Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
10-11-2020 11:36
Static task
static1
Behavioral task
behavioral1
Sample
0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe
Resource
win10v20201028
General
-
Target
0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe
-
Size
435KB
-
MD5
380a4c6e00eaf2178218caccea4d1bc6
-
SHA1
04141863defce9312434f5e2f7386e629c0f0b17
-
SHA256
0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a
-
SHA512
187d34126eb202c2d052a52e05bc2ef1a7245186bc480c287a3e6d48b1a0ebe1ec91d7630f95e1c61e56fc342c52a38cbe6c6778363dbb78d9d516ca6f906582
Malware Config
Extracted
darkcomet
06-11-2020
LAMIA-41739.portmap.io:41739
karmina113.sytes.net:7777
karmina200.sytes.net:7777
DC_MUTEX-R9E2RDG
-
InstallPath
svchost\svchost.exe
-
gencode
dneJWn9fFTdt
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost\\svchost.exe" 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe -
Executes dropped EXE 3 IoCs
Processes:
svchost.exesvchost.exesvchost.exepid process 2040 svchost.exe 1612 svchost.exe 1756 svchost.exe -
Processes:
resource yara_rule behavioral1/memory/1964-4-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/1964-6-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/1964-7-0x0000000000400000-0x00000000004C7000-memory.dmp upx -
Loads dropped DLL 3 IoCs
Processes:
0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exesvchost.exepid process 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe 2040 svchost.exe 2040 svchost.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe" 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost\\svchost.exe" 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost\\svchost.exe" svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exesvchost.exedescription pid process target process PID 1668 set thread context of 1964 1668 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe PID 2040 set thread context of 1756 2040 svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
svchost.exepid process 2040 svchost.exe 2040 svchost.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exesvchost.exesvchost.exedescription pid process Token: SeDebugPrivilege 1668 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeIncreaseQuotaPrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeSecurityPrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeTakeOwnershipPrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeLoadDriverPrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeSystemProfilePrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeSystemtimePrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeProfSingleProcessPrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeIncBasePriorityPrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeCreatePagefilePrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeBackupPrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeRestorePrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeShutdownPrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeDebugPrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeSystemEnvironmentPrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeChangeNotifyPrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeRemoteShutdownPrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeUndockPrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeManageVolumePrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeImpersonatePrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeCreateGlobalPrivilege 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: 33 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: 34 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: 35 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe Token: SeDebugPrivilege 2040 svchost.exe Token: SeIncreaseQuotaPrivilege 1756 svchost.exe Token: SeSecurityPrivilege 1756 svchost.exe Token: SeTakeOwnershipPrivilege 1756 svchost.exe Token: SeLoadDriverPrivilege 1756 svchost.exe Token: SeSystemProfilePrivilege 1756 svchost.exe Token: SeSystemtimePrivilege 1756 svchost.exe Token: SeProfSingleProcessPrivilege 1756 svchost.exe Token: SeIncBasePriorityPrivilege 1756 svchost.exe Token: SeCreatePagefilePrivilege 1756 svchost.exe Token: SeBackupPrivilege 1756 svchost.exe Token: SeRestorePrivilege 1756 svchost.exe Token: SeShutdownPrivilege 1756 svchost.exe Token: SeDebugPrivilege 1756 svchost.exe Token: SeSystemEnvironmentPrivilege 1756 svchost.exe Token: SeChangeNotifyPrivilege 1756 svchost.exe Token: SeRemoteShutdownPrivilege 1756 svchost.exe Token: SeUndockPrivilege 1756 svchost.exe Token: SeManageVolumePrivilege 1756 svchost.exe Token: SeImpersonatePrivilege 1756 svchost.exe Token: SeCreateGlobalPrivilege 1756 svchost.exe Token: 33 1756 svchost.exe Token: 34 1756 svchost.exe Token: 35 1756 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svchost.exepid process 1756 svchost.exe -
Suspicious use of WriteProcessMemory 63 IoCs
Processes:
0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.execmd.execmd.exesvchost.exesvchost.exedescription pid process target process PID 1668 wrote to memory of 1964 1668 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe PID 1668 wrote to memory of 1964 1668 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe PID 1668 wrote to memory of 1964 1668 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe PID 1668 wrote to memory of 1964 1668 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe PID 1668 wrote to memory of 1964 1668 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe PID 1668 wrote to memory of 1964 1668 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe PID 1668 wrote to memory of 1964 1668 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe PID 1668 wrote to memory of 1964 1668 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe PID 1964 wrote to memory of 1884 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe cmd.exe PID 1964 wrote to memory of 1884 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe cmd.exe PID 1964 wrote to memory of 1884 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe cmd.exe PID 1964 wrote to memory of 1884 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe cmd.exe PID 1964 wrote to memory of 1708 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe cmd.exe PID 1964 wrote to memory of 1708 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe cmd.exe PID 1964 wrote to memory of 1708 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe cmd.exe PID 1964 wrote to memory of 1708 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe cmd.exe PID 1884 wrote to memory of 1820 1884 cmd.exe attrib.exe PID 1884 wrote to memory of 1820 1884 cmd.exe attrib.exe PID 1884 wrote to memory of 1820 1884 cmd.exe attrib.exe PID 1884 wrote to memory of 1820 1884 cmd.exe attrib.exe PID 1708 wrote to memory of 1692 1708 cmd.exe attrib.exe PID 1708 wrote to memory of 1692 1708 cmd.exe attrib.exe PID 1708 wrote to memory of 1692 1708 cmd.exe attrib.exe PID 1708 wrote to memory of 1692 1708 cmd.exe attrib.exe PID 1964 wrote to memory of 2040 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe svchost.exe PID 1964 wrote to memory of 2040 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe svchost.exe PID 1964 wrote to memory of 2040 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe svchost.exe PID 1964 wrote to memory of 2040 1964 0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe svchost.exe PID 2040 wrote to memory of 1612 2040 svchost.exe svchost.exe PID 2040 wrote to memory of 1612 2040 svchost.exe svchost.exe PID 2040 wrote to memory of 1612 2040 svchost.exe svchost.exe PID 2040 wrote to memory of 1612 2040 svchost.exe svchost.exe PID 2040 wrote to memory of 1756 2040 svchost.exe svchost.exe PID 2040 wrote to memory of 1756 2040 svchost.exe svchost.exe PID 2040 wrote to memory of 1756 2040 svchost.exe svchost.exe PID 2040 wrote to memory of 1756 2040 svchost.exe svchost.exe PID 2040 wrote to memory of 1756 2040 svchost.exe svchost.exe PID 2040 wrote to memory of 1756 2040 svchost.exe svchost.exe PID 2040 wrote to memory of 1756 2040 svchost.exe svchost.exe PID 2040 wrote to memory of 1756 2040 svchost.exe svchost.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe PID 1756 wrote to memory of 336 1756 svchost.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1820 attrib.exe 1692 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe"C:\Users\Admin\AppData\Local\Temp\0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe"C:\Users\Admin\AppData\Local\Temp\0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe"2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\0760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a.exe" +s +h4⤵
