Analysis
-
max time kernel
551s -
max time network
545s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
04-06-2021 01:54
Static task
static1
Behavioral task
behavioral1
Sample
570fbe91fdd6d1eb8cfd2f03c032cdde.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
570fbe91fdd6d1eb8cfd2f03c032cdde.exe
Resource
win10v20210408
General
-
Target
570fbe91fdd6d1eb8cfd2f03c032cdde.exe
-
Size
872KB
-
MD5
570fbe91fdd6d1eb8cfd2f03c032cdde
-
SHA1
59d07617c682fed330d82b1d97f1bf32c30c6ff1
-
SHA256
b4a1845a21726b4826eb4157114d424c9a0f1c3112f67f587cbea352dd33ac61
-
SHA512
e0cd9f67e26140b22dbcee760b0690e5dd2bb0242091d3c759c123789c6b2bb8abbf1c2a80d6b4e1b00f9097f4f782ba2035041c92afc2280dd75a9dc21f7fb6
Malware Config
Extracted
C:\_readme.txt
djvu
helpteam@mail.ch
helpmanager@airmail.cc
https://we.tl/t-B0FsLNO3fN
Signatures
-
Detected Djvu ransomeware 10 IoCs
Processes:
resource yara_rule behavioral2/memory/2676-114-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2676-115-0x0000000000424141-mapping.dmp family_djvu behavioral2/memory/656-116-0x0000000002420000-0x000000000253B000-memory.dmp family_djvu behavioral2/memory/2676-117-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1992-122-0x0000000000424141-mapping.dmp family_djvu behavioral2/memory/1992-124-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2068-127-0x0000000000424141-mapping.dmp family_djvu behavioral2/memory/2068-130-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/648-133-0x0000000000424141-mapping.dmp family_djvu behavioral2/memory/648-136-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Executes dropped EXE 4 IoCs
Processes:
570fbe91fdd6d1eb8cfd2f03c032cdde.exe570fbe91fdd6d1eb8cfd2f03c032cdde.exe570fbe91fdd6d1eb8cfd2f03c032cdde.exe570fbe91fdd6d1eb8cfd2f03c032cdde.exepid process 3720 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 2068 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 1812 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 648 570fbe91fdd6d1eb8cfd2f03c032cdde.exe -
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
570fbe91fdd6d1eb8cfd2f03c032cdde.exedescription ioc process File renamed C:\Users\Admin\Pictures\WaitPop.tif => C:\Users\Admin\Pictures\WaitPop.tif.paas 570fbe91fdd6d1eb8cfd2f03c032cdde.exe File renamed C:\Users\Admin\Pictures\CompareRevoke.tif => C:\Users\Admin\Pictures\CompareRevoke.tif.paas 570fbe91fdd6d1eb8cfd2f03c032cdde.exe File renamed C:\Users\Admin\Pictures\MergeSearch.tiff => C:\Users\Admin\Pictures\MergeSearch.tiff.paas 570fbe91fdd6d1eb8cfd2f03c032cdde.exe File renamed C:\Users\Admin\Pictures\MergeTrace.raw => C:\Users\Admin\Pictures\MergeTrace.raw.paas 570fbe91fdd6d1eb8cfd2f03c032cdde.exe File renamed C:\Users\Admin\Pictures\OptimizeApprove.png => C:\Users\Admin\Pictures\OptimizeApprove.png.paas 570fbe91fdd6d1eb8cfd2f03c032cdde.exe File renamed C:\Users\Admin\Pictures\UnlockTest.png => C:\Users\Admin\Pictures\UnlockTest.png.paas 570fbe91fdd6d1eb8cfd2f03c032cdde.exe File renamed C:\Users\Admin\Pictures\ClearConvertFrom.tif => C:\Users\Admin\Pictures\ClearConvertFrom.tif.paas 570fbe91fdd6d1eb8cfd2f03c032cdde.exe File renamed C:\Users\Admin\Pictures\EnableUnlock.crw => C:\Users\Admin\Pictures\EnableUnlock.crw.paas 570fbe91fdd6d1eb8cfd2f03c032cdde.exe File opened for modification C:\Users\Admin\Pictures\MergeSearch.tiff 570fbe91fdd6d1eb8cfd2f03c032cdde.exe File renamed C:\Users\Admin\Pictures\ShowDisconnect.tif => C:\Users\Admin\Pictures\ShowDisconnect.tif.paas 570fbe91fdd6d1eb8cfd2f03c032cdde.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
