Analysis
-
max time kernel
150s -
max time network
57s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 03:57
Static task
static1
Behavioral task
behavioral1
Sample
d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998.exe
Resource
win7-20220812-en
General
-
Target
d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998.exe
-
Size
820KB
-
MD5
7f0263ae88e07076889366970ce6147f
-
SHA1
84a669be1ad036f481be5bca379b6d962523342e
-
SHA256
d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998
-
SHA512
a8b02c7cfc7296f1eae5415c4aa4f4c8b1c02ad30ea7047f9eb7e79c3c9d677b4ca5a98a87a7d48c343e5bacbb7f157af91296bcc26ec75c1600e1a95ce304e2
-
SSDEEP
12288:9H0sGRDS9vqmZzw7JLjJoGmpuoJQQJBIwV1Kathio+:GkhqSzwRjporBB1Kj
Malware Config
Extracted
darkcomet
Strain10
mediaupdate.sytes.net:1604
DC_MUTEX-4WRRCYC
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
QbtXBpuhirwF
-
install
true
-
offline_keylogger
false
-
persistence
false
-
reg_key
MediaUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
AppLaunch.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" AppLaunch.exe -
Executes dropped EXE 3 IoCs
Processes:
MsCtfMonitor.exertscom.exemsdcsc.exepid process 968 MsCtfMonitor.exe 1708 rtscom.exe 272 msdcsc.exe -
Processes:
resource yara_rule behavioral1/memory/1304-61-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1304-63-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1304-64-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1304-66-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1304-73-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1304-75-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1304-81-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1304-82-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/832-101-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/832-103-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/832-104-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/832-105-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Loads dropped DLL 3 IoCs
Processes:
explorer.exeMsCtfMonitor.exeAppLaunch.exepid process 1360 explorer.exe 968 MsCtfMonitor.exe 1304 AppLaunch.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
MsCtfMonitor.exeAppLaunch.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Activex Application Updater = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\MsCtfMonitor.exe" MsCtfMonitor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MediaUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" AppLaunch.exe -
Drops file in System32 directory 3 IoCs
Processes:
AppLaunch.exedescription ioc process File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe AppLaunch.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe AppLaunch.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ AppLaunch.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
explorer.exertscom.exedescription pid process target process PID 1360 set thread context of 1304 1360 explorer.exe AppLaunch.exe PID 1708 set thread context of 832 1708 rtscom.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998.exeexplorer.exeMsCtfMonitor.exertscom.exepid process 1948 d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998.exe 1948 d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 968 MsCtfMonitor.exe 1708 rtscom.exe 1708 rtscom.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1360 explorer.exe 1708 rtscom.exe 1708 rtscom.exe 1360 explorer.exe 1708 rtscom.exe 1360 explorer.exe 1708 rtscom.exe 1360 explorer.exe 1360 explorer.exe 1708 rtscom.exe 1708 rtscom.exe 1360 explorer.exe 1360 explorer.exe 1708 rtscom.exe 1708 rtscom.exe 1360 explorer.exe 1360 explorer.exe 1708 rtscom.exe 1708 rtscom.exe 1360 explorer.exe 1708 rtscom.exe 1360 explorer.exe 1360 explorer.exe 1708 rtscom.exe 1360 explorer.exe 1708 rtscom.exe 1708 rtscom.exe 1360 explorer.exe 1360 explorer.exe 1708 rtscom.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998.exepid process 1948 d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
Processes:
d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998.exeexplorer.exeMsCtfMonitor.exertscom.exeAppLaunch.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 1948 d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998.exe Token: SeDebugPrivilege 1360 explorer.exe Token: SeDebugPrivilege 968 MsCtfMonitor.exe Token: SeDebugPrivilege 1708 rtscom.exe Token: SeIncreaseQuotaPrivilege 1304 AppLaunch.exe Token: SeSecurityPrivilege 1304 AppLaunch.exe Token: SeTakeOwnershipPrivilege 1304 AppLaunch.exe Token: SeLoadDriverPrivilege 1304 AppLaunch.exe Token: SeSystemProfilePrivilege 1304 AppLaunch.exe Token: SeSystemtimePrivilege 1304 AppLaunch.exe Token: SeProfSingleProcessPrivilege 1304 AppLaunch.exe Token: SeIncBasePriorityPrivilege 1304 AppLaunch.exe Token: SeCreatePagefilePrivilege 1304 AppLaunch.exe Token: SeBackupPrivilege 1304 AppLaunch.exe Token: SeRestorePrivilege 1304 AppLaunch.exe Token: SeShutdownPrivilege 1304 AppLaunch.exe Token: SeDebugPrivilege 1304 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 1304 AppLaunch.exe Token: SeChangeNotifyPrivilege 1304 AppLaunch.exe Token: SeRemoteShutdownPrivilege 1304 AppLaunch.exe Token: SeUndockPrivilege 1304 AppLaunch.exe Token: SeManageVolumePrivilege 1304 AppLaunch.exe Token: SeImpersonatePrivilege 1304 AppLaunch.exe Token: SeCreateGlobalPrivilege 1304 AppLaunch.exe Token: 33 1304 AppLaunch.exe Token: 34 1304 AppLaunch.exe Token: 35 1304 AppLaunch.exe Token: SeIncreaseQuotaPrivilege 832 AppLaunch.exe Token: SeSecurityPrivilege 832 AppLaunch.exe Token: SeTakeOwnershipPrivilege 832 AppLaunch.exe Token: SeLoadDriverPrivilege 832 AppLaunch.exe Token: SeSystemProfilePrivilege 832 AppLaunch.exe Token: SeSystemtimePrivilege 832 AppLaunch.exe Token: SeProfSingleProcessPrivilege 832 AppLaunch.exe Token: SeIncBasePriorityPrivilege 832 AppLaunch.exe Token: SeCreatePagefilePrivilege 832 AppLaunch.exe Token: SeBackupPrivilege 832 AppLaunch.exe Token: SeRestorePrivilege 832 AppLaunch.exe Token: SeShutdownPrivilege 832 AppLaunch.exe Token: SeDebugPrivilege 832 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 832 AppLaunch.exe Token: SeChangeNotifyPrivilege 832 AppLaunch.exe Token: SeRemoteShutdownPrivilege 832 AppLaunch.exe Token: SeUndockPrivilege 832 AppLaunch.exe Token: SeManageVolumePrivilege 832 AppLaunch.exe Token: SeImpersonatePrivilege 832 AppLaunch.exe Token: SeCreateGlobalPrivilege 832 AppLaunch.exe Token: 33 832 AppLaunch.exe Token: 34 832 AppLaunch.exe Token: 35 832 AppLaunch.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998.exeexplorer.exeMsCtfMonitor.exeAppLaunch.exertscom.exedescription pid process target process PID 1948 wrote to memory of 1360 1948 d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998.exe explorer.exe PID 1948 wrote to memory of 1360 1948 d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998.exe explorer.exe PID 1948 wrote to memory of 1360 1948 d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998.exe explorer.exe PID 1948 wrote to memory of 1360 1948 d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998.exe explorer.exe PID 1360 wrote to memory of 1304 1360 explorer.exe AppLaunch.exe PID 1360 wrote to memory of 1304 1360 explorer.exe AppLaunch.exe PID 1360 wrote to memory of 1304 1360 explorer.exe AppLaunch.exe PID 1360 wrote to memory of 1304 1360 explorer.exe AppLaunch.exe PID 1360 wrote to memory of 1304 1360 explorer.exe AppLaunch.exe PID 1360 wrote to memory of 1304 1360 explorer.exe AppLaunch.exe PID 1360 wrote to memory of 1304 1360 explorer.exe AppLaunch.exe PID 1360 wrote to memory of 1304 1360 explorer.exe AppLaunch.exe PID 1360 wrote to memory of 1304 1360 explorer.exe AppLaunch.exe PID 1360 wrote to memory of 1304 1360 explorer.exe AppLaunch.exe PID 1360 wrote to memory of 1304 1360 explorer.exe AppLaunch.exe PID 1360 wrote to memory of 968 1360 explorer.exe MsCtfMonitor.exe PID 1360 wrote to memory of 968 1360 explorer.exe MsCtfMonitor.exe PID 1360 wrote to memory of 968 1360 explorer.exe MsCtfMonitor.exe PID 1360 wrote to memory of 968 1360 explorer.exe MsCtfMonitor.exe PID 968 wrote to memory of 1708 968 MsCtfMonitor.exe rtscom.exe PID 968 wrote to memory of 1708 968 MsCtfMonitor.exe rtscom.exe PID 968 wrote to memory of 1708 968 MsCtfMonitor.exe rtscom.exe PID 968 wrote to memory of 1708 968 MsCtfMonitor.exe rtscom.exe PID 1304 wrote to memory of 272 1304 AppLaunch.exe msdcsc.exe PID 1304 wrote to memory of 272 1304 AppLaunch.exe msdcsc.exe PID 1304 wrote to memory of 272 1304 AppLaunch.exe msdcsc.exe PID 1304 wrote to memory of 272 1304 AppLaunch.exe msdcsc.exe PID 1304 wrote to memory of 272 1304 AppLaunch.exe msdcsc.exe PID 1304 wrote to memory of 272 1304 AppLaunch.exe msdcsc.exe PID 1304 wrote to memory of 272 1304 AppLaunch.exe msdcsc.exe PID 1708 wrote to memory of 832 1708 rtscom.exe AppLaunch.exe PID 1708 wrote to memory of 832 1708 rtscom.exe AppLaunch.exe PID 1708 wrote to memory of 832 1708 rtscom.exe AppLaunch.exe PID 1708 wrote to memory of 832 1708 rtscom.exe AppLaunch.exe PID 1708 wrote to memory of 832 1708 rtscom.exe AppLaunch.exe PID 1708 wrote to memory of 832 1708 rtscom.exe AppLaunch.exe PID 1708 wrote to memory of 832 1708 rtscom.exe AppLaunch.exe PID 1708 wrote to memory of 832 1708 rtscom.exe AppLaunch.exe PID 1708 wrote to memory of 832 1708 rtscom.exe AppLaunch.exe PID 1708 wrote to memory of 832 1708 rtscom.exe AppLaunch.exe PID 1708 wrote to memory of 832 1708 rtscom.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998.exe"C:\Users\Admin\AppData\Local\Temp\d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe3⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsCtfMonitor.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsCtfMonitor.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rtscom.exe"C:\Users\Admin\AppData\Local\Temp\rtscom.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe5⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\rtscom.exeFilesize
820KB
MD57f0263ae88e07076889366970ce6147f
SHA184a669be1ad036f481be5bca379b6d962523342e
SHA256d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998
SHA512a8b02c7cfc7296f1eae5415c4aa4f4c8b1c02ad30ea7047f9eb7e79c3c9d677b4ca5a98a87a7d48c343e5bacbb7f157af91296bcc26ec75c1600e1a95ce304e2
-
C:\Users\Admin\AppData\Local\Temp\rtscom.exeFilesize
820KB
MD57f0263ae88e07076889366970ce6147f
SHA184a669be1ad036f481be5bca379b6d962523342e
SHA256d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998
SHA512a8b02c7cfc7296f1eae5415c4aa4f4c8b1c02ad30ea7047f9eb7e79c3c9d677b4ca5a98a87a7d48c343e5bacbb7f157af91296bcc26ec75c1600e1a95ce304e2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsCtfMonitor.exeFilesize
10KB
MD535d27e7f59c8f5513992c45176692cea
SHA1995e3161e4aec8352944d8bd89bc39336ca7e5a2
SHA25681b234bc8bfc469366ecf1e050b876499350decc68014d3c3aa35b61cf7562c6
SHA5127d33964473172f385deac03edab825037003fdbfe88f5695ac1832804ed46d8b068c77b30c2742688f8cbb7b15b3c245f9a9a8ecb702a39b29a0dfa41ebcdede
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsCtfMonitor.exeFilesize
10KB
MD535d27e7f59c8f5513992c45176692cea
