Analysis
-
max time kernel
188s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:58
Static task
static1
Behavioral task
behavioral1
Sample
d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe
Resource
win10v2004-20221111-en
General
-
Target
d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe
-
Size
838KB
-
MD5
1eb1d37928ffa971a4c74c965bc9e88e
-
SHA1
d3d3cb7b02d7c2699650b4adb19cd4d41c8cfe45
-
SHA256
d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca
-
SHA512
ccd895d36ac7a8136e739b99e78820447a3d739797cdf517cf407642af0ae2511fce3cbfafe461c1e1280f4ac64cb455a4dc78c6f29f06a8c7f6fd8fba514a98
-
SSDEEP
12288:qoxy8TP40QeYKbQ4wgMUMDSH+Mf3vW9RLGAcypv69CiGc1uWxU8p557:qWtTP4a1dMDSHytGvMY/qOUa55
Malware Config
Extracted
darkcomet
Guest16_min
customersservicebx.uni.me:2121
DCMIN_MUTEX-UZ6AB7L
-
gencode
s8XX3Rqr3xKD
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
WUDHost.exeAcctres.exeWUDHost.exepid process 2884 WUDHost.exe 1812 Acctres.exe 4268 WUDHost.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WUDHost.exeAcctres.exed925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation WUDHost.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation Acctres.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
WUDHost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Boot File Servicing Utility = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WUDHost.exe" WUDHost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exeAcctres.exedescription pid process target process PID 2220 set thread context of 216 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe vbc.exe PID 1812 set thread context of 1112 1812 Acctres.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exepid process 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe -
Suspicious use of AdjustPrivilegeToken 51 IoCs
Processes:
d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exevbc.exeWUDHost.exeAcctres.exevbc.exedescription pid process Token: SeDebugPrivilege 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe Token: SeIncreaseQuotaPrivilege 216 vbc.exe Token: SeSecurityPrivilege 216 vbc.exe Token: SeTakeOwnershipPrivilege 216 vbc.exe Token: SeLoadDriverPrivilege 216 vbc.exe Token: SeSystemProfilePrivilege 216 vbc.exe Token: SeSystemtimePrivilege 216 vbc.exe Token: SeProfSingleProcessPrivilege 216 vbc.exe Token: SeIncBasePriorityPrivilege 216 vbc.exe Token: SeCreatePagefilePrivilege 216 vbc.exe Token: SeBackupPrivilege 216 vbc.exe Token: SeRestorePrivilege 216 vbc.exe Token: SeShutdownPrivilege 216 vbc.exe Token: SeDebugPrivilege 216 vbc.exe Token: SeSystemEnvironmentPrivilege 216 vbc.exe Token: SeChangeNotifyPrivilege 216 vbc.exe Token: SeRemoteShutdownPrivilege 216 vbc.exe Token: SeUndockPrivilege 216 vbc.exe Token: SeManageVolumePrivilege 216 vbc.exe Token: SeImpersonatePrivilege 216 vbc.exe Token: SeCreateGlobalPrivilege 216 vbc.exe Token: 33 216 vbc.exe Token: 34 216 vbc.exe Token: 35 216 vbc.exe Token: 36 216 vbc.exe Token: SeDebugPrivilege 2884 WUDHost.exe Token: SeDebugPrivilege 1812 Acctres.exe Token: SeIncreaseQuotaPrivilege 1112 vbc.exe Token: SeSecurityPrivilege 1112 vbc.exe Token: SeTakeOwnershipPrivilege 1112 vbc.exe Token: SeLoadDriverPrivilege 1112 vbc.exe Token: SeSystemProfilePrivilege 1112 vbc.exe Token: SeSystemtimePrivilege 1112 vbc.exe Token: SeProfSingleProcessPrivilege 1112 vbc.exe Token: SeIncBasePriorityPrivilege 1112 vbc.exe Token: SeCreatePagefilePrivilege 1112 vbc.exe Token: SeBackupPrivilege 1112 vbc.exe Token: SeRestorePrivilege 1112 vbc.exe Token: SeShutdownPrivilege 1112 vbc.exe Token: SeDebugPrivilege 1112 vbc.exe Token: SeSystemEnvironmentPrivilege 1112 vbc.exe Token: SeChangeNotifyPrivilege 1112 vbc.exe Token: SeRemoteShutdownPrivilege 1112 vbc.exe Token: SeUndockPrivilege 1112 vbc.exe Token: SeManageVolumePrivilege 1112 vbc.exe Token: SeImpersonatePrivilege 1112 vbc.exe Token: SeCreateGlobalPrivilege 1112 vbc.exe Token: 33 1112 vbc.exe Token: 34 1112 vbc.exe Token: 35 1112 vbc.exe Token: 36 1112 vbc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vbc.exepid process 216 vbc.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exeWUDHost.exeAcctres.exedescription pid process target process PID 2220 wrote to memory of 216 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe vbc.exe PID 2220 wrote to memory of 216 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe vbc.exe PID 2220 wrote to memory of 216 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe vbc.exe PID 2220 wrote to memory of 216 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe vbc.exe PID 2220 wrote to memory of 216 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe vbc.exe PID 2220 wrote to memory of 216 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe vbc.exe PID 2220 wrote to memory of 216 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe vbc.exe PID 2220 wrote to memory of 216 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe vbc.exe PID 2220 wrote to memory of 216 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe vbc.exe PID 2220 wrote to memory of 216 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe vbc.exe PID 2220 wrote to memory of 216 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe vbc.exe PID 2220 wrote to memory of 216 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe vbc.exe PID 2220 wrote to memory of 2884 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe WUDHost.exe PID 2220 wrote to memory of 2884 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe WUDHost.exe PID 2220 wrote to memory of 2884 2220 d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe WUDHost.exe PID 2884 wrote to memory of 1812 2884 WUDHost.exe Acctres.exe PID 2884 wrote to memory of 1812 2884 WUDHost.exe Acctres.exe PID 2884 wrote to memory of 1812 2884 WUDHost.exe Acctres.exe PID 1812 wrote to memory of 1112 1812 Acctres.exe vbc.exe PID 1812 wrote to memory of 1112 1812 Acctres.exe vbc.exe PID 1812 wrote to memory of 1112 1812 Acctres.exe vbc.exe PID 1812 wrote to memory of 1112 1812 Acctres.exe vbc.exe PID 1812 wrote to memory of 1112 1812 Acctres.exe vbc.exe PID 1812 wrote to memory of 1112 1812 Acctres.exe vbc.exe PID 1812 wrote to memory of 1112 1812 Acctres.exe vbc.exe PID 1812 wrote to memory of 1112 1812 Acctres.exe vbc.exe PID 1812 wrote to memory of 1112 1812 Acctres.exe vbc.exe PID 1812 wrote to memory of 1112 1812 Acctres.exe vbc.exe PID 1812 wrote to memory of 1112 1812 Acctres.exe vbc.exe PID 1812 wrote to memory of 1112 1812 Acctres.exe vbc.exe PID 1812 wrote to memory of 4268 1812 Acctres.exe WUDHost.exe PID 1812 wrote to memory of 4268 1812 Acctres.exe WUDHost.exe PID 1812 wrote to memory of 4268 1812 Acctres.exe WUDHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe"C:\Users\Admin\AppData\Local\Temp\d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\WUDHost.exe.logFilesize
128B
MD5a5dcc7c9c08af7dddd82be5b036a4416
SHA14f998ca1526d199e355ffb435bae111a2779b994
SHA256e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5
SHA51256035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exeFilesize
838KB
MD51eb1d37928ffa971a4c74c965bc9e88e
SHA1d3d3cb7b02d7c2699650b4adb19cd4d41c8cfe45
SHA256d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca
SHA512ccd895d36ac7a8136e739b99e78820447a3d739797cdf517cf407642af0ae2511fce3cbfafe461c1e1280f4ac64cb455a4dc78c6f29f06a8c7f6fd8fba514a98
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exeFilesize
838KB
MD51eb1d37928ffa971a4c74c965bc9e88e
SHA1d3d3cb7b02d7c2699650b4adb19cd4d41c8cfe45
SHA256d925123b49f1202422b46e8d3db2941d96d5c33970aa74a58055f15d644958ca
SHA512ccd895d36ac7a8136e739b99e78820447a3d739797cdf517cf407642af0ae2511fce3cbfafe461c1e1280f4ac64cb455a4dc78c6f29f06a8c7f6fd8fba514a98
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exeFilesize
7KB
MD52c62f37716a62494ce5f45810719a3fc
SHA12887e7d8db8ad0bbc0cbe9de6c8359185c80c04d
SHA25651a00bf16cd01366357158cb76090db39af00bd839945f435b751f8b8037d07c
SHA512c10b8e2fb53522a2b816b1d9703799654ff0396c6f4b85fd5c0d7567e520f023e4fcf50658fac928ca7c472d17d345e246b4c78a5d04e2572b68d4ecb128e667
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exeFilesize
7KB
MD52c62f37716a62494ce5f45810719a3fc
SHA12887e7d8db8ad0bbc0cbe9de6c8359185c80c04d
SHA25651a00bf16cd01366357158cb76090db39af00bd839945f435b751f8b8037d07c
SHA512c10b8e2fb53522a2b816b1d9703799654ff0396c6f4b85fd5c0d7567e520f023e4fcf50658fac928ca7c472d17d345e246b4c78a5d04e2572b68d4ecb128e667
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exeFilesize
7KB
MD52c62f37716a62494ce5f45810719a3fc
SHA12887e7d8db8ad0bbc0cbe9de6c8359185c80c04d
SHA25651a00bf16cd01366357158cb76090db39af00bd839945f435b751f8b8037d07c
SHA512c10b8e2fb53522a2b816b1d9703799654ff0396c6f4b85fd5c0d7567e520f023e4fcf50658fac928ca7c472d17d345e246b4c78a5d04e2572b68d4ecb128e667
-
memory/216-138-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/216-135-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/216-134-0x0000000000000000-mapping.dmp
-
memory/216-137-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/216-136-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1112-155-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1112-150-0x0000000000000000-mapping.dmp
-
memory/1812-147-0x0000000074D60000-0x0000000075311000-memory.dmpFilesize
5.7MB
-
memory/1812-145-0x0000000000000000-mapping.dmp
-
memory/1812-148-0x0000000074D60000-0x0000000075311000-memory.dmpFilesize
5.7MB
-
memory/2220-152-0x0000000074D60000-0x0000000075311000-memory.dmpFilesize
5.7MB
-
memory/2220-132-0x0000000074D60000-0x0000000075311000-memory.dmpFilesize
5.7MB
-
memory/2220-133-0x0000000074D60000-0x0000000075311000-memory.dmpFilesize
5.7MB
-
memory/2884-139-0x0000000000000000-mapping.dmp
-
memory/2884-149-0x0000000074D60000-0x0000000075311000-memory.dmpFilesize
5.7MB
-
memory/2884-143-0x0000000074D60000-0x0000000075311000-memory.dmpFilesize
5.7MB
-
memory/2884-142-0x0000000074D60000-0x0000000075311000-memory.dmpFilesize
5.7MB
-
memory/4268-156-0x0000000000000000-mapping.dmp
-
memory/4268-159-0x0000000074D60000-0x0000000075311000-memory.dmpFilesize
5.7MB