Analysis
-
max time kernel
151s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 09:42
Static task
static1
Behavioral task
behavioral1
Sample
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe
Resource
win10v2004-20220901-en
General
-
Target
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe
-
Size
696KB
-
MD5
fa6817c001c89663999ff6d3c7fdb639
-
SHA1
3ec2e03437a1e8d0a1ab16588a73faf8879e8741
-
SHA256
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd
-
SHA512
edf3a2a240f78960586b1e6a552fd912859445298e5397fb97d1d0de29c48b93330bafde307448005989065dcaaf06bfce91e419ef0320ef4bc256fa3ddc386b
-
SSDEEP
12288:C/BJPqODJXXn3n0kZJc+vZi3G0khHCpp1tlAhpxz:6qOJXnkk/c2wW064dlY
Malware Config
Extracted
darkcomet
Spy
127.0.0.1:1604
nibiru3.duckdns.org:1604
nibiru33.duckdns.org:1604
DC_MUTEX-QE733CL
-
InstallPath
MSDCSC\Audio Realtek Driver.exe
-
gencode
R3iDnMXzRFHM
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Audio Realtek Driver
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\Audio Realtek Driver.exe" f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe -
Executes dropped EXE 2 IoCs
Processes:
Audio Realtek Driver.exeAudio Realtek Driver.exepid process 836 Audio Realtek Driver.exe 1016 Audio Realtek Driver.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 2036 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exeAudio Realtek Driver.exepid process 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe 836 Audio Realtek Driver.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exeAudio Realtek Driver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Audio Realtek Driver = "C:\\Users\\Admin\\Documents\\MSDCSC\\Audio Realtek Driver.exe" f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Audio Realtek Driver = "C:\\Users\\Admin\\Documents\\MSDCSC\\Audio Realtek Driver.exe" Audio Realtek Driver.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exeAudio Realtek Driver.exedescription pid process target process PID 1112 set thread context of 1708 1112 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 836 set thread context of 1016 836 Audio Realtek Driver.exe Audio Realtek Driver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exeAudio Realtek Driver.exedescription pid process Token: SeIncreaseQuotaPrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeSecurityPrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeTakeOwnershipPrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeLoadDriverPrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeSystemProfilePrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeSystemtimePrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeProfSingleProcessPrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeIncBasePriorityPrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeCreatePagefilePrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeBackupPrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeRestorePrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeShutdownPrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeDebugPrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeSystemEnvironmentPrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeChangeNotifyPrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeRemoteShutdownPrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeUndockPrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeManageVolumePrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeImpersonatePrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeCreateGlobalPrivilege 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: 33 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: 34 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: 35 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeIncreaseQuotaPrivilege 1016 Audio Realtek Driver.exe Token: SeSecurityPrivilege 1016 Audio Realtek Driver.exe Token: SeTakeOwnershipPrivilege 1016 Audio Realtek Driver.exe Token: SeLoadDriverPrivilege 1016 Audio Realtek Driver.exe Token: SeSystemProfilePrivilege 1016 Audio Realtek Driver.exe Token: SeSystemtimePrivilege 1016 Audio Realtek Driver.exe Token: SeProfSingleProcessPrivilege 1016 Audio Realtek Driver.exe Token: SeIncBasePriorityPrivilege 1016 Audio Realtek Driver.exe Token: SeCreatePagefilePrivilege 1016 Audio Realtek Driver.exe Token: SeBackupPrivilege 1016 Audio Realtek Driver.exe Token: SeRestorePrivilege 1016 Audio Realtek Driver.exe Token: SeShutdownPrivilege 1016 Audio Realtek Driver.exe Token: SeDebugPrivilege 1016 Audio Realtek Driver.exe Token: SeSystemEnvironmentPrivilege 1016 Audio Realtek Driver.exe Token: SeChangeNotifyPrivilege 1016 Audio Realtek Driver.exe Token: SeRemoteShutdownPrivilege 1016 Audio Realtek Driver.exe Token: SeUndockPrivilege 1016 Audio Realtek Driver.exe Token: SeManageVolumePrivilege 1016 Audio Realtek Driver.exe Token: SeImpersonatePrivilege 1016 Audio Realtek Driver.exe Token: SeCreateGlobalPrivilege 1016 Audio Realtek Driver.exe Token: 33 1016 Audio Realtek Driver.exe Token: 34 1016 Audio Realtek Driver.exe Token: 35 1016 Audio Realtek Driver.