Analysis
-
max time kernel
179s -
max time network
83s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 06:11
Static task
static1
Behavioral task
behavioral1
Sample
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe
Resource
win10v2004-20220812-en
General
-
Target
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe
-
Size
836KB
-
MD5
6f90f939b919550ee51d5c8d628cf6e3
-
SHA1
372d4f0fe47bd63c6df8a9cc785637126935ca87
-
SHA256
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624
-
SHA512
346296703898a8673555f4cffad0c2e00cee9495d56442744efee77aec70ed291df98859a08c848ab0f4eafd1fac7e21da31d70a20d80e766486402471ee93da
-
SSDEEP
24576:GcK0FPnmjaDqRTzhuMC1cwzrZttdIE9qOk2VMJGn:V+aDqXud1PZ69OHVR
Malware Config
Extracted
darkcomet
hard
gabrielzinho.no-ip.org:1604
DC_MUTEX-ZVWF6UW
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
aUYHsEtnsFw3
-
install
true
-
offline_keylogger
true
-
password
87080060abc
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe -
Executes dropped EXE 2 IoCs
Processes:
msdcsc.exemsdcsc.exepid process 1700 msdcsc.exe 316 msdcsc.exe -
Loads dropped DLL 2 IoCs
Processes:
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exepid process 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Drops file in System32 directory 4 IoCs
Processes:
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exemsdcsc.exedescription ioc process File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exemsdcsc.exedescription pid process target process PID 1056 set thread context of 988 1056 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 1700 set thread context of 316 1700 msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeSecurityPrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeTakeOwnershipPrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeLoadDriverPrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeSystemProfilePrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeSystemtimePrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeProfSingleProcessPrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeIncBasePriorityPrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeCreatePagefilePrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeBackupPrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeRestorePrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeShutdownPrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeDebugPrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeSystemEnvironmentPrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeChangeNotifyPrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeRemoteShutdownPrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeUndockPrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeManageVolumePrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeImpersonatePrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeCreateGlobalPrivilege 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: 33 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: 34 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: 35 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeIncreaseQuotaPrivilege 316 msdcsc.exe Token: SeSecurityPrivilege 316 msdcsc.exe Token: SeTakeOwnershipPrivilege 316 msdcsc.exe Token: SeLoadDriverPrivilege 316 msdcsc.exe Token: SeSystemProfilePrivilege 316 msdcsc.exe Token: SeSystemtimePrivilege 316 msdcsc.exe Token: SeProfSingleProcessPrivilege 316 msdcsc.exe Token: SeIncBasePriorityPrivilege 316 msdcsc.exe Token: SeCreatePagefilePrivilege 316 msdcsc.exe Token: SeBackupPrivilege 316 msdcsc.exe Token: SeRestorePrivilege 316 msdcsc.exe Token: SeShutdownPrivilege 316 msdcsc.exe Token: SeDebugPrivilege 316 msdcsc.exe Token: SeSystemEnvironmentPrivilege 316 msdcsc.exe Token: SeChangeNotifyPrivilege 316 msdcsc.exe Token: SeRemoteShutdownPrivilege 316 msdcsc.exe Token: SeUndockPrivilege 316 msdcsc.exe Token: SeManageVolumePrivilege 316 msdcsc.exe Token: SeImpersonatePrivilege 316 msdcsc.exe Token: SeCreateGlobalPrivilege 316 msdcsc.exe Token: 33 316 msdcsc.exe Token: 34 316 msdcsc.exe Token: 35 316 msdcsc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exemsdcsc.exemsdcsc.exepid process 1056 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 1700 msdcsc.exe 316 msdcsc.exe -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exemsdcsc.exemsdcsc.exedescription pid process target process PID 1056 wrote to memory of 988 1056 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 1056 wrote to memory of 988 1056 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 1056 wrote to memory of 988 1056 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 1056 wrote to memory of 988 1056 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 1056 wrote to memory of 988 1056 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 1056 wrote to memory of 988 1056 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 1056 wrote to memory of 988 1056 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 1056 wrote to memory of 988 1056 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 1056 wrote to memory of 988 1056 