Resubmissions
25-11-2021 12:39
211125-pvmtfafbhm 8Analysis
-
max time kernel
129s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
25-11-2021 12:39
Static task
static1
Behavioral task
behavioral1
Sample
79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe
Resource
win7-en-20211104
General
-
Target
79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe
-
Size
4.6MB
-
MD5
fe1de0acb3aa75f88f61a784288a32d1
-
SHA1
d973f591f56c3d53aac4e2da4a3eede185c910d9
-
SHA256
79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10
-
SHA512
084770ea021d7d52b50228d1ca6277a9fb5880ae22378c297d24b4bccaca7919a207954350f3257485c010ec0c0cdc6e6548a2508bba1e090647465aa160cf7e
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmpjskit.exepid process 964 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 764 jskit.exe -
Loads dropped DLL 12 IoCs
Processes:
79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmpjskit.exeWerFault.exepid process 1504 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 1368 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 764 jskit.exe 1328 WerFault.exe 1328 WerFault.exe 1328 WerFault.exe 1328 WerFault.exe 1328 WerFault.exe 1328 WerFault.exe 1328 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1328 764 WerFault.exe jskit.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmpWerFault.exepid process 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 1328 WerFault.exe 1328 WerFault.exe 1328 WerFault.exe 1328 WerFault.exe 1328 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1328 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 1328 WerFault.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmppid process 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmpjskit.exedescription pid process target process PID 1504 wrote to memory of 964 1504 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1504 wrote to memory of 964 1504 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1504 wrote to memory of 964 1504 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1504 wrote to memory of 964 1504 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1504 wrote to memory of 964 1504 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1504 wrote to memory of 964 1504 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1504 wrote to memory of 964 1504 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 964 wrote to memory of 1368 964 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe PID 964 wrote to memory of 1368 964 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe PID 964 wrote to memory of 1368 964 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe PID 964 wrote to memory of 1368 964 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe PID 964 wrote to memory of 1368 964 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe PID 964 wrote to memory of 1368 964 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe PID 964 wrote to memory of 1368 964 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe PID 1368 wrote to memory of 1812 1368 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1368 wrote to memory of 1812 1368 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1368 wrote to memory of 1812 1368 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1368 wrote to memory of 1812 1368 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1368 wrote to memory of 1812 1368 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1368 wrote to memory of 1812 1368 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1368 wrote to memory of 1812 1368 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp PID 1812 wrote to memory of 764 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp jskit.exe PID 1812 wrote to memory of 764 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp jskit.exe PID 1812 wrote to memory of 764 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp jskit.exe PID 1812 wrote to memory of 764 1812 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp jskit.exe PID 764 wrote to memory of 1328 764 jskit.exe WerFault.exe PID 764 wrote to memory of 1328 764 jskit.exe WerFault.exe PID 764 wrote to memory of 1328 764 jskit.exe WerFault.exe PID 764 wrote to memory of 1328 764 jskit.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe"C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-7QDRC.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp"C:\Users\Admin\AppData\Local\Temp\is-7QDRC.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp" /SL5="$80154,4018938,831488,C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe"C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe" /VERYSILENT3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-4KCP2.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp"C:\Users\Admin\AppData\Local\Temp\is-4KCP2.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmp" /SL5="$5012A,4018938,831488,C:\Users\Admin\AppData\Local\Temp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe"C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 2646⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-4KCP2.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmpMD5
