Analysis
-
max time kernel
121s -
max time network
133s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
11-10-2021 20:52
Static task
static1
URLScan task
urlscan1
Sample
https://protonmail14245.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkY2MDI2MjUuc2VsY2RuLnJ1JTJGbGlua3MlMkZvd2EtYXV0aGljYXRpb25tYW5hZ2VybmV3YWNodWtzLmh0bSUzRmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMkZjb21tb24lMkZvYXV0aDIlMkZ2Mi4wJTJGbG9nb3V0JTNGcG9zdF9sb2dvdXRfcmVkaXJlY3RfdXJpJTNEaHR0cHMlMjUzQSUyNTJGJTI1MkZ3d3cub2ZmaWNlLmNvbSUyNTJGJTI2c3RhdGUlM0RmaF85dm4zTUo3d2RYTTRCSjZpYl9YX2d0aWtQZ0tiOGF1QVMzRWcyNXVYcndHdDRqSDl5WGJpdUZ2VzMzSXVIa0ZEQ1lQM2R0NmhfRnNucWp2SlBoM21TOUJJSGxBT25YQlo0UVpZcGJsRnVTNmc1cEd1SGlWTkNzZ3VudVdISCUyNngtY2xpZW50LVNLVSUzRElEX05FVFNUQU5EQVJEMl8wJTI2eC1jbGllbnQtdmVyJTNENi4xMS4wLjA=&sig=BVwTv9igxH3LrZyY1GbGYLQfx6MQUQtCGAfVGsSAYvZo&iat=1633946508&a=477163247&account=protonmail14245%2Eactivehosted%2Ecom&email=pYSK1E%2F10CldpCu4Ef%2BzhwA3SuMkJhmkGexv49sZvNU%3D&s=bWFuYWdlbWVudHM5NjBAZ21haWwuY29t&i=1A3A1A5#Anslem.Obanor@etranzactng.com
Behavioral task
behavioral1
Sample
https://protonmail14245.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkY2MDI2MjUuc2VsY2RuLnJ1JTJGbGlua3MlMkZvd2EtYXV0aGljYXRpb25tYW5hZ2VybmV3YWNodWtzLmh0bSUzRmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMkZjb21tb24lMkZvYXV0aDIlMkZ2Mi4wJTJGbG9nb3V0JTNGcG9zdF9sb2dvdXRfcmVkaXJlY3RfdXJpJTNEaHR0cHMlMjUzQSUyNTJGJTI1MkZ3d3cub2ZmaWNlLmNvbSUyNTJGJTI2c3RhdGUlM0RmaF85dm4zTUo3d2RYTTRCSjZpYl9YX2d0aWtQZ0tiOGF1QVMzRWcyNXVYcndHdDRqSDl5WGJpdUZ2VzMzSXVIa0ZEQ1lQM2R0NmhfRnNucWp2SlBoM21TOUJJSGxBT25YQlo0UVpZcGJsRnVTNmc1cEd1SGlWTkNzZ3VudVdISCUyNngtY2xpZW50LVNLVSUzRElEX05FVFNUQU5EQVJEMl8wJTI2eC1jbGllbnQtdmVyJTNENi4xMS4wLjA=&sig=BVwTv9igxH3LrZyY1GbGYLQfx6MQUQtCGAfVGsSAYvZo&iat=1633946508&a=477163247&account=protonmail14245%2Eactivehosted%2Ecom&email=pYSK1E%2F10CldpCu4Ef%2BzhwA3SuMkJhmkGexv49sZvNU%3D&s=bWFuYWdlbWVudHM5NjBAZ21haWwuY29t&i=1A3A1A5#Anslem.Obanor@etranzactng.com
Resource
win10-en-20210920
General
-
Target
https://protonmail14245.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkY2MDI2MjUuc2VsY2RuLnJ1JTJGbGlua3MlMkZvd2EtYXV0aGljYXRpb25tYW5hZ2VybmV3YWNodWtzLmh0bSUzRmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMkZjb21tb24lMkZvYXV0aDIlMkZ2Mi4wJTJGbG9nb3V0JTNGcG9zdF9sb2dvdXRfcmVkaXJlY3RfdXJpJTNEaHR0cHMlMjUzQSUyNTJGJTI1MkZ3d3cub2ZmaWNlLmNvbSUyNTJGJTI2c3RhdGUlM0RmaF85dm4zTUo3d2RYTTRCSjZpYl9YX2d0aWtQZ0tiOGF1QVMzRWcyNXVYcndHdDRqSDl5WGJpdUZ2VzMzSXVIa0ZEQ1lQM2R0NmhfRnNucWp2SlBoM21TOUJJSGxBT25YQlo0UVpZcGJsRnVTNmc1cEd1SGlWTkNzZ3VudVdISCUyNngtY2xpZW50LVNLVSUzRElEX05FVFNUQU5EQVJEMl8wJTI2eC1jbGllbnQtdmVyJTNENi4xMS4wLjA=&sig=BVwTv9igxH3LrZyY1GbGYLQfx6MQUQtCGAfVGsSAYvZo&iat=1633946508&a=477163247&account=protonmail14245%2Eactivehosted%2Ecom&email=pYSK1E%2F10CldpCu4Ef%2BzhwA3SuMkJhmkGexv49sZvNU%3D&s=bWFuYWdlbWVudHM5NjBAZ21haWwuY29t&i=1A3A1A5#Anslem.Obanor@etranzactng.com
-
Sample
211011-znxeeaabc9
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A75DDDAE-2D30-11EC-AF2E-D6F6AE26EDF0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "340834929" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d00000000020000000000106600000001000020000000962d9e91f8331cc4b57473f59446c6dc522179c376d4c63c913b0112e7cd0c86000000000e8000000002000020000000d0ad5ec9938abbd6aa5acb42a5ca87c28c4845a8fe69bad00127a76b2518dd3b200000007eab9a954479266ac12b727a8762460f5cabcf2b47c3ebef79bc4a6301b7c7ac4000000092aa0d991cdf93893c1010cc761304ab704b6c631bc22212aafecb455aeb244dcfb5088f10d3069689ab43e0c2fb79da48514c1902aae254c65bf89e8c695473 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0571b6235bfd701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d00000000020000000000106600000001000020000000661337a4d1b9f0daa2802e0fd4714109cc0088c4f6ac0eaa07dc45255e8045f0000000000e80000000020000200000000a1865d8b6c8d9f442c709b9ca4966306e80abfc5d313a45932894680dd0574b20000000ad640d4fe6dcb3646ab41f1245d1f2a697d27fb5018d670556aedeb87b72eef34000000044d0a64c43ee58bf2a1fe47fb0dece465bc0d3ee6503bf954f1ea3bbd6d5534df0818478f2d935e115e92b4867ce37e71893e1b6105ebc1e50170f8a83723258 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6038466235bfd701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "340786343" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "340802938" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 3612 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3612 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3612 iexplore.exe 3612 iexplore.exe 4380 IEXPLORE.EXE 4380 IEXPLORE.EXE 4380 IEXPLORE.EXE 4380 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 3612 wrote to memory of 4380 3612 iexplore.exe IEXPLORE.EXE PID 3612 wrote to memory of 4380 3612 iexplore.exe IEXPLORE.EXE PID 3612 wrote to memory of 4380 3612 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://protonmail14245.