Analysis
-
max time kernel
150s -
max time network
8s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
21-04-2021 10:18
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-207480-PR-128311 (2).exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
RFQ-207480-PR-128311 (2).exe
Resource
win10v20210408
General
-
Target
RFQ-207480-PR-128311 (2).exe
-
Size
460KB
-
MD5
502049e944a8d3bbb0138098597b30e8
-
SHA1
5242d649abb58f4d797bad53c448bd5028a7fdce
-
SHA256
2be649f814ee89705f39489d11d8dc2d32e76ba97cec1f0707edc0ec4b4aa060
-
SHA512
61270a3112f90358050597ddc0c92c70a8d086b42d3e1bcbdabca8751730835f0ccd13ae3536fdcc688fbeedb9d69087acc7bf9d2861a698b68ecce15f164e8d
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.t7global-my.com - Port:
587 - Username:
manage@t7global-my.com - Password:
KyDCvxSl$2
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2036-89-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/2036-90-0x000000000043761E-mapping.dmp family_agenttesla behavioral1/memory/2036-91-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Nirsoft 13 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\AdvancedRun.exe Nirsoft -
Executes dropped EXE 4 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exeAdvancedRun.exeAdvancedRun.exepid process 1392 AdvancedRun.exe 420 AdvancedRun.exe 1464 AdvancedRun.exe 732 AdvancedRun.exe -
Loads dropped DLL 8 IoCs
Processes:
RFQ-207480-PR-128311 (2).exeAdvancedRun.exeAdvancedRun.exepid process 788 RFQ-207480-PR-128311 (2).exe 788 RFQ-207480-PR-128311 (2).exe 1392 AdvancedRun.exe 1392 AdvancedRun.exe 788 RFQ-207480-PR-128311 (2).exe 788 RFQ-207480-PR-128311 (2).exe 1464 AdvancedRun.exe 1464 AdvancedRun.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ-207480-PR-128311 (2).exedescription pid process target process PID 788 set thread context of 2036 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exeAdvancedRun.exeAdvancedRun.exeRFQ-207480-PR-128311 (2).exeRFQ-207480-PR-128311 (2).exepowershell.exepid process 1392 AdvancedRun.exe 1392 AdvancedRun.exe 420 AdvancedRun.exe 420 AdvancedRun.exe 1464 AdvancedRun.exe 1464 AdvancedRun.exe 732 AdvancedRun.exe 732 AdvancedRun.exe 788 RFQ-207480-PR-128311 (2).exe 788 RFQ-207480-PR-128311 (2).exe 788 RFQ-207480-PR-128311 (2).exe 788 RFQ-207480-PR-128311 (2).exe 788 RFQ-207480-PR-128311 (2).exe 788 RFQ-207480-PR-128311 (2).exe 2036 RFQ-207480-PR-128311 (2).exe 2036 RFQ-207480-PR-128311 (2).exe 360 powershell.exe 360 powershell.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exeAdvancedRun.exeAdvancedRun.exeRFQ-207480-PR-128311 (2).exeRFQ-207480-PR-128311 (2).exepowershell.exedescription pid process Token: SeDebugPrivilege 1392 AdvancedRun.exe Token: SeImpersonatePrivilege 1392 AdvancedRun.exe Token: SeDebugPrivilege 420 AdvancedRun.exe Token: SeImpersonatePrivilege 420 AdvancedRun.exe Token: SeDebugPrivilege 1464 AdvancedRun.exe Token: SeImpersonatePrivilege 1464 AdvancedRun.exe Token: SeDebugPrivilege 732 AdvancedRun.exe Token: SeImpersonatePrivilege 732 AdvancedRun.exe Token: SeDebugPrivilege 788 RFQ-207480-PR-128311 (2).exe Token: SeDebugPrivilege 2036 RFQ-207480-PR-128311 (2).exe Token: SeDebugPrivilege 360 powershell.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
RFQ-207480-PR-128311 (2).exeAdvancedRun.exeAdvancedRun.exeWScript.exedescription pid process target process PID 788 wrote to memory of 1392 788 RFQ-207480-PR-128311 (2).exe AdvancedRun.exe PID 788 wrote to memory of 1392 788 RFQ-207480-PR-128311 (2).exe AdvancedRun.exe PID 788 wrote to memory of 1392 788 RFQ-207480-PR-128311 (2).exe AdvancedRun.exe PID 788 wrote to memory of 1392 788 RFQ-207480-PR-128311 (2).exe AdvancedRun.exe PID 1392 wrote to memory of 420 1392 AdvancedRun.exe AdvancedRun.exe PID 1392 wrote to memory of 420 1392 AdvancedRun.exe AdvancedRun.exe PID 1392 wrote to memory of 420 1392 AdvancedRun.exe AdvancedRun.exe PID 1392 wrote to memory of 420 1392 AdvancedRun.exe AdvancedRun.exe PID 788 wrote to memory of 1464 788 RFQ-207480-PR-128311 (2).exe AdvancedRun.exe PID 788 wrote to memory of 1464 788 RFQ-207480-PR-128311 (2).exe AdvancedRun.exe PID 788 wrote to memory of 1464 788 RFQ-207480-PR-128311 (2).exe AdvancedRun.exe PID 788 wrote to memory of 1464 788 RFQ-207480-PR-128311 (2).exe AdvancedRun.exe PID 1464 wrote to memory of 732 1464 AdvancedRun.exe AdvancedRun.exe PID 1464 wrote to memory of 732 1464 AdvancedRun.exe AdvancedRun.exe PID 1464 wrote to memory of 732 1464 AdvancedRun.exe AdvancedRun.exe PID 1464 wrote to memory of 732 1464 AdvancedRun.exe AdvancedRun.exe PID 788 wrote to memory of 472 788 RFQ-207480-PR-128311 (2).exe WScript.exe PID 788 wrote to memory of 472 788 RFQ-207480-PR-128311 (2).exe WScript.exe PID 788 wrote to memory of 472 788 RFQ-207480-PR-128311 (2).exe WScript.exe PID 788 wrote to memory