Analysis
-
max time kernel
56s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01-05-2024 13:36
Static task
static1
Behavioral task
behavioral1
Sample
W2_PDF.jar
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
W2_PDF.jar
Resource
win10v2004-20240419-en
General
-
Target
W2_PDF.jar
-
Size
447KB
-
MD5
ec0e8133dbb9686ae7bd0144704415c2
-
SHA1
b4929e2a864b61e09a571b86b1ff0311b646d0cd
-
SHA256
d4f6ed754a730d7c59147abf4d58ad0c13a3dc6d9a7661d51edbda043b5d2b08
-
SHA512
8685664a8e1261c097b2a09d6f4b0ed09f5f4481ea40212962eb066be3e7ca2a3f334d4cafbb36f8137ea8e6566783206ea7aa7a0422d2f7d3394a82bd6f20a7
-
SSDEEP
12288:aPwjWiIxcEQlQyjQP5QTS4jcvZSFWeQe20Y469iyUmOYRvdm:8wjwOEeQrWTnGSFbB69ZT1m
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
javaw.exepid process 4664 javaw.exe -
Loads dropped DLL 7 IoCs
Processes:
javaw.exepid process 4664 javaw.exe 4664 javaw.exe 4664 javaw.exe 4664 javaw.exe 4664 javaw.exe 4664 javaw.exe 4664 javaw.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QYraFnSZOca = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\WCUkqDHuYPW.jpg\\WUFKYxLvepBd.JStdFc\"" reg.exe -
Drops file in System32 directory 1 IoCs
Processes:
java.exedescription ioc process File created C:\Windows\System32\test.txt java.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
java.exepid process 2228 java.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
java.exejava.execmd.execmd.exedescription pid process target process PID 4952 wrote to memory of 3520 4952 java.exe icacls.exe PID 4952 wrote to memory of 3520 4952 java.exe icacls.exe PID 4952 wrote to memory of 2228 4952 java.exe java.exe PID 4952 wrote to memory of 2228 4952 java.exe java.exe PID 4952 wrote to memory of 4424 4952 java.exe REG.exe PID 4952 wrote to memory of 4424 4952 java.exe REG.exe PID 2228 wrote to memory of 4864 2228 java.exe cmd.exe PID 2228 wrote to memory of 4864 2228 java.exe cmd.exe PID 4864 wrote to memory of 2736 4864 cmd.exe cscript.exe PID 4864 wrote to memory of 2736 4864 cmd.exe cscript.exe PID 2228 wrote to memory of 3000 2228 java.exe cmd.exe PID 2228 wrote to memory of 3000 2228 java.exe cmd.exe PID 3000 wrote to memory of 2652 3000 cmd.exe cscript.exe PID 3000 wrote to memory of 2652 3000 cmd.exe cscript.exe PID 2228 wrote to memory of 1940 2228 java.exe xcopy.exe PID 2228 wrote to memory of 1940 2228 java.exe xcopy.exe PID 2228 wrote to memory of 2772 2228 java.exe cmd.exe PID 2228 wrote to memory of 2772 2228 java.exe cmd.exe PID 2228 wrote to memory of 2808 2228 java.exe reg.exe PID 2228 wrote to memory of 2808 2228 java.exe reg.exe PID 2228 wrote to memory of 4216 2228 java.exe attrib.exe PID 2228 wrote to memory of 4216 2228 java.exe attrib.exe PID 2228 wrote to memory of 4924 2228 java.exe attrib.exe PID 2228 wrote to memory of 4924 2228 java.exe attrib.exe PID 2228 wrote to memory of 4664 2228 java.exe javaw.exe PID 2228 wrote to memory of 4664 2228 java.exe javaw.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 4216 attrib.exe 4924 attrib.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\W2_PDF.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\MCNKJHGGFFF9153676964700264670.JAR istmp2⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5087608617762602552.vbs3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive5087608617762602552.vbs4⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3247548674338841980.vbs3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cscript.execscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3247548674338841980.vbs4⤵
-
C:\Windows\SYSTEM32\xcopy.exexcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e3⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe3⤵
