Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
10-11-2020 11:49
Static task
static1
Behavioral task
behavioral1
Sample
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe
Resource
win10v20201028
General
-
Target
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe
-
Size
354KB
-
MD5
77761a1080c4b0b32f59254414490f67
-
SHA1
6bc2da22ab25b8eee137cff621f970ac28deffe0
-
SHA256
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e
-
SHA512
48ee910e12c4b94346f99beecab7980be1bfc15c7637b4e0761f783aa57bf5fc44c9e7f090bcd48538f65911e3b3362578eeb6525a104c2484e1b54eec365d1d
Malware Config
Extracted
darkcomet
06-11-2020
LAMIA-41739.portmap.io:41739
karmina113.sytes.net:7777
karmina200.sytes.net:7777
DC_MUTEX-R9E2RDG
-
InstallPath
svchost\svchost.exe
-
gencode
dneJWn9fFTdt
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost\\svchost.exe" f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe -
Executes dropped EXE 2 IoCs
Processes:
svchost.exesvchost.exepid process 1464 svchost.exe 1864 svchost.exe -
Processes:
resource yara_rule behavioral1/memory/1508-4-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/1508-6-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/1508-7-0x0000000000400000-0x00000000004C7000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exesvchost.exepid process 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe 1464 svchost.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
svchost.exef6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exef6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost\\svchost.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe" f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost\\svchost.exe" f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exesvchost.exedescription pid process target process PID 1080 set thread context of 1508 1080 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe PID 1464 set thread context of 1864 1464 svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exesvchost.exedescription pid process Token: SeIncreaseQuotaPrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeSecurityPrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeTakeOwnershipPrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeLoadDriverPrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeSystemProfilePrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeSystemtimePrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeProfSingleProcessPrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeIncBasePriorityPrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeCreatePagefilePrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeBackupPrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeRestorePrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeShutdownPrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeDebugPrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeSystemEnvironmentPrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeChangeNotifyPrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeRemoteShutdownPrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeUndockPrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeManageVolumePrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeImpersonatePrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeCreateGlobalPrivilege 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: 33 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: 34 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: 35 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe Token: SeIncreaseQuotaPrivilege 1864 svchost.exe Token: SeSecurityPrivilege 1864 svchost.exe Token: SeTakeOwnershipPrivilege 1864 svchost.exe Token: SeLoadDriverPrivilege 1864 svchost.exe Token: SeSystemProfilePrivilege 1864 svchost.exe Token: SeSystemtimePrivilege 1864 svchost.exe Token: SeProfSingleProcessPrivilege 1864 svchost.exe Token: SeIncBasePriorityPrivilege 1864 svchost.exe Token: SeCreatePagefilePrivilege 1864 svchost.exe Token: SeBackupPrivilege 1864 svchost.exe Token: SeRestorePrivilege 1864 svchost.exe Token: SeShutdownPrivilege 1864 svchost.exe Token: SeDebugPrivilege 1864 svchost.exe Token: SeSystemEnvironmentPrivilege 1864 svchost.exe Token: SeChangeNotifyPrivilege 1864 svchost.exe Token: SeRemoteShutdownPrivilege 1864 svchost.exe Token: SeUndockPrivilege 1864 svchost.exe Token: SeManageVolumePrivilege 1864 svchost.exe Token: SeImpersonatePrivilege 1864 svchost.exe Token: SeCreateGlobalPrivilege 1864 svchost.exe Token: 33 1864 svchost.exe Token: 34 1864 svchost.exe Token: 35 1864 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svchost.exepid process 1864 svchost.exe -
Suspicious use of WriteProcessMemory 59 IoCs
Processes:
