Analysis
-
max time kernel
1800s -
max time network
1793s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
02-08-2022 09:04
General
-
Target
SoulmadeCrypter.exe
-
Size
252KB
-
MD5
3fffcd3191abaa96ffbc819093bc59ac
-
SHA1
9f65baa9c64ecfd1e729ba3587d45006ec827b79
-
SHA256
1bdab49165da54a2344c1a76a3cc326d0b03cd3e7b666f0a70d89371a75dfabb
-
SHA512
20156c4561750fad79f0a3b98a4abfdc12ff42443848e3da63712c97c2a2a8e32d7128eb8b2f749c328f25ccf417b6a902666ab03c678e22691703f01b4a3e9c
Malware Config
Extracted
darkcomet
Guest16
6.tcp.ngrok.io:10830
DC_MUTEX-UDT9PP1
-
InstallPath
OpenVPN\openvpn-gui.exe
-
gencode
ceWNfKVtFeL3
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
SoulmadeCrypter.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\OpenVPN\\openvpn-gui.exe" SoulmadeCrypter.exe -
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
iexplore.exeopenvpn-gui.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" iexplore.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile openvpn-gui.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" openvpn-gui.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" openvpn-gui.exe -
Modifies security service 2 TTPs 2 IoCs
Processes:
openvpn-gui.exeiexplore.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" openvpn-gui.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" iexplore.exe -
Processes:
openvpn-gui.exeiexplore.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" openvpn-gui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" openvpn-gui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iexplore.exe -
Disables RegEdit via registry modification 2 IoCs
Processes:
openvpn-gui.exeiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" openvpn-gui.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iexplore.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
openvpn-gui.exepid process 1332 openvpn-gui.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 948 attrib.exe 1472 attrib.exe -
Processes:
resource yara_rule behavioral1/memory/1856-59-0x0000000000400000-0x00000000004B7000-memory.dmp upx \Windows\SysWOW64\OpenVPN\openvpn-gui.exe upx \Windows\SysWOW64\OpenVPN\openvpn-gui.exe upx C:\Windows\SysWOW64\OpenVPN\openvpn-gui.exe upx C:\Windows\SysWOW64\OpenVPN\openvpn-gui.exe upx behavioral1/memory/1332-68-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1856-72-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1940 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
SoulmadeCrypter.exepid process 1856 SoulmadeCrypter.exe 1856 SoulmadeCrypter.exe -
Processes:
openvpn-gui.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" openvpn-gui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" openvpn-gui.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
SoulmadeCrypter.exeopenvpn-gui.exeiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\OpenVPN\\openvpn-gui.exe" SoulmadeCrypter.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\OpenVPN\\openvpn-gui.exe" openvpn-gui.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\OpenVPN\\openvpn-gui.exe" iexplore.exe -
Drops file in System32 directory 3 IoCs
Processes:
SoulmadeCrypter.exedescription ioc process File created C:\Windows\SysWOW64\OpenVPN\openvpn-gui.exe SoulmadeCrypter.exe File opened for modification C:\Windows\SysWOW64\OpenVPN\openvpn-gui.exe SoulmadeCrypter.exe File opened for modification C:\Windows\SysWOW64\OpenVPN\ SoulmadeCrypter.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
openvpn-gui.exedescription pid process target process PID 1332 set thread context of 1768 1332 openvpn-gui.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1768 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
SoulmadeCrypter.exeopenvpn-gui.exeiexplore.exedescription pid process Token: SeIncreaseQuotaPrivilege 1856 SoulmadeCrypter.exe Token: SeSecurityPrivilege 1856 SoulmadeCrypter.exe Token: SeTakeOwnershipPrivilege 1856 SoulmadeCrypter.exe Token: SeLoadDriverPrivilege 1856 SoulmadeCrypter.exe Token: SeSystemProfilePrivilege 1856 SoulmadeCrypter.exe Token: SeSystemtimePrivilege 1856 SoulmadeCrypter.exe Token: SeProfSingleProcessPrivilege 1856 SoulmadeCrypter.exe Token: SeIncBasePriorityPrivilege 1856 SoulmadeCrypter.exe Token: SeCreatePagefilePrivilege 1856 SoulmadeCrypter.exe Token: SeBackupPrivilege 1856 SoulmadeCrypter.exe Token: SeRestorePrivilege 1856 SoulmadeCrypter.exe Token: SeShutdownPrivilege 1856 SoulmadeCrypter.exe Token: SeDebugPrivilege 1856 SoulmadeCrypter.exe Token: SeSystemEnvironmentPrivilege 1856 SoulmadeCrypter.exe Token: SeChangeNotifyPrivilege 1856 SoulmadeCrypter.exe Token: SeRemoteShutdownPrivilege 1856 SoulmadeCrypter.exe Token: SeUndockPrivilege 1856 SoulmadeCrypter.exe Token: SeManageVolumePrivilege 1856 SoulmadeCrypter.exe Token: SeImpersonatePrivilege 1856 SoulmadeCrypter.exe Token: SeCreateGlobalPrivilege 1856 SoulmadeCrypter.exe Token: 33 1856 SoulmadeCrypter.exe Token: 34 1856 SoulmadeCrypter.exe Token: 35 1856 SoulmadeCrypter.exe Token: SeIncreaseQuotaPrivilege 1332 openvpn-gui.exe Token: SeSecurityPrivilege 1332 openvpn-gui.exe Token: SeTakeOwnershipPrivilege 1332 openvpn-gui.exe Token: SeLoadDriverPrivilege 1332 openvpn-gui.exe Token: SeSystemProfilePrivilege 1332 openvpn-gui.exe Token: SeSystemtimePrivilege 1332 openvpn-gui.exe Token: SeProfSingleProcessPrivilege 1332 openvpn-gui.exe Token: SeIncBasePriorityPrivilege 1332 openvpn-gui.exe Token: SeCreatePagefilePrivilege 1332 openvpn-gui.exe Token: SeBackupPrivilege 1332 openvpn-gui.exe Token: SeRestorePrivilege 1332 openvpn-gui.exe Token: SeShutdownPrivilege 1332 openvpn-gui.exe Token: SeDebugPrivilege 1332 openvpn-gui.exe Token: SeSystemEnvironmentPrivilege 1332 openvpn-gui.exe Token: SeChangeNotifyPrivilege 1332 openvpn-gui.exe Token: SeRemoteShutdownPrivilege 1332 openvpn-gui.exe Token: SeUndockPrivilege 1332 openvpn-gui.exe Token: SeManageVolumePrivilege 1332 openvpn-gui.exe Token: SeImpersonatePrivilege 1332 openvpn-gui.exe Token: SeCreateGlobalPrivilege 1332 openvpn-gui.exe Token: 33 1332 openvpn-gui.exe Token: 34 1332 openvpn-gui.exe Token: 35 1332 openvpn-gui.exe Token: SeIncreaseQuotaPrivilege 1768 iexplore.exe Token: SeSecurityPrivilege 1768 iexplore.exe Token: SeTakeOwnershipPrivilege 1768 iexplore.exe Token: SeLoadDriverPrivilege 1768 iexplore.exe Token: SeSystemProfilePrivilege 1768 iexplore.exe Token: SeSystemtimePrivilege 1768 iexplore.exe Token: SeProfSingleProcessPrivilege 1768 iexplore.exe Token: SeIncBasePriorityPrivilege 1768 iexplore.exe Token: SeCreatePagefilePrivilege 1768 iexplore.exe Token: SeBackupPrivilege 1768 iexplore.exe Token: SeRestorePrivilege 1768 iexplore.exe Token: SeShutdownPrivilege 1768 iexplore.exe Token: SeDebugPrivilege 1768 iexplore.exe Token: SeSystemEnvironmentPrivilege 1768 iexplore.exe Token: SeChangeNotifyPrivilege 1768 iexplore.exe Token: SeRemoteShutdownPrivilege 1768 iexplore.exe Token: SeUndockPrivilege 1768 iexplore.exe Token: SeManageVolumePrivilege 1768 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid process 1768 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SoulmadeCrypter.execmd.execmd.exeopenvpn-gui.exeiexplore.exedescription pid process target process PID 1856 wrote to memory of 2028 1856 SoulmadeCrypter.exe cmd.exe PID 1856 wrote to memory of 2028 1856 SoulmadeCrypter.exe cmd.exe PID 1856 wrote to memory of 2028 1856 SoulmadeCrypter.exe cmd.exe PID 1856 wrote to memory of 2028 1856 SoulmadeCrypter.exe cmd.exe PID 1856 wrote to memory of 1000 1856 SoulmadeCrypter.exe cmd.exe PID 1856 wrote to memory of 1000 1856 SoulmadeCrypter.exe cmd.exe PID 1856 wrote to memory of 1000 1856 SoulmadeCrypter.exe cmd.exe PID 1856 wrote to memory of 1000 1856 SoulmadeCrypter.exe cmd.exe PID 1000 wrote to memory of 948 1000 cmd.exe attrib.exe PID 1000 wrote to memory of 948 1000 cmd.exe attrib.exe PID 1000 wrote to memory of 948 1000 cmd.exe attrib.exe PID 1000 wrote to memory of 948 1000 cmd.exe attrib.exe PID 2028 wrote to memory of 1472 2028 cmd.exe attrib.exe PID 2028 wrote to memory of 1472 2028 cmd.exe attrib.exe PID 2028 wrote to memory of 1472 2028 cmd.exe attrib.exe PID 2028 wrote to memory of 1472 2028 cmd.exe attrib.exe PID 1856 wrote to memory of 1940 1856 SoulmadeCrypter.exe notepad.exe PID 1856 wrote to memory of 1940 1856 SoulmadeCrypter.exe notepad.exe PID 1856 wrote to memory of 1940 1856 SoulmadeCrypter.exe notepad.exe PID 1856 wrote to memory of 1940 1856 SoulmadeCrypter.exe notepad.exe PID 1856 wrote to memory of 1940 1856 SoulmadeCrypter.exe notepad.exe PID 1856 wrote to memory of 1940 1856 SoulmadeCrypter.exe notepad.exe PID 1856 wrote to memory of 1940 1856 SoulmadeCrypter.exe notepad.exe PID 1856 wrote to memory of 1940 1856 SoulmadeCrypter.exe notepad.exe PID 1856 wrote to memory of 1940 1856 SoulmadeCrypter.exe notepad.exe PID 1856 wrote to memory of 1940 1856 SoulmadeCrypter.exe notepad.exe PID 1856 wrote to memory of 1940 1856 SoulmadeCrypter.exe notepad.exe PID 1856 wrote to memory of 1940 1856 SoulmadeCrypter.exe notepad.exe PID 1856 wrote to memory of 1940 1856 SoulmadeCrypter.exe notepad.exe PID 1856 wrote to memory of 1940 1856 SoulmadeCrypter.exe notepad.exe PID 1856 wrote to memory of 1940 1856 SoulmadeCrypter.exe notepad.exe PID 1856 wrote to memory of 1940 1856 SoulmadeCrypter.exe notepad.exe PID 1856 wrote to memory of 1940 1856 SoulmadeCrypter.exe notepad.exe PID 1856 wrote to memory of 1940 1856 SoulmadeCrypter.exe notepad.exe PID 1856 wrote to memory of 1332 1856 SoulmadeCrypter.exe openvpn-gui.exe PID 1856 wrote to memory of 1332 1856 SoulmadeCrypter.exe openvpn-gui.exe PID 1856 wrote to memory of 1332 1856 SoulmadeCrypter.exe openvpn-gui.exe PID 1856 wrote to memory of 1332 1856 SoulmadeCrypter.exe openvpn-gui.exe PID 1332 wrote to memory of 1768 1332 openvpn-gui.exe iexplore.exe PID 1332 wrote to memory of 1768 1332 openvpn-gui.exe iexplore.exe PID 1332 wrote to memory of 1768 1332 openvpn-gui.exe iexplore.exe PID 1332 wrote to memory of 1768 1332 openvpn-gui.exe iexplore.exe PID 1332 wrote to memory of 1768 1332 openvpn-gui.exe iexplore.exe PID 1332 wrote to memory of 1768 1332 openvpn-gui.exe iexplore.