Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05-02-2024 20:37
Static task
static1
Behavioral task
behavioral1
Sample
92f143956b9a12540154e290c4e62564.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
92f143956b9a12540154e290c4e62564.exe
Resource
win10v2004-20231215-en
General
-
Target
92f143956b9a12540154e290c4e62564.exe
-
Size
761KB
-
MD5
92f143956b9a12540154e290c4e62564
-
SHA1
1fee278385d5b122aed257fafad8438382492dec
-
SHA256
eba350227560d9ced91f4d3d85758edeca142d387cb2156dc9e169aaa0a4e6c6
-
SHA512
9dc37a30a62757252577fa00dbfc195b99274f8b868a9833a2b46f3b7b1d50c1363d142807b405068d8bdab1cbbc8ec5dca1691f223dc04c3b64c08066d5f3f7
-
SSDEEP
12288:BMrNIqNDs+RG7Y/ovzi0dSR/qP5OrOEuDAE+GL2QehBLouk3DefG7h:CrNIqNDsK6tvRda/RONAE+M2QebnkQGl
Malware Config
Extracted
darkcomet
Crypted
anonymoushere.no-ip.org:1604
DC_MUTEX-J8M2E7P
-
gencode
GmA26Nic56qT
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
92f143956b9a12540154e290c4e62564.exed3dref9.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 92f143956b9a12540154e290c4e62564.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation d3dref9.exe -
Executes dropped EXE 3 IoCs
Processes:
d3dref9.exeifsutilx.exeifsutilx.exepid process 2248 d3dref9.exe 4232 ifsutilx.exe 4520 ifsutilx.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
d3dref9.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\d3dref9.exe" d3dref9.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
92f143956b9a12540154e290c4e62564.exeifsutilx.exeifsutilx.exedescription pid process target process PID 5028 set thread context of 208 5028 92f143956b9a12540154e290c4e62564.exe AppLaunch.exe PID 4232 set thread context of 4812 4232 ifsutilx.exe AppLaunch.exe PID 4520 set thread context of 2044 4520 ifsutilx.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
dw20.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
dw20.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
92f143956b9a12540154e290c4e62564.exed3dref9.exeifsutilx.exeifsutilx.exepid process 5028 92f143956b9a12540154e290c4e62564.exe 2248 d3dref9.exe 5028 92f143956b9a12540154e290c4e62564.exe 5028 92f143956b9a12540154e290c4e62564.exe 2248 d3dref9.exe 5028 92f143956b9a12540154e290c4e62564.exe 4232 ifsutilx.exe 2248 d3dref9.exe 5028 92f143956b9a12540154e290c4e62564.exe 4232 ifsutilx.exe 2248 d3dref9.exe 5028 92f143956b9a12540154e290c4e62564.exe 2248 d3dref9.exe 5028 92f143956b9a12540154e290c4e62564.exe 2248 d3dref9.exe 4520 ifsutilx.exe 5028 92f143956b9a12540154e290c4e62564.exe 4520 ifsutilx.exe 2248 d3dref9.exe 5028 92f143956b9a12540154e290c4e62564.exe 2248 d3dref9.exe 4520 ifsutilx.exe 5028 92f143956b9a12540154e290c4e62564.exe 4520 ifsutilx.exe 2248 d3dref9.exe 5028 92f143956b9a12540154e290c4e62564.exe 2248 d3dref9.exe 4520 ifsutilx.exe 5028 92f143956b9a12540154e290c4e62564.exe 4520 ifsutilx.exe 2248 d3dref9.exe 5028 92f143956b9a12540154e290c4e62564.exe 2248 d3dref9.exe 4520 ifsutilx.exe 5028 92f143956b9a12540154e290c4e62564.exe 4520 ifsutilx.exe 2248 d3dref9.exe 