Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows7_x64 -
resource
win7 -
submitted
27-10-2020 10:58
Static task
static1
Behavioral task
behavioral1
Sample
76c8a9dbff9b571500729611595f1a1bce8dab543922d731c3bb42af5477f517.exe
Resource
win7
Behavioral task
behavioral2
Sample
76c8a9dbff9b571500729611595f1a1bce8dab543922d731c3bb42af5477f517.exe
Resource
win10
General
-
Target
76c8a9dbff9b571500729611595f1a1bce8dab543922d731c3bb42af5477f517.exe
-
Size
459KB
-
MD5
165764b4314eea6105dcb41e02a0bea4
-
SHA1
9e9218fa0b3d51ed02185658a5290200b7ced108
-
SHA256
76c8a9dbff9b571500729611595f1a1bce8dab543922d731c3bb42af5477f517
-
SHA512
641477979c2484bd5101e537bea96001bcc93737b0945d26ab4ddc6d748653dce5f09655e0f6dec002c6f16aa2918dcfc77912b5c06323adee47c807de52adc6
Malware Config
Signatures
-
Ursnif RM3
A heavily modified version of Ursnif discovered in the wild.
-
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEiexplore.exeiexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70e331be50acd601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D6EFD81-1844-11EB-9740-F23A3BF41EA9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDE7C541-1843-11EB-9740-F23A3BF41EA9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1BEB9BC1-1844-11EB-9740-F23A3BF41EA9} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exepid process 1300 iexplore.exe 1504 iexplore.exe 1908 iexplore.exe 1628 iexplore.exe 1712 iexplore.exe 1312 iexplore.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEpid process 1300 iexplore.exe 1300 iexplore.exe 1484 IEXPLORE.EXE 1484 IEXPLORE.EXE 1504 iexplore.exe 1504 iexplore.exe 1900 IEXPLORE.EXE 1900 IEXPLORE.EXE 1908 iexplore.exe 1908 iexplore.exe 320 IEXPLORE.EXE 320 IEXPLORE.EXE 1628 iexplore.exe 1628 iexplore.exe 1236 IEXPLORE.EXE 1236 IEXPLORE.EXE 1712 iexplore.exe 1712 iexplore.exe 1728 IEXPLORE.EXE 1728 IEXPLORE.EXE 1312 iexplore.exe 1312 iexplore.exe 524 IEXPLORE.EXE 524 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exeiexplore.exedescription pid process target process PID 1300 wrote to memory of 1484 1300 iexplore.exe IEXPLORE.EXE PID 1300 wrote to memory of 1484 1300 iexplore.exe IEXPLORE.EXE PID 1300 wrote to memory of 1484 1300 iexplore.exe IEXPLORE.EXE PID 1300 wrote to memory of 1484 1300 iexplore.exe IEXPLORE.EXE PID 1504 wrote to memory of 1900 1504 iexplore.exe IEXPLORE.EXE PID 1504 wrote to memory of 1900 1504 iexplore.exe IEXPLORE.EXE PID 1504 wrote to memory of 1900 1504 iexplore.exe IEXPLORE.EXE PID 1504 wrote to memory of 1900 1504 iexplore.exe IEXPLORE.EXE PID 1908 wrote to memory of 320 1908 iexplore.exe IEXPLORE.EXE PID 1908 wrote to memory of 320 1908 iexplore.exe IEXPLORE.EXE PID 1908 wrote to memory of 320 1908 iexplore.exe IEXPLORE.EXE PID 1908 wrote to memory of 320 1908 iexplore.exe IEXPLORE.EXE PID 1628 wrote to memory of 1236 1628 iexplore.exe IEXPLORE.EXE PID 1628 wrote to memory of 1236 1628 iexplore.exe IEXPLORE.EXE PID 1628 wrote to memory of 1236 1628 iexplore.exe IEXPLORE.EXE PID 1628 wrote to memory of 1236 1628 iexplore.exe IEXPLORE.EXE PID 1712 wrote to memory of 1728 1712 iexplore.exe IEXPLORE.EXE PID 1712 wrote to memory of 1728 1712 iexplore.exe IEXPLORE.EXE