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 1056 wrote to memory of 988 1056 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 1056 wrote to memory of 988 1056 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 1056 wrote to memory of 988 1056 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 1056 wrote to memory of 988 1056 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 988 wrote to memory of 1700 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe msdcsc.exe PID 988 wrote to memory of 1700 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe msdcsc.exe PID 988 wrote to memory of 1700 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe msdcsc.exe PID 988 wrote to memory of 1700 988 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe msdcsc.exe PID 1700 wrote to memory of 316 1700 msdcsc.exe msdcsc.exe PID 1700 wrote to memory of 316 1700 msdcsc.exe msdcsc.exe PID 1700 wrote to memory of 316 1700 msdcsc.exe msdcsc.exe PID 1700 wrote to memory of 316 1700 msdcsc.exe msdcsc.exe PID 1700 wrote to memory of 316 1700 msdcsc.exe msdcsc.exe PID 1700 wrote to memory of 316 1700 msdcsc.exe msdcsc.exe PID 1700 wrote to memory of 316 1700 msdcsc.exe msdcsc.exe PID 1700 wrote to memory of 316 1700 msdcsc.exe msdcsc.exe PID 1700 wrote to memory of 316 1700 msdcsc.exe msdcsc.exe PID 1700 wrote to memory of 316 1700 msdcsc.exe msdcsc.exe PID 1700 wrote to memory of 316 1700 msdcsc.exe msdcsc.exe PID 1700 wrote to memory of 316 1700 msdcsc.exe msdcsc.exe PID 1700 wrote to memory of 316 1700 msdcsc.exe msdcsc.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe PID 316 wrote to memory of 600 316 msdcsc.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe"C:\Users\Admin\AppData\Local\Temp\24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe"C:\Users\Admin\AppData\Local\Temp\24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe"2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3845472200-3839195424-595303356-1000\699c4b9cdebca7aaea5193cae8a50098_7725c12a-7257-458e-a47f-7029d9191548Filesize
50B
MD55b63d4dd8c04c88c0e30e494ec6a609a
SHA1884d5a8bdc25fe794dc22ef9518009dcf0069d09
SHA2564d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
SHA51215ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
836KB
MD56f90f939b919550ee51d5c8d628cf6e3
SHA1372d4f0fe47bd63c6df8a9cc785637126935ca87
SHA25624716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624
SHA512346296703898a8673555f4cffad0c2e00cee9495d56442744efee77aec70ed291df98859a08c848ab0f4eafd1fac7e21da31d70a20d80e766486402471ee93da
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
836KB
MD56f90f939b919550ee51d5c8d628cf6e3
SHA1372d4f0fe47bd63c6df8a9cc785637126935ca87
SHA25624716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624
SHA512346296703898a8673555f4cffad0c2e00cee9495d56442744efee77aec70ed291df98859a08c848ab0f4eafd1fac7e21da31d70a20d80e766486402471ee93da
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
836KB
MD56f90f939b919550ee51d5c8d628cf6e3
SHA1372d4f0fe47bd63c6df8a9cc785637126935ca87
SHA25624716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624
SHA512346296703898a8673555f4cffad0c2e00cee9495d56442744efee77aec70ed291df98859a08c848ab0f4eafd1fac7e21da31d70a20d80e766486402471ee93da
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
836KB
MD56f90f939b919550ee51d5c8d628cf6e3
SHA1372d4f0fe47bd63c6df8a9cc785637126935ca87
SHA25624716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624
SHA512346296703898a8673555f4cffad0c2e00cee9495d56442744efee77aec70ed291df98859a08c848ab0f4eafd1fac7e21da31d70a20d80e766486402471ee93da
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
836KB
MD56f90f939b919550ee51d5c8d628cf6e3
SHA1372d4f0fe47bd63c6df8a9cc785637126935ca87
SHA25624716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624
SHA512346296703898a8673555f4cffad0c2e00cee9495d56442744efee77aec70ed291df98859a08c848ab0f4eafd1fac7e21da31d70a20d80e766486402471ee93da
-
memory/316-108-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/316-104-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/316-99-0x000000000048F888-mapping.dmp
-
memory/600-106-0x0000000000000000-mapping.dmp
-
memory/988-66-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/988-70-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/988-74-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/988-75-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/988-72-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/988-57-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/988-71-0x000000000048F888-mapping.dmp
-
memory/988-73-0x0000000075E31000-0x0000000075E33000-memory.dmpFilesize
8KB
-
memory/988-68-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/988-56-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/988-65-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/988-63-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/988-61-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/988-105-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/988-59-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/1700-78-0x0000000000000000-mapping.dmp