Overview
overview
10Static
static
3Loader/Ant...sabler
windows10-1703-x64
1Loader/Gam...Inject
windows10-1703-x64
1Loader/Gam...meMenu
windows10-1703-x64
1Loader/Gam...Status
windows10-1703-x64
1Loader/GameDetect
windows10-1703-x64
1Loader/Launcher.dll
windows10-1703-x64
1Loader/Loader.exe
windows10-1703-x64
10Loader/Upd...pdater
windows10-1703-x64
1Loader/Upd...eb.xml
windows10-1703-x64
1Loader/config
windows10-1703-x64
1Loader/mainf.dll
windows10-1703-x64
1Loader/mco...ig.xml
windows10-1703-x64
1Analysis
-
max time kernel
134s -
max time network
142s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
15-06-2024 19:50
Static task
static1
Behavioral task
behavioral1
Sample
Loader/AntiCheatDisabler
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Loader/GameCheck/GameInject
Resource
win10-20240611-en
Behavioral task
behavioral3
Sample
Loader/GameCheck/GameMenu
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Loader/GameCheck/GameStatus
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
Loader/GameDetect
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
Loader/Launcher.dll
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
Loader/Loader.exe
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
Loader/Updater/Updater
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
Loader/Updater/web.xml
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
Loader/config
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
Loader/mainf.dll
Resource
win10-20240611-en
Behavioral task
behavioral12
Sample
Loader/mconfig/config.xml
Resource
win10-20240404-en
General
-
Target
Loader/mconfig/config.xml
-
Size
25KB
-
MD5
f34b330f20dce1bdcce9058fca287099
-
SHA1
936520d5bb5c00a1985d7a4c4f0ef763a9031862
-
SHA256
0c56e34c69124510fa8c19e7b4c2ca6c1c4ff460ae19f798dd0ca035809e396d
-
SHA512
d6d4a8321eb44c117755a41a2590296be86a0568d27a5347f9d7f32f2d151d8f7e169675c83faed2dab5ad0f8d81858f8cd1167e439cd4bff7e68c243e3544fd
-
SSDEEP
192:Bt074zTxASaKp3T7pJsPpPT8B13eeaVonGdEBMmhVbeyeTfWDBzmAwdavahmhNIa:LAMDp35JyPCCu96yJwgag
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31113053" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000397fb53428fc2248832c3f5980ef467100000000020000000000106600000001000020000000f29328257c7f03746d61d91c1619b01e3b0ece5e12da9af51737540f4e77892b000000000e800000000200002000000004e3af2dddb6c33a79410af456210ca4931e012b1fc34fd71b04cb6039a94240200000005833e4ae3c14a5d84ce495cbbb53cd1bb1bc520a6424f29d7879f06fa0d53c8740000000042dce0add5b7c7d4b25d3933d4e1be4df3035f1e2615f07c310c11dffa46023112f9b7a100bb6d6ff70baa53b3ec898aca8701971bd4af416550a69eea6d0e8 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1652258764" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425246019" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1651477758" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e7af625dbfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1651477758" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31113053" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1652258764" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "425294604" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "425262613" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Key created \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8DD18CDB-2B50-11EF-ABE2-D654E02D47C9} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000397fb53428fc2248832c3f5980ef467100000000020000000000106600000001000020000000b9e1401446ab69a49f7ddc41db10f4a51c1c68d47407edbe83e23c25b1b35c0f000000000e80000000020000200000009e3bdf08c6bd9d4a443ef4c69144184849455e38b9e9740d37a651fe5b7d2a7620000000cd1d51655d5769331d8bf27eb472f83b1e86281123e6876ddd04f73b298e5030400000003b188cac6c62a01f6f0dfc0864602e394a1f802e27b23a6f3eb4f4da1f90ee6d2f331d20669c1a14e697eddc342b5a0ea52972716bd36f3df15501f2cb23d3e6 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31113053" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31113053" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d005ab625dbfda01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4624 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4624 iexplore.exe 4624 iexplore.exe 3136 IEXPLORE.EXE 3136 IEXPLORE.EXE 3136 IEXPLORE.EXE 3136 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
