Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15-03-2024 17:03
Behavioral task
behavioral1
Sample
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe
Resource
win7-20240221-en
General
-
Target
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe
-
Size
975KB
-
MD5
af7484c40877c3d74d58100509797f71
-
SHA1
70cd03800362f1b35dc5260642ebf7d2159f18b8
-
SHA256
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86
-
SHA512
b964f8277222df462ffd60b321ce856bdc4956234171bd8ea57dff4adfa02a07d0101e52eb5e5db5684a5b3f56b6ec67cadb10db9fb87b8d51affe8cba9220e1
-
SSDEEP
12288:W9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hlx3st:yZ1xuVVjfFoynPaVBUR8f+kN10EBDBst
Malware Config
Extracted
darkcomet
Guest16
nakaga.ddns.net:1604
DC_MUTEX-4A2S168
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
pkmsYsbr22Ni
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 3236 attrib.exe 3772 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 4736 notepad.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 3576 msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 3576 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeSecurityPrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeTakeOwnershipPrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeLoadDriverPrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeSystemProfilePrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeSystemtimePrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeProfSingleProcessPrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeIncBasePriorityPrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeCreatePagefilePrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeBackupPrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeRestorePrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeShutdownPrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeDebugPrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeSystemEnvironmentPrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeChangeNotifyPrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeRemoteShutdownPrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeUndockPrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeManageVolumePrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeImpersonatePrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeCreateGlobalPrivilege 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: 33 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: 34 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: 35 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: 36 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe Token: SeIncreaseQuotaPrivilege 3576 msdcsc.exe Token: SeSecurityPrivilege 3576 msdcsc.exe Token: SeTakeOwnershipPrivilege 3576 msdcsc.exe Token: SeLoadDriverPrivilege 3576 msdcsc.exe Token: SeSystemProfilePrivilege 3576 msdcsc.exe Token: SeSystemtimePrivilege 3576 msdcsc.exe Token: SeProfSingleProcessPrivilege 3576 msdcsc.exe Token: SeIncBasePriorityPrivilege 3576 msdcsc.exe Token: SeCreatePagefilePrivilege 3576 msdcsc.exe Token: SeBackupPrivilege 3576 msdcsc.exe Token: SeRestorePrivilege 3576 msdcsc.exe Token: SeShutdownPrivilege 3576 msdcsc.exe Token: SeDebugPrivilege 3576 msdcsc.exe Token: SeSystemEnvironmentPrivilege 3576 msdcsc.exe Token: SeChangeNotifyPrivilege 3576 msdcsc.exe Token: SeRemoteShutdownPrivilege 3576 msdcsc.exe Token: SeUndockPrivilege 3576 msdcsc.exe Token: SeManageVolumePrivilege 3576 msdcsc.exe Token: SeImpersonatePrivilege 3576 msdcsc.exe Token: SeCreateGlobalPrivilege 3576 msdcsc.exe Token: 33 3576 msdcsc.exe Token: 34 3576 msdcsc.exe Token: 35 3576 msdcsc.exe Token: 36 3576 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 3576 msdcsc.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.execmd.execmd.exemsdcsc.exedescription pid process target process PID 1008 wrote to memory of 2692 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe cmd.exe PID 1008 wrote to memory of 2692 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe cmd.exe PID 1008 wrote to memory of 2692 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe cmd.exe PID 1008 wrote to memory of 4416 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe cmd.exe PID 1008 wrote to memory of 4416 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe cmd.exe PID 1008 wrote to memory of 4416 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe cmd.exe PID 1008 wrote to memory of 4736 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1008 wrote to memory of 4736 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1008 wrote to memory of 4736 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1008 wrote to memory of 4736 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1008 wrote to memory of 4736 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1008 wrote to memory of 4736 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1008 wrote to memory of 4736 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1008 wrote to memory of 4736 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1008 wrote to memory of 4736 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1008 wrote to memory of 4736 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1008 wrote to memory of 4736 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1008 wrote to memory of 4736 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1008 wrote to memory of 4736 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1008 wrote to memory of 4736 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1008 wrote to memory of 4736 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1008 wrote to memory of 4736 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 1008 wrote to memory of 4736 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe notepad.exe PID 2692 wrote to memory of 3236 2692 cmd.exe attrib.exe PID 2692 wrote to memory of 3236 2692 cmd.exe attrib.exe PID 2692 wrote to memory of 3236 2692 cmd.exe attrib.exe PID 4416 wrote to memory of 3772 4416 cmd.exe attrib.exe PID 4416 wrote to memory of 3772 4416 cmd.exe attrib.exe PID 4416 wrote to memory of 3772 4416 cmd.exe attrib.exe PID 1008 wrote to memory of 3576 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe msdcsc.exe PID 1008 wrote to memory of 3576 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe msdcsc.exe PID 1008 wrote to memory of 3576 1008 001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe msdcsc.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe PID 3576 wrote to memory of 1324 3576 msdcsc.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 3236 attrib.exe 3772 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe"C:\Users\Admin\AppData\Local\Temp\001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
975KB
MD5af7484c40877c3d74d58100509797f71
SHA170cd03800362f1b35dc5260642ebf7d2159f18b8
SHA256001d1b9ef0730a65eeb9d7e745d9cebb76207406fa5d9580599cc46307c88d86
SHA512b964f8277222df462ffd60b321ce856bdc4956234171bd8ea57dff4adfa02a07d0101e52eb5e5db5684a5b3f56b6ec67cadb10db9fb87b8d51affe8cba9220e1
-
memory/1008-0-0x0000000002450000-0x0000000002451000-memory.dmpFilesize
4KB
-
memory/1008-65-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/1324-64-0x0000000000870000-0x0000000000871000-memory.dmpFilesize
4KB
-
memory/3576-71-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/3576-72-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/3576-67-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/3576-68-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/3576-69-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/3576-70-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/3576-80-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/3576-63-0x0000000000710000-0x0000000000711000-memory.dmpFilesize
4KB
-
memory/3576-73-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/3576-74-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/3576-75-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/3576-76-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/3576-77-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/3576-78-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/3576-79-0x0000000000400000-0x0000000000501000-memory.dmpFilesize
1.0MB
-
memory/4736-4-0x0000000000AC0000-0x0000000000AC1000-memory.dmpFilesize
4KB