Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:51
Static task
static1
Behavioral task
behavioral1
Sample
2bfcc18ff3157d5b800d7d8f3d2ca77a131f228a7e37c64632977073efa9d279.exe
Resource
win7v20201028
General
-
Target
2bfcc18ff3157d5b800d7d8f3d2ca77a131f228a7e37c64632977073efa9d279.exe
-
Size
746KB
-
MD5
614176a1e8e22a51c1106403ce3d1423
-
SHA1
482ea2b067d059eef45ee47fdb782a0e24fdab8e
-
SHA256
2bfcc18ff3157d5b800d7d8f3d2ca77a131f228a7e37c64632977073efa9d279
-
SHA512
4db9c64c491c0e9574616596497f7be9e9abece4d3cc68c66d5f91c4b223b88bbe8ea192aa90cedc8c63b7caa9ce44ad00d89394850787b019ce51b1aa93a6f8
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
UPC.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\svchost.exe" UPC.exe -
Executes dropped EXE 4 IoCs
Processes:
0.exeUPC.sfx.exeUPC.exesvchost.exepid process 2008 0.exe 1960 UPC.sfx.exe 316 UPC.exe 1148 svchost.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\1\UPC.exe upx \Users\Admin\AppData\Local\Temp\1\UPC.exe upx \Users\Admin\AppData\Local\Temp\1\UPC.exe upx \Users\Admin\AppData\Local\Temp\1\UPC.exe upx C:\Users\Admin\AppData\Local\Temp\1\UPC.exe upx \Users\Admin\AppData\Local\Temp\1\UPC.exe upx C:\Users\Admin\AppData\Local\Temp\1\UPC.exe upx \Users\Admin\AppData\Local\Temp\Microsoft\svchost.exe upx \Users\Admin\AppData\Local\Temp\Microsoft\svchost.exe upx C:\Users\Admin\AppData\Local\Temp\Microsoft\svchost.exe upx C:\Users\Admin\AppData\Local\Temp\Microsoft\svchost.exe upx -
Loads dropped DLL 11 IoCs
Processes:
2bfcc18ff3157d5b800d7d8f3d2ca77a131f228a7e37c64632977073efa9d279.exeUPC.sfx.exeUPC.exepid process 752 2bfcc18ff3157d5b800d7d8f3d2ca77a131f228a7e37c64632977073efa9d279.exe 752 2bfcc18ff3157d5b800d7d8f3d2ca77a131f228a7e37c64632977073efa9d279.exe 752 2bfcc18ff3157d5b800d7d8f3d2ca77a131f228a7e37c64632977073efa9d279.exe 752 2bfcc18ff3157d5b800d7d8f3d2ca77a131f228a7e37c64632977073efa9d279.exe 1960 UPC.sfx.exe 1960 UPC.sfx.exe 1960 UPC.sfx.exe 1960 UPC.sfx.exe 1960 UPC.sfx.exe 316 UPC.exe 316 UPC.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
UPC.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\svchost.exe" UPC.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\svchost.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
UPC.sfx.exepid process 1960 UPC.sfx.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
svchost.exepid process 1148 svchost.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
UPC.exesvchost.exedescription pid process Token: SeIncreaseQuotaPrivilege 316 UPC.exe Token: SeSecurityPrivilege 316 UPC.exe Token: SeTakeOwnershipPrivilege 316 UPC.exe Token: SeLoadDriverPrivilege 316 UPC.exe Token: SeSystemProfilePrivilege 316 UPC.exe Token: SeSystemtimePrivilege 316 UPC.exe Token: SeProfSingleProcessPrivilege 316 UPC.exe Token: SeIncBasePriorityPrivilege 316 UPC.exe Token: SeCreatePagefilePrivilege 316 UPC.exe Token: SeBackupPrivilege 316 