Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 09:42
Static task
static1
Behavioral task
behavioral1
Sample
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe
Resource
win10v2004-20220901-en
General
-
Target
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe
-
Size
696KB
-
MD5
fa6817c001c89663999ff6d3c7fdb639
-
SHA1
3ec2e03437a1e8d0a1ab16588a73faf8879e8741
-
SHA256
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd
-
SHA512
edf3a2a240f78960586b1e6a552fd912859445298e5397fb97d1d0de29c48b93330bafde307448005989065dcaaf06bfce91e419ef0320ef4bc256fa3ddc386b
-
SSDEEP
12288:C/BJPqODJXXn3n0kZJc+vZi3G0khHCpp1tlAhpxz:6qOJXnkk/c2wW064dlY
Malware Config
Extracted
darkcomet
Spy
127.0.0.1:1604
nibiru3.duckdns.org:1604
nibiru33.duckdns.org:1604
DC_MUTEX-QE733CL
-
InstallPath
MSDCSC\Audio Realtek Driver.exe
-
gencode
R3iDnMXzRFHM
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Audio Realtek Driver
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\Audio Realtek Driver.exe" f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe -
Executes dropped EXE 2 IoCs
Processes:
Audio Realtek Driver.exeAudio Realtek Driver.exepid process 1664 Audio Realtek Driver.exe 2700 Audio Realtek Driver.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exeAudio Realtek Driver.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Audio Realtek Driver = "C:\\Users\\Admin\\Documents\\MSDCSC\\Audio Realtek Driver.exe" f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Audio Realtek Driver = "C:\\Users\\Admin\\Documents\\MSDCSC\\Audio Realtek Driver.exe" Audio Realtek Driver.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exeAudio Realtek Driver.exedescription pid process target process PID 4876 set thread context of 4936 4876 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 1664 set thread context of 2700 1664 Audio Realtek Driver.exe Audio Realtek Driver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exeAudio Realtek Driver.exedescription pid process Token: SeIncreaseQuotaPrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeSecurityPrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeTakeOwnershipPrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeLoadDriverPrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeSystemProfilePrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeSystemtimePrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeProfSingleProcessPrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeIncBasePriorityPrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeCreatePagefilePrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeBackupPrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeRestorePrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeShutdownPrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeDebugPrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeSystemEnvironmentPrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeChangeNotifyPrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeRemoteShutdownPrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeUndockPrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeManageVolumePrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeImpersonatePrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeCreateGlobalPrivilege 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: 33 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: 34 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: 35 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: 36 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Token: SeIncreaseQuotaPrivilege 2700 Audio Realtek Driver.exe Token: SeSecurityPrivilege 2700 Audio Realtek Driver.exe Token: SeTakeOwnershipPrivilege 2700 Audio Realtek Driver.exe Token: SeLoadDriverPrivilege 2700 Audio Realtek Driver.exe Token: SeSystemProfilePrivilege 2700 Audio Realtek Driver.exe Token: SeSystemtimePrivilege 2700 Audio Realtek Driver.exe Token: SeProfSingleProcessPrivilege 2700 Audio Realtek Driver.exe Token: SeIncBasePriorityPrivilege 2700 Audio Realtek Driver.exe Token: SeCreatePagefilePrivilege 2700 Audio Realtek Driver.exe Token: SeBackupPrivilege 2700 Audio Realtek Driver.exe Token: SeRestorePrivilege 2700 Audio Realtek Driver.exe Token: SeShutdownPrivilege 2700 Audio Realtek Driver.exe Token: SeDebugPrivilege 2700 Audio Realtek Driver.exe Token: SeSystemEnvironmentPrivilege 2700 Audio Realtek Driver.exe Token: SeChangeNotifyPrivilege 2700 Audio Realtek Driver.exe Token: SeRemoteShutdownPrivilege 2700 Audio Realtek Driver.exe Token: SeUndockPrivilege 2700 Audio Realtek Driver.exe Token: SeManageVolumePrivilege 2700 Audio Realtek Driver.exe Token: SeImpersonatePrivilege 2700 Audio Realtek Driver.exe Token: SeCreateGlobalPrivilege 2700 Audio Realtek Driver.exe Token: 33 2700 Audio Realtek Driver.exe Token: 34 2700 Audio Realtek Driver.exe Token: 35 2700 Audio Realtek Driver.exe Token: 36 2700 Audio Realtek Driver.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Audio Realtek Driver.exepid process 2700 Audio Realtek Driver.