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkY2MDI2MjUuc2VsY2RuLnJ1JTJGbGlua3MlMkZvd2EtYXV0aGljYXRpb25tYW5hZ2VybmV3YWNodWtzLmh0bSUzRmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20lMkZjb21tb24lMkZvYXV0aDIlMkZ2Mi4wJTJGbG9nb3V0JTNGcG9zdF9sb2dvdXRfcmVkaXJlY3RfdXJpJTNEaHR0cHMlMjUzQSUyNTJGJTI1MkZ3d3cub2ZmaWNlLmNvbSUyNTJGJTI2c3RhdGUlM0RmaF85dm4zTUo3d2RYTTRCSjZpYl9YX2d0aWtQZ0tiOGF1QVMzRWcyNXVYcndHdDRqSDl5WGJpdUZ2VzMzSXVIa0ZEQ1lQM2R0NmhfRnNucWp2SlBoM21TOUJJSGxBT25YQlo0UVpZcGJsRnVTNmc1cEd1SGlWTkNzZ3VudVdISCUyNngtY2xpZW50LVNLVSUzRElEX05FVFNUQU5EQVJEMl8wJTI2eC1jbGllbnQtdmVyJTNENi4xMS4wLjA=&sig=BVwTv9igxH3LrZyY1GbGYLQfx6MQUQtCGAfVGsSAYvZo&iat=1633946508&a=477163247&account=protonmail14245%2Eactivehosted%2Ecom&email=pYSK1E%2F10CldpCu4Ef%2BzhwA3SuMkJhmkGexv49sZvNU%3D&s=bWFuYWdlbWVudHM5NjBAZ21haWwuY29t&i=1A3A1A5#Anslem.Obanor@etranzactng.com1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3612 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\9ZPATWY6.cookieMD5
44584daf9e6d0482526d27d61b8d137c
SHA17cdece89717d4a865b86a78cb161df91fd992733
SHA256de97ddf17afdab24535e474a453bd0bb4eeef6662878014641c6601c0e6ddd1b
SHA5129eb15e60d44808fbc56b818e555a759c5eaba353b9de9b26e3618a8c02e122dec201f074ba1e3a2900b3062c0ae88ab26f965815cd74de2d3683d9db2dc37193
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\IFL1UQKO.cookieMD5
2eb5f0510b53feb5018bf1709371d230
SHA1621d10cd8271df610afb04770c93244a9e2375d5
SHA2569b72ef69f7d135e89f8155c26d7de3552f75c22194cf0683b12c6125b3fc8abb
SHA5127512b62e27c6413b808dbd7e1c87ec22265f57d46a9d82f14ca0faf768baa39e9a04dfb4e1867fd2ffeb3a9bcaa3bb24ed387473ca1a43bee99029e5530e5309
-
memory/3612-142-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-121-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-120-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-144-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-122-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-123-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-124-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-125-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-127-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-128-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-129-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-131-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-133-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-134-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-135-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-145-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-136-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-138-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-116-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-141-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-117-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-119-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-137-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-147-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-149-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-150-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-151-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-155-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-156-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-157-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-163-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-164-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-165-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-166-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-167-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-168-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-169-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-173-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-175-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-178-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-179-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/3612-115-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmpFilesize
428KB
-
memory/4380-140-0x0000000000000000-mapping.dmp