Analysis
-
max time kernel
121s -
max time network
137s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
10-11-2021 10:30
Static task
static1
Behavioral task
behavioral1
Sample
http://61664282.capitalcampinas.com.br/#[email protected]
Resource
win10-en-20211104
General
-
Target
http://61664282.capitalcampinas.com.br/#[email protected]
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7D5DD99-446C-11EC-B34F-F6D3DA6824A5} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://www.facebook.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e9706a3ed6d701 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://login.aliexpress.com/" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "343319092" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url3 = 769f60673ed6d701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://61664282.capitalcampinas.com.br/#" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "http://61664282.capitalcampinas.com.br/#" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://signin.ebay.com/ws/ebayisapi.dll" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b5b008aa2024f4581a8e5e30df850c300000000020000000000106600000001000020000000009ed3e970629151f47a0d20f0fca68b9e28d94425ccb9c3505a658d42f41bd1000000000e8000000002000020000000f14fd395fe8c96e818b67f6b32e93c4a9af6228cebb66f2a02ea977780077dc520000000c2824de246af86979decde3950d6cfae18a71ac1d113c169d6841b08ebbfdc5240000000331364c7c915b8d331b665f5e433bf5be59a1d9b60e248314b1444b0fc2fcda83671e68210c14d753a96fa239d10fed8649d65a88a7fe2e1c53ae83fba9a1ea1 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b5b008aa2024f4581a8e5e30df850c300000000020000000000106600000001000020000000789df6f67923dc6fda0b41a1084d1f39a38d75629ce31a9066e1d2ee3ed10739000000000e80000000020000200000009222a96a9762ef477bd005941c786af65fc041512b14574043643bc55fd9800e20000000f6501771b2c02f009ce5a52b3c2d1775811a5d5384813789b36ae3208b40f03640000000741bbbc479dc6bf6d7903bba5038f6f0450ddae2cebd07bdd65c8259f17d29339bc48b1c9e539242ffd0018880232ad0cd7166748196a73a4e49fb6bf86ab643 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a04f056d3ed6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url6 = "https://login.live.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = 7eade16c3ed6d701 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://www.facebook.com/" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05ff9643ed6d701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 769f60673ed6d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLsTime iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://61664282.capitalcampinas.com.br/d" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "http://61664282.capitalcampinas.com.br/#" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b5b008aa2024f4581a8e5e30df850c30000000002000000000010660000000100002000000023916a040dad214784688b72f6bd95be9a50475e3060cb2ea7f66e65fdf5e759000000000e8000000002000020000000252787e3b708c28d03e0a58df9e1c479277841f34593ca9c34e57184585ca99220000000e1d93eb1cf34bd94f695fcbe903fc7c36aac6582a1544bbf1fbb9817c57060df400000004a4a6b6a62bbaf6b4fab5665b745714c193ea2abd49c6ed4f674932ecdea03ac48d6ed6c5faf3e3d71d43e2e3042424ccf97664c9275246c95c8f3f38826d703 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = 769f60673ed6d701 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url7 = "https://login.live.com/" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002b5b008aa2024f4581a8e5e30df850c300000000020000000000106600000001000020000000ed1b3fa83e38caa3e2d971dc705f6636972435ed0da03435e7428e15a98629f8000000000e8000000002000020000000e213af2e07ef0457cf112743398a78a3787a80d3eb8954681fef49b1006e1d66200000005ea066ce50fc6b2e85947f673aa478cd9581193b8fe99c0b161a604d0183158a40000000e829e1e48cd32c2a80eec6b41e4197740ddbea11841d062f1b42dfc8bdc467ce55a1e25c2cd24ca32b6c418b1458fa41489c7f3f679c1a384f616e94459885ff iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = a256416a3ed6d701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b37a673ed6d701 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://61664282.capitalcampinas.com.br/" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.aliexpress.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2003e4643ed6d701 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\TypedURLs\url8 = "https://twitter.com/" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2748 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2748 iexplore.exe 2748 iexplore.exe 404 IEXPLORE.EXE 404 IEXPLORE.EXE 404 IEXPLORE.EXE 404 IEXPLORE.EXE 2748 iexplore.exe 2748 iexplore.exe 2748 iexplore.exe 2748 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 2748 wrote to memory of 404 2748 iexplore.exe IEXPLORE.EXE PID 2748 wrote to memory of 404 2748 iexplore.exe IEXPLORE.EXE PID 2748 wrote to memory of 404 2748 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://61664282.capitalcampinas.com.br/#[email protected]1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\76JYIG75.cookieMD5
89009b8ddd0efd592d9ef206f3e72f8c
SHA1638f52e791828eb70bcd3a1bd298a761b947854b
SHA25623d94e92926c673e6bec8927813b960c9636e46fdba519ca46cdf15abfc0d3c9
SHA5126f82e53fbcb5dc3ef109301e38e128af584a065f2b8b87b12714e13a67c2b95d0a306df2825b0f91d62d8b744a23a9bdc74a96f187351a2f8a85bd01e0b0677b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\YKUFSYS1.cookieMD5
d6fa3b59b510e69d4d33c654410f19b7
SHA1dc9b4541c725bd0da43772214ce80295b955eee2
SHA256ba02b812fe61c480a120e48fc60b937065814bf46d061acd7e4e84242e7385ec
SHA512d7dceffc29888fa87e51d2f15302b80f1adaa97a435d7b13907f059bc54517d720303db22174c66710dcbaaa704f3cb199a1b21beb5ac37bc86ef199d4e72d95
-
memory/404-143-0x0000000000000000-mapping.dmp
-
memory/2748-145-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-130-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-150-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-125-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-126-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-127-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-128-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-147-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-131-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-132-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-134-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-135-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-148-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-138-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-139-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-140-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-141-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-122-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-144-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-118-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-136-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-123-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-124-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-152-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-153-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-154-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-158-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-159-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-160-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-166-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-167-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-168-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-169-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-170-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-171-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-172-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-176-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-177-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-181-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-182-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-120-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB
-
memory/2748-119-0x00007FFD64B00000-0x00007FFD64B6B000-memory.dmpFilesize
428KB