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exef5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exeAudio Realtek Driver.exeAudio Realtek Driver.exedescription pid process target process PID 4876 wrote to memory of 4936 4876 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 4876 wrote to memory of 4936 4876 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 4876 wrote to memory of 4936 4876 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 4876 wrote to memory of 4936 4876 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 4876 wrote to memory of 4936 4876 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 4876 wrote to memory of 4936 4876 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 4876 wrote to memory of 4936 4876 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 4876 wrote to memory of 4936 4876 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 4876 wrote to memory of 4936 4876 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 4876 wrote to memory of 4936 4876 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 4876 wrote to memory of 4936 4876 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 4876 wrote to memory of 4936 4876 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe PID 4936 wrote to memory of 1448 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 4936 wrote to memory of 1448 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 4936 wrote to memory of 1448 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 4936 wrote to memory of 1448 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 4936 wrote to memory of 1448 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 4936 wrote to memory of 1448 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 4936 wrote to memory of 1448 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 4936 wrote to memory of 1448 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 4936 wrote to memory of 1448 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 4936 wrote to memory of 1448 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 4936 wrote to memory of 1448 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 4936 wrote to memory of 1448 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 4936 wrote to memory of 1448 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 4936 wrote to memory of 1448 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 4936 wrote to memory of 1448 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 4936 wrote to memory of 1448 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 4936 wrote to memory of 1448 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe notepad.exe PID 4936 wrote to memory of 1664 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Audio Realtek Driver.exe PID 4936 wrote to memory of 1664 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Audio Realtek Driver.exe PID 4936 wrote to memory of 1664 4936 f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe Audio Realtek Driver.exe PID 1664 wrote to memory of 2700 1664 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 1664 wrote to memory of 2700 1664 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 1664 wrote to memory of 2700 1664 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 1664 wrote to memory of 2700 1664 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 1664 wrote to memory of 2700 1664 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 1664 wrote to memory of 2700 1664 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 1664 wrote to memory of 2700 1664 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 1664 wrote to memory of 2700 1664 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 1664 wrote to memory of 2700 1664 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 1664 wrote to memory of 2700 1664 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 1664 wrote to memory of 2700 1664 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 1664 wrote to memory of 2700 1664 Audio Realtek Driver.exe Audio Realtek Driver.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe PID 2700 wrote to memory of 2216 2700 Audio Realtek Driver.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe"C:\Users\Admin\AppData\Local\Temp\f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe"C:\Users\Admin\AppData\Local\Temp\f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:1448
-
C:\Users\Admin\Documents\MSDCSC\Audio Realtek Driver.exe"C:\Users\Admin\Documents\MSDCSC\Audio Realtek Driver.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\Documents\MSDCSC\Audio Realtek Driver.exe"C:\Users\Admin\Documents\MSDCSC\Audio Realtek Driver.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\notepad.exenotepad5⤵PID:2216
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\Audio Realtek Driver.exeFilesize
696KB
MD5fa6817c001c89663999ff6d3c7fdb639
SHA13ec2e03437a1e8d0a1ab16588a73faf8879e8741
SHA256f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd
SHA512edf3a2a240f78960586b1e6a552fd912859445298e5397fb97d1d0de29c48b93330bafde307448005989065dcaaf06bfce91e419ef0320ef4bc256fa3ddc386b
-
C:\Users\Admin\Documents\MSDCSC\Audio Realtek Driver.exeFilesize
696KB
MD5fa6817c001c89663999ff6d3c7fdb639
SHA13ec2e03437a1e8d0a1ab16588a73faf8879e8741
SHA256f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd
SHA512edf3a2a240f78960586b1e6a552fd912859445298e5397fb97d1d0de29c48b93330bafde307448005989065dcaaf06bfce91e419ef0320ef4bc256fa3ddc386b
-
C:\Users\Admin\Documents\MSDCSC\Audio Realtek Driver.exeFilesize
696KB
MD5fa6817c001c89663999ff6d3c7fdb639
SHA13ec2e03437a1e8d0a1ab16588a73faf8879e8741
SHA256f5e66d442091eee7ac6ee962077b6555535429c94df82e6ff1331329e2f029cd
SHA512edf3a2a240f78960586b1e6a552fd912859445298e5397fb97d1d0de29c48b93330bafde307448005989065dcaaf06bfce91e419ef0320ef4bc256fa3ddc386b
-
memory/1448-137-0x0000000000000000-mapping.dmp
-
memory/1664-139-0x0000000000000000-mapping.dmp
-
memory/2216-147-0x0000000000000000-mapping.dmp
-
memory/2700-142-0x0000000000000000-mapping.dmp
-
memory/2700-149-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2700-148-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4876-132-0x0000000000250000-0x0000000000304000-memory.dmpFilesize
720KB
-
memory/4936-135-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4936-138-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4936-136-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4936-134-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4936-133-0x0000000000000000-mapping.dmp