5028 92f143956b9a12540154e290c4e62564.exe 2248 d3dref9.exe 4520 ifsutilx.exe 5028 92f143956b9a12540154e290c4e62564.exe 4520 ifsutilx.exe 2248 d3dref9.exe 5028 92f143956b9a12540154e290c4e62564.exe 2248 d3dref9.exe 4520 ifsutilx.exe 5028 92f143956b9a12540154e290c4e62564.exe 4520 ifsutilx.exe 2248 d3dref9.exe 5028 92f143956b9a12540154e290c4e62564.exe 2248 d3dref9.exe 4520 ifsutilx.exe 5028 92f143956b9a12540154e290c4e62564.exe 4520 ifsutilx.exe 2248 d3dref9.exe 5028 92f143956b9a12540154e290c4e62564.exe 2248 d3dref9.exe 4520 ifsutilx.exe 5028 92f143956b9a12540154e290c4e62564.exe 4520 ifsutilx.exe 2248 d3dref9.exe 5028 92f143956b9a12540154e290c4e62564.exe 2248 d3dref9.exe 4520 ifsutilx.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
92f143956b9a12540154e290c4e62564.exeAppLaunch.exed3dref9.exeifsutilx.exedw20.exeAppLaunch.exeifsutilx.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 5028 92f143956b9a12540154e290c4e62564.exe Token: SeIncreaseQuotaPrivilege 208 AppLaunch.exe Token: SeSecurityPrivilege 208 AppLaunch.exe Token: SeTakeOwnershipPrivilege 208 AppLaunch.exe Token: SeLoadDriverPrivilege 208 AppLaunch.exe Token: SeSystemProfilePrivilege 208 AppLaunch.exe Token: SeSystemtimePrivilege 208 AppLaunch.exe Token: SeProfSingleProcessPrivilege 208 AppLaunch.exe Token: SeIncBasePriorityPrivilege 208 AppLaunch.exe Token: SeCreatePagefilePrivilege 208 AppLaunch.exe Token: SeBackupPrivilege 208 AppLaunch.exe Token: SeRestorePrivilege 208 AppLaunch.exe Token: SeShutdownPrivilege 208 AppLaunch.exe Token: SeDebugPrivilege 208 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 208 AppLaunch.exe Token: SeChangeNotifyPrivilege 208 AppLaunch.exe Token: SeRemoteShutdownPrivilege 208 AppLaunch.exe Token: SeUndockPrivilege 208 AppLaunch.exe Token: SeManageVolumePrivilege 208 AppLaunch.exe Token: SeImpersonatePrivilege 208 AppLaunch.exe Token: SeCreateGlobalPrivilege 208 AppLaunch.exe Token: 33 208 AppLaunch.exe Token: 34 208 AppLaunch.exe Token: 35 208 AppLaunch.exe Token: 36 208 AppLaunch.exe Token: SeDebugPrivilege 2248 d3dref9.exe Token: SeDebugPrivilege 4232 ifsutilx.exe Token: SeRestorePrivilege 3764 dw20.exe Token: SeBackupPrivilege 3764 dw20.exe Token: SeIncreaseQuotaPrivilege 4812 AppLaunch.exe Token: SeSecurityPrivilege 4812 AppLaunch.exe Token: SeTakeOwnershipPrivilege 4812 AppLaunch.exe Token: SeLoadDriverPrivilege 4812 AppLaunch.exe Token: SeSystemProfilePrivilege 4812 AppLaunch.exe Token: SeSystemtimePrivilege 4812 AppLaunch.exe Token: SeProfSingleProcessPrivilege 4812 AppLaunch.exe Token: SeIncBasePriorityPrivilege 4812 AppLaunch.exe Token: SeCreatePagefilePrivilege 4812 AppLaunch.exe Token: SeBackupPrivilege 4812 AppLaunch.exe Token: SeRestorePrivilege 4812 AppLaunch.exe Token: SeShutdownPrivilege 4812 AppLaunch.exe Token: SeDebugPrivilege 4812 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 4812 AppLaunch.exe Token: SeChangeNotifyPrivilege 4812 AppLaunch.exe Token: SeBackupPrivilege 3764 dw20.exe Token: SeRemoteShutdownPrivilege 4812 