-
C:\Windows\SYSTEM32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v QYraFnSZOca /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\WCUkqDHuYPW.jpg\WUFKYxLvepBd.JStdFc\"" /f3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\SYSTEM32\attrib.exeattrib +h "C:\Users\Admin\WCUkqDHuYPW.jpg\*.*"3⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +h "C:\Users\Admin\WCUkqDHuYPW.jpg"3⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exeC:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\Admin\WCUkqDHuYPW.jpg\WUFKYxLvepBd.JStdFc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SYSTEM32\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "REalTechInfo" /t REG_SZ /F /D "java -jar "C:\Users\Admin\AppData\Local\Temp\MCNKJHGGFFF9153676964700264670.JAR istmp""2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD54dcc97c54a2284cdbcfc191618d83ba8
SHA1f2b551bf8ddeeed74537b76961303d886fc321f7
SHA256cd3e36cfc865927011583399e96d082538361241aa2e9bb985c3708d51939d1e
SHA51237e8c084f0ebb69c551a1c783d822f41bda999b073ae68cc702c8d0fc3eb8c86dd12658623328d1a10a93406757fb229cb14aaefaf68f11d18e90099728817dc
-
C:\Users\Admin\AppData\Local\Temp\MCNKJHGGFFF9153676964700264670.JARFilesize
447KB
MD5ec0e8133dbb9686ae7bd0144704415c2
SHA1b4929e2a864b61e09a571b86b1ff0311b646d0cd
SHA256d4f6ed754a730d7c59147abf4d58ad0c13a3dc6d9a7661d51edbda043b5d2b08
SHA5128685664a8e1261c097b2a09d6f4b0ed09f5f4481ea40212962eb066be3e7ca2a3f334d4cafbb36f8137ea8e6566783206ea7aa7a0422d2f7d3394a82bd6f20a7
-
C:\Users\Admin\AppData\Local\Temp\Retrive3247548674338841980.vbsFilesize
281B
MD5a32c109297ed1ca155598cd295c26611
SHA1dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA25645bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
SHA51270372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887
-
C:\Users\Admin\AppData\Local\Temp\Retrive5087608617762602552.vbsFilesize
276B
MD53bdfd33017806b85949b6faa7d4b98e4
SHA1f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA2569da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
SHA512ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429
-
C:\Users\Admin\AppData\Local\Temp\m17145705697621498266110416546183.tmpFilesize
399KB
MD5093ac0d0747d88c9a27a3426eda6afb9
SHA111b1c7704788b7d0066cda44152a00a53e216bb1
SHA256267ecdcbd7bd564398711133eea96b0747bb284f4dc9238f0393d9545a1d4ff7
SHA51273c2eb0e5da0abf70854bbf798c4d59e9b76b5860a116b7ca69057f4b16283d25a53818c795dc7359089cd6fd563c1ca04ce6f403340316c137b279ccacdcaa8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3726321484-1950364574-433157660-1000\83aa4cc77f591dfc2374580bbd95f6ba_702abe76-fde0-4134-943b-e0c6d24c5ee3Filesize
45B
MD5c8366ae350e7019aefc9d1e6e6a498c6
SHA15731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA25611e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA51233c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
-
C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dllFilesize
162KB
MD5583e8b42864ec183c945164f373cb375
SHA15ec118befbb5d17593a05db2899ee52f7267da37
SHA2569bc9178d3f4246433fe209a0f5ca70e77568e80c928268c78f8c8b00107ce6ed
SHA5121feaac37bac19bde93171ebda2e76a65e9d5472a503b05939f6977b3a4d94d131298f3989dd048d7617ecd69cf09db7ac986fc39f0df9f56c84ea01726d0c898
-
C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exeFilesize
285KB
MD5122e34bfa3146ef9ae5a51fdc744353f
SHA1f0cc2294fe150a4cceca8a3da8615edcc4eb20e4
SHA256dd2169db3358ccdf4a4a185e4a22955c989eaa3b9d3e0e6025599b8fa173c968
SHA512306341e00598f02a70d3edc6ef666cb64982f1e31e5c0a1304977a1700c95395c1c7f0857ae8056853370eced0bd2aeafc72da804a65f98c1422929b7c431700
