\Newtonsoft.Json.10.0.3\lib\net45\Newtonsoft.Json.xml.fun
                            Filesize

                            658KB

                            MD5

                            e3ab3f6e3dd3856197ef93ab05bc2048

                            SHA1

                            05a5ebab502ac54af84109bf361cfbab147d4eb4

                            SHA256

                            89ab2878576875ad4b5f06ef7ee0f76311a86d87a50c17ec2d2e34dbe9c15fa1

                            SHA512

                            4047bea983fa05ee89257fcfa060fb6ec4c01e33f948a3277792f9f1a643a0f20d9b8c0f2dafd5619d7fd9d8d03f89ba36bcd681a0bb61d3265a388451a4ce5b

                            Download Submit

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\container.dat.fun
                            Filesize

                            16B

                            MD5

                            cfdae8214d34112dbee6587664059558

                            SHA1

                            f649f45d08c46572a9a50476478ddaef7e964353

                            SHA256

                            33088cb514406f31e3d96a92c03294121ee9f24e176f7062625c2b36bee7a325

                            SHA512

                            c260f2c223ecbf233051ac1d6a1548ad188a2777085e9d43b02da41b291ff258e4c506f99636150847aa24918c7bbb703652fef2fe55b3f50f85b5bd8dd5f6e3

                            Download Submit

                          • C:\Users\Admin\m_backup.exe
                            Filesize

                            1.7MB

                            MD5

                            2d4991c3b6da35745e0d4f76dffbca56

                            SHA1

                            61340c41787d16b753598670de2cb1dcf50718c5

                            SHA256

                            3dacf5cd40090a6d011f1e522eaed2d29699b9d892ce122ea406e0c9d03d5d2d

                            SHA512

                            87eb0d4957d81c9ec3be2bf5f032428b4d8e298b8dd70c6a5fc9cd98ad2bb12beb457b32ab698452cb558fdd98e6a78fb081fdf22f63ad0238f0a8ff1092a17f

                            Download Submit

                          • \Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\a.exe
                            Filesize

                            2.4MB

                            MD5

                            d948d4b6db5d6d6e2e1ba6c0fa4bf008

                            SHA1

                            05846d5b1d37ee2d716140de4f4f984cf1e631d1

                            SHA256

                            1f43703d2171ab90e98357b6dfdf824417baa191a59419c27fce42cbafdb7ecf

                            SHA512

                            fce681b3721eaf87f27b758782095e34665517ea4e0529cf18b32c4d0d5270ec40c8acf296ad2665e60a6e7e0430807f87e01e3a145902c9fea2a3c83100c15d

                            Download Submit

                          • \Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\f.exe
                            Filesize

                            3.0MB

                            MD5

                            4994952020da28bb0aa023d236a6bf3b

                            SHA1

                            af807380a745a4bcf937b87a081ef895ee7f15ba

                            SHA256

                            bb8c0e477512adab1db26eb77fe10dadbc5dcbf8e94569061c7199ca4626a420

                            SHA512

                            88393499d0816c173ea0b983995833e82e1aac1a73554d0b64d959b69dcf943644ab74927ad576bda48bbdace66256900aab33383f5a0546f6dfe21a8dd5662a

                            Download Submit

                          • \Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\jigsaw.exe
                            Filesize

                            60KB

                            MD5

                            14a2065165fca7f48b20123ea1ca8d2d

                            SHA1

                            f6371909e9b9751d3f7539a75ec0f024cd3094bf

                            SHA256

                            cb8068f6f5623b19fea0e5e8657ea059283dc7fbb04ac61c204b8fcf9b09cc3c

                            SHA512

                            eadd1e658b19805cc64a8a9a391f42fcae5c410c89b95a1b2e5d8615aadc1e873fb67e214fff5f96163b8340bc37443cfbb4d50eccd2b8e06b6294f503adf103

                            Download Submit

                          • \Users\Admin\AppData\Local\Temp\AntivirusDefender-main\AntivirusDefender\AntivirusDefender\Resources\thirdpartyclamavinstaller.exe
                            Filesize

                            14KB

                            MD5

                            05bd1940ef02d78bc2bd107e81f729f5

                            SHA1

                            dd5a4c413464dd21143e98f57484ea979e79d057

                            SHA256

                            576e4c14ef11683d332abc303503e257084cfef8ced3072549bdecd0a44bfbe1

                            SHA512

                            5967ddaa8eef68883a29de0b470ea101a0c2fb7ba51e7e45ecef1c2f31391993fa9514300c778c1931581b44001f672affb0217333353797742e821e7e885343

                            Download Submit

                          • memory/1752-351-0x00000000745E0000-0x0000000074CCE000-memory.dmp

                            Filesize

                            6.9MB

                            Download

                          • memory/1752-352-0x0000000000B60000-0x0000000000BA0000-memory.dmp

                            Filesize

                            256KB

                            Download

                          • memory/1752-0-0x00000000745E0000-0x0000000074CCE000-memory.dmp

                            Filesize

                            6.9MB

                            Download

                          • memory/1752-2-0x0000000000B60000-0x0000000000BA0000-memory.dmp

                            Filesize

                            256KB

                            Download

                          • memory/1752-1-0x0000000000F50000-0x0000000001968000-memory.dmp

                            Filesize

                            10.1MB

                            Download

                          • memory/1880-57-0x0000000000170000-0x0000000000196000-memory.dmp

                            Filesize

                            152KB

                            Download

                          • memory/2028-95-0x0000000000AA0000-0x0000000000AB6000-memory.dmp

                            Filesize

                            88KB

                            Download

                          • memory/2060-114-0x0000000000210000-0x0000000000226000-memory.dmp

                            Filesize

                            88KB

                            Download

                          • memory/2544-32-0x00000000773E0000-0x0000000077589000-memory.dmp

                            Filesize

                            1.7MB

                            Download

                          • memory/2572-11-0x0000000000840000-0x000000000084A000-memory.dmp

                            Filesize

                            40KB

                            Download