of 472 788 RFQ-207480-PR-128311 (2).exe WScript.exe PID 788 wrote to memory of 1468 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 788 wrote to memory of 1468 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 788 wrote to memory of 1468 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 788 wrote to memory of 1468 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 788 wrote to memory of 1468 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 788 wrote to memory of 1468 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 788 wrote to memory of 1468 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 788 wrote to memory of 2036 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 788 wrote to memory of 2036 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 788 wrote to memory of 2036 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 788 wrote to memory of 2036 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 788 wrote to memory of 2036 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 788 wrote to memory of 2036 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 788 wrote to memory of 2036 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 788 wrote to memory of 2036 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 788 wrote to memory of 2036 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 788 wrote to memory of 2036 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 788 wrote to memory of 2036 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 788 wrote to memory of 2036 788 RFQ-207480-PR-128311 (2).exe RFQ-207480-PR-128311 (2).exe PID 472 wrote to memory of 360 472 WScript.exe powershell.exe PID 472 wrote to memory of 360 472 WScript.exe powershell.exe PID 472 wrote to memory of 360 472 WScript.exe powershell.exe PID 472 wrote to memory of 360 472 WScript.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ-207480-PR-128311 (2).exe"C:\Users\Admin\AppData\Local\Temp\RFQ-207480-PR-128311 (2).exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 13923⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 14643⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\zQjffrliptxvamq.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\RFQ-207480-PR-128311 (2).exe"C:\Users\Admin\AppData\Local\Temp\RFQ-207480-PR-128311 (2).exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\RFQ-207480-PR-128311 (2).exe"C:\Users\Admin\AppData\Local\Temp\RFQ-207480-PR-128311 (2).exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\zQjffrliptxvamq.vbsMD5
570e1760047887d4773c02a7f0c0a9ef
SHA1ea36b58136c15c0c38ca496e5fd55e9de62073dc
SHA256c14774447472f5eec655d2046e6e4930b3bed4877de328d4f8a58416b7144db2
SHA512aeb14674534d2a4cc6d58fe733a4a6085d031f1a45ddad9e3e8fa312879b6cd8a1dff962529639b8ebea98d1ca8a9d42c0893d267696a70c7e9db696980b9ef3
-
\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
memory/360-100-0x0000000004800000-0x0000000004801000-memory.dmpFilesize
4KB
-
memory/360-109-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/360-134-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/360-133-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/360-119-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/360-118-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/360-117-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/360-110-0x0000000006100000-0x0000000006101000-memory.dmpFilesize
4KB
-
memory/360-104-0x0000000005690000-0x0000000005691000-memory.dmpFilesize
4KB
-
memory/360-101-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/360-99-0x0000000004872000-0x0000000004873000-memory.dmpFilesize
4KB
-
memory/360-98-0x0000000004870000-0x0000000004871000-memory.dmpFilesize
4KB
-
memory/360-96-0x00000000048B0000-0x00000000048B1000-memory.dmpFilesize
4KB
-
memory/360-93-0x0000000000000000-mapping.dmp
-
memory/360-95-0x00000000023A0000-0x00000000023A1000-memory.dmpFilesize
4KB
-
memory/420-73-0x0000000000000000-mapping.dmp
-
memory/472-86-0x0000000000000000-mapping.dmp
-
memory/732-83-0x0000000000000000-mapping.dmp
-
memory/788-63-0x00000000004C0000-0x00000000004FB000-memory.dmpFilesize
236KB
-
memory/788-62-0x0000000000380000-0x0000000000382000-memory.dmpFilesize
8KB
-
memory/788-60-0x0000000000D20000-0x0000000000D21000-memory.dmpFilesize
4KB
-
memory/788-64-0x0000000000530000-0x0000000000531000-memory.dmpFilesize
4KB
-
memory/1392-69-0x0000000075551000-0x0000000075553000-memory.dmpFilesize
8KB
-
memory/1392-67-0x0000000000000000-mapping.dmp
-
memory/1464-78-0x0000000000000000-mapping.dmp
-
memory/2036-89-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2036-91-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2036-90-0x000000000043761E-mapping.dmp
-
memory/2036-97-0x00000000046A0000-0x00000000046A1000-memory.dmpFilesize
4KB