-
C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\msvcp140.dllFilesize
558KB
MD5bf78c15068d6671693dfcdfa5770d705
SHA14418c03c3161706a4349dfe3f97278e7a5d8962a
SHA256a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb
SHA5125b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372
-
C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140.dllFilesize
95KB
MD57415c1cc63a0c46983e2a32581daefee
SHA15f8534d79c84ac45ad09b5a702c8c5c288eae240
SHA256475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
SHA5123d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf
-
C:\Users\Admin\AppData\Roaming\Oracle\bin\plugin2\vcruntime140_1.dllFilesize
36KB
MD5fcda37abd3d9e9d8170cd1cd15bf9d3f
SHA1b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2
SHA2560579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6
SHA512de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257
-
C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dllFilesize
8.5MB
MD536e3e370db5f0b66689811b41f1a8445
SHA17fcbe290c3a6a0827b77af78115a1b4bc834d685
SHA2569f28a06990d2ed1d14130072109e37e733b3a7d4922e325e679dd4d917741550
SHA512f93bc4ca946e383ee1edfef3c7b5574585d23d660a4cc3db5b6b203f6111a3fe1f245d583ca53852888ac67812fb6efd0d121d0643180875baeb0d7b811d4db9
-
C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dllFilesize
55KB
MD50fcda2fc9a161614e68d74f4d9eecc2d
SHA1d3734149ff561209aa9e851ea958012e20ce41da
SHA256b1cf5a699d1a48691c2fe8dfad1c8c8aa1c4013c52b4107bad905faf037ddffa
SHA5125402af47558721f084f5f05264e160bd43ebe265c2d2e3b415c2a0ea7bf9adf7aebb76e2c12dcf93ae5bf10d00f4c80aa3a97f35c02eb3279df9c675f3a037bc
-
C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dllFilesize
87KB
MD52ca64779a19ba733a408edd9511b7c37
SHA199ad8571bc8cd48efba19a48066c0f0dd321ecc1
SHA256c3c3365932d865e111972184ae12dc3853dc7e5d6df2f474dbeee5faead92cd3
SHA5120822bb0e4d18115d325f3981ad15cb036d5a9f845d2c68975c5e9164b5fbdab0fdd4e882d3b8001f58271b7b38cba9bdc1299ccfab00ce0321f396aa8bf248a5
-
C:\Users\Admin\AppData\Roaming\Oracle\lib\amd64\jvm.cfgFilesize
634B
MD5499f2a4e0a25a41c1ff80df2d073e4fd
SHA1e2469cbe07e92d817637be4e889ebb74c3c46253
SHA25680847ed146dbc5a9f604b07ec887737fc266699abba266177b553149487ce9eb
SHA5127828f7b06d0f4309b9edd3aa71ae0bb7ee92d2f8df5642c13437bba2a3888e457dc9b24c16aa9e0f19231530cb44b8ccd955cbbdf5956ce8622cc208796b357d
-
C:\Users\Admin\AppData\Roaming\Oracle\lib\charsets.jarFilesize
2.9MB
MD5a5b8d1a15884d8450ec905fc08d6e1d2
SHA1472cdfe3f3bf1e719e3bc73f008f26960d2a74fc
SHA25694e16e5ba8033fc3cd2a2e731b6326958dfe7c9b70fd4826eb2c0709a656d83d
SHA5123eee8ff3e969161d551903a1687db379f516ddfe4bec35c508964012a58895a45a36d4efcd06a60448f3ec764c4f3dd7e317445c32e23b8c888b68361747e330
-
C:\Users\Admin\AppData\Roaming\Oracle\lib\deploy\messages_zh_TW.propertiesFilesize
3KB
MD5880baacb176553deab39edbe4b74380d
SHA137a57aad121c14c25e149206179728fa62203bf0
SHA256ff4a3a92bc92cb08d2c32c435810440fd264edd63e56efa39430e0240c835620
SHA5123039315bb283198af9090bd3d31cfae68ee73bc2b118bbae0b32812d4e3fd0f11ce962068d4a17b065dab9a66ef651b9cb8404c0a2defce74bb6b2d1d93646d5
-
C:\Users\Admin\AppData\Roaming\Oracle\lib\images\cursors\win32_CopyNoDrop32x32.gifFilesize
153B
MD51e9d8f133a442da6b0c74d49bc84a341
SHA1259edc45b4569427e8319895a444f4295d54348f
SHA2561a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
SHA51263d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
-
C:\Users\Admin\AppData\Roaming\Oracle\lib\jce.jarFilesize
120KB
MD599247d1d5370a784e438416e599abe36
SHA12f958cccadeb2d991e41edccece08bc1a64368cf
SHA256f5700ffd6842bff801307c09e02ce3ca9792eb2cd4d34e79563bf77ff44ae531
