Analysis
-
max time kernel
114s -
max time network
141s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
22-01-2021 15:04
Static task
static1
URLScan task
urlscan1
Sample
https://j.mp/3bZ6ZG7
Behavioral task
behavioral1
Sample
https://j.mp/3bZ6ZG7
Resource
win10v20201028
General
-
Target
https://j.mp/3bZ6ZG7
-
Sample
210122-ll8z5fc276
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 3988 created 672 3988 WerFault.exe IEXPLORE.EXE PID 1708 created 988 1708 WerFault.exe IEXPLORE.EXE PID 416 created 2872 416 WerFault.exe IEXPLORE.EXE PID 652 created 4020 652 WerFault.exe IEXPLORE.EXE PID 3204 created 3728 3204 WerFault.exe IEXPLORE.EXE -
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3624 1404 WerFault.exe IEXPLORE.EXE 1176 672 WerFault.exe IEXPLORE.EXE 3988 672 WerFault.exe IEXPLORE.EXE 1708 988 WerFault.exe IEXPLORE.EXE 2368 2872 WerFault.exe IEXPLORE.EXE 416 2872 WerFault.exe IEXPLORE.EXE 652 4020 WerFault.exe IEXPLORE.EXE 3176 4020 WerFault.exe IEXPLORE.EXE 3200 3728 WerFault.exe IEXPLORE.EXE 3204 3728 WerFault.exe IEXPLORE.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
IEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30863576" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00985af7d8f0d601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{153A4EC5-5CCC-11EB-B59A-CA9C6575B2E4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3930684416" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3930724406" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001cad0ccd232972468e753df42302a60a00000000020000000000106600000001000020000000b3dad541bfaf58725c9947eaa0c27ba376755df6da62550fec21c5686bdf14e6000000000e80000000020000200000001adbde91ed627cec7f94a0e84fbe93df456b6aeb7b453cf85462f0bf2a26e13c2000000009d78a605978eb8ecd7d37e4470ddae87e98a3866e2434a90c7bcec33060bebd40000000478077534563835246f214788f535ae767388c4944793040f828309e6a7349134ae4ec786d1f5a6f8d07155a0054c07efb3a0820007ed75e5ce978772da170ed iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30863576" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 99 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 3624 WerFault.exe 1176 WerFault.exe 1176 WerFault.exe 1176 WerFault.exe 1176 WerFault.exe 1176 WerFault.exe 1176 WerFault.exe 1176 WerFault.exe 1176 WerFault.exe 1176 WerFault.exe 1176 WerFault.exe 1176 WerFault.exe 1176 WerFault.exe 1176 WerFault.exe 1176 WerFault.exe 1176 WerFault.exe 1176 WerFault.exe 1176 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 1708 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe 2368 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 3624 WerFault.exe Token: SeBackupPrivilege 3624 WerFault.exe Token: SeDebugPrivilege 3624 WerFault.exe Token: SeDebugPrivilege 1176 WerFault.exe Token: SeDebugPrivilege 1708 WerFault.exe Token: SeDebugPrivilege 2368 WerFault.exe Token: SeDebugPrivilege 3176 WerFault.exe Token: SeDebugPrivilege 3200 WerFault.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 692 iexplore.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 692 iexplore.exe 692 iexplore.exe 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE 988 IEXPLORE.EXE 988 IEXPLORE.EXE 988 IEXPLORE.EXE 988 IEXPLORE.EXE 672 IEXPLORE.EXE 672 IEXPLORE.EXE 988 IEXPLORE.EXE 988 IEXPLORE.EXE 2872 IEXPLORE.EXE 2872 IEXPLORE.EXE 4020 IEXPLORE.EXE 4020 IEXPLORE.EXE 4020 IEXPLORE.EXE 4020 IEXPLORE.EXE 588 IEXPLORE.EXE 588 IEXPLORE.EXE 4020 IEXPLORE.EXE 4020 IEXPLORE.EXE 3728 IEXPLORE.EXE 3728 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
iexplore.exedescription pid process target process PID 692 wrote to memory of 1404 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 1404 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 1404 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 988 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 988 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 988 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 672 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 672 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 672 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 2872 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 2872 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 2872 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 4020 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 4020 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 4020 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 