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe PID 1768 wrote to memory of 1648 1768 iexplore.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
openvpn-gui.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion openvpn-gui.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern openvpn-gui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" openvpn-gui.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 948 attrib.exe 1472 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SoulmadeCrypter.exe"C:\Users\Admin\AppData\Local\Temp\SoulmadeCrypter.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\SoulmadeCrypter.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\SoulmadeCrypter.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Windows\SysWOW64\OpenVPN\openvpn-gui.exe"C:\Windows\system32\OpenVPN\openvpn-gui.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\OpenVPN\openvpn-gui.exeFilesize
252KB
MD53fffcd3191abaa96ffbc819093bc59ac
SHA19f65baa9c64ecfd1e729ba3587d45006ec827b79
SHA2561bdab49165da54a2344c1a76a3cc326d0b03cd3e7b666f0a70d89371a75dfabb
SHA51220156c4561750fad79f0a3b98a4abfdc12ff42443848e3da63712c97c2a2a8e32d7128eb8b2f749c328f25ccf417b6a902666ab03c678e22691703f01b4a3e9c
-
C:\Windows\SysWOW64\OpenVPN\openvpn-gui.exeFilesize
252KB
MD53fffcd3191abaa96ffbc819093bc59ac
SHA19f65baa9c64ecfd1e729ba3587d45006ec827b79
SHA2561bdab49165da54a2344c1a76a3cc326d0b03cd3e7b666f0a70d89371a75dfabb
SHA51220156c4561750fad79f0a3b98a4abfdc12ff42443848e3da63712c97c2a2a8e32d7128eb8b2f749c328f25ccf417b6a902666ab03c678e22691703f01b4a3e9c
-
\Windows\SysWOW64\OpenVPN\openvpn-gui.exeFilesize
252KB
MD53fffcd3191abaa96ffbc819093bc59ac
SHA19f65baa9c64ecfd1e729ba3587d45006ec827b79
SHA2561bdab49165da54a2344c1a76a3cc326d0b03cd3e7b666f0a70d89371a75dfabb
SHA51220156c4561750fad79f0a3b98a4abfdc12ff42443848e3da63712c97c2a2a8e32d7128eb8b2f749c328f25ccf417b6a902666ab03c678e22691703f01b4a3e9c
-
\Windows\SysWOW64\OpenVPN\openvpn-gui.exeFilesize
252KB
MD53fffcd3191abaa96ffbc819093bc59ac
SHA19f65baa9c64ecfd1e729ba3587d45006ec827b79
SHA2561bdab49165da54a2344c1a76a3cc326d0b03cd3e7b666f0a70d89371a75dfabb
SHA51220156c4561750fad79f0a3b98a4abfdc12ff42443848e3da63712c97c2a2a8e32d7128eb8b2f749c328f25ccf417b6a902666ab03c678e22691703f01b4a3e9c
-
memory/948-57-0x0000000000000000-mapping.dmp
-
memory/1000-56-0x0000000000000000-mapping.dmp
-
memory/1332-64-0x0000000000000000-mapping.dmp
-
memory/1332-68-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1472-58-0x0000000000000000-mapping.dmp
-
memory/1648-69-0x0000000000000000-mapping.dmp
-
memory/1856-59-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1856-54-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1856-71-0x00000000039F0000-0x0000000003AA7000-memory.dmpFilesize
732KB
-
memory/1856-72-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1940-60-0x0000000000000000-mapping.dmp
-
memory/2028-55-0x0000000000000000-mapping.dmp