Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 06:44
Behavioral task
behavioral1
Sample
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe
Resource
win7-20230220-en
General
-
Target
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe
-
Size
658KB
-
MD5
3c41b88825ed5288001a0840f638bb15
-
SHA1
f12e5059fa029c6eea893ab2e6745922d0d89570
-
SHA256
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f
-
SHA512
bc4b3a9088e0fa70731573c0ac4a8bb4cff8ea68ef737010bfdc6eb0fadaad2e78dda5ca67be4830137f4c3a174d2fec9989b5a638d71d83b4299ede540f4401
-
SSDEEP
12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h5:KZ1xuVVjfFoynPaVBUR8f+kN10EBT
Malware Config
Extracted
darkcomet
Guest16
sussysdfffdfff343.duckdns.org:1604
DC_MUTEX-6F4SERN
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
mKaVRbcLZnA8
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Google Handler
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 228 attrib.exe 2496 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 860 msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msdcsc.exe3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Handler = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Handler = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Modifies registry class 1 IoCs
Processes:
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
taskmgr.exepid process 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 860 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
Processes:
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exemsdcsc.exetaskmgr.exedescription pid process Token: SeIncreaseQuotaPrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeSecurityPrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeTakeOwnershipPrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeLoadDriverPrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeSystemProfilePrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeSystemtimePrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeProfSingleProcessPrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeIncBasePriorityPrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeCreatePagefilePrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeBackupPrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeRestorePrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeShutdownPrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeDebugPrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeSystemEnvironmentPrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeChangeNotifyPrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeRemoteShutdownPrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeUndockPrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeManageVolumePrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeImpersonatePrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeCreateGlobalPrivilege 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: 33 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: 34 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: 35 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: 36 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeIncreaseQuotaPrivilege 860 msdcsc.exe Token: SeSecurityPrivilege 860 msdcsc.exe Token: SeTakeOwnershipPrivilege 860 msdcsc.exe Token: SeLoadDriverPrivilege 860 msdcsc.exe Token: SeSystemProfilePrivilege 860 msdcsc.exe Token: SeSystemtimePrivilege 860 msdcsc.exe Token: SeProfSingleProcessPrivilege 860 msdcsc.exe Token: SeIncBasePriorityPrivilege 860 msdcsc.exe Token: SeCreatePagefilePrivilege 860 msdcsc.exe Token: SeBackupPrivilege 860 msdcsc.exe Token: SeRestorePrivilege 860 msdcsc.exe Token: SeShutdownPrivilege 860 msdcsc.exe Token: SeDebugPrivilege 860 msdcsc.exe Token: SeSystemEnvironmentPrivilege 860 msdcsc.exe Token: SeChangeNotifyPrivilege 860 msdcsc.exe Token: SeRemoteShutdownPrivilege 860 msdcsc.exe Token: SeUndockPrivilege 860 msdcsc.exe Token: SeManageVolumePrivilege 860 msdcsc.exe Token: SeImpersonatePrivilege 860 msdcsc.exe Token: SeCreateGlobalPrivilege 860 msdcsc.exe Token: 33 860 msdcsc.exe Token: 34 860 msdcsc.exe Token: 35 860 msdcsc.exe Token: 36 860 msdcsc.exe Token: SeDebugPrivilege 4648 taskmgr.exe Token: SeSystemProfilePrivilege 4648 taskmgr.exe Token: SeCreateGlobalPrivilege 4648 taskmgr.exe Token: 33 4648 taskmgr.exe Token: SeIncBasePriorityPrivilege 4648 taskmgr.exe -