AppLaunch.exe Token: SeUndockPrivilege 4812 AppLaunch.exe Token: SeManageVolumePrivilege 4812 AppLaunch.exe Token: SeImpersonatePrivilege 4812 AppLaunch.exe Token: SeCreateGlobalPrivilege 4812 AppLaunch.exe Token: 33 4812 AppLaunch.exe Token: 34 4812 AppLaunch.exe Token: 35 4812 AppLaunch.exe Token: 36 4812 AppLaunch.exe Token: SeBackupPrivilege 3764 dw20.exe Token: SeDebugPrivilege 4520 ifsutilx.exe Token: SeIncreaseQuotaPrivilege 2044 AppLaunch.exe Token: SeSecurityPrivilege 2044 AppLaunch.exe Token: SeTakeOwnershipPrivilege 2044 AppLaunch.exe Token: SeLoadDriverPrivilege 2044 AppLaunch.exe Token: SeSystemProfilePrivilege 2044 AppLaunch.exe Token: SeSystemtimePrivilege 2044 AppLaunch.exe Token: SeProfSingleProcessPrivilege 2044 AppLaunch.exe Token: SeIncBasePriorityPrivilege 2044 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AppLaunch.exepid process 2044 AppLaunch.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
92f143956b9a12540154e290c4e62564.exed3dref9.exeifsutilx.exeifsutilx.exedescription pid process target process PID 5028 wrote to memory of 208 5028 92f143956b9a12540154e290c4e62564.exe AppLaunch.exe PID 5028 wrote to memory of 208 5028 92f143956b9a12540154e290c4e62564.exe AppLaunch.exe PID 5028 wrote to memory of 208 5028 92f143956b9a12540154e290c4e62564.exe AppLaunch.exe PID 5028 wrote to memory of 208 5028 92f143956b9a12540154e290c4e62564.exe AppLaunch.exe PID 5028 wrote to memory of 208 5028 92f143956b9a12540154e290c4e62564.exe AppLaunch.exe PID 5028 wrote to memory of 208 5028 92f143956b9a12540154e290c4e62564.exe AppLaunch.exe PID 5028 wrote to memory of 208 5028 92f143956b9a12540154e290c4e62564.exe AppLaunch.exe PID 5028 wrote to memory of 208 5028 92f143956b9a12540154e290c4e62564.exe AppLaunch.exe PID 5028 wrote to memory of 208 5028 92f143956b9a12540154e290c4e62564.exe AppLaunch.exe PID 5028 wrote to memory of 208 5028 92f143956b9a12540154e290c4e62564.exe AppLaunch.exe PID 5028 wrote to memory of 208 5028 92f143956b9a12540154e290c4e62564.exe AppLaunch.exe PID 5028 wrote to memory of 208 5028 92f143956b9a12540154e290c4e62564.exe AppLaunch.exe PID 5028 wrote to memory of 208 5028 92f143956b9a12540154e290c4e62564.exe AppLaunch.exe PID 5028 wrote to memory of 208 5028 92f143956b9a12540154e290c4e62564.exe AppLaunch.exe PID 5028 wrote to memory of 2248 5028 92f143956b9a12540154e290c4e62564.exe d3dref9.exe PID 5028 wrote to memory of 2248 5028 92f143956b9a12540154e290c4e62564.exe d3dref9.exe PID 5028 wrote to memory of 2248 5028 92f143956b9a12540154e290c4e62564.exe d3dref9.exe PID 2248 wrote to memory of 4232 2248 d3dref9.exe ifsutilx.exe PID 2248 wrote to memory of 4232 2248 d3dref9.exe ifsutilx.exe PID 2248 wrote to memory of 4232 2248 d3dref9.exe ifsutilx.exe PID 4232 wrote to memory of 3764 4232 ifsutilx.exe dw20.exe PID 4232 wrote to memory of 3764 4232 ifsutilx.exe dw20.exe PID 4232 wrote to memory of 3764 4232 ifsutilx.exe dw20.exe PID 4232 wrote to memory of 4812 4232 ifsutilx.exe AppLaunch.exe PID 4232 wrote to memory