UPC.exe Token: SeRestorePrivilege 316 UPC.exe Token: SeShutdownPrivilege 316 UPC.exe Token: SeDebugPrivilege 316 UPC.exe Token: SeSystemEnvironmentPrivilege 316 UPC.exe Token: SeChangeNotifyPrivilege 316 UPC.exe Token: SeRemoteShutdownPrivilege 316 UPC.exe Token: SeUndockPrivilege 316 UPC.exe Token: SeManageVolumePrivilege 316 UPC.exe Token: SeImpersonatePrivilege 316 UPC.exe Token: SeCreateGlobalPrivilege 316 UPC.exe Token: 33 316 UPC.exe Token: 34 316 UPC.exe Token: 35 316 UPC.exe Token: SeIncreaseQuotaPrivilege 1148 svchost.exe Token: SeSecurityPrivilege 1148 svchost.exe Token: SeTakeOwnershipPrivilege 1148 svchost.exe Token: SeLoadDriverPrivilege 1148 svchost.exe Token: SeSystemProfilePrivilege 1148 svchost.exe Token: SeSystemtimePrivilege 1148 svchost.exe Token: SeProfSingleProcessPrivilege 1148 svchost.exe Token: SeIncBasePriorityPrivilege 1148 svchost.exe Token: SeCreatePagefilePrivilege 1148 svchost.exe Token: SeBackupPrivilege 1148 svchost.exe Token: SeRestorePrivilege 1148 svchost.exe Token: SeShutdownPrivilege 1148 svchost.exe Token: SeDebugPrivilege 1148 svchost.exe Token: SeSystemEnvironmentPrivilege 1148 svchost.exe Token: SeChangeNotifyPrivilege 1148 svchost.exe Token: SeRemoteShutdownPrivilege 1148 svchost.exe Token: SeUndockPrivilege 1148 svchost.exe Token: SeManageVolumePrivilege 1148 svchost.exe Token: SeImpersonatePrivilege 1148 svchost.exe Token: SeCreateGlobalPrivilege 1148 svchost.exe Token: 33 1148 svchost.exe Token: 34 1148 svchost.exe Token: 35 1148 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svchost.exepid process 1148 svchost.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
2bfcc18ff3157d5b800d7d8f3d2ca77a131f228a7e37c64632977073efa9d279.exe0.execmd.exeUPC.sfx.exeUPC.execmd.exesvchost.exedescription pid process target process PID 752 wrote to memory of 2008 752 2bfcc18ff3157d5b800d7d8f3d2ca77a131f228a7e37c64632977073efa9d279.exe 0.exe PID 752 wrote to memory of 2008 752 2bfcc18ff3157d5b800d7d8f3d2ca77a131f228a7e37c64632977073efa9d279.exe 0.exe PID 752 wrote to memory of 2008 752 2bfcc18ff3157d5b800d7d8f3d2ca77a131f228a7e37c64632977073efa9d279.exe 0.exe PID 752 wrote to memory of 2008 752 2bfcc18ff3157d5b800d7d8f3d2ca77a131f228a7e37c64632977073efa9d279.exe 0.exe PID 2008 wrote to memory of 1436 2008 0.exe cmd.exe PID 2008 wrote to memory of 1436 2008 0.exe cmd.exe PID 2008 wrote to memory of 1436 2008 0.exe cmd.exe PID 2008 wrote to memory of 1436 2008 0.exe cmd.exe PID 1436 wrote to memory of 1960 1436 cmd.exe UPC.sfx.exe PID 1436 wrote to memory of 1960 1436 cmd.exe UPC.sfx.exe PID 1436 wrote to memory of 1960 1436 cmd.exe UPC.sfx.exe PID 1436 wrote to memory of 1960 1436 cmd.exe UPC.sfx.exe PID 1960 wrote to memory of 316 1960 UPC.sfx.exe UPC.exe PID 1960 wrote to memory of 316 1960 UPC.sfx.exe UPC.exe PID 1960 wrote to memory of 316 1960 UPC.sfx.exe UPC.exe PID 1960 wrote to memory of 316 1960 UPC.sfx.exe UPC.exe PID 316 wrote to memory of 976 316 UPC.exe cmd.exe PID 316 wrote to memory of 976 316 UPC.exe cmd.exe PID 316 wrote to memory of 976 316 UPC.exe cmd.exe PID 316 wrote to memory of 976 316 UPC.exe cmd.exe PID 976 wrote to memory of 1356 976 cmd.exe attrib.exe PID 976 wrote to memory of 1356 976 cmd.exe attrib.exe PID 976 wrote to memory of 1356 976 cmd.exe attrib.exe PID 976 wrote to memory of 1356 976 cmd.exe attrib.exe PID 316 wrote to memory of 1148 316 UPC.exe svchost.exe PID 316 wrote to memory of 1148 316 UPC.exe svchost.exe PID 316 wrote to memory of 1148 316 UPC.exe svchost.exe PID 316 wrote to memory of 1148 316 UPC.exe svchost.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe PID 1148 wrote to memory of 1532 1148 svchost.exe notepad.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bfcc18ff3157d5b800d7d8f3d2ca77a131f228a7e37c64632977073efa9d279.exe"C:\Users\Admin\AppData\Local\Temp\2bfcc18ff3157d5b800d7d8f3d2ca77a131f228a7e37c64632977073efa9d279.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2\0.exe"C:\Users\Admin\AppData\Local\Temp\2\0.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1AA2.tmp\1AA3.bat C:\Users\Admin\AppData\Local\Temp\2\0.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2\UPC.sfx.exeUPC.sfx.exe -p43434325gfhfcghjgjkghkjhgjlkhjlhgjkfghjdrhfgvjsr4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1\UPC.exe"C:\Users\Admin\AppData\Local\Temp\1\UPC.exe"5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\1" +s +h6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\1" +s +h7⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft\svchost.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad7⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp\1AA3.batMD5
409d7fa8239971ab6329e6d9a54b5bbf
SHA122827c4d3619474aa39859644c912710e2b97eb4
SHA256d07057af15d3b5f41895459978b87db7dcbdb27b7b11db134ab3f321fef43440
SHA5128f2b5a6e3ae5f1594462641146ec468c65a95bb30fb40ef76a39c4387f1f0add995719a266be38bfa5590335cc13e514a8ff9752116ff21ce85005d03104655e
-
C:\Users\Admin\AppData\Local\Temp\1\UPC.exeMD5
e7f0c59ca166b1226032afcc2a595abe
SHA1f6c1903c44c32547d980fddf2803d111916ddad2
SHA256f234484af5c2e9160c57a25423af367d8704f80bc991f5f0d3471f9deb74c140
SHA5126b016c8ec618908b6f140d7456daaf1728c62c1621b4dfc583247522d4cd4bfa39d653868237db7e250276f87951108be712e03da98d40e88571ca2c69fd1489
-
C:\Users\Admin\AppData\Local\Temp\1\UPC.exeMD5
e7f0c59ca166b1226032afcc2a595abe
SHA1f6c1903c44c32547d980fddf2803d111916ddad2
SHA256f234484af5c2e9160c57a25423af367d8704f80bc991f5f0d3471f9deb74c140
SHA5126b016c8ec618908b6f140d7456daaf1728c62c1621b4dfc583247522d4cd4bfa39d653868237db7e250276f87951108be712e03da98d40e88571ca2c69fd1489
-
C:\Users\Admin\AppData\Local\Temp\2\0.exeMD5
d47cb093de7d3980b54a894310d712c6
SHA1e68ab2b2a9b190ba73053326cb1496c76270d84b
SHA25651c85e3a6b80c75d0efddeb0bc7e9940d0c6753306dd6ffa5ffb5cf59d2894d4
