Analysis
-
max time kernel
192s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 14:59
Static task
static1
Behavioral task
behavioral1
Sample
c9d1bc0e756f1f7c29b37a064ab8417c60d571e27ecadeddcc148a666866d16d.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c9d1bc0e756f1f7c29b37a064ab8417c60d571e27ecadeddcc148a666866d16d.dll
Resource
win10v2004-20220812-en
General
-
Target
c9d1bc0e756f1f7c29b37a064ab8417c60d571e27ecadeddcc148a666866d16d.dll
-
Size
1.6MB
-
MD5
98c58fe0e02ab8581e799c1d6079255b
-
SHA1
068ab045b368186ca7e88e1ee1d79e75cb06cafd
-
SHA256
c9d1bc0e756f1f7c29b37a064ab8417c60d571e27ecadeddcc148a666866d16d
-
SHA512
e729e7c7b79042982f5d9372f885c0df5c0f3ef3846586346dd95d452e9f55c088b1d3bfde904afec4b2d4be51ce8798a5ae7346b0fabaedbc854b90947c3723
-
SSDEEP
49152:uDxcv/FexHPvHFHmq8CMpPw/N+nb9qspRY:ulcoxHnHpmq7Sb9qsR
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
rundll32.exeflow pid process 19 4308 rundll32.exe 20 4308 rundll32.exe 21 4308 rundll32.exe 30 4308 rundll32.exe -
Modifies AppInit DLL entries 2 TTPs
-
Loads dropped DLL 4 IoCs
Processes:
rundll32.exerundll32.exepid process 2836 rundll32.exe 2972 rundll32.exe 2972 rundll32.exe 2972 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Program Files (x86)\IncludeProc\IncludeProc.dll rundll32.exe -
Modifies data under HKEY_USERS 53 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\340d3099 = "/P////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\e8f9dcc7 = "UlAr/XJ/c//k////" rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\iiid = "1" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\72758a5d = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\bbf88800 = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\c5705860 = "Vx////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\d94388d2 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\e46c271e = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\8b9e4cbc = "V/////%%" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\00000000\3efeb33e = 00000000 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\1c311243 = "GxAp/X2/FPAm/X6/FlAu/XD/ax/j/Xt/axAv/X6////%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\2d71d5ab = "V/////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\37b7a6d8 = "UlAr/XJ/c//k////" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\65114b36 = "VP/l////" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\f1f24e29 = "Vl/l/C/////%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\0e93c3f3 = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\7f69fa1f = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\a0743acc = "N/////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\c99a5f5c = "///%" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\00000000\370856c7 = 00000000 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\0c230bcb = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\a2e3b941 = "///%" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\00000000 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\f2c53c49 = "UlAr/XJ/c//k////" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA} rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\060df2cd = "GlAu/YP/c/Au/YZ/GxAp/YZ/GP/j/Xt/axAv/X6////%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\1520c6f1 = "V/////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\27ddcf6f = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\48bd1aff = "V/////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\6185d035 = "Vx/2/Cx/V//l////" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\414bc593 = "///%" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\00000000 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\0dc3ee96 = "/P////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\2e22d94e = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\3c09c42b = "///%" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\f6ad6fa6 = "V/////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\38583bc3 = "Ml/2/CF/M//g/CZ////%" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\f0bf0bde = "///%" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\00000000\a47da861 = 6f00300031004f0030003700780030006d00300030004b003000320045003000610055003100670030003600450030006e006c0031004f0030003600740030006a00300031004f00300036004f0030006d0055003100670030003200490030006f0078003100530030003600710030006e0055003000540030003700740030006e006c003100440030003600490030006d00550031004f0030003600340030006e00300031005900300032004500300000006f00300031004f0030003700780030006d00300030004b003000320045003000610055003100670030003600450030006e006c0031004f0030003600740030006a00300031004f00300036004f0030006d0055003100670030003200490030006f007800310053003000320045003000690078003100530030003600680030006e006c0031004e00300037007800300071007800310059003000360055003000610055003000250000006f00300031004f0030003700780030006d00300030004b003000320045003000610055003100590030003600450030006d006c003100680030003600340030006d006c0031004f0030003700380030007000780031004e0030003600450030006900780031004d0030003600620030007000780031004e0030003200490030006f0078003100530030003600710030006e0055003000540030003700740030006e006c003100440030003600490030006d00550031004f0030003600340030006e00300031005900300032004500300000006f00300031004f0030003700780030006d00300030004b003000320045003000610055003100590030003600450030006d006c003100680030003600340030006d006c0031004f0030003700380030007000780031004e0030003600450030006900780031004d0030003600620030007000780031004e0030003200490030006f007800310053003000320045003000690078003100530030003600680030006e006c0031004e00300037007800300071007800310059003000360055003000610055003000250000006f00300031004f0030003700780030006d00300030004b003000320045003000610055003100680030003600680030006d006c0031002b003000360062003000690030003100550030003600340030006d006c0031004e0030003600740030006d006c003000530030003600680030006e006c003000540030003700740030006e006c003100440030003600490030006d00550031004f0030003600340030006e00300031005900300032004500300000006f00300031004f0030003700780030006d00300030004b003000320045003000610055003100680030003600680030006d006c0031002b003000360062003000690030003100550030003600340030006d006c0031004e0030003600740030006d006c003000530030003600680030006e006c00310041003000360045003000610055003100500030003600490030006f007800310053003000370062003000690030003100650030003600550030006e00300030005400300030002500250000006f00300031004f0030003700780030006d00300030004b003000320045003000610055003100410030003600680030006e006c0031002b00300036007800300071006c003100440030003700780030006d0030003100540030003700620030006f00780031004f0030003600680030006e0055003100530030003200490030006f007800310053003000320045003000690078003100530030003600680030006e006c0031004e00300037007800300071007800310059003000360055003000610055003000250000006f00300031004f0030003700780030006d00300030004b003000320045003000610055003100440030003600490030006d00550031004f0030003600340030006e006c003100670030003600740030006900550031004d0030003600340030006d0030003000530030003600490030007000780031004f003000320045003000690078003100530030003600680030006e006c0031004e00300037007800300071007800310059003000360055003000610055003000250000006f00300031004f0030003700780030006d00300030004b003000320045003000610055003100670030003600450030006e006c0031004f0030003600740030006a00300031004f0030003600550030006f00780031004e00300037007800300061006c0031004400300036004900300070006c00310054003000320045003000690078003100530030003600680030006e006c0031004e00300037007800300071007800310059003000360055003000610055003000250000006f00300031004f0030003700780030006d00300030004b003000320045003000610055003100670030003600450030006e006c0031004f0030003600740030006a00300031004f0030003600550030006f00780031004e00300037007800300061006c00310053003000360074003000690030003000540030003700740030006e006c003100440030003600490030006d00550031004f0030003600340030006e00300031005900300032004500300000000000 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\7367429f = "///%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\a1dcff5b = "V/////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\51d2f2ea = "RPAj/XV/a/A+/XP/GPAP/YZ/alAs////" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\c24899a6 = "VP/g/CV/Vl/2/Cx////%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\c6c5dd44 = "V/////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\587b5709 = "V/////%%" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\00000000\493c7345 = 6d0030003100650030003700380030006d00550031002b0030003700380030006d00550031002b00300036003400300061006c0031004400300036004900300070006c00310054003000300025002500000070006c00310044003000360049003000710078003100590030003600450030007100550031002b0030003600340030006e006c003000530030003600620030006e00550031005a00300030002500250000000000 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\fe94ce1e = "V/////%%" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_18f5616d\eae10f9d\d1abcdb6 = "///%" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