of 4812 4232 ifsutilx.exe AppLaunch.exe PID 4232 wrote to memory of 4812 4232 ifsutilx.exe AppLaunch.exe PID 4232 wrote to memory of 4812 4232 ifsutilx.exe AppLaunch.exe PID 4232 wrote to memory of 4812 4232 ifsutilx.exe AppLaunch.exe PID 4232 wrote to memory of 4812 4232 ifsutilx.exe AppLaunch.exe PID 4232 wrote to memory of 4812 4232 ifsutilx.exe AppLaunch.exe PID 4232 wrote to memory of 4812 4232 ifsutilx.exe AppLaunch.exe PID 4232 wrote to memory of 4812 4232 ifsutilx.exe AppLaunch.exe PID 4232 wrote to memory of 4812 4232 ifsutilx.exe AppLaunch.exe PID 4232 wrote to memory of 4812 4232 ifsutilx.exe AppLaunch.exe PID 4232 wrote to memory of 4812 4232 ifsutilx.exe AppLaunch.exe PID 4232 wrote to memory of 4812 4232 ifsutilx.exe AppLaunch.exe PID 4232 wrote to memory of 4812 4232 ifsutilx.exe AppLaunch.exe PID 2248 wrote to memory of 4520 2248 d3dref9.exe ifsutilx.exe PID 2248 wrote to memory of 4520 2248 d3dref9.exe ifsutilx.exe PID 2248 wrote to memory of 4520 2248 d3dref9.exe ifsutilx.exe PID 4520 wrote to memory of 2044 4520 ifsutilx.exe AppLaunch.exe PID 4520 wrote to memory of 2044 4520 ifsutilx.exe AppLaunch.exe PID 4520 wrote to memory of 2044 4520 ifsutilx.exe AppLaunch.exe PID 4520 wrote to memory of 2044 4520 ifsutilx.exe AppLaunch.exe PID 4520 wrote to memory of 2044 4520 ifsutilx.exe AppLaunch.exe PID 4520 wrote to memory of 2044 4520 ifsutilx.exe AppLaunch.exe PID 4520 wrote to memory of 2044 4520 ifsutilx.exe AppLaunch.exe PID 4520 wrote to memory of 2044 4520 ifsutilx.exe AppLaunch.exe PID 4520 wrote to memory of 2044 4520 ifsutilx.exe AppLaunch.exe PID 4520 wrote to memory of 2044 4520 ifsutilx.exe AppLaunch.exe PID 4520 wrote to memory of 2044 4520 ifsutilx.exe AppLaunch.exe PID 4520 wrote to memory of 2044 4520 ifsutilx.exe AppLaunch.exe PID 4520 wrote to memory of 2044 4520 ifsutilx.exe AppLaunch.exe PID 4520 wrote to memory of 2044 4520 ifsutilx.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\92f143956b9a12540154e290c4e62564.exe"C:\Users\Admin\AppData\Local\Temp\92f143956b9a12540154e290c4e62564.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\d3dref9.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\d3dref9.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ifsutilx.exe"C:\Users\Admin\AppData\Local\Temp\ifsutilx.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ifsutilx.exe"C:\Users\Admin\AppData\Local\Temp\ifsutilx.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 4482⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ifsutilx.exeFilesize
280KB
MD552b210e09a253e760791851f93718517
SHA118c89f4b1fc5d9850ab57bfa6c78a6518ebdb063
SHA256822cc6d2c6a150934cd2557a84459ceb8d15d7de94376f00cd5cc82ef35fc13d
SHA512dbc142e330ce6f8cf185dd51e84a694e644edb5c7dc0f2f780b3f1a0d6509d6527f2979e10ef35b3a27d7b5fb1e995387cb65c98baae6ecbf563e61a24028b92
-
C:\Users\Admin\AppData\Local\Temp\ifsutilx.exeFilesize
297KB
MD5fe7c3dd024ee5d385ea23a2e2b963d94
SHA1a9e058e840aa7bcd33c9aa45aafa4b321c885028