SHA51258a24861a3ee7c4e28f61fffdeb9e4e503054f0b6f3ea152541340b1ac90e7fb3687c5be9dc178d383e528284b555b06fea76d35161ea7b21aa71e20f131b4b8
-
C:\Users\Admin\AppData\Local\Temp\2\UPC.sfx.exeMD5
2759b2b1bd638ab68fe28f29d6302ce2
SHA1cc8d631e4192749f05b98ae08cb73173aeb778fd
SHA256459bda39e5fec6ac92933006d8e9993b7942a9445a2de4c4e2daa9ec546b07af
SHA512cf01b2b799e03c69d5e6cd618e87454a45d66038da867dfb2063c93a657b83d58602ab695b850d1f882c2e816715574d4c307bfb58b48fd2178eb75d34b389bf
-
C:\Users\Admin\AppData\Local\Temp\2\UPC.sfx.exeMD5
2759b2b1bd638ab68fe28f29d6302ce2
SHA1cc8d631e4192749f05b98ae08cb73173aeb778fd
SHA256459bda39e5fec6ac92933006d8e9993b7942a9445a2de4c4e2daa9ec546b07af
SHA512cf01b2b799e03c69d5e6cd618e87454a45d66038da867dfb2063c93a657b83d58602ab695b850d1f882c2e816715574d4c307bfb58b48fd2178eb75d34b389bf
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\svchost.exeMD5
e7f0c59ca166b1226032afcc2a595abe
SHA1f6c1903c44c32547d980fddf2803d111916ddad2
SHA256f234484af5c2e9160c57a25423af367d8704f80bc991f5f0d3471f9deb74c140
SHA5126b016c8ec618908b6f140d7456daaf1728c62c1621b4dfc583247522d4cd4bfa39d653868237db7e250276f87951108be712e03da98d40e88571ca2c69fd1489
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\svchost.exeMD5
e7f0c59ca166b1226032afcc2a595abe
SHA1f6c1903c44c32547d980fddf2803d111916ddad2
SHA256f234484af5c2e9160c57a25423af367d8704f80bc991f5f0d3471f9deb74c140
SHA5126b016c8ec618908b6f140d7456daaf1728c62c1621b4dfc583247522d4cd4bfa39d653868237db7e250276f87951108be712e03da98d40e88571ca2c69fd1489
-
\Users\Admin\AppData\Local\Temp\1\UPC.exeMD5
e7f0c59ca166b1226032afcc2a595abe
SHA1f6c1903c44c32547d980fddf2803d111916ddad2
SHA256f234484af5c2e9160c57a25423af367d8704f80bc991f5f0d3471f9deb74c140
SHA5126b016c8ec618908b6f140d7456daaf1728c62c1621b4dfc583247522d4cd4bfa39d653868237db7e250276f87951108be712e03da98d40e88571ca2c69fd1489
-
\Users\Admin\AppData\Local\Temp\1\UPC.exeMD5
e7f0c59ca166b1226032afcc2a595abe
SHA1f6c1903c44c32547d980fddf2803d111916ddad2
SHA256f234484af5c2e9160c57a25423af367d8704f80bc991f5f0d3471f9deb74c140
SHA5126b016c8ec618908b6f140d7456daaf1728c62c1621b4dfc583247522d4cd4bfa39d653868237db7e250276f87951108be712e03da98d40e88571ca2c69fd1489
-
\Users\Admin\AppData\Local\Temp\1\UPC.exeMD5
e7f0c59ca166b1226032afcc2a595abe
SHA1f6c1903c44c32547d980fddf2803d111916ddad2
SHA256f234484af5c2e9160c57a25423af367d8704f80bc991f5f0d3471f9deb74c140
SHA5126b016c8ec618908b6f140d7456daaf1728c62c1621b4dfc583247522d4cd4bfa39d653868237db7e250276f87951108be712e03da98d40e88571ca2c69fd1489
-
\Users\Admin\AppData\Local\Temp\1\UPC.exeMD5
e7f0c59ca166b1226032afcc2a595abe
SHA1f6c1903c44c32547d980fddf2803d111916ddad2
SHA256f234484af5c2e9160c57a25423af367d8704f80bc991f5f0d3471f9deb74c140
SHA5126b016c8ec618908b6f140d7456daaf1728c62c1621b4dfc583247522d4cd4bfa39d653868237db7e250276f87951108be712e03da98d40e88571ca2c69fd1489
-
\Users\Admin\AppData\Local\Temp\1\UPC.exeMD5