MSOXMLED.EXEiexplore.exedescription pid process target process PID 1204 wrote to memory of 4624 1204 MSOXMLED.EXE iexplore.exe PID 1204 wrote to memory of 4624 1204 MSOXMLED.EXE iexplore.exe PID 4624 wrote to memory of 3136 4624 iexplore.exe IEXPLORE.EXE PID 4624 wrote to memory of 3136 4624 iexplore.exe IEXPLORE.EXE PID 4624 wrote to memory of 3136 4624 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Loader\mconfig\config.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Loader\mconfig\config.xml2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4624 CREDAT:82945 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157Filesize
4KB
MD51bfe591a4fe3d91b03cdf26eaacd8f89
SHA1719c37c320f518ac168c86723724891950911cea
SHA2569cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA51202f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5353d80880163e69df5b6056bd95c4c32
SHA178d105b9d4a87648135886f68ee548b8c3773e7f
SHA256ebf1cf4b34ac839f419ca2cd197cac7935facf09ce3fb9b2ea56473adfa2e1d1
SHA5126854a476e104ce370e7f1fc41ac5cc8415373fd46d1aa170104c303780903e1e24d5352ee91b0a551366bb33304bedcb60ad0e0168cfbc2e8ede5ab4a5915b0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157Filesize
338B
MD576859dcb6a2dcb201a7871bd4dff1dde
SHA11e3aa6d6759463a51a31ba3dfa75a09dbad4af1e
SHA256777726a5b269b0bd5235a7948d6bce1db84fc6f21179a7c071b3f1afed5ff0bf
SHA51219919531f477b7ad7140c9bfb352ad9cb2d70fa2875620c2e2e8093e81e08ebe8c93e28f78598db50dc3ee1c7f8f7d8b1c751e615550320c17b22f047b412ce9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD511931147cacf6860cbcad91d5ffb9a89
SHA19fe13d9cbc6decd5a825ae3654cbc66f0d7a2484
SHA256dc67737579039f54038bd41c79498b44372acda11abf385a38bda3627a20dae0
SHA512f8d9333cd6d73c7f7712e87aa1a546ffbade6f4abd2b2b5da76758b802dda2a75bf170fe5455097e1903f8439e3167b9a233e1d80e01088976b9e86b85fdec44
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verDACF.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TBE3XFIK\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\RAAJR8XT.cookieFilesize
541B
MD53ff4c8cef369b80babf75ab67a9f15bc
SHA125bca3cd837ad1313d51e830e6c52916a6b8b194
SHA256019094c2927f5f36ce8186c64dd14428d427be712b2a0e54ccf66193e2e6984a
SHA5123394bb06c685b70f013a13e9d32284dcbc7168bf169a99f57979b089ce968fbc9e10d9be2261fad9fb57c07b1579a22b946456cb52b14718914652165bd063fe
-
memory/1204-13-0x00007FFACC1F0000-0x00007FFACC3CB000-memory.dmpFilesize
1.9MB
-
memory/1204-18-0x00007FFACC1F0000-0x00007FFACC3CB000-memory.dmpFilesize
1.9MB
-
memory/1204-8-0x00007FFACC1F0000-0x00007FFACC3CB000-memory.dmpFilesize
1.9MB
-
memory/1204-10-0x00007FFACC1F0000-0x00007FFACC3CB000-memory.dmpFilesize
1.9MB
-
memory/1204-11-0x00007FFACC1F0000-0x00007FFACC3CB000-memory.dmpFilesize
1.9MB
-
memory/1204-0-0x00007FFA8C280000-0x00007FFA8C290000-memory.dmpFilesize
64KB
-
memory/1204-12-0x00007FFACC1F0000-0x00007FFACC3CB000-memory.dmpFilesize
1.9MB
-
memory/1204-17-0x00007FFA8C280000-0x00007FFA8C290000-memory.dmpFilesize
64KB
-
memory/1204-16-0x00007FFA8C280000-0x00007FFA8C290000-memory.dmpFilesize
64KB
-
memory/1204-9-0x00007FFACC1F0000-0x00007FFACC3CB000-memory.dmpFilesize
1.9MB
-
memory/1204-15-0x00007FFA8C280000-0x00007FFA8C290000-memory.dmpFilesize
64KB
-
memory/1204-14-0x00007FFA8C280000-0x00007FFA8C290000-memory.dmpFilesize
64KB
-
memory/1204-5-0x00007FFACC1F0000-0x00007FFACC3CB000-memory.dmpFilesize
1.9MB
-
memory/1204-6-0x00007FFA8C280000-0x00007FFA8C290000-memory.dmpFilesize
64KB
-
memory/1204-7-0x00007FFACC1F0000-0x00007FFACC3CB000-memory.dmpFilesize
1.9MB
-
memory/1204-2-0x00007FFA8C280000-0x00007FFA8C290000-memory.dmpFilesize
64KB
-
memory/1204-4-0x00007FFACC1F0000-0x00007FFACC3CB000-memory.dmpFilesize
1.9MB
-
memory/1204-1-0x00007FFACC295000-0x00007FFACC296000-memory.dmpFilesize
4KB
-
memory/1204-3-0x00007FFA8C280000-0x00007FFA8C290000-memory.dmpFilesize
64KB