SHA256e1b6a106b7ad1eeef3d6748b7ba92f891c41827e201c5f12aa45a9a71d1fc793
SHA5124cbff6fafe23f9808a63f4ef97e8bd2997036d0e9036ba208b5e0150f9aeda8bbd39a1709e0f90dafe082cf48cc5158b70fbc41239c54eeca4a3cee1a8aa623e
-
C:\Users\Admin\AppData\Local\Temp\ifsutilx.exeFilesize
149KB
MD5d31c982d25c7994cad866e7aa2493b89
SHA158165482dbbca536f0433d2bf5927c8ee6ae653c
SHA256b0d2003ad03288858cbddca09dc2425325fb85eb8558f3c218a408263a12caca
SHA512db5e75a58653daea3860918b11af9b43c5846d4cb9277c20ff2262a4b8fee6e5096a3e9a0d49a3f6b60200a9504dbacec0ec609527cc1169923547e40190401d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\d3dref9.exeFilesize
7KB
MD5bfab13f3f1c91d2590ef07c65839ffef
SHA185177eab769ca28a67a56e768d1279b457b4fa74
SHA256f50751a3a7df1fff2022b398b937892e4c6f7f545107a93466d26db346a04310
SHA51202cee67f4bc8c5a330a6c0a96d88372497730b2477b9575451a5710b340f2c61f2c4f7644cae3d885363e4ec9aa30c736dd292120d0e25528674fe10b8bdd3b3
-
memory/208-8-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/208-9-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/208-7-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/208-10-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/2044-50-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/2044-49-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/2044-47-0x00000000007F0000-0x00000000007F1000-memory.dmpFilesize
4KB
-
memory/2248-21-0x0000000075440000-0x00000000759F1000-memory.dmpFilesize
5.7MB
-
memory/2248-23-0x0000000075440000-0x00000000759F1000-memory.dmpFilesize
5.7MB
-
memory/2248-53-0x0000000075440000-0x00000000759F1000-memory.dmpFilesize
5.7MB
-
memory/2248-54-0x0000000001340000-0x0000000001350000-memory.dmpFilesize
64KB
-
memory/2248-22-0x0000000001340000-0x0000000001350000-memory.dmpFilesize
64KB
-
memory/4232-39-0x0000000075440000-0x00000000759F1000-memory.dmpFilesize
5.7MB
-
memory/4232-30-0x0000000075440000-0x00000000759F1000-memory.dmpFilesize
5.7MB
-
memory/4232-27-0x00000000010D0000-0x00000000010E0000-memory.dmpFilesize
64KB
-
memory/4232-26-0x0000000075440000-0x00000000759F1000-memory.dmpFilesize
5.7MB
-
memory/4520-42-0x0000000000B00000-0x0000000000B10000-memory.dmpFilesize
64KB
-
memory/4520-44-0x0000000075440000-0x00000000759F1000-memory.dmpFilesize
5.7MB
-
memory/4520-41-0x0000000075440000-0x00000000759F1000-memory.dmpFilesize
5.7MB
-
memory/4520-56-0x0000000000B00000-0x0000000000B10000-memory.dmpFilesize
64KB
-
memory/4520-55-0x0000000075440000-0x00000000759F1000-memory.dmpFilesize
5.7MB
-
memory/4812-32-0x0000000002180000-0x0000000002181000-memory.dmpFilesize
4KB
-
memory/5028-0-0x0000000075440000-0x00000000759F1000-memory.dmpFilesize
5.7MB
-
memory/5028-52-0x0000000000C40000-0x0000000000C50000-memory.dmpFilesize
64KB
-
memory/5028-51-0x0000000075440000-0x00000000759F1000-memory.dmpFilesize
5.7MB
-
memory/5028-2-0x0000000000C40000-0x0000000000C50000-memory.dmpFilesize
64KB
-
memory/5028-1-0x0000000075440000-0x00000000759F1000-memory.dmpFilesize
5.7MB
-
memory/5028-48-0x0000000075440000-0x00000000759F1000-memory.dmpFilesize
5.7MB