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Audio Realtek Driver.exepid process 1016 Audio Realtek Driver.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exef5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exeAudio Realtek Driver.exeAudio Realtek Driver.exedescription pid process target process PID 1112 wrote to memory of 1708 1112 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 1112 wrote to memory of 1708 1112 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 1112 wrote to memory of 1708 1112 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 1112 wrote to memory of 1708 1112 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 1112 wrote to memory of 1708 1112 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 1112 wrote to memory of 1708 1112 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 1112 wrote to memory of 1708 1112 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 1112 wrote to memory of 1708 1112 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 1112 wrote to memory of 1708 1112 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 1112 wrote to memory of 1708 1112 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 1112 wrote to memory of 1708 1112 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 1112 wrote to memory of 1708 1112 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 1112 wrote to memory of 1708 1112 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 1708 wrote to memory of 2036 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 1708 wrote to memory of 2036 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 1708 wrote to memory of 2036 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 1708 wrote to memory of 2036 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 1708 wrote to memory of 2036 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 1708 wrote to memory of 2036 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 1708 wrote to memory of 2036 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 1708 wrote to memory of 2036 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 1708 wrote to memory of 2036 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 1708 wrote to memory of 2036 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 1708 wrote to memory of 2036 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 1708 wrote to memory of 2036 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 1708 wrote to memory of 2036 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 1708 wrote to memory of 2036 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 1708 wrote to memory of 2036 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 1708 wrote to memory of 2036 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 1708 wrote to memory of 2036 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 1708 wrote to memory of 2036 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 1708 wrote to memory of 836 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Audio Realtek Driver.exe PID 1708 wrote to memory of 836 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Audio Realtek Driver.exe PID 1708 wrote to memory of 836 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Audio Realtek Driver.exe PID 1708 wrote to memory of 836 1708 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Audio Realtek Driver.exe PID 836 wrote to memory of 1016 836 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 836 wrote to memory of 1016 836 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 836 wrote to memory of 1016 836 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 836 wrote to memory of 1016 836 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 836 wrote to memory of 1016 836 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 836 wrote to memory of 1016 836 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 836 wrote to memory of 1016 836 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 836 wrote to memory of 1016 836 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 836 wrote to memory of 1016 836 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 836 wrote to memory of 1016 836 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 836 wrote to memory of 1016 836 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 836 wrote to memory of 1016 836 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 836 wrote to memory of 1016 836 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 1016 wrote to memory of 1448 1016 Audio Realtek Driver.exe notepad.exe PID 1016 wrote to memory of 1448 1016 Audio Realtek Driver.exe notepad.exe PID 1016 wrote to memory of 1448 1016 Audio Realtek Driver.exe notepad.exe PID 1016 wrote to memory of 1448 1016 Audio Realtek Driver.exe notepad.exe PID 1016 wrote to memory of 1448 1016 Audio Realtek Driver.exe notepad.exe PID 