SHA512e3380e411f1b7219df659cbb4691cf3cd23c66f4af428f3b71539e579b6c2ce8209fad949f3909337a89282fd5c1d1eacf2a1acc34ff129c69c7b0bdb1b65a35
-
C:\Users\Admin\AppData\Roaming\Oracle\lib\jfr.jarFilesize
566KB
MD59868c5f7a74f603107ecdb43a367d91b
SHA16b5499786196c71c7c2ff63d1f15d70b4c0164a8
SHA2568660a4dd44225c06a79afb5e8015a74cd610c50c777b4b2737008d179b69dd83
SHA5121740c646cc0b83398ff0aa6c7b297cd4882840c9cae28fbac4914617764cc21c2026539b7eaf9209fff8d3b1df89a09299021f43910c07e434060434461daa8e
-
C:\Users\Admin\AppData\Roaming\Oracle\lib\jsse.jarFilesize
1.7MB
MD56b4188fce8bf2334732741b2f3c3c864
SHA195dfc9d9709f9b6e7fce99bc02a3bc7d1fde75d8
SHA25646599d42d2c0b9bc6484a5b2d5a53bb5d9b238bef9c87f006acd61cc52bdb0ff
SHA51259cbc0820e01fcf7a62675aa9bece9afd2ca20c3cca4b7033394c398e669b0b7f7ec5ac97486fecfb6fa48187b7faa0fb1fb5987e93c6a0a5e85e99b9ddda590
-
C:\Users\Admin\AppData\Roaming\Oracle\lib\meta-indexFilesize
2KB
MD5689c0cbde7697f43642bf1134f4b70af
SHA1307db1c4a9570f01479dea98f6b5bd33a1deb759
SHA2566bd7ea02b9456a3730755e76d4ee1ccc04c524e93366cd74d7f42ac628d4ec77
SHA51213afe0797d9c2c7ab8721fbedab42225b41f45059a9167c046a11e1bf6e03ad82accaed42884dff335b66ec41d3608d0d0bd06582af51634a81550c81baff2fb
-
C:\Users\Admin\AppData\Roaming\Oracle\lib\resources.jarFilesize
3.4MB
MD5181737fb6fbc7447670c89c22262199c
SHA111150f5ba9782d8550fd1a3d6eee889a0ca66da0
SHA2569dafdd0afd9f6aab6eec3f130d0c85bf5507b8535b063e17c8fa4924773470b0
SHA5128daad658207f9e8fd937254c453fb4be8b488cc061ce9e41df83fbd228193da9007feed3bb3ff12188c41a6b733d2851933d276d68d03f8edec3c3de602ca60a
-
C:\Users\Admin\AppData\Roaming\Oracle\lib\rt.jarFilesize
53.3MB
MD5644137cf0708bdcfadd32296f28c2c70
SHA1f42ada87824f49449a94c5e3ff1e0cbcb3d445af
SHA256bf417af0d7b3c7894d3515371fbbb7ea581e084bc2e4acb99709aff564f2a5c6
SHA512b438cc97a3e18635a33681c5ca8aa680fd89b40557ae5f20b3715a43dad7d96d5be57e87e01acec2f849e51fbf4cdf6e88354cdae84e3f3b9b8e1e051c3acb0c
-
C:\Users\Admin\AppData\Roaming\Oracle\lib\security\policy\unlimited\US_export_policy.jarFilesize
7KB
MD512f971b6e65cbc7184701235469f0339
SHA106cb165157c5e0078b872c48707a1328b1dcba19
SHA25684e035372ca8979bb4a387428a74942ffc7248a0e61988b7033b5b266cd187c8
SHA51258646fc81de2e4750a3259d79a207a8cff2dc6692f178a63d92a453fc408c8d1088007ef4e93157d1017be706565716a0236039dbac848c40745a0ad89c4d0de
-
C:\Users\Admin\WCUkqDHuYPW.jpg\ID.txtFilesize
47B
MD50ec22f6b596b6d13cc6a3f8aaf09777b
SHA11c0e48f1bd8516f900a688b28364fc93b5504873
SHA2568a0e92b2734fff165c36d9fb2b46ea4e7c16cedd71c97ed73a89b1b3328e019c
SHA51219a02ec415fd0977ecd4e6499c46e9fe4c7e55c7c5ba4f4df5d8b0260f9b8305eda80dc6a7e98c9a13b2e941749e15ab8093ebf0a1356a445e766fd5c59a9f73
-
memory/2228-68-0x0000021A84970000-0x0000021A84971000-memory.dmpFilesize
4KB
-
memory/2228-54-0x0000021A84990000-0x0000021A85990000-memory.dmpFilesize
16.0MB
-
memory/2228-38-0x0000021A84990000-0x0000021A85990000-memory.dmpFilesize
16.0MB
-
memory/2228-67-0x0000021A84990000-0x0000021A85990000-memory.dmpFilesize
16.0MB
-
memory/2228-74-0x0000021A84990000-0x0000021A85990000-memory.dmpFilesize
16.0MB
-
memory/2228-72-0x0000021A84990000-0x0000021A85990000-memory.dmpFilesize
16.0MB
-
memory/2228-28-0x0000021A84970000-0x0000021A84971000-memory.dmpFilesize
4KB
-
memory/2228-25-0x0000021A84990000-0x0000021A85990000-memory.dmpFilesize
16.0MB
-
memory/2228-73-0x0000021A84970000-0x0000021A84971000-memory.dmpFilesize
4KB
-
memory/2228-969-0x0000021A84970000-0x0000021A84971000-memory.dmpFilesize
4KB
-
memory/4952-10-0x0000020B0BE30000-0x0000020B0CE30000-memory.dmpFilesize
16.0MB
-
memory/4952-15-0x0000020B0A5C0000-0x0000020B0A5C1000-memory.dmpFilesize
4KB