Analysis
-
max time kernel
191s -
max time network
213s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 22:07
Static task
static1
Behavioral task
behavioral1
Sample
939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe
Resource
win7-20221111-en
General
-
Target
939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe
-
Size
997KB
-
MD5
cc1439d43a95d8834e593a20b082ef24
-
SHA1
5cd14499b0b902bad969d39ab28b1e9efe0d9354
-
SHA256
939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8
-
SHA512
a7c4a8ef7bf9b52cb8db3b3557a2e72e20b1fedc95d69895a6872979062dd90639771be6da3758f49b0d528a87fc3bddbe8db1940725231926ac8a34edc662d0
-
SSDEEP
24576:FbcOE7O5ueXGqJghIL2AYS3ymFYe9eQxX4P:hcs5tbL4beLG
Malware Config
Extracted
darkcomet
Guest16
neo2.ddns.net:1200
DC_MUTEX-0WZBGJC
-
InstallPath
SystemC\SystemC.exe
-
gencode
qMq25piLPy1w
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
SystemC
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\SystemC\\SystemC.exe" 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
SystemC.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile SystemC.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" SystemC.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" SystemC.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
SystemC.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" SystemC.exe -
Processes:
SystemC.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" SystemC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" SystemC.exe -
Executes dropped EXE 2 IoCs
Processes:
SystemC.exeSystemC.exepid process 2712 SystemC.exe 2160 SystemC.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe -
Processes:
SystemC.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" SystemC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" SystemC.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemC = "C:\\Users\\Admin\\AppData\\Roaming\\SystemC\\SystemC.exe" 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exeSystemC.exedescription pid process target process PID 4048 set thread context of 4992 4048 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe PID 2712 set thread context of 2160 2712 SystemC.exe SystemC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
SystemC.exepid process 2160 SystemC.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
Processes:
939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exeSystemC.exeSystemC.exedescription pid process Token: SeDebugPrivilege 4048 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeIncreaseQuotaPrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeSecurityPrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeTakeOwnershipPrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeLoadDriverPrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeSystemProfilePrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeSystemtimePrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeProfSingleProcessPrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeIncBasePriorityPrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeCreatePagefilePrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeBackupPrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeRestorePrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeShutdownPrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeDebugPrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeSystemEnvironmentPrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeChangeNotifyPrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeRemoteShutdownPrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeUndockPrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeManageVolumePrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeImpersonatePrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeCreateGlobalPrivilege 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: 33 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: 34 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: 35 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: 36 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe Token: SeDebugPrivilege 2712 SystemC.exe Token: SeIncreaseQuotaPrivilege 2160 SystemC.exe Token: SeSecurityPrivilege 2160 SystemC.exe Token: SeTakeOwnershipPrivilege 2160 SystemC.exe Token: SeLoadDriverPrivilege 2160 SystemC.exe Token: SeSystemProfilePrivilege 2160 SystemC.exe Token: SeSystemtimePrivilege 2160 SystemC.exe Token: SeProfSingleProcessPrivilege 2160 SystemC.exe Token: SeIncBasePriorityPrivilege 2160 SystemC.exe Token: SeCreatePagefilePrivilege 2160 SystemC.exe Token: SeBackupPrivilege 2160 SystemC.exe Token: SeRestorePrivilege 2160 SystemC.exe Token: SeShutdownPrivilege 2160 SystemC.exe Token: SeDebugPrivilege 2160 SystemC.exe Token: SeSystemEnvironmentPrivilege 2160 SystemC.exe Token: SeChangeNotifyPrivilege 2160 SystemC.exe Token: SeRemoteShutdownPrivilege 2160 SystemC.exe Token: SeUndockPrivilege 2160 SystemC.exe Token: SeManageVolumePrivilege 2160 SystemC.exe Token: SeImpersonatePrivilege 2160 SystemC.exe Token: SeCreateGlobalPrivilege 2160 SystemC.exe Token: 33 2160 SystemC.exe Token: 34 2160 SystemC.exe Token: 35 2160 SystemC.exe Token: 36 2160 SystemC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