1016 wrote to memory of 1448 1016 Audio Realtek Driver.exe notepad.exe PID 1016 wrote to memory of 1448 1016 Audio Realtek Driver.exe notepad.exe PID 1016 wrote to memory of 1448 1016 Audio Realtek Driver.exe notepad.exe PID 1016 wrote to memory of 1448 1016 Audio Realtek Driver.exe notepad.exe PID 1016 wrote to memory of 1448 1016 Audio Realtek Driver.exe notepad.exe PID 1016 wrote to memory of 1448 1016 Audio Realtek Driver.exe notepad.exe PID 1016 wrote to memory of 1448 1016 Audio Realtek Driver.exe notepad.exe PID 1016 wrote to memory of 1448 1016 Audio Realtek Driver.exe notepad.exe PID 1016 wrote to memory of 1448 1016 Audio Realtek Driver.exe notepad.exe PID 1016 wrote to memory of 1448 1016 Audio Realtek Driver.exe notepad.exe PID 1016 wrote to memory of 1448 1016 Audio Realtek Driver.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe"C:\Users\Admin\AppData\Local\Temp\f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe"C:\Users\Admin\AppData\Local\Temp\f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe"2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Deletes itself
PID:2036 -
C:\Users\Admin\Documents\MSDCSC\Audio Realtek Driver.exe"C:\Users\Admin\Documents\MSDCSC\Audio Realtek Driver.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\Documents\MSDCSC\Audio Realtek Driver.exe"C:\Users\Admin\Documents\MSDCSC\Audio Realtek Driver.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\notepad.exenotepad5⤵PID:1448
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\Audio Realtek Driver.exeFilesize
696KB
MD5fa6817c001c89663999ff6d3c7fdb639
SHA13ec2e03437a1e8d0a1ab16588a73faf8879e8741
SHA256f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd
SHA512edf3a2a240f78960586b1e6a552fd912859445298e5397fb97d1d0de29c48b93330bafde307448005989065dcaaf06bfce91e419ef0320ef4bc256fa3ddc386b
-
C:\Users\Admin\Documents\MSDCSC\Audio Realtek Driver.exeFilesize
696KB
MD5fa6817c001c89663999ff6d3c7fdb639
SHA13ec2e03437a1e8d0a1ab16588a73faf8879e8741
SHA256f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd
SHA512edf3a2a240f78960586b1e6a552fd912859445298e5397fb97d1d0de29c48b93330bafde307448005989065dcaaf06bfce91e419ef0320ef4bc256fa3ddc386b
-
C:\Users\Admin\Documents\MSDCSC\Audio Realtek Driver.exeFilesize
696KB
MD5fa6817c001c89663999ff6d3c7fdb639
SHA13ec2e03437a1e8d0a1ab16588a73faf8879e8741
SHA256f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd
SHA512edf3a2a240f78960586b1e6a552fd912859445298e5397fb97d1d0de29c48b93330bafde307448005989065dcaaf06bfce91e419ef0320ef4bc256fa3ddc386b
-
\Users\Admin\Documents\MSDCSC\Audio Realtek Driver.exeFilesize
696KB
MD5fa6817c001c89663999ff6d3c7fdb639
SHA13ec2e03437a1e8d0a1ab16588a73faf8879e8741
SHA256f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd
SHA512edf3a2a240f78960586b1e6a552fd912859445298e5397fb97d1d0de29c48b93330bafde307448005989065dcaaf06bfce91e419ef0320ef4bc256fa3ddc386b
-
\Users\Admin\Documents\MSDCSC\Audio Realtek Driver.exeFilesize
696KB
MD5fa6817c001c89663999ff6d3c7fdb639
SHA13ec2e03437a1e8d0a1ab16588a73faf8879e8741
SHA256f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd
SHA512edf3a2a240f78960586b1e6a552fd912859445298e5397fb97d1d0de29c48b93330bafde307448005989065dcaaf06bfce91e419ef0320ef4bc256fa3ddc386b
-
memory/836-88-0x0000000000000000-mapping.dmp
-
memory/836-91-0x00000000002E0000-0x0000000000394000-memory.dmpFilesize
720KB
-
memory/1016-108-0x000000000048F888-mapping.dmp
-
memory/1016-110-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1016-112-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1016-115-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1016-116-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1112-54-0x0000000000240000-0x00000000002F4000-memory.dmpFilesize
720KB
-
memory/1112-55-0x0000000000330000-0x0000000000338000-memory.dmpFilesize
32KB
-
memory/1448-113-0x0000000000000000-mapping.dmp
-
memory/1708-65-0x0000000000080000-0x0000000000132000-memory.dmpFilesize
712KB
-
memory/1708-71-0x000000000048F888-mapping.dmp
-
memory/1708-84-0x0000000000080000-0x0000000000132000-memory.dmpFilesize
712KB
-
memory/1708-83-0x0000000075B11000-0x0000000075B13000-memory.dmpFilesize
8KB
-
memory/1708-82-0x0000000000080000-0x0000000000132000-memory.dmpFilesize
712KB
-
memory/1708-77-0x0000000000080000-0x0000000000132000-memory.dmpFilesize
712KB
-
memory/1708-72-0x0000000000080000-0x0000000000132000-memory.dmpFilesize
712KB
-
memory/1708-56-0x0000000000080000-0x0000000000132000-memory.dmpFilesize
712KB
-
memory/1708-68-0x0000000000080000-0x0000000000132000-memory.dmpFilesize
712KB
-
memory/1708-66-0x0000000000080000-0x0000000000132000-memory.dmpFilesize
712KB
-
memory/1708-63-0x0000000000080000-0x0000000000132000-memory.dmpFilesize
712KB
-
memory/1708-61-0x0000000000080000-0x0000000000132000-memory.dmpFilesize
712KB
-
memory/1708-59-0x0000000000080000-0x0000000000132000-memory.dmpFilesize
712KB
-
memory/1708-57-0x0000000000080000-0x0000000000132000-memory.dmpFilesize
712KB
-
memory/2036-85-0x0000000000000000-mapping.dmp