- Views/modifies file attributes
PID:1820 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Views/modifies file attributes
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exe"4⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\notepad.exenotepad5⤵PID:336
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exeMD5
380a4c6e00eaf2178218caccea4d1bc6
SHA104141863defce9312434f5e2f7386e629c0f0b17
SHA2560760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a
SHA512187d34126eb202c2d052a52e05bc2ef1a7245186bc480c287a3e6d48b1a0ebe1ec91d7630f95e1c61e56fc342c52a38cbe6c6778363dbb78d9d516ca6f906582
-
C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exeMD5
380a4c6e00eaf2178218caccea4d1bc6
SHA104141863defce9312434f5e2f7386e629c0f0b17
SHA2560760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a
SHA512187d34126eb202c2d052a52e05bc2ef1a7245186bc480c287a3e6d48b1a0ebe1ec91d7630f95e1c61e56fc342c52a38cbe6c6778363dbb78d9d516ca6f906582
-
C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exeMD5
380a4c6e00eaf2178218caccea4d1bc6
SHA104141863defce9312434f5e2f7386e629c0f0b17
SHA2560760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a
SHA512187d34126eb202c2d052a52e05bc2ef1a7245186bc480c287a3e6d48b1a0ebe1ec91d7630f95e1c61e56fc342c52a38cbe6c6778363dbb78d9d516ca6f906582
-
C:\Users\Admin\AppData\Local\Temp\svchost\svchost.exeMD5
380a4c6e00eaf2178218caccea4d1bc6
SHA104141863defce9312434f5e2f7386e629c0f0b17
SHA2560760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a
SHA512187d34126eb202c2d052a52e05bc2ef1a7245186bc480c287a3e6d48b1a0ebe1ec91d7630f95e1c61e56fc342c52a38cbe6c6778363dbb78d9d516ca6f906582
-
\Users\Admin\AppData\Local\Temp\svchost\svchost.exeMD5
380a4c6e00eaf2178218caccea4d1bc6
SHA104141863defce9312434f5e2f7386e629c0f0b17
SHA2560760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a
SHA512187d34126eb202c2d052a52e05bc2ef1a7245186bc480c287a3e6d48b1a0ebe1ec91d7630f95e1c61e56fc342c52a38cbe6c6778363dbb78d9d516ca6f906582
-
\Users\Admin\AppData\Local\Temp\svchost\svchost.exeMD5
380a4c6e00eaf2178218caccea4d1bc6
SHA104141863defce9312434f5e2f7386e629c0f0b17
SHA2560760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a
SHA512187d34126eb202c2d052a52e05bc2ef1a7245186bc480c287a3e6d48b1a0ebe1ec91d7630f95e1c61e56fc342c52a38cbe6c6778363dbb78d9d516ca6f906582
-
\Users\Admin\AppData\Local\Temp\svchost\svchost.exeMD5
380a4c6e00eaf2178218caccea4d1bc6
SHA104141863defce9312434f5e2f7386e629c0f0b17
SHA2560760a20f6fd56ff65c69d851987a5655001e0029c36add11f54e5ee49133055a
SHA512187d34126eb202c2d052a52e05bc2ef1a7245186bc480c287a3e6d48b1a0ebe1ec91d7630f95e1c61e56fc342c52a38cbe6c6778363dbb78d9d516ca6f906582
-
memory/336-28-0x0000000000000000-mapping.dmp
-
memory/336-30-0x0000000000000000-mapping.dmp
-
memory/336-29-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/1668-1-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/1668-0-0x00000000744C0000-0x0000000074BAE000-memory.dmpFilesize
6.9MB
-
memory/1668-3-0x00000000004C0000-0x00000000004C3000-memory.dmpFilesize
12KB
-
memory/1692-11-0x0000000000000000-mapping.dmp
-
memory/1708-9-0x0000000000000000-mapping.dmp
-
memory/1756-24-0x00000000004BD830-mapping.dmp
-
memory/1820-10-0x0000000000000000-mapping.dmp
-
memory/1884-8-0x0000000000000000-mapping.dmp
-
memory/1964-4-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1964-5-0x00000000004BD830-mapping.dmp
-
memory/1964-6-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/1964-7-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/2040-17-0x0000000000880000-0x0000000000881000-memory.dmpFilesize
4KB
-
memory/2040-16-0x00000000728C0000-0x0000000072FAE000-memory.dmpFilesize
6.9MB
-
memory/2040-13-0x0000000000000000-mapping.dmp