Suspicious use of FindShellTrayWindow 56 IoCs
Processes:
taskmgr.exepid process 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe -
Suspicious use of SendNotifyMessage 55 IoCs
Processes:
taskmgr.exepid process 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe 4648 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 860 msdcsc.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.execmd.execmd.exemsdcsc.exedescription pid process target process PID 4120 wrote to memory of 920 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 4120 wrote to memory of 920 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 4120 wrote to memory of 920 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 4120 wrote to memory of 4420 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 4120 wrote to memory of 4420 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 4120 wrote to memory of 4420 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 4420 wrote to memory of 228 4420 cmd.exe attrib.exe PID 4420 wrote to memory of 228 4420 cmd.exe attrib.exe PID 4420 wrote to memory of 228 4420 cmd.exe attrib.exe PID 920 wrote to memory of 2496 920 cmd.exe attrib.exe PID 920 wrote to memory of 2496 920 cmd.exe attrib.exe PID 920 wrote to memory of 2496 920 cmd.exe attrib.exe PID 4120 wrote to memory of 860 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe msdcsc.exe PID 4120 wrote to memory of 860 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe msdcsc.exe PID 4120 wrote to memory of 860 4120 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe msdcsc.exe PID 860 wrote to memory of 4168 860 msdcsc.exe iexplore.exe PID 860 wrote to memory of 4168 860 msdcsc.exe iexplore.exe PID 860 wrote to memory of 4168 860 msdcsc.exe iexplore.exe PID 860 wrote to memory of 5052 860 msdcsc.exe explorer.exe PID 860 wrote to memory of 5052 860 msdcsc.exe explorer.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe PID 860 wrote to memory of 4964 860 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 228 attrib.exe 2496 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe"C:\Users\Admin\AppData\Local\Temp\3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
658KB
MD53c41b88825ed5288001a0840f638bb15
SHA1f12e5059fa029c6eea893ab2e6745922d0d89570
SHA2563f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f
SHA512bc4b3a9088e0fa70731573c0ac4a8bb4cff8ea68ef737010bfdc6eb0fadaad2e78dda5ca67be4830137f4c3a174d2fec9989b5a638d71d83b4299ede540f4401
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
658KB
MD53c41b88825ed5288001a0840f638bb15
SHA1f12e5059fa029c6eea893ab2e6745922d0d89570
SHA2563f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f
SHA512bc4b3a9088e0fa70731573c0ac4a8bb4cff8ea68ef737010bfdc6eb0fadaad2e78dda5ca67be4830137f4c3a174d2fec9989b5a638d71d83b4299ede540f4401
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
658KB
MD53c41b88825ed5288001a0840f638bb15
SHA1f12e5059fa029c6eea893ab2e6745922d0d89570
SHA2563f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f
SHA512bc4b3a9088e0fa70731573c0ac4a8bb4cff8ea68ef737010bfdc6eb0fadaad2e78dda5ca67be4830137f4c3a174d2fec9989b5a638d71d83b4299ede540f4401
-
memory/860-225-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/860-195-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/860-197-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/860-199-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4120-133-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/4120-196-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4648-206-0x000001628DA10000-0x000001628DA11000-memory.dmpFilesize
4KB
-
memory/4648-205-0x000001628DA10000-0x000001628DA11000-memory.dmpFilesize
4KB
-
memory/4648-207-0x000001628DA10000-0x000001628DA11000-memory.dmpFilesize
4KB
-
memory/4648-212-0x000001628DA10000-0x000001628DA11000-memory.dmpFilesize
4KB
-
memory/4648-211-0x000001628DA10000-0x000001628DA11000-memory.dmpFilesize
4KB
-
memory/4648-213-0x000001628DA10000-0x000001628DA11000-memory.dmpFilesize
4KB
-
memory/4648-214-0x000001628DA10000-0x000001628DA11000-memory.dmpFilesize
4KB
-
memory/4648-216-0x000001628DA10000-0x000001628DA11000-memory.dmpFilesize
4KB
-
memory/4648-215-0x000001628DA10000-0x000001628DA11000-memory.dmpFilesize
4KB
-
memory/4648-217-0x000001628DA10000-0x000001628DA11000-memory.dmpFilesize
4KB
-
memory/4964-194-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB