Analysis
-
max time kernel
38s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
10-06-2023 00:39
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230220-en
General
-
Target
file.exe
-
Size
1.1MB
-
MD5
06eae25115858e2475c1bab16bae9585
-
SHA1
657cdc54121fa9baaae7cc944ed935e1eddf4ebc
-
SHA256
d9bed95674d8f25aba2b84067e0691d254c86d686a4ec42dec119a8a2b006c98
-
SHA512
2ad4ccbbf950dac84d2353b9d59e8d59415ec3f9bef1d226270ebc4f416489dc6c39b5c4725dd10316b2cbc6adc8bef3e7db8e430ed581444857db8e0d0c53d1
-
SSDEEP
12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbiYS3HzuWTEv3L9aCcyYiqlbl117n1k4Rq5zs:U2G/nvxW3Ww0t03THqRaCQJThLis
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1756 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1676 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 632 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1940 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 268 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1512 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1780 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1388 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1148 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2012 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 960 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1812 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1768 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1932 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 576 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1588 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1764 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 524 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1412 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 336 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1528 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 640 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1000 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1700 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1060 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 948 1724 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1872 1724 schtasks.exe -
Processes:
resource yara_rule C:\providerwindriverHostDll\comNet.exe dcrat \providerwindriverHostDll\comNet.exe dcrat C:\providerwindriverHostDll\comNet.exe dcrat \providerwindriverHostDll\comNet.exe dcrat behavioral1/memory/588-67-0x0000000001180000-0x0000000001256000-memory.dmp dcrat behavioral1/memory/588-72-0x000000001AFB0000-0x000000001B030000-memory.dmp dcrat C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WMIADAP.exe dcrat C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WMIADAP.exe dcrat C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WMIADAP.exe dcrat behavioral1/memory/1656-93-0x0000000001000000-0x00000000010D6000-memory.dmp dcrat behavioral1/memory/1656-94-0x000000001AED0000-0x000000001AF50000-memory.dmp dcrat behavioral1/memory/1656-95-0x000000001AED0000-0x000000001AF50000-memory.dmp dcrat -
Executes dropped EXE 2 IoCs
Processes:
comNet.exeWMIADAP.exepid process 588 comNet.exe 1656 WMIADAP.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 472 cmd.exe 472 cmd.exe -
Drops file in Program Files directory 4 IoCs
Processes:
comNet.exedescription ioc process File created C:\Program Files\Internet Explorer\en-US\winlogon.exe comNet.exe File created C:\Program Files\Internet Explorer\en-US\cc11b995f2a76d comNet.exe File created C:\Program Files (x86)\Internet Explorer\fr-FR\wininit.exe comNet.exe File created C:\Program Files (x86)\Internet Explorer\fr-FR\56085415360792 comNet.exe -
Drops file in Windows directory 4 IoCs
Processes:
comNet.exedescription ioc process File created C:\Windows\de-DE\comNet.exe comNet.exe File created C:\Windows\de-DE\ba389f48f982ed comNet.exe File created C:\Windows\Offline Web Pages\WMIADAP.exe comNet.exe File created C:\Windows\Offline Web Pages\75a57c1bdf437c comNet.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1528 schtasks.exe 1780 schtasks.exe 1756 schtasks.exe 268 schtasks.exe 524 schtasks.exe 1940 schtasks.exe 1588 schtasks.exe 1060 schtasks.exe 2012 schtasks.exe 1768 schtasks.exe 576 schtasks.exe 1676 schtasks.exe 1388 schtasks.exe 1148 schtasks.exe 1812 schtasks.exe 1412 schtasks.exe 948 schtasks.exe 640 schtasks.exe 1000 schtasks.exe 1700 schtasks.exe 1512 schtasks.exe 1872 schtasks.exe 632 schtasks.exe 960 schtasks.exe 1932 schtasks.exe 1764 schtasks.exe 336 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
comNet.exeWMIADAP.exepid process 588 comNet.exe 588 comNet.exe 588 comNet.exe 1656 WMIADAP.exe 1656 WMIADAP.exe 1656 WMIADAP.exe 1656 WMIADAP.exe 1656 WMIADAP.exe 1656 WMIADAP.exe 1656 WMIADAP.exe 1656 WMIADAP.exe 1656 WMIADAP.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
comNet.exeWMIADAP.exedescription pid process Token: SeDebugPrivilege 588 comNet.exe Token: SeDebugPrivilege 1656 WMIADAP.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
file.exeWScript.execmd.execomNet.exedescription pid process target process PID 2044 wrote to memory of 940 2044 file.exe WScript.exe PID 2044 wrote to memory of 940 2044 file.exe WScript.exe PID 2044 wrote to memory of 940 2044 file.exe WScript.exe PID 2044 wrote to memory of 940 2044 file.exe WScript.exe PID 940 wrote to memory of 472 940 WScript.exe cmd.exe PID 940 wrote to memory of 472 940 WScript.exe cmd.exe PID 940 wrote to memory of 472 940 WScript.exe cmd.exe PID 940 wrote to memory of 472 940 WScript.exe cmd.exe PID 472 wrote to memory of 588 472 cmd.exe comNet.exe PID 472 wrote to memory of 588 472 cmd.exe comNet.exe PID 472 wrote to memory of 588 472 cmd.exe comNet.exe PID 472 wrote to memory of 588 472 cmd.exe comNet.exe PID 588 wrote to memory of 1656 588 comNet.exe WMIADAP.exe PID 588 wrote to memory of 1656 588 comNet.exe WMIADAP.exe PID 588 wrote to memory of 1656 588 comNet.exe WMIADAP.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providerwindriverHostDll\eQhltUTnqbyYIJBHh.vbe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\providerwindriverHostDll\5O0IdEW060cxJkvUmnX.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\providerwindriverHostDll\comNet.exe"C:\providerwindriverHostDll\comNet.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WMIADAP.exe"C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WMIADAP.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\providerwindriverHostDll\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providerwindriverHostDll\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\providerwindriverHostDll\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\en-US\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\en-US\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\en-US\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\providerwindriverHostDll\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providerwindriverHostDll\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\providerwindriverHostDll\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "comNetc" /sc MINUTE /mo 11 /tr "'C:\Windows\de-DE\comNet.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "comNet" /sc ONLOGON /tr "'C:\Windows\de-DE\comNet.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "comNetc" /sc MINUTE /mo 14 /tr "'C:\Windows\de-DE\comNet.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\lsm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Default User\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 7 /tr "'C:\Windows\Offline Web Pages\WMIADAP.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\WMIADAP.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 11 /tr "'C:\Windows\Offline Web Pages\WMIADAP.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WMIADAP.exeFilesize
