Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 12:15
Static task
static1
Behavioral task
behavioral1
Sample
ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe
Resource
win7-20220901-en
General
-
Target
ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe
-
Size
693KB
-
MD5
6de7cd0ab88ab2804c3406df023bb3a0
-
SHA1
edf82e682f3eed25b22755ae52226131d9ccaf66
-
SHA256
ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63
-
SHA512
2ac5d42ed2ba3282881e2df8afc59043793baad6499eea5fc7dc3ce4e650e986d8833a7eee541b29c74794edaff7ce1ae4630be6c95303687f5714055d0d5368
-
SSDEEP
12288:BZ8nw7Aaw+qphbSZmoTeBrp8pLKHxA/qnGIVuett6C63qGWKPMto3bybWBTBn/r:BZ8wEaL0oyBVSgJnGIVjGWFKbvn/r
Malware Config
Extracted
darkcomet
HackEd
net0.noip.me:1604
DC_MUTEX-TEWLSPF
-
InstallPath
Microsoft\windows\explorer.exe
-
gencode
J5KZ635fLizV
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Microsoft Windows
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Microsoft\\windows\\explorer.exe" ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" explorer.exe -
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" explorer.exe -
Executes dropped EXE 1 IoCs
Processes:
explorer.exepid process 1700 explorer.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1104 attrib.exe 1736 attrib.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1020 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exepid process 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe -
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Microsoft\\windows\\explorer.exe" ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Microsoft\\windows\\explorer.exe" explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1700 explorer.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exeexplorer.exedescription pid process Token: SeIncreaseQuotaPrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeSecurityPrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeTakeOwnershipPrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeLoadDriverPrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeSystemProfilePrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeSystemtimePrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeProfSingleProcessPrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeIncBasePriorityPrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeCreatePagefilePrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeBackupPrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeRestorePrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeShutdownPrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeDebugPrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeSystemEnvironmentPrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeChangeNotifyPrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeRemoteShutdownPrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeUndockPrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeManageVolumePrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeImpersonatePrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeCreateGlobalPrivilege 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: 33 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: 34 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: 35 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeIncreaseQuotaPrivilege 1700 explorer.exe Token: SeSecurityPrivilege 1700 explorer.exe Token: SeTakeOwnershipPrivilege 1700 explorer.exe Token: SeLoadDriverPrivilege 1700 explorer.exe Token: SeSystemProfilePrivilege 1700 explorer.exe Token: SeSystemtimePrivilege 1700 explorer.exe Token: SeProfSingleProcessPrivilege 1700 explorer.exe Token: SeIncBasePriorityPrivilege 1700 explorer.exe Token: SeCreatePagefilePrivilege 1700 explorer.exe Token: SeBackupPrivilege 1700 explorer.exe Token: SeRestorePrivilege 1700 explorer.exe Token: SeShutdownPrivilege 1700 explorer.exe Token: SeDebugPrivilege 1700 explorer.exe Token: SeSystemEnvironmentPrivilege 1700 explorer.exe Token: SeChangeNotifyPrivilege 1700 explorer.exe Token: SeRemoteShutdownPrivilege 1700 explorer.exe Token: SeUndockPrivilege 1700 explorer.exe Token: SeManageVolumePrivilege 1700 explorer.exe Token: SeImpersonatePrivilege 1700 explorer.exe Token: SeCreateGlobalPrivilege 1700 explorer.exe Token: 33 1700 explorer.exe Token: 34 1700 explorer.exe Token: 35 1700 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
explorer.exepid process 1700 explorer.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.execmd.execmd.exeexplorer.exedescription pid process target process PID 1328 wrote to memory of 616 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe cmd.exe PID 1328 wrote to memory of 616 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe cmd.exe PID 1328 wrote to memory of 616 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe cmd.exe PID 1328 wrote to memory of 616 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe cmd.exe PID 1328 wrote to memory of 1516 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe cmd.exe PID 1328 wrote to memory of 1516 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe cmd.exe PID 1328 wrote to memory of 1516 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe cmd.exe PID 1328 wrote to memory of 1516 