PID 1712 wrote to memory of 1728 1712 iexplore.exe IEXPLORE.EXE PID 1712 wrote to memory of 1728 1712 iexplore.exe IEXPLORE.EXE PID 1312 wrote to memory of 524 1312 iexplore.exe IEXPLORE.EXE PID 1312 wrote to memory of 524 1312 iexplore.exe IEXPLORE.EXE PID 1312 wrote to memory of 524 1312 iexplore.exe IEXPLORE.EXE PID 1312 wrote to memory of 524 1312 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\76c8a9dbff9b571500729611595f1a1bce8dab543922d731c3bb42af5477f517.exe"C:\Users\Admin\AppData\Local\Temp\76c8a9dbff9b571500729611595f1a1bce8dab543922d731c3bb42af5477f517.exe"1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1300 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1504 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1312 CREDAT:275457 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9sinn1d\imagestore.datMD5
939e7d52deb3eb1d35e6bdad7d8f54f0
SHA1333e4d9b4b00e78d5da5d799decd6f0d8face1ad
SHA256b912515457694b73c9531a2e40cd234ab95b14c757172f42a012d6f8fe089e28
SHA512426cdaeea6bb74ee11ee0028ce37aac498acfa278b50a442329fef69ba970d9a421e13958fa85ba80155af60b9f5ad60160c823c21cef6adfa4da063d15e42bc
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9sinn1d\imagestore.datMD5
939e7d52deb3eb1d35e6bdad7d8f54f0
SHA1333e4d9b4b00e78d5da5d799decd6f0d8face1ad
SHA256b912515457694b73c9531a2e40cd234ab95b14c757172f42a012d6f8fe089e28
SHA512426cdaeea6bb74ee11ee0028ce37aac498acfa278b50a442329fef69ba970d9a421e13958fa85ba80155af60b9f5ad60160c823c21cef6adfa4da063d15e42bc
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9sinn1d\imagestore.datMD5
939e7d52deb3eb1d35e6bdad7d8f54f0
SHA1333e4d9b4b00e78d5da5d799decd6f0d8face1ad
SHA256b912515457694b73c9531a2e40cd234ab95b14c757172f42a012d6f8fe089e28
SHA512426cdaeea6bb74ee11ee0028ce37aac498acfa278b50a442329fef69ba970d9a421e13958fa85ba80155af60b9f5ad60160c823c21cef6adfa4da063d15e42bc
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9sinn1d\imagestore.datMD5
939e7d52deb3eb1d35e6bdad7d8f54f0
SHA1333e4d9b4b00e78d5da5d799decd6f0d8face1ad
SHA256b912515457694b73c9531a2e40cd234ab95b14c757172f42a012d6f8fe089e28
SHA512426cdaeea6bb74ee11ee0028ce37aac498acfa278b50a442329fef69ba970d9a421e13958fa85ba80155af60b9f5ad60160c823c21cef6adfa4da063d15e42bc
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9sinn1d\imagestore.datMD5
939e7d52deb3eb1d35e6bdad7d8f54f0
SHA1333e4d9b4b00e78d5da5d799decd6f0d8face1ad
SHA256b912515457694b73c9531a2e40cd234ab95b14c757172f42a012d6f8fe089e28
SHA512426cdaeea6bb74ee11ee0028ce37aac498acfa278b50a442329fef69ba970d9a421e13958fa85ba80155af60b9f5ad60160c823c21cef6adfa4da063d15e42bc
-
memory/320-8-0x0000000000000000-mapping.dmp
-
memory/524-17-0x0000000000000000-mapping.dmp
-
memory/568-1-0x000007FEF83D0000-0x000007FEF864A000-memory.dmpFilesize
2.5MB
-
memory/1236-11-0x0000000000000000-mapping.dmp
-
memory/1456-0-0x0000000000160000-0x0000000000172000-memory.dmpFilesize
72KB
-
memory/1484-4-0x0000000004F20000-0x0000000004F23000-memory.dmpFilesize
12KB
-
memory/1484-3-0x00000000069A0000-0x00000000069C3000-memory.dmpFilesize
140KB
-
memory/1484-2-0x0000000000000000-mapping.dmp
-
memory/1728-14-0x0000000000000000-mapping.dmp
-
memory/1900-5-0x0000000000000000-mapping.dmp