eb8e24c85edf254cf3f2c1344842b55f
SHA12da756889e7e93b4019bb91ff74cd06866a4ec86
SHA256e6bb9bb3fa48e9c1e7a74c010adf9e30ca6eb4906b0c31c8834102e7adfccc2d
SHA512e3fd05d7e827400a7b66f0545d184633bf776e7a71b95876c4c8d679fa0e74cf031ae23382ade91ff723414614f4346236c3cb767389f44b50283c51653bcb61
-
C:\Users\Admin\AppData\Local\Temp\is-7QDRC.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmpMD5
eb8e24c85edf254cf3f2c1344842b55f
SHA12da756889e7e93b4019bb91ff74cd06866a4ec86
SHA256e6bb9bb3fa48e9c1e7a74c010adf9e30ca6eb4906b0c31c8834102e7adfccc2d
SHA512e3fd05d7e827400a7b66f0545d184633bf776e7a71b95876c4c8d679fa0e74cf031ae23382ade91ff723414614f4346236c3cb767389f44b50283c51653bcb61
-
C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exeMD5
81acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exeMD5
81acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
C:\Users\Admin\AppData\Roaming\PhantomJS WebKit\libvorbisenc-2.dllMD5
958de7dd326bd45460ecb5082064df4c
SHA142e0da2a5c761641cfa2ff8d57ea21a3325f7606
SHA256f89d307fa7c880e72b2f3b5827d755943f1c7ad3a98683a22de721f1fce2e38c
SHA512dfe4d1a7c73a0ccfe505501bf7b41976616c3db61b8f44d0dda5537e1321fdc02ad9963c0e0e901020c91b6803782faf195ccdc687d9e4bd2be95c1afb78f894
-
\Users\Admin\AppData\Local\Temp\is-4KCP2.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmpMD5
eb8e24c85edf254cf3f2c1344842b55f
SHA12da756889e7e93b4019bb91ff74cd06866a4ec86
SHA256e6bb9bb3fa48e9c1e7a74c010adf9e30ca6eb4906b0c31c8834102e7adfccc2d
SHA512e3fd05d7e827400a7b66f0545d184633bf776e7a71b95876c4c8d679fa0e74cf031ae23382ade91ff723414614f4346236c3cb767389f44b50283c51653bcb61
-
\Users\Admin\AppData\Local\Temp\is-7QDRC.tmp\79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f10.tmpMD5
eb8e24c85edf254cf3f2c1344842b55f
SHA12da756889e7e93b4019bb91ff74cd06866a4ec86
SHA256e6bb9bb3fa48e9c1e7a74c010adf9e30ca6eb4906b0c31c8834102e7adfccc2d
SHA512e3fd05d7e827400a7b66f0545d184633bf776e7a71b95876c4c8d679fa0e74cf031ae23382ade91ff723414614f4346236c3cb767389f44b50283c51653bcb61
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exeMD5
81acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exeMD5
81acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exeMD5
81acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exeMD5
81acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exeMD5
81acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exeMD5
81acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exeMD5
81acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exeMD5
81acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\jskit.exeMD5
81acde2ff13a5f79e0d172f3af07d7c0
SHA1a07ce9830d50d2c3d94e7df41de032b04fe641d2
SHA256c4d0998328ce86ce10e965abd0936aa0d920abbb78fbe6a4d1e4d8072f68ad2d
SHA5129d81fa14b26f7d678b3cb1fc71b5724392f11ac399f98ad5f3d98f0caa909a6587c6b349ccc6b6eb325e8024e8fbbf642f92e0be50e626aa1495cb861c0c2bf0
-
\Users\Admin\AppData\Roaming\PhantomJS WebKit\libvorbisenc-2.dllMD5
958de7dd326bd45460ecb5082064df4c
SHA142e0da2a5c761641cfa2ff8d57ea21a3325f7606
SHA256f89d307fa7c880e72b2f3b5827d755943f1c7ad3a98683a22de721f1fce2e38c
SHA512dfe4d1a7c73a0ccfe505501bf7b41976616c3db61b8f44d0dda5537e1321fdc02ad9963c0e0e901020c91b6803782faf195ccdc687d9e4bd2be95c1afb78f894
-
memory/764-77-0x0000000000000000-mapping.dmp
-
memory/964-63-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/964-60-0x0000000000000000-mapping.dmp
-
memory/1328-81-0x0000000000000000-mapping.dmp
-
memory/1328-91-0x00000000006B0000-0x00000000006B1000-memory.dmpFilesize
4KB
-
memory/1368-69-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/1368-64-0x0000000000000000-mapping.dmp
-
memory/1504-58-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/1504-55-0x0000000075141000-0x0000000075143000-memory.dmpFilesize
8KB
-
memory/1812-74-0x0000000074391000-0x0000000074393000-memory.dmpFilesize
8KB
-
memory/1812-73-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1812-70-0x0000000000000000-mapping.dmp