588 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 588 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 588 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 3728 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 3728 692 iexplore.exe IEXPLORE.EXE PID 692 wrote to memory of 3728 692 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://j.mp/3bZ6ZG71⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:692 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 29803⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:692 CREDAT:148482 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 33683⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:692 CREDAT:148483 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 23923⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 24643⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:692 CREDAT:148485 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 23803⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 24563⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:692 CREDAT:279554 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 33883⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 33083⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:692 CREDAT:148486 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:692 CREDAT:279558 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 15083⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3728 -s 24723⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RW8YYLAG\expressinstall[1].htmMD5
bb99ee39a8e125db06398286defcba8f
SHA17e9687ad6ce7448f774e31573c10b31db3d2b708
SHA2562bc8b01b479ef42aa7d1f1b1bc60269728cef10f465490a91b8be95df7883cfd
SHA5129bcc5a60e651f16d5da9c523cd395b6dbfee8341aa3e89f9d1be3ba8afa35d2287bc9c668ba4dbc7194e0d2799ae93725875a1b42e9d6e6ba2e50171bfb7e434
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RW8YYLAG\expressinstall[1].htmMD5
bb99ee39a8e125db06398286defcba8f
SHA17e9687ad6ce7448f774e31573c10b31db3d2b708
SHA2562bc8b01b479ef42aa7d1f1b1bc60269728cef10f465490a91b8be95df7883cfd
SHA5129bcc5a60e651f16d5da9c523cd395b6dbfee8341aa3e89f9d1be3ba8afa35d2287bc9c668ba4dbc7194e0d2799ae93725875a1b42e9d6e6ba2e50171bfb7e434
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RW8YYLAG\expressinstall[2].htmMD5
bb99ee39a8e125db06398286defcba8f
SHA17e9687ad6ce7448f774e31573c10b31db3d2b708
SHA2562bc8b01b479ef42aa7d1f1b1bc60269728cef10f465490a91b8be95df7883cfd
SHA5129bcc5a60e651f16d5da9c523cd395b6dbfee8341aa3e89f9d1be3ba8afa35d2287bc9c668ba4dbc7194e0d2799ae93725875a1b42e9d6e6ba2e50171bfb7e434
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UOAPEAJQ\expressinstall[1].htmMD5
bb99ee39a8e125db06398286defcba8f
SHA17e9687ad6ce7448f774e31573c10b31db3d2b708
SHA2562bc8b01b479ef42aa7d1f1b1bc60269728cef10f465490a91b8be95df7883cfd
SHA5129bcc5a60e651f16d5da9c523cd395b6dbfee8341aa3e89f9d1be3ba8afa35d2287bc9c668ba4dbc7194e0d2799ae93725875a1b42e9d6e6ba2e50171bfb7e434
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XMX44WX9\expressinstall[1].htmMD5
bb99ee39a8e125db06398286defcba8f
SHA17e9687ad6ce7448f774e31573c10b31db3d2b708
SHA2562bc8b01b479ef42aa7d1f1b1bc60269728cef10f465490a91b8be95df7883cfd
SHA5129bcc5a60e651f16d5da9c523cd395b6dbfee8341aa3e89f9d1be3ba8afa35d2287bc9c668ba4dbc7194e0d2799ae93725875a1b42e9d6e6ba2e50171bfb7e434
-
memory/416-21-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/588-24-0x0000000000000000-mapping.dmp
-
memory/652-27-0x0000000004320000-0x0000000004321000-memory.dmpFilesize
4KB
-
memory/672-7-0x0000000000000000-mapping.dmp
-
memory/988-6-0x0000000000000000-mapping.dmp
-
memory/1176-9-0x0000000004810000-0x0000000004811000-memory.dmpFilesize
4KB
-
memory/1404-2-0x0000000000000000-mapping.dmp
-
memory/1708-16-0x00000000047C0000-0x00000000047C1000-memory.dmpFilesize
4KB
-
memory/2368-20-0x0000000004470000-0x0000000004471000-memory.dmpFilesize
4KB
-
memory/2872-17-0x0000000000000000-mapping.dmp
-
memory/3176-26-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/3200-32-0x0000000004E60000-0x0000000004E61000-memory.dmpFilesize
4KB
-
memory/3204-35-0x0000000004990000-0x0000000004991000-memory.dmpFilesize
4KB
-
memory/3624-4-0x0000000004780000-0x0000000004781000-memory.dmpFilesize
4KB
-
memory/3624-3-0x0000000004780000-0x0000000004781000-memory.dmpFilesize
4KB
-
memory/3728-30-0x0000000000000000-mapping.dmp
-
memory/3988-12-0x0000000004730000-0x0000000004731000-memory.dmpFilesize
4KB
-
memory/4020-18-0x0000000000000000-mapping.dmp