f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exef6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.execmd.execmd.exesvchost.exesvchost.exedescription pid process target process PID 1080 wrote to memory of 1508 1080 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe PID 1080 wrote to memory of 1508 1080 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe PID 1080 wrote to memory of 1508 1080 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe PID 1080 wrote to memory of 1508 1080 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe PID 1080 wrote to memory of 1508 1080 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe PID 1080 wrote to memory of 1508 1080 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe PID 1080 wrote to memory of 1508 1080 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe PID 1080 wrote to memory of 1508 1080 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe PID 1508 wrote to memory of 1580 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe cmd.exe PID 1508 wrote to memory of 1580 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe cmd.exe PID 1508 wrote to memory of 1580 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe cmd.exe PID 1508 wrote to memory of 1580 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe cmd.exe PID 1508 wrote to memory of 1668 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe cmd.exe PID 1508 wrote to memory of 1668 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe cmd.exe PID 1508 wrote to memory of 1668 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe cmd.exe PID 1508 wrote to memory of 1668 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe cmd.exe PID 1668 wrote to memory of 1324 1668 cmd.exe attrib.exe PID 1668 wrote to memory of 1324 1668 cmd.exe attrib.exe PID 1668 wrote to memory of 1324 1668 cmd.exe attrib.exe PID 1668 wrote to memory of 1324 1668 cmd.exe attrib.exe PID 1580 wrote to memory of 1112 1580 cmd.exe attrib.exe PID 1580 wrote to memory of 1112 1580 cmd.exe attrib.exe PID 1580 wrote to memory of 1112 1580 cmd.exe attrib.exe PID 1580 wrote to memory of 1112 1580 cmd.exe attrib.exe PID 1508 wrote to memory of 1464 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe svchost.exe PID 1508 wrote to memory of 1464 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe svchost.exe PID 1508 wrote to memory of 1464 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe svchost.exe PID 1508 wrote to memory of 1464 1508 f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe svchost.exe PID 1464 wrote to memory of 1864 1464 svchost.exe svchost.exe PID 1464 wrote to memory of 1864 1464 svchost.exe svchost.exe PID 1464 wrote to memory of 1864 1464 svchost.exe svchost.exe PID 1464 wrote to memory of 1864 1464 svchost.exe svchost.exe PID 1464 wrote to memory of 1864 1464 svchost.exe svchost.exe PID 1464 wrote to memory of 1864 1464 svchost.exe svchost.exe PID 1464 wrote to memory of 1864 1464 svchost.exe svchost.exe PID 1464 wrote to memory of 1864 1464 svchost.exe svchost.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe PID 1864 wrote to memory of 616 1864 svchost.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1324 attrib.exe 1112 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe"C:\Users\Admin\AppData\Local\Temp\f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe"C:\Users\Admin\AppData\Local\Temp\f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe"2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e.exe" +s +h4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exeMD5
77761a1080c4b0b32f59254414490f67
SHA16bc2da22ab25b8eee137cff621f970ac28deffe0
SHA256f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e
SHA51248ee910e12c4b94346f99beecab7980be1bfc15c7637b4e0761f783aa57bf5fc44c9e7f090bcd48538f65911e3b3362578eeb6525a104c2484e1b54eec365d1d
-
C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exeMD5
77761a1080c4b0b32f59254414490f67
SHA16bc2da22ab25b8eee137cff621f970ac28deffe0
SHA256f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e
SHA51248ee910e12c4b94346f99beecab7980be1bfc15c7637b4e0761f783aa57bf5fc44c9e7f090bcd48538f65911e3b3362578eeb6525a104c2484e1b54eec365d1d
-
C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exeMD5
77761a1080c4b0b32f59254414490f67
SHA16bc2da22ab25b8eee137cff621f970ac28deffe0
SHA256f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e
SHA51248ee910e12c4b94346f99beecab7980be1bfc15c7637b4e0761f783aa57bf5fc44c9e7f090bcd48538f65911e3b3362578eeb6525a104c2484e1b54eec365d1d
-
\Users\Admin\AppData\Local\Temp\svchost\svchost.exeMD5
77761a1080c4b0b32f59254414490f67
SHA16bc2da22ab25b8eee137cff621f970ac28deffe0
SHA256f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e
SHA51248ee910e12c4b94346f99beecab7980be1bfc15c7637b4e0761f783aa57bf5fc44c9e7f090bcd48538f65911e3b3362578eeb6525a104c2484e1b54eec365d1d
-
\Users\Admin\AppData\Local\Temp\svchost\svchost.exeMD5
77761a1080c4b0b32f59254414490f67
SHA16bc2da22ab25b8eee137cff621f970ac28deffe0
SHA256f6cad4b6b0fba341834bc45e9581befaba5db61c6fa5ec450342f0515c4e754e
SHA51248ee910e12c4b94346f99beecab7980be1bfc15c7637b4e0761f783aa57bf5fc44c9e7f090bcd48538f65911e3b3362578eeb6525a104c2484e1b54eec365d1d
-
memory/616-28-0x0000000000000000-mapping.dmp
-
memory/616-26-0x0000000000000000-mapping.dmp
-
memory/616-27-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1080-0-0x0000000074710000-0x0000000074DFE000-memory.dmpFilesize
6.9MB
-
memory/1080-3-0x00000000001D0000-0x00000000001D3000-memory.dmpFilesize
12KB
-
memory/1080-1-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/1112-11-0x0000000000000000-mapping.dmp
-
memory/1324-10-0x0000000000000000-mapping.dmp
-
memory/1464-16-0x0000000072570000-0x0000000072C5E000-memory.dmpFilesize
6.9MB
-
memory/1464-13-0x0000000000000000-mapping.dmp
-
memory/1464-17-0x0000000000F50000-0x0000000000F51000-memory.dmpFilesize
4KB
-
memory/1508-7-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1508-6-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1508-5-0x00000000004BD830-mapping.dmp
-
memory/1508-4-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1580-8-0x0000000000000000-mapping.dmp
-
memory/1668-9-0x0000000000000000-mapping.dmp
-
memory/1864-22-0x00000000004BD830-mapping.dmp