Analysis
-
max time kernel
162s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2022 11:41
Static task
static1
Behavioral task
behavioral1
Sample
7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe
Resource
win7-20220715-en
General
-
Target
7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe
-
Size
440KB
-
MD5
a56c8f7c8cc94966093d7ea2b3241f12
-
SHA1
e12bdd5b96295d73e2bd14b63d5be1dffe485796
-
SHA256
7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744
-
SHA512
5f343bd670d633f403d561312de638a4eac63bb937b86557c39b56f89a86ac94382319a36ac9bff5e9a4401e2f91950f4129e945e51668cd8937ec4a7c8849a6
Malware Config
Extracted
darkcomet
garry
212.83.162.240:4449
DC_MUTEX-HVQYYV2
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
qP9qMy51lYCf
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
SQLBrowser
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 4916 msdcsc.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Processes:
resource yara_rule behavioral2/memory/4108-133-0x0000000000400000-0x0000000000B9C000-memory.dmp upx behavioral2/memory/4108-135-0x0000000000400000-0x0000000000B9C000-memory.dmp upx behavioral2/memory/4916-143-0x0000000000400000-0x0000000000B9C000-memory.dmp upx behavioral2/memory/4916-146-0x0000000000400000-0x0000000000B9C000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SQLBrowser = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Set value (str) \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SQLBrowser = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 15 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1816 4108 WerFault.exe 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe 4496 4108 WerFault.exe 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe 2040 4108 WerFault.exe 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe 1472 4108 WerFault.exe 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe 4556 4108 WerFault.exe 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe 2260 4108 WerFault.exe 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe 2380 4108 WerFault.exe 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe 1092 4916 WerFault.exe msdcsc.exe 4032 4916 WerFault.exe msdcsc.exe 4732 4916 WerFault.exe msdcsc.exe 1644 4916 WerFault.exe msdcsc.exe 108 4916 WerFault.exe msdcsc.exe 4368 4916 WerFault.exe msdcsc.exe 4848 4916 WerFault.exe msdcsc.exe 1624 4916 WerFault.exe msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeSecurityPrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeTakeOwnershipPrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeLoadDriverPrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeSystemProfilePrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeSystemtimePrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeProfSingleProcessPrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeIncBasePriorityPrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeCreatePagefilePrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeBackupPrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeRestorePrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeShutdownPrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeDebugPrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeSystemEnvironmentPrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeChangeNotifyPrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeRemoteShutdownPrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeUndockPrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeManageVolumePrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeImpersonatePrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeCreateGlobalPrivilege 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: 33 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: 34 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: 35 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: 36 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeIncreaseQuotaPrivilege 4916 msdcsc.exe Token: SeSecurityPrivilege 4916 msdcsc.exe Token: SeTakeOwnershipPrivilege 4916 msdcsc.exe Token: SeLoadDriverPrivilege 4916 msdcsc.exe Token: SeSystemProfilePrivilege 4916 msdcsc.exe Token: SeSystemtimePrivilege 4916 msdcsc.exe Token: SeProfSingleProcessPrivilege 4916 msdcsc.exe Token: SeIncBasePriorityPrivilege 4916 msdcsc.exe Token: SeCreatePagefilePrivilege 4916 msdcsc.exe Token: SeBackupPrivilege 4916 msdcsc.exe Token: SeRestorePrivilege 4916 msdcsc.exe Token: SeShutdownPrivilege 4916 msdcsc.exe Token: SeDebugPrivilege 4916 msdcsc.exe Token: SeSystemEnvironmentPrivilege 4916 msdcsc.exe Token: SeChangeNotifyPrivilege 4916 msdcsc.exe Token: SeRemoteShutdownPrivilege 4916 msdcsc.exe Token: SeUndockPrivilege 4916 msdcsc.exe Token: SeManageVolumePrivilege 4916 msdcsc.exe Token: SeImpersonatePrivilege 4916 msdcsc.exe Token: SeCreateGlobalPrivilege 4916 msdcsc.exe Token: 33 4916 msdcsc.exe Token: 34 4916 msdcsc.exe Token: 35 4916 msdcsc.exe Token: 36 4916 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 4916 msdcsc.