570fbe91fdd6d1eb8cfd2f03c032cdde.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\6dcb6942-e898-4cf4-bddf-e65f9bd9c6b2\\570fbe91fdd6d1eb8cfd2f03c032cdde.exe\" --AutoStart" 570fbe91fdd6d1eb8cfd2f03c032cdde.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 api.2ip.ua 12 api.2ip.ua 17 api.2ip.ua 23 api.2ip.ua -
Suspicious use of SetThreadContext 4 IoCs
Processes:
570fbe91fdd6d1eb8cfd2f03c032cdde.exe570fbe91fdd6d1eb8cfd2f03c032cdde.exe570fbe91fdd6d1eb8cfd2f03c032cdde.exe570fbe91fdd6d1eb8cfd2f03c032cdde.exedescription pid process target process PID 656 set thread context of 2676 656 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 200 set thread context of 1992 200 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 3720 set thread context of 2068 3720 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 1812 set thread context of 648 1812 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
570fbe91fdd6d1eb8cfd2f03c032cdde.exe570fbe91fdd6d1eb8cfd2f03c032cdde.exe570fbe91fdd6d1eb8cfd2f03c032cdde.exe570fbe91fdd6d1eb8cfd2f03c032cdde.exepid process 2676 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 2676 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 1992 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 1992 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 2068 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 2068 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 1992 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 1992 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 648 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 648 570fbe91fdd6d1eb8cfd2f03c032cdde.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
570fbe91fdd6d1eb8cfd2f03c032cdde.exe570fbe91fdd6d1eb8cfd2f03c032cdde.exe570fbe91fdd6d1eb8cfd2f03c032cdde.exe570fbe91fdd6d1eb8cfd2f03c032cdde.exe570fbe91fdd6d1eb8cfd2f03c032cdde.exedescription pid process target process PID 656 wrote to memory of 2676 656 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 656 wrote to memory of 2676 656 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 656 wrote to memory of 2676 656 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 656 wrote to memory of 2676 656 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 656 wrote to memory of 2676 656 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 656 wrote to memory of 2676 656 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 656 wrote to memory of 2676 656 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 656 wrote to memory of 2676 656 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 656 wrote to memory of 2676 656 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 656 wrote to memory of 2676 656 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 2676 wrote to memory of 3380 2676 570fbe91fdd6d1eb8cfd2f03c032cdde.exe icacls.exe PID 2676 wrote to memory of 3380 2676 570fbe91fdd6d1eb8cfd2f03c032cdde.exe icacls.exe PID 2676 wrote to memory of 3380 2676 570fbe91fdd6d1eb8cfd2f03c032cdde.exe icacls.exe PID 2676 wrote to memory of 200 2676 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 2676 wrote to memory of 200 2676 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 2676 wrote to memory of 200 2676 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 200 wrote to memory of 1992 200 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 200 wrote to memory of 1992 200 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 200 wrote to memory of 1992 200 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 200 wrote to memory of 