SHA1995e3161e4aec8352944d8bd89bc39336ca7e5a2
SHA25681b234bc8bfc469366ecf1e050b876499350decc68014d3c3aa35b61cf7562c6
SHA5127d33964473172f385deac03edab825037003fdbfe88f5695ac1832804ed46d8b068c77b30c2742688f8cbb7b15b3c245f9a9a8ecb702a39b29a0dfa41ebcdede
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
54KB
MD50f01571a3e4c71eb4313175aae86488e
SHA12ba648afe2cd52edf5f25e304f77d457abf7ac0e
SHA2568cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022
SHA512159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
54KB
MD50f01571a3e4c71eb4313175aae86488e
SHA12ba648afe2cd52edf5f25e304f77d457abf7ac0e
SHA2568cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022
SHA512159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794
-
\Users\Admin\AppData\Local\Temp\rtscom.exeFilesize
820KB
MD57f0263ae88e07076889366970ce6147f
SHA184a669be1ad036f481be5bca379b6d962523342e
SHA256d87d4d7a0dbb25f084859b8512e23f2ef94589655f2cd417c25009e9605c6998
SHA512a8b02c7cfc7296f1eae5415c4aa4f4c8b1c02ad30ea7047f9eb7e79c3c9d677b4ca5a98a87a7d48c343e5bacbb7f157af91296bcc26ec75c1600e1a95ce304e2
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsCtfMonitor.exeFilesize
10KB
MD535d27e7f59c8f5513992c45176692cea
SHA1995e3161e4aec8352944d8bd89bc39336ca7e5a2
SHA25681b234bc8bfc469366ecf1e050b876499350decc68014d3c3aa35b61cf7562c6
SHA5127d33964473172f385deac03edab825037003fdbfe88f5695ac1832804ed46d8b068c77b30c2742688f8cbb7b15b3c245f9a9a8ecb702a39b29a0dfa41ebcdede
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
54KB
MD50f01571a3e4c71eb4313175aae86488e
SHA12ba648afe2cd52edf5f25e304f77d457abf7ac0e
SHA2568cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022
SHA512159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794
-
memory/272-87-0x0000000000000000-mapping.dmp
-
memory/832-98-0x00000000004B5760-mapping.dmp
-
memory/832-101-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/832-103-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/832-104-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/832-105-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/832-106-0x0000000000478000-0x00000000004B6000-memory.dmpFilesize
248KB
-
memory/832-107-0x0000000000478000-0x00000000004B6000-memory.dmpFilesize
248KB
-
memory/968-91-0x0000000074590000-0x0000000074B3B000-memory.dmpFilesize
5.7MB
-
memory/968-69-0x0000000000000000-mapping.dmp
-
memory/968-83-0x0000000074590000-0x0000000074B3B000-memory.dmpFilesize
5.7MB
-
memory/1304-65-0x00000000004B5760-mapping.dmp
-
memory/1304-73-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1304-82-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1304-61-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1304-84-0x0000000000478000-0x00000000004B6000-memory.dmpFilesize
248KB
-
memory/1304-81-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1304-75-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1304-60-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1304-66-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1304-63-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1304-64-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1360-59-0x0000000074590000-0x0000000074B3B000-memory.dmpFilesize
5.7MB
-
memory/1360-58-0x0000000074590000-0x0000000074B3B000-memory.dmpFilesize
5.7MB
-
memory/1360-55-0x0000000000000000-mapping.dmp
-
memory/1708-85-0x0000000074590000-0x0000000074B3B000-memory.dmpFilesize
5.7MB
-
memory/1708-92-0x0000000074590000-0x0000000074B3B000-memory.dmpFilesize
5.7MB
-
memory/1708-78-0x0000000000000000-mapping.dmp
-
memory/1948-54-0x00000000764D1000-0x00000000764D3000-memory.dmpFilesize
8KB
-
memory/1948-57-0x0000000074590000-0x0000000074B3B000-memory.dmpFilesize
5.7MB