827KB
MD52b84697f835c36d37b5dc11106d655f5
SHA11f406d774af24ba55e55fcf03ee5928905fe7123
SHA256148197a0b0db24058a70a599a00ff4111376d4d085f796b3a5a3ad767d9ed731
SHA512ad2d09513a04d055e26d3bce550bb2f7b577aba2449e9d2fb2454b6f58187441922acf541ca79be712f37d61ba16aead9aefd8f2d11a7180444d6ea69f0ee934
-
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WMIADAP.exeFilesize
827KB
MD52b84697f835c36d37b5dc11106d655f5
SHA11f406d774af24ba55e55fcf03ee5928905fe7123
SHA256148197a0b0db24058a70a599a00ff4111376d4d085f796b3a5a3ad767d9ed731
SHA512ad2d09513a04d055e26d3bce550bb2f7b577aba2449e9d2fb2454b6f58187441922acf541ca79be712f37d61ba16aead9aefd8f2d11a7180444d6ea69f0ee934
-
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\WMIADAP.exeFilesize
827KB
MD52b84697f835c36d37b5dc11106d655f5
SHA11f406d774af24ba55e55fcf03ee5928905fe7123
SHA256148197a0b0db24058a70a599a00ff4111376d4d085f796b3a5a3ad767d9ed731
SHA512ad2d09513a04d055e26d3bce550bb2f7b577aba2449e9d2fb2454b6f58187441922acf541ca79be712f37d61ba16aead9aefd8f2d11a7180444d6ea69f0ee934
-
C:\providerwindriverHostDll\5O0IdEW060cxJkvUmnX.batFilesize
40B
MD5b7f686a12452b0e946a2b35746aa85d8
SHA13637b428ac91dd8e93259eb32e9fd8d1f43825f5
SHA25691a97a0a5785891a0c5c68a17625dbd99324eb363f0c13707f9ba9be9417253f
SHA512e70765edac455c33ac137ae6b3e67db616fcbbfe82298b5bbd59dc5179126ecc015fe4c18e9a0bd668da826d2cd4d2e3276dab7ed0331db7892795d6221c4ba8
-
C:\providerwindriverHostDll\comNet.exeFilesize
827KB
MD52b84697f835c36d37b5dc11106d655f5
SHA11f406d774af24ba55e55fcf03ee5928905fe7123
SHA256148197a0b0db24058a70a599a00ff4111376d4d085f796b3a5a3ad767d9ed731
SHA512ad2d09513a04d055e26d3bce550bb2f7b577aba2449e9d2fb2454b6f58187441922acf541ca79be712f37d61ba16aead9aefd8f2d11a7180444d6ea69f0ee934
-
C:\providerwindriverHostDll\comNet.exeFilesize
827KB
MD52b84697f835c36d37b5dc11106d655f5
SHA11f406d774af24ba55e55fcf03ee5928905fe7123
SHA256148197a0b0db24058a70a599a00ff4111376d4d085f796b3a5a3ad767d9ed731
SHA512ad2d09513a04d055e26d3bce550bb2f7b577aba2449e9d2fb2454b6f58187441922acf541ca79be712f37d61ba16aead9aefd8f2d11a7180444d6ea69f0ee934
-
C:\providerwindriverHostDll\eQhltUTnqbyYIJBHh.vbeFilesize
220B
MD5175e0c8fb6f8d79de10516a3c70b8bd4
SHA1c46ecb7f245a26cc06f9c227b75cb0e51fa5a922
SHA256c2d8a00d704a88597d0d1a31b06965713efbf55a6ec68e567fccd4e0ad236079
SHA512d2895a6260801876bac10b885e137bb3a1a62972d55660e45829aeafc76d25baa8af7857eb2a3d7245ee58404699278e24db4fe7e498f465e294b42578c60926
-
\providerwindriverHostDll\comNet.exeFilesize
827KB
MD52b84697f835c36d37b5dc11106d655f5
SHA11f406d774af24ba55e55fcf03ee5928905fe7123
SHA256148197a0b0db24058a70a599a00ff4111376d4d085f796b3a5a3ad767d9ed731
SHA512ad2d09513a04d055e26d3bce550bb2f7b577aba2449e9d2fb2454b6f58187441922acf541ca79be712f37d61ba16aead9aefd8f2d11a7180444d6ea69f0ee934
-
\providerwindriverHostDll\comNet.exeFilesize
827KB
MD52b84697f835c36d37b5dc11106d655f5
SHA11f406d774af24ba55e55fcf03ee5928905fe7123
SHA256148197a0b0db24058a70a599a00ff4111376d4d085f796b3a5a3ad767d9ed731
SHA512ad2d09513a04d055e26d3bce550bb2f7b577aba2449e9d2fb2454b6f58187441922acf541ca79be712f37d61ba16aead9aefd8f2d11a7180444d6ea69f0ee934
-
memory/588-72-0x000000001AFB0000-0x000000001B030000-memory.dmpFilesize
512KB
-
memory/588-67-0x0000000001180000-0x0000000001256000-memory.dmpFilesize
856KB
-
memory/1656-93-0x0000000001000000-0x00000000010D6000-memory.dmpFilesize
856KB
-
memory/1656-94-0x000000001AED0000-0x000000001AF50000-memory.dmpFilesize
512KB
-
memory/1656-95-0x000000001AED0000-0x000000001AF50000-memory.dmpFilesize
512KB