Analysis
-
max time kernel
148s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
01-08-2022 06:46
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Variant.Zusy.434746.7045.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Variant.Zusy.434746.7045.exe
Resource
win10v2004-20220721-en
General
-
Target
SecuriteInfo.com.Variant.Zusy.434746.7045.exe
-
Size
797KB
-
MD5
2dcd18054977a85a30fb329b710e981d
-
SHA1
530a090ae3c4b382b141e7609bd0ea1d08cc9f3c
-
SHA256
cba6785969467c94bedde7b14cfe32911fe3f1beb4cfda7abcad657477076562
-
SHA512
c1d631eb4462f20867c66ff28369fab866de023b2680fd83a95aa3e35ab156ddcdcdbe955336a8711d35cb4d5dd31bc0235726656d18c23f234c126e8c60bb40
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 45 IoCs
Processes:
resource yara_rule behavioral1/memory/1476-57-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-59-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-60-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-63-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-62-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-61-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-64-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-68-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-67-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-66-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-65-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-69-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-72-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-71-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-70-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-73-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-74-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-75-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-77-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-76-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-78-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-79-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-96-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-97-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-98-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-99-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-100-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-101-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-102-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-103-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-104-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-105-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-106-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-107-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-108-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-109-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-111-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-113-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-115-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-116-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-114-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-117-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-118-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1476-119-0x0000000003B90000-0x0000000003C2C000-memory.dmp modiloader_stage2 behavioral1/memory/1132-120-0x0000000001F80000-0x00000000020DC000-memory.dmp modiloader_stage2 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SecuriteInfo.com.Variant.Zusy.434746.7045.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Run\Encbbb = "C:\\Users\\Public\\Libraries\\bbbcnE.url" SecuriteInfo.com.Variant.Zusy.434746.7045.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
cleanmgr.exedescription ioc process File opened (read-only) \??\F: cleanmgr.exe File opened (read-only) \??\G: cleanmgr.exe File opened (read-only) \??\K: cleanmgr.exe File opened (read-only) \??\V: cleanmgr.exe File opened (read-only) \??\W: cleanmgr.exe File opened (read-only) \??\B: cleanmgr.exe File opened (read-only) \??\L: cleanmgr.exe File opened (read-only) \??\P: cleanmgr.exe File opened (read-only) \??\T: cleanmgr.exe File opened (read-only) \??\U: cleanmgr.exe File opened (read-only) \??\Y: cleanmgr.exe File opened (read-only) \??\Z: cleanmgr.exe File opened (read-only) \??\J: cleanmgr.exe File opened (read-only) \??\Q: cleanmgr.exe File opened (read-only) \??\E: cleanmgr.exe File opened (read-only) \??\H: cleanmgr.exe File opened (read-only) \??\I: cleanmgr.exe File opened (read-only) \??\M: cleanmgr.exe File opened (read-only) \??\N: cleanmgr.exe File opened (read-only) \??\O: cleanmgr.exe File opened (read-only) \??\R: cleanmgr.exe File opened (read-only) \??\S: cleanmgr.exe File opened (read-only) \??\A: cleanmgr.exe File opened (read-only) \??\X: cleanmgr.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cleanmgr.exewlanext.exedescription pid process target process PID 1132 set thread context of 1432 1132 cleanmgr.exe Explorer.EXE PID 1832 set thread context of 1432 1832 wlanext.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
SecuriteInfo.com.Variant.Zusy.434746.7045.execleanmgr.exewlanext.exepowershell.exepid process 1476 SecuriteInfo.com.Variant.Zusy.434746.7045.exe 1132 cleanmgr.exe 1132 cleanmgr.exe 1132 cleanmgr.exe 1132 cleanmgr.exe 1832 wlanext.exe 1832 wlanext.exe 1448 powershell.exe 1832 wlanext.exe 1832 wlanext.exe 1832 wlanext.exe 1832 wlanext.exe 1832 wlanext.exe 1832 wlanext.exe 1832 wlanext.exe 1832 wlanext.exe 1832 wlanext.exe 1832 wlanext.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
cleanmgr.exewlanext.exepid process 1132 cleanmgr.exe 1132 cleanmgr.exe 1132 cleanmgr.exe 1832 wlanext.exe 1832 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
cleanmgr.exewlanext.exepowershell.exedescription pid process Token: SeDebugPrivilege 1132 cleanmgr.exe Token: SeDebugPrivilege 1832 wlanext.exe Token: SeDebugPrivilege 1448 powershell.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
SecuriteInfo.com.Variant.Zusy.434746.7045.execmd.execmd.exenet.exeExplorer.EXEdescription pid process target process PID 1476 wrote to memory of 1556 1476 SecuriteInfo.com.Variant.Zusy.434746.7045.exe cmd.exe PID 1476 wrote to memory of 1556 1476 SecuriteInfo.com.Variant.Zusy.434746.7045.exe cmd.exe PID 1476 wrote to memory of 1556 1476 SecuriteInfo.com.Variant.Zusy.434746.7045.exe cmd.exe PID 1476 wrote to memory of 1556 1476 SecuriteInfo.com.Variant.Zusy.434746.7045.exe cmd.exe PID 1556 wrote to memory of 1496 1556 cmd.exe cmd.exe PID 1556 wrote to memory of 1496 1556 cmd.exe cmd.exe PID 1556 wrote to memory of 1496 1556 cmd.exe cmd.exe PID 1556 wrote to memory of 1496 1556 cmd.exe cmd.exe PID 1496 wrote to memory of 1328 1496 cmd.exe net.exe PID 1496 wrote to memory of 1328 1496 cmd.exe net.exe PID 1496 wrote to memory of 1328 1496 cmd.exe net.exe PID 1496 wrote to memory of 1328 1496 cmd.exe net.exe PID 1328 wrote to memory of 1992 1328 net.exe net1.exe PID 1328 wrote to memory of 1992 1328 net.exe net1.exe PID 1328 wrote to memory of 1992 1328 net.exe net1.exe PID 1328 wrote to memory of 1992 1328 net.exe net1.exe PID 1496 wrote to memory of 1448 1496 cmd.exe powershell.exe PID 1496 wrote to memory of 1448 1496 cmd.exe powershell.exe PID 1496 wrote to memory of 1448 1496 cmd.exe powershell.exe PID 1496 wrote to memory of 1448 1496 cmd.exe powershell.exe PID 1476 wrote to memory of 1132 1476 SecuriteInfo.com.Variant.Zusy.434746.7045.exe cleanmgr.exe PID 1476 wrote to memory of 1132 1476 SecuriteInfo.com.Variant.Zusy.434746.7045.exe cleanmgr.exe PID 1476 wrote to memory of 1132 1476 SecuriteInfo.com.Variant.Zusy.434746.7045.exe cleanmgr.exe PID 1476 wrote to memory of 1132 1476 SecuriteInfo.com.Variant.Zusy.434746.7045.exe cleanmgr.exe PID 1476 wrote to memory of 1132 1476 SecuriteInfo.com.Variant.Zusy.434746.7045.exe cleanmgr.exe PID 1476 wrote to memory of 1132 1476 SecuriteInfo.com.Variant.Zusy.434746.7045.exe cleanmgr.exe PID 1476 wrote to memory of 1132 1476 SecuriteInfo.com.Variant.Zusy.434746.7045.exe cleanmgr.exe PID 1432 wrote to memory of 1832 1432 Explorer.EXE wlanext.exe PID 1432 wrote to memory of 1832 1432 Explorer.EXE wlanext.exe PID 1432 wrote to memory of 1832 1432 Explorer.EXE wlanext.exe PID 1432 wrote to memory of 1832 1432 Explorer.EXE wlanext.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.434746.7045.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.434746.7045.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Public\Libraries\Encbbbt.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\Libraries\EncbbbO.bat4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet session5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cleanmgr.exe"C:\Windows\System32\cleanmgr.exe"3⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Libraries\Cdex.batFilesize
155B
MD5213c60adf1c9ef88dc3c9b2d579959d2
SHA1e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021
SHA25637c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e
SHA512fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7
-
C:\Users\Public\Libraries\EncbbbO.batFilesize
1KB
MD5df48c09f243ebcc8a165f77a1c2bf889
SHA1455f7db0adcc2a58d006f1630fb0bd55cd868c07
SHA2564ef9821678da07138c19405387f3fb95e409fbd461c7b8d847c05075facd63ca
SHA512735838c7cca953697ded48adfcd037b7f198072a8962f5940ce12e1bb1c7dd8c1f257a829276f5f5456f776f5bd13342222dd6e0dfc8f18a23f464f2c8d8f1cc
-
C:\Users\Public\Libraries\Encbbbt.batFilesize
55B
MD5f48272a1226b1c61776990037f92db33
SHA1a51c08cd09d18478ba5191d14ad66f2768d256c8
SHA256221ebeebded52cee8eb2615f3b4a4de1c2f3d0120fa57f2cc1e39016bfa47a0a
SHA5125cc6d80b56bf59f55d34b179e868a38c708e7644dcb7a51752fc31bdae4dd8f0b34b8fdc8df45341908525530ef48d90c517ebdd9720565140028e6a7a318a77
-
memory/1132-123-0x0000000050480000-0x00000000504AD000-memory.dmpFilesize
180KB
-
memory/1132-120-0x0000000001F80000-0x00000000020DC000-memory.dmpFilesize
1.4MB
-
memory/1132-112-0x0000000003580000-0x0000000003883000-memory.dmpFilesize
3.0MB
-
memory/1132-94-0x0000000050480000-0x00000000504AD000-memory.dmpFilesize
180KB
-
memory/1132-90-0x0000000000000000-mapping.dmp
-
memory/1328-84-0x0000000000000000-mapping.dmp
-
memory/1432-131-0x0000000007290000-0x0000000007400000-memory.dmpFilesize
1.4MB
-
memory/1432-129-0x0000000007290000-0x0000000007400000-memory.dmpFilesize
1.4MB
-
memory/1432-121-0x0000000007180000-0x000000000728C000-memory.dmpFilesize
1.0MB
-
memory/1448-128-0x00000000734F0000-0x0000000073A9B000-memory.dmpFilesize
5.7MB
-
memory/1448-87-0x0000000000000000-mapping.dmp
-
memory/1448-89-0x00000000734F0000-0x0000000073A9B000-memory.dmpFilesize
5.7MB
-
memory/1448-132-0x00000000734F0000-0x0000000073A9B000-memory.dmpFilesize
5.7MB
-
memory/1476-93-0x0000000050480000-0x00000000504AD000-memory.dmpFilesize
180KB
-
memory/1476-104-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-75-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-77-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-76-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-78-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-79-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-57-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-73-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-59-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-70-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-71-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-60-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-72-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-69-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-65-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-66-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-54-0x00000000768C1000-0x00000000768C3000-memory.dmpFilesize
8KB
-
memory/1476-67-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-96-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-97-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-98-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-99-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-100-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-101-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-102-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-103-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-74-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-105-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-106-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-107-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-108-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-109-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-111-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-113-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-68-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-115-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-116-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-114-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-117-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-118-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-119-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-64-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-61-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-63-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1476-62-0x0000000003B90000-0x0000000003C2C000-memory.dmpFilesize
624KB
-
memory/1496-82-0x0000000000000000-mapping.dmp
-
memory/1556-80-0x0000000000000000-mapping.dmp
-
memory/1832-124-0x0000000000C90000-0x0000000000CA6000-memory.dmpFilesize
88KB
-
memory/1832-125-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1832-126-0x00000000020B0000-0x00000000023B3000-memory.dmpFilesize
3.0MB
-
memory/1832-127-0x00000000008F0000-0x0000000000980000-memory.dmpFilesize
576KB
-
memory/1832-122-0x0000000000000000-mapping.dmp
-
memory/1832-130-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/1992-85-0x0000000000000000-mapping.dmp