e7f0c59ca166b1226032afcc2a595abe
SHA1f6c1903c44c32547d980fddf2803d111916ddad2
SHA256f234484af5c2e9160c57a25423af367d8704f80bc991f5f0d3471f9deb74c140
SHA5126b016c8ec618908b6f140d7456daaf1728c62c1621b4dfc583247522d4cd4bfa39d653868237db7e250276f87951108be712e03da98d40e88571ca2c69fd1489
-
\Users\Admin\AppData\Local\Temp\2\0.exeMD5
d47cb093de7d3980b54a894310d712c6
SHA1e68ab2b2a9b190ba73053326cb1496c76270d84b
SHA25651c85e3a6b80c75d0efddeb0bc7e9940d0c6753306dd6ffa5ffb5cf59d2894d4
SHA51258a24861a3ee7c4e28f61fffdeb9e4e503054f0b6f3ea152541340b1ac90e7fb3687c5be9dc178d383e528284b555b06fea76d35161ea7b21aa71e20f131b4b8
-
\Users\Admin\AppData\Local\Temp\2\0.exeMD5
d47cb093de7d3980b54a894310d712c6
SHA1e68ab2b2a9b190ba73053326cb1496c76270d84b
SHA25651c85e3a6b80c75d0efddeb0bc7e9940d0c6753306dd6ffa5ffb5cf59d2894d4
SHA51258a24861a3ee7c4e28f61fffdeb9e4e503054f0b6f3ea152541340b1ac90e7fb3687c5be9dc178d383e528284b555b06fea76d35161ea7b21aa71e20f131b4b8
-
\Users\Admin\AppData\Local\Temp\2\0.exeMD5
d47cb093de7d3980b54a894310d712c6
SHA1e68ab2b2a9b190ba73053326cb1496c76270d84b
SHA25651c85e3a6b80c75d0efddeb0bc7e9940d0c6753306dd6ffa5ffb5cf59d2894d4
SHA51258a24861a3ee7c4e28f61fffdeb9e4e503054f0b6f3ea152541340b1ac90e7fb3687c5be9dc178d383e528284b555b06fea76d35161ea7b21aa71e20f131b4b8
-
\Users\Admin\AppData\Local\Temp\2\0.exeMD5
d47cb093de7d3980b54a894310d712c6
SHA1e68ab2b2a9b190ba73053326cb1496c76270d84b
SHA25651c85e3a6b80c75d0efddeb0bc7e9940d0c6753306dd6ffa5ffb5cf59d2894d4
SHA51258a24861a3ee7c4e28f61fffdeb9e4e503054f0b6f3ea152541340b1ac90e7fb3687c5be9dc178d383e528284b555b06fea76d35161ea7b21aa71e20f131b4b8
-
\Users\Admin\AppData\Local\Temp\Microsoft\svchost.exeMD5
e7f0c59ca166b1226032afcc2a595abe
SHA1f6c1903c44c32547d980fddf2803d111916ddad2
SHA256f234484af5c2e9160c57a25423af367d8704f80bc991f5f0d3471f9deb74c140
SHA5126b016c8ec618908b6f140d7456daaf1728c62c1621b4dfc583247522d4cd4bfa39d653868237db7e250276f87951108be712e03da98d40e88571ca2c69fd1489
-
\Users\Admin\AppData\Local\Temp\Microsoft\svchost.exeMD5
e7f0c59ca166b1226032afcc2a595abe
SHA1f6c1903c44c32547d980fddf2803d111916ddad2
SHA256f234484af5c2e9160c57a25423af367d8704f80bc991f5f0d3471f9deb74c140
SHA5126b016c8ec618908b6f140d7456daaf1728c62c1621b4dfc583247522d4cd4bfa39d653868237db7e250276f87951108be712e03da98d40e88571ca2c69fd1489
-
memory/316-18-0x0000000000000000-mapping.dmp
-
memory/976-21-0x0000000000000000-mapping.dmp
-
memory/1148-25-0x0000000000000000-mapping.dmp
-
memory/1356-22-0x0000000000000000-mapping.dmp
-
memory/1436-6-0x0000000000000000-mapping.dmp
-
memory/1532-29-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB
-
memory/1532-28-0x0000000000000000-mapping.dmp
-
memory/1532-30-0x0000000000000000-mapping.dmp
-
memory/1960-11-0x0000000002420000-0x0000000002421000-memory.dmpFilesize
4KB
-
memory/1960-9-0x0000000000000000-mapping.dmp
-
memory/2008-4-0x0000000000000000-mapping.dmp