rundll32.exerundll32.exepid process 4308 rundll32.exe 4308 rundll32.exe 4308 rundll32.exe 4308 rundll32.exe 4308 rundll32.exe 4308 rundll32.exe 4308 rundll32.exe 4308 rundll32.exe 2972 rundll32.exe 2972 rundll32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
rundll32.exerundll32.exerundll32.exedescription pid process target process PID 1300 wrote to memory of 4308 1300 rundll32.exe rundll32.exe PID 1300 wrote to memory of 4308 1300 rundll32.exe rundll32.exe PID 1300 wrote to memory of 4308 1300 rundll32.exe rundll32.exe PID 4308 wrote to memory of 2836 4308 rundll32.exe rundll32.exe PID 4308 wrote to memory of 2836 4308 rundll32.exe rundll32.exe PID 4308 wrote to memory of 2836 4308 rundll32.exe rundll32.exe PID 4332 wrote to memory of 2972 4332 rundll32.exe rundll32.exe PID 4332 wrote to memory of 2972 4332 rundll32.exe rundll32.exe PID 4332 wrote to memory of 2972 4332 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c9d1bc0e756f1f7c29b37a064ab8417c60d571e27ecadeddcc148a666866d16d.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c9d1bc0e756f1f7c29b37a064ab8417c60d571e27ecadeddcc148a666866d16d.dll,#12⤵
- Blocklisted process makes network request
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\IncludeProc\IncludeProc.dll",serv -install3⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\IncludeProc\IncludeProc.dll",serv1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\IncludeProc\IncludeProc.dll",serv2⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\IncludeProc\IncludeProc.dllFilesize
1.6MB
MD598c58fe0e02ab8581e799c1d6079255b
SHA1068ab045b368186ca7e88e1ee1d79e75cb06cafd
SHA256c9d1bc0e756f1f7c29b37a064ab8417c60d571e27ecadeddcc148a666866d16d
SHA512e729e7c7b79042982f5d9372f885c0df5c0f3ef3846586346dd95d452e9f55c088b1d3bfde904afec4b2d4be51ce8798a5ae7346b0fabaedbc854b90947c3723
-
C:\Program Files (x86)\IncludeProc\IncludeProc.dllFilesize
1.6MB
MD598c58fe0e02ab8581e799c1d6079255b
SHA1068ab045b368186ca7e88e1ee1d79e75cb06cafd
SHA256c9d1bc0e756f1f7c29b37a064ab8417c60d571e27ecadeddcc148a666866d16d
SHA512e729e7c7b79042982f5d9372f885c0df5c0f3ef3846586346dd95d452e9f55c088b1d3bfde904afec4b2d4be51ce8798a5ae7346b0fabaedbc854b90947c3723
-
C:\Program Files (x86)\IncludeProc\IncludeProc.dllFilesize
1.6MB
MD598c58fe0e02ab8581e799c1d6079255b
SHA1068ab045b368186ca7e88e1ee1d79e75cb06cafd
SHA256c9d1bc0e756f1f7c29b37a064ab8417c60d571e27ecadeddcc148a666866d16d
SHA512e729e7c7b79042982f5d9372f885c0df5c0f3ef3846586346dd95d452e9f55c088b1d3bfde904afec4b2d4be51ce8798a5ae7346b0fabaedbc854b90947c3723
-
C:\Program Files (x86)\IncludeProc\IncludeProc.dllFilesize
1.6MB
MD598c58fe0e02ab8581e799c1d6079255b
SHA1068ab045b368186ca7e88e1ee1d79e75cb06cafd
SHA256c9d1bc0e756f1f7c29b37a064ab8417c60d571e27ecadeddcc148a666866d16d
SHA512e729e7c7b79042982f5d9372f885c0df5c0f3ef3846586346dd95d452e9f55c088b1d3bfde904afec4b2d4be51ce8798a5ae7346b0fabaedbc854b90947c3723
-
\??\c:\Program Files (x86)\IncludeProc\IncludeProc.dllFilesize
1.6MB
MD598c58fe0e02ab8581e799c1d6079255b
SHA1068ab045b368186ca7e88e1ee1d79e75cb06cafd
SHA256c9d1bc0e756f1f7c29b37a064ab8417c60d571e27ecadeddcc148a666866d16d
SHA512e729e7c7b79042982f5d9372f885c0df5c0f3ef3846586346dd95d452e9f55c088b1d3bfde904afec4b2d4be51ce8798a5ae7346b0fabaedbc854b90947c3723
-
memory/2836-138-0x0000000000000000-mapping.dmp
-
memory/2836-141-0x000000007F660000-0x000000007F9B8000-memory.dmpFilesize
3.3MB
-
memory/2972-146-0x0000000000000000-mapping.dmp
-
memory/2972-148-0x000000007F5B0000-0x000000007F908000-memory.dmpFilesize
3.3MB
-
memory/4308-132-0x0000000000000000-mapping.dmp
-
memory/4308-133-0x000000007EC10000-0x000000007EF68000-memory.dmpFilesize
3.3MB