SystemC.exepid process 2160 SystemC.exe -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exeSystemC.exeSystemC.exedescription pid process target process PID 4048 wrote to memory of 4992 4048 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe PID 4048 wrote to memory of 4992 4048 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe PID 4048 wrote to memory of 4992 4048 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe PID 4048 wrote to memory of 4992 4048 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe PID 4048 wrote to memory of 4992 4048 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe PID 4048 wrote to memory of 4992 4048 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe PID 4048 wrote to memory of 4992 4048 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe PID 4048 wrote to memory of 4992 4048 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe PID 4048 wrote to memory of 4992 4048 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe PID 4048 wrote to memory of 4992 4048 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe PID 4048 wrote to memory of 4992 4048 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe PID 4048 wrote to memory of 4992 4048 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe PID 4048 wrote to memory of 4992 4048 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe PID 4048 wrote to memory of 4992 4048 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe PID 4992 wrote to memory of 2712 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe SystemC.exe PID 4992 wrote to memory of 2712 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe SystemC.exe PID 4992 wrote to memory of 2712 4992 939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe SystemC.exe PID 2712 wrote to memory of 2160 2712 SystemC.exe SystemC.exe PID 2712 wrote to memory of 2160 2712 SystemC.exe SystemC.exe PID 2712 wrote to memory of 2160 2712 SystemC.exe SystemC.exe PID 2712 wrote to memory of 2160 2712 SystemC.exe SystemC.exe PID 2712 wrote to memory of 2160 2712 SystemC.exe SystemC.exe PID 2712 wrote to memory of 2160 2712 SystemC.exe SystemC.exe PID 2712 wrote to memory of 2160 2712 SystemC.exe SystemC.exe PID 2712 wrote to memory of 2160 2712 SystemC.exe SystemC.exe PID 2712 wrote to memory of 2160 2712 SystemC.exe SystemC.exe PID 2712 wrote to memory of 2160 2712 SystemC.exe SystemC.exe PID 2712 wrote to memory of 2160 2712 SystemC.exe SystemC.exe PID 2712 wrote to memory of 2160 2712 SystemC.exe SystemC.exe PID 2712 wrote to memory of 2160 2712 SystemC.exe SystemC.exe PID 2712 wrote to memory of 2160 2712 SystemC.exe SystemC.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe PID 2160 wrote to memory of 4936 2160 SystemC.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
SystemC.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion SystemC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern SystemC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" SystemC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe"C:\Users\Admin\AppData\Local\Temp\939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exeC:\Users\Admin\AppData\Local\Temp\939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8.exe2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SystemC\SystemC.exe"C:\Users\Admin\AppData\Roaming\SystemC\SystemC.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SystemC\SystemC.exeC:\Users\Admin\AppData\Roaming\SystemC\SystemC.exe4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SystemC\SystemC.exeFilesize
997KB
MD5cc1439d43a95d8834e593a20b082ef24
SHA15cd14499b0b902bad969d39ab28b1e9efe0d9354
SHA256939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8
SHA512a7c4a8ef7bf9b52cb8db3b3557a2e72e20b1fedc95d69895a6872979062dd90639771be6da3758f49b0d528a87fc3bddbe8db1940725231926ac8a34edc662d0
-
C:\Users\Admin\AppData\Roaming\SystemC\SystemC.exeFilesize
997KB
MD5cc1439d43a95d8834e593a20b082ef24
SHA15cd14499b0b902bad969d39ab28b1e9efe0d9354
SHA256939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8
SHA512a7c4a8ef7bf9b52cb8db3b3557a2e72e20b1fedc95d69895a6872979062dd90639771be6da3758f49b0d528a87fc3bddbe8db1940725231926ac8a34edc662d0
-
C:\Users\Admin\AppData\Roaming\SystemC\SystemC.exeFilesize
997KB
MD5cc1439d43a95d8834e593a20b082ef24
SHA15cd14499b0b902bad969d39ab28b1e9efe0d9354
SHA256939f5f385c855cb98c481ae373ea9efe7af50f1714adf47fc01a288488abe5c8
SHA512a7c4a8ef7bf9b52cb8db3b3557a2e72e20b1fedc95d69895a6872979062dd90639771be6da3758f49b0d528a87fc3bddbe8db1940725231926ac8a34edc662d0
-
memory/2160-151-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2160-149-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2160-142-0x0000000000000000-mapping.dmp
-
memory/2712-147-0x0000000071D20000-0x00000000722D1000-memory.dmpFilesize
5.7MB
-
memory/2712-139-0x0000000000000000-mapping.dmp
-
memory/4048-137-0x0000000074CE0000-0x0000000075291000-memory.dmpFilesize
5.7MB
-
memory/4048-132-0x0000000074CE0000-0x0000000075291000-memory.dmpFilesize
5.7MB
-
memory/4936-148-0x0000000000000000-mapping.dmp
-
memory/4992-138-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4992-136-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4992-135-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4992-134-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4992-150-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4992-133-0x0000000000000000-mapping.dmp