1992 200 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 200 wrote to memory of 1992 200 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 200 wrote to memory of 1992 200 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 200 wrote to memory of 1992 200 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 200 wrote to memory of 1992 200 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 200 wrote to memory of 1992 200 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 200 wrote to memory of 1992 200 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 3720 wrote to memory of 2068 3720 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 3720 wrote to memory of 2068 3720 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 3720 wrote to memory of 2068 3720 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 3720 wrote to memory of 2068 3720 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 3720 wrote to memory of 2068 3720 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 3720 wrote to memory of 2068 3720 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 3720 wrote to memory of 2068 3720 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 3720 wrote to memory of 2068 3720 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 3720 wrote to memory of 2068 3720 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 3720 wrote to memory of 2068 3720 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 1812 wrote to memory of 648 1812 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 1812 wrote to memory of 648 1812 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 1812 wrote to memory of 648 1812 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 1812 wrote to memory of 648 1812 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 1812 wrote to memory of 648 1812 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 1812 wrote to memory of 648 1812 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 1812 wrote to memory of 648 1812 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 1812 wrote to memory of 648 1812 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 1812 wrote to memory of 648 1812 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe PID 1812 wrote to memory of 648 1812 570fbe91fdd6d1eb8cfd2f03c032cdde.exe 570fbe91fdd6d1eb8cfd2f03c032cdde.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\570fbe91fdd6d1eb8cfd2f03c032cdde.exe"C:\Users\Admin\AppData\Local\Temp\570fbe91fdd6d1eb8cfd2f03c032cdde.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\570fbe91fdd6d1eb8cfd2f03c032cdde.exe"C:\Users\Admin\AppData\Local\Temp\570fbe91fdd6d1eb8cfd2f03c032cdde.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\6dcb6942-e898-4cf4-bddf-e65f9bd9c6b2" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\570fbe91fdd6d1eb8cfd2f03c032cdde.exe"C:\Users\Admin\AppData\Local\Temp\570fbe91fdd6d1eb8cfd2f03c032cdde.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\570fbe91fdd6d1eb8cfd2f03c032cdde.exe"C:\Users\Admin\AppData\Local\Temp\570fbe91fdd6d1eb8cfd2f03c032cdde.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Modifies extensions of user files