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe cmd.exe PID 1328 wrote to memory of 1020 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 1328 wrote to memory of 1020 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 1328 wrote to memory of 1020 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 1328 wrote to memory of 1020 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 1328 wrote to memory of 1020 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 1328 wrote to memory of 1020 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 1328 wrote to memory of 1020 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 1328 wrote to memory of 1020 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 1328 wrote to memory of 1020 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 1328 wrote to memory of 1020 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 1328 wrote to memory of 1020 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 1328 wrote to memory of 1020 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 1328 wrote to memory of 1020 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 1328 wrote to memory of 1020 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 1328 wrote to memory of 1020 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 1328 wrote to memory of 1020 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 1328 wrote to memory of 1020 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 1328 wrote to memory of 1020 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 1516 wrote to memory of 1104 1516 cmd.exe attrib.exe PID 1516 wrote to memory of 1104 1516 cmd.exe attrib.exe PID 1516 wrote to memory of 1104 1516 cmd.exe attrib.exe PID 1516 wrote to memory of 1104 1516 cmd.exe attrib.exe PID 616 wrote to memory of 1736 616 cmd.exe attrib.exe PID 616 wrote to memory of 1736 616 cmd.exe attrib.exe PID 616 wrote to memory of 1736 616 cmd.exe attrib.exe PID 616 wrote to memory of 1736 616 cmd.exe attrib.exe PID 1328 wrote to memory of 1700 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe explorer.exe PID 1328 wrote to memory of 1700 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe explorer.exe PID 1328 wrote to memory of 1700 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe explorer.exe PID 1328 wrote to memory of 1700 1328 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe explorer.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe PID 1700 wrote to memory of 1640 1700 explorer.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" explorer.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1104 attrib.exe 1736 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe"C:\Users\Admin\AppData\Local\Temp\ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Microsoft\windows\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Microsoft\windows\explorer.exe"2⤵
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Microsoft\windows\explorer.exeFilesize
693KB
MD56de7cd0ab88ab2804c3406df023bb3a0
SHA1edf82e682f3eed25b22755ae52226131d9ccaf66
SHA256ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63
SHA5122ac5d42ed2ba3282881e2df8afc59043793baad6499eea5fc7dc3ce4e650e986d8833a7eee541b29c74794edaff7ce1ae4630be6c95303687f5714055d0d5368
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Microsoft\windows\explorer.exeFilesize
693KB
MD56de7cd0ab88ab2804c3406df023bb3a0
SHA1edf82e682f3eed25b22755ae52226131d9ccaf66
SHA256ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63
SHA5122ac5d42ed2ba3282881e2df8afc59043793baad6499eea5fc7dc3ce4e650e986d8833a7eee541b29c74794edaff7ce1ae4630be6c95303687f5714055d0d5368
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Microsoft\windows\explorer.exeFilesize
693KB
MD56de7cd0ab88ab2804c3406df023bb3a0
SHA1edf82e682f3eed25b22755ae52226131d9ccaf66
SHA256ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63
SHA5122ac5d42ed2ba3282881e2df8afc59043793baad6499eea5fc7dc3ce4e650e986d8833a7eee541b29c74794edaff7ce1ae4630be6c95303687f5714055d0d5368
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Microsoft\windows\explorer.exeFilesize
693KB
MD56de7cd0ab88ab2804c3406df023bb3a0
SHA1edf82e682f3eed25b22755ae52226131d9ccaf66
SHA256ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63
SHA5122ac5d42ed2ba3282881e2df8afc59043793baad6499eea5fc7dc3ce4e650e986d8833a7eee541b29c74794edaff7ce1ae4630be6c95303687f5714055d0d5368
-
memory/616-55-0x0000000000000000-mapping.dmp
-
memory/1020-57-0x0000000000000000-mapping.dmp
-
memory/1104-59-0x0000000000000000-mapping.dmp
-
memory/1328-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB
-
memory/1328-67-0x0000000003C40000-0x0000000003DB9000-memory.dmpFilesize
1.5MB
-
memory/1328-65-0x0000000000400000-0x0000000000579000-memory.dmpFilesize
1.5MB
-
memory/1516-56-0x0000000000000000-mapping.dmp
-
memory/1640-69-0x0000000000000000-mapping.dmp
-
memory/1700-63-0x0000000000000000-mapping.dmp
-
memory/1700-70-0x0000000000400000-0x0000000000579000-memory.dmpFilesize
1.5MB
-
memory/1700-72-0x0000000000400000-0x0000000000579000-memory.dmpFilesize
1.5MB
-
memory/1700-73-0x0000000000400000-0x0000000000579000-memory.dmpFilesize
1.5MB
-
memory/1700-74-0x0000000000400000-0x0000000000579000-memory.dmpFilesize
1.5MB
-
memory/1736-60-0x0000000000000000-mapping.dmp