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.execmd.exemsdcsc.exedescription pid process target process PID 4108 wrote to memory of 3524 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe cmd.exe PID 4108 wrote to memory of 3524 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe cmd.exe PID 4108 wrote to memory of 3524 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe cmd.exe PID 4108 wrote to memory of 4100 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 4108 wrote to memory of 4100 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 4108 wrote to memory of 4100 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 4108 wrote to memory of 4100 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 4108 wrote to memory of 4100 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 4108 wrote to memory of 4100 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 4108 wrote to memory of 4100 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 4108 wrote to memory of 4100 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 4108 wrote to memory of 4100 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 4108 wrote to memory of 4100 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 4108 wrote to memory of 4100 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 4108 wrote to memory of 4100 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 4108 wrote to memory of 4100 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 4108 wrote to memory of 4100 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 4108 wrote to memory of 4100 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 4108 wrote to memory of 4100 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 4108 wrote to memory of 4100 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 4108 wrote to memory of 4916 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe msdcsc.exe PID 4108 wrote to memory of 4916 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe msdcsc.exe PID 4108 wrote to memory of 4916 4108 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe msdcsc.exe PID 3524 wrote to memory of 1736 3524 cmd.exe attrib.exe PID 3524 wrote to memory of 1736 3524 cmd.exe attrib.exe PID 3524 wrote to memory of 1736 3524 cmd.exe attrib.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe PID 4916 wrote to memory of 1824 4916 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe"C:\Users\Admin\AppData\Local\Temp\7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 6362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 9882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 9882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 9882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 10642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 11802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 12002⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 6203⤵
- Program crash
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 9123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 9203⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 9763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 9563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 10083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 10123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 9643⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4108 -ip 41081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4108 -ip 41081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4108 -ip 41081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4108 -ip 41081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4108 -ip 41081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4108 -ip 41081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4108 -ip 41081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4916 -ip 49161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4916 -ip 49161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4916 -ip 49161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4916 -ip 49161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4916 -ip 49161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4916 -ip 49161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4916 -ip 49161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4916 -ip 49161⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
440KB
MD5a56c8f7c8cc94966093d7ea2b3241f12
SHA1e12bdd5b96295d73e2bd14b63d5be1dffe485796
SHA2567925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744
SHA5125f343bd670d633f403d561312de638a4eac63bb937b86557c39b56f89a86ac94382319a36ac9bff5e9a4401e2f91950f4129e945e51668cd8937ec4a7c8849a6
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
440KB
MD5a56c8f7c8cc94966093d7ea2b3241f12
SHA1e12bdd5b96295d73e2bd14b63d5be1dffe485796
SHA2567925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744
SHA5125f343bd670d633f403d561312de638a4eac63bb937b86557c39b56f89a86ac94382319a36ac9bff5e9a4401e2f91950f4129e945e51668cd8937ec4a7c8849a6
-
memory/1736-141-0x0000000000000000-mapping.dmp
-
memory/1824-144-0x0000000000000000-mapping.dmp
-
memory/3524-136-0x0000000000000000-mapping.dmp
-
memory/4100-137-0x0000000000000000-mapping.dmp
-
memory/4108-135-0x0000000000400000-0x0000000000B9C000-memory.dmpFilesize
7.6MB
-
memory/4108-132-0x0000000000E6B000-0x0000000000EAB000-memory.dmpFilesize
256KB
-
memory/4108-134-0x0000000000E6B000-0x0000000000EAB000-memory.dmpFilesize
256KB
-
memory/4108-133-0x0000000000400000-0x0000000000B9C000-memory.dmpFilesize
7.6MB
-
memory/4916-138-0x0000000000000000-mapping.dmp
-
memory/4916-142-0x0000000000C4B000-0x0000000000C8B000-memory.dmpFilesize
256KB
-
memory/4916-143-0x0000000000400000-0x0000000000B9C000-memory.dmpFilesize
7.6MB
-
memory/4916-145-0x0000000000C4B000-0x0000000000C8B000-memory.dmpFilesize
256KB
-
memory/4916-146-0x0000000000400000-0x0000000000B9C000-memory.dmpFilesize
7.6MB