Analysis
-
max time kernel
148s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2022 06:45
Static task
static1
Behavioral task
behavioral1
Sample
e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe
Resource
win10v2004-20220812-en
General
-
Target
e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe
-
Size
192KB
-
MD5
54e5e90fbafdf6f051f2c89da50a4b95
-
SHA1
f1e4459301f216cd4ff0bd27deb9d5a910ef9f5b
-
SHA256
e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a
-
SHA512
a22ccbff0ff8da17a8a3a04f38f644b041b47e1c995b8b40b9a7ec4577c850439d244b966834f86d7ce6dd4ec3369ac11d9950429a3336b9b9c53095ea9b0b4b
-
SSDEEP
1536:bB+R6Ywvj1k3w45lEdhKzoUSFeuiS2FIlKbz0PEziNQKjoa:tAwvj1Mw4shKzoUSFeuiS2FIIcwKoa
Malware Config
Extracted
bitrat
1.38
gh9st.mywire.org:5005
-
communication_password
803355ca422bf9b37bc523a750e21842
-
install_dir
svcsvc
-
install_file
svcsvc.exe
-
tor_process
tor
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exee4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Qusfukpzsf = "\"C:\\Users\\Admin\\AppData\\Roaming\\Vvxyeheuij\\Qusfukpzsf.exe\"" e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svcsvc = "C:\\Users\\Admin\\AppData\\Local\\svcsvc\\svcsvc.exeЀ" e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svcsvc = "C:\\Users\\Admin\\AppData\\Local\\svcsvc\\svcsvc.exe" e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exepid process 4176 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe 4176 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe 4176 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe 4176 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe 4176 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exee4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exee4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exedescription pid process target process PID 4844 set thread context of 3204 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3204 set thread context of 3468 3204 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3468 set thread context of 4176 3468 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4584 3468 WerFault.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exee4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exee4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exepid process 4108 powershell.exe 4108 powershell.exe 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe 3468 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe 3468 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe 3468 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe -
Suspicious behavior: RenamesItself 6 IoCs
Processes:
e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exepid process 4176 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe 4176 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe 4176 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe 4176 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe 4176 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe 4176 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exepowershell.exee4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exee4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exedescription pid process Token: SeDebugPrivilege 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe Token: SeDebugPrivilege 4108 powershell.exe Token: SeDebugPrivilege 3468 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe Token: SeShutdownPrivilege 4176 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exepid process 4176 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe 4176 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exee4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exee4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exedescription pid process target process PID 4844 wrote to memory of 4108 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe powershell.exe PID 4844 wrote to memory of 4108 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe powershell.exe PID 4844 wrote to memory of 4108 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe powershell.exe PID 4844 wrote to memory of 1780 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 4844 wrote to memory of 1780 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 4844 wrote to memory of 1780 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 4844 wrote to memory of 1544 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 4844 wrote to memory of 1544 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 4844 wrote to memory of 1544 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 4844 wrote to memory of 3204 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 4844 wrote to memory of 3204 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 4844 wrote to memory of 3204 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 4844 wrote to memory of 3204 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 4844 wrote to memory of 3204 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 4844 wrote to memory of 3204 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 4844 wrote to memory of 3204 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 4844 wrote to memory of 3204 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 4844 wrote to memory of 3204 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 4844 wrote to memory of 3204 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 4844 wrote to memory of 3204 4844 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3204 wrote to memory of 3468 3204 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3204 wrote to memory of 3468 3204 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3204 wrote to memory of 3468 3204 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3204 wrote to memory of 3468 3204 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3204 wrote to memory of 3468 3204 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3204 wrote to memory of 3468 3204 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3204 wrote to memory of 3468 3204 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3204 wrote to memory of 3468 3204 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3468 wrote to memory of 4176 3468 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3468 wrote to memory of 4176 3468 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3468 wrote to memory of 4176 3468 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3468 wrote to memory of 4176 3468 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3468 wrote to memory of 4176 3468 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3468 wrote to memory of 4176 3468 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3468 wrote to memory of 4176 3468 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3468 wrote to memory of 4176 3468 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3468 wrote to memory of 4176 3468 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3468 wrote to memory of 4176 3468 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe PID 3468 wrote to memory of 4176 3468 e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe"C:\Users\Admin\AppData\Local\Temp\e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exeC:\Users\Admin\AppData\Local\Temp\e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exeC:\Users\Admin\AppData\Local\Temp\e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exeC:\Users\Admin\AppData\Local\Temp\e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe"C:\Users\Admin\AppData\Local\Temp\e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe"C:\Users\Admin\AppData\Local\Temp\e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe"4⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3468 -s 11804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3468 -ip 34681⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e4d62d22644bd8f7b85b47328cbac771dd76473902ac2a92cb3bb06ff7ed091a.exe.logFilesize
1KB
MD5e87e48b105757e1c7563d1c719059733
SHA128a3f2b2e0672da2b531f4757d2b20b53032dafc
SHA2560aaf22dc84cc3fcfe53de7ccfed8e662247dfb7f1a9967032c88790d0c663461
SHA512bf19c5743143aee914a453c41189c722c9b90a5b8bf299cecf3e1f97656d32cd209ecb74da8aebc89bb41c27d189f73aaaabbc64fe383410c95dc76ad4218968
-
memory/1544-143-0x0000000000000000-mapping.dmp
-
memory/1780-142-0x0000000000000000-mapping.dmp
-
memory/3204-147-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/3204-145-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/3204-144-0x0000000000000000-mapping.dmp
-
memory/3204-146-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/3204-151-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/3204-148-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/3468-153-0x0000000005C30000-0x00000000061D4000-memory.dmpFilesize
5.6MB
-
memory/3468-149-0x0000000000000000-mapping.dmp
-
memory/3468-150-0x0000000000400000-0x00000000005F6000-memory.dmpFilesize
2.0MB
-
memory/3468-154-0x0000000005760000-0x00000000057F2000-memory.dmpFilesize
584KB
-
memory/3468-155-0x0000000005810000-0x000000000581A000-memory.dmpFilesize
40KB
-
memory/4108-140-0x0000000007380000-0x00000000079FA000-memory.dmpFilesize
6.5MB
-
memory/4108-134-0x0000000000000000-mapping.dmp
-
memory/4108-141-0x0000000006240000-0x000000000625A000-memory.dmpFilesize
104KB
-
memory/4108-139-0x0000000005D40000-0x0000000005D5E000-memory.dmpFilesize
120KB
-
memory/4108-138-0x00000000056F0000-0x0000000005756000-memory.dmpFilesize
408KB
-
memory/4108-137-0x00000000055D0000-0x0000000005636000-memory.dmpFilesize
408KB
-
memory/4108-136-0x0000000004FA0000-0x00000000055C8000-memory.dmpFilesize
6.2MB
-
memory/4108-135-0x0000000002770000-0x00000000027A6000-memory.dmpFilesize
216KB
-
memory/4176-159-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4176-156-0x0000000000000000-mapping.dmp
-
memory/4176-157-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4176-158-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4176-160-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4176-161-0x0000000070530000-0x0000000070569000-memory.dmpFilesize
228KB
-
memory/4176-162-0x0000000070480000-0x00000000704B9000-memory.dmpFilesize
228KB
-
memory/4176-163-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4844-133-0x00000000071D0000-0x00000000071F2000-memory.dmpFilesize
136KB
-
memory/4844-132-0x0000000000BD0000-0x0000000000C06000-memory.dmpFilesize
216KB