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\6dcb6942-e898-4cf4-bddf-e65f9bd9c6b2\570fbe91fdd6d1eb8cfd2f03c032cdde.exeC:\Users\Admin\AppData\Local\6dcb6942-e898-4cf4-bddf-e65f9bd9c6b2\570fbe91fdd6d1eb8cfd2f03c032cdde.exe --Task1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\6dcb6942-e898-4cf4-bddf-e65f9bd9c6b2\570fbe91fdd6d1eb8cfd2f03c032cdde.exeC:\Users\Admin\AppData\Local\6dcb6942-e898-4cf4-bddf-e65f9bd9c6b2\570fbe91fdd6d1eb8cfd2f03c032cdde.exe --Task2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\6dcb6942-e898-4cf4-bddf-e65f9bd9c6b2\570fbe91fdd6d1eb8cfd2f03c032cdde.exeC:\Users\Admin\AppData\Local\6dcb6942-e898-4cf4-bddf-e65f9bd9c6b2\570fbe91fdd6d1eb8cfd2f03c032cdde.exe --Task1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\6dcb6942-e898-4cf4-bddf-e65f9bd9c6b2\570fbe91fdd6d1eb8cfd2f03c032cdde.exeC:\Users\Admin\AppData\Local\6dcb6942-e898-4cf4-bddf-e65f9bd9c6b2\570fbe91fdd6d1eb8cfd2f03c032cdde.exe --Task2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\SystemID\PersonalID.txtMD5
c9141abc06f106bb6d58deb107253ac0
SHA18c748834dc38500d3632e3b6428977b02a6c8b84
SHA2563d7cc5c63e5ac14b56e12c37ffa484eb9c4c3c28f89f36579d1d02da2433b0a2
SHA512f01916ded59752b7ad45df8e2c83e9a809b0fd1de8f17863c973f9139ba4e4ac18aedef97c196ad782a6e733faafd9fcdd5447c82ec71676deb0f1d86097d203
-
C:\Users\Admin\AppData\Local\6dcb6942-e898-4cf4-bddf-e65f9bd9c6b2\570fbe91fdd6d1eb8cfd2f03c032cdde.exeMD5
570fbe91fdd6d1eb8cfd2f03c032cdde
SHA159d07617c682fed330d82b1d97f1bf32c30c6ff1
SHA256b4a1845a21726b4826eb4157114d424c9a0f1c3112f67f587cbea352dd33ac61
SHA512e0cd9f67e26140b22dbcee760b0690e5dd2bb0242091d3c759c123789c6b2bb8abbf1c2a80d6b4e1b00f9097f4f782ba2035041c92afc2280dd75a9dc21f7fb6
-
C:\Users\Admin\AppData\Local\6dcb6942-e898-4cf4-bddf-e65f9bd9c6b2\570fbe91fdd6d1eb8cfd2f03c032cdde.exeMD5
570fbe91fdd6d1eb8cfd2f03c032cdde
SHA159d07617c682fed330d82b1d97f1bf32c30c6ff1
SHA256b4a1845a21726b4826eb4157114d424c9a0f1c3112f67f587cbea352dd33ac61
SHA512e0cd9f67e26140b22dbcee760b0690e5dd2bb0242091d3c759c123789c6b2bb8abbf1c2a80d6b4e1b00f9097f4f782ba2035041c92afc2280dd75a9dc21f7fb6
-
C:\Users\Admin\AppData\Local\6dcb6942-e898-4cf4-bddf-e65f9bd9c6b2\570fbe91fdd6d1eb8cfd2f03c032cdde.exeMD5
570fbe91fdd6d1eb8cfd2f03c032cdde
SHA159d07617c682fed330d82b1d97f1bf32c30c6ff1
SHA256b4a1845a21726b4826eb4157114d424c9a0f1c3112f67f587cbea352dd33ac61
SHA512e0cd9f67e26140b22dbcee760b0690e5dd2bb0242091d3c759c123789c6b2bb8abbf1c2a80d6b4e1b00f9097f4f782ba2035041c92afc2280dd75a9dc21f7fb6
-
C:\Users\Admin\AppData\Local\6dcb6942-e898-4cf4-bddf-e65f9bd9c6b2\570fbe91fdd6d1eb8cfd2f03c032cdde.exeMD5
570fbe91fdd6d1eb8cfd2f03c032cdde
SHA159d07617c682fed330d82b1d97f1bf32c30c6ff1
SHA256b4a1845a21726b4826eb4157114d424c9a0f1c3112f67f587cbea352dd33ac61
SHA512e0cd9f67e26140b22dbcee760b0690e5dd2bb0242091d3c759c123789c6b2bb8abbf1c2a80d6b4e1b00f9097f4f782ba2035041c92afc2280dd75a9dc21f7fb6
-
C:\Users\Admin\AppData\Local\6dcb6942-e898-4cf4-bddf-e65f9bd9c6b2\570fbe91fdd6d1eb8cfd2f03c032cdde.exeMD5
570fbe91fdd6d1eb8cfd2f03c032cdde
SHA159d07617c682fed330d82b1d97f1bf32c30c6ff1
SHA256b4a1845a21726b4826eb4157114d424c9a0f1c3112f67f587cbea352dd33ac61
SHA512e0cd9f67e26140b22dbcee760b0690e5dd2bb0242091d3c759c123789c6b2bb8abbf1c2a80d6b4e1b00f9097f4f782ba2035041c92afc2280dd75a9dc21f7fb6
-
memory/200-120-0x0000000000000000-mapping.dmp
-
memory/648-136-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/648-133-0x0000000000424141-mapping.dmp
-
memory/656-116-0x0000000002420000-0x000000000253B000-memory.dmpFilesize
1.1MB
-
memory/1992-122-0x0000000000424141-mapping.dmp
-
memory/1992-124-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2068-130-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2068-127-0x0000000000424141-mapping.dmp
-
memory/2676-114-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2676-117-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2676-115-0x0000000000424141-mapping.dmp
-
memory/3380-118-0x0000000000000000-mapping.dmp