Analysis
-
max time kernel
150s -
max time network
66s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 21:17
Static task
static1
Behavioral task
behavioral1
Sample
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe
Resource
win7-20220812-en
General
-
Target
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe
-
Size
564KB
-
MD5
a1d3624a30411262cfe25674dbd05051
-
SHA1
3d2c681609f5213a680955573e26f4e3a52025a9
-
SHA256
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f
-
SHA512
59bc2190ff355409ac2d9d3fd197c6c6cddb89f25990b4cb2614a3cb6b8ca5a6cde931807290366cd203fdadb48e5a0977606f06231233d6a7be62d88af033d5
-
SSDEEP
6144:6pX2i9HjHIDeRzKPCqIlKqX6ehf1gOGqHCibZwSDqMPoyoMGGGGGGGGGGbGGGGG4:Q20zyeRWtI9qGu6HCWZwMqoKHjl
Malware Config
Extracted
pony
http://www.powerturk.rocks/web/gate.php
http://www.powerturk.rocks/webd/gate.php
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 840 csrss.exe -
Loads dropped DLL 2 IoCs
Processes:
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exepid process 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exedescription pid process target process PID 1120 set thread context of 1724 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
csrss.exepid process 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe 840 csrss.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
csrss.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exedescription pid process Token: SeDebugPrivilege 840 csrss.exe Token: SeImpersonatePrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeTcbPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeChangeNotifyPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeCreateTokenPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeBackupPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeRestorePrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeIncreaseQuotaPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeAssignPrimaryTokenPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeImpersonatePrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeTcbPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeChangeNotifyPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeCreateTokenPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeBackupPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeRestorePrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeIncreaseQuotaPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeAssignPrimaryTokenPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeImpersonatePrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeTcbPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeChangeNotifyPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeCreateTokenPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeBackupPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeRestorePrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeIncreaseQuotaPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeAssignPrimaryTokenPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeImpersonatePrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeTcbPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeChangeNotifyPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeCreateTokenPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeBackupPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeRestorePrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeIncreaseQuotaPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe Token: SeAssignPrimaryTokenPrivilege 1724 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
AcroRd32.exepid process 1396 AcroRd32.exe 1396 AcroRd32.exe 1396 AcroRd32.exe 1396 AcroRd32.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.execsrss.exe172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exedescription pid process target process PID 1120 wrote to memory of 1396 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe AcroRd32.exe PID 1120 wrote to memory of 1396 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe AcroRd32.exe PID 1120 wrote to memory of 1396 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe AcroRd32.exe PID 1120 wrote to memory of 1396 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe AcroRd32.exe PID 1120 wrote to memory of 1724 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 1120 wrote to memory of 1724 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 1120 wrote to memory of 1724 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 1120 wrote to memory of 1724 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 1120 wrote to memory of 1724 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 1120 wrote to memory of 1724 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 1120 wrote to memory of 1724 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 1120 wrote to memory of 1724 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 1120 wrote to memory of 1724 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 1120 wrote to memory of 840 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe csrss.exe PID 1120 wrote to memory of 840 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe csrss.exe PID 1120 wrote to memory of 840 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe csrss.exe PID 1120 wrote to memory of 840 1120 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe csrss.exe PID 840 wrote to memory of 676 840 csrss.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 840 wrote to memory of 676 840 csrss.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 840 wrote to memory of 676 840 csrss.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 840 wrote to memory of 676 840 csrss.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 676 wrote to memory of 1908 676 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe AcroRd32.exe PID 676 wrote to memory of 1908 676 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe AcroRd32.exe PID 676 wrote to memory of 1908 676 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe AcroRd32.exe PID 676 wrote to memory of 1908 676 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe AcroRd32.exe PID 676 wrote to memory of 1744 676 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 676 wrote to memory of 1744 676 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 676 wrote to memory of 1744 676 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 676 wrote to memory of 1744 676 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 676 wrote to memory of 1744 676 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 676 wrote to memory of 1744 676 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe PID 676 wrote to memory of 1744 676 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe -
outlook_win_path 1 IoCs
Processes:
172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\SLED_PO_Template.pdf"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\csrss.exe"C:\Users\Admin\AppData\Local\Temp\csrss.exe" -prochide 1724 -proc 1724 C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\SLED_PO_Template.pdf"4⤵
-
C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"C:\Users\Admin\AppData\Local\Temp\172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
564KB
MD5a1d3624a30411262cfe25674dbd05051
SHA13d2c681609f5213a680955573e26f4e3a52025a9
SHA256172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f
SHA51259bc2190ff355409ac2d9d3fd197c6c6cddb89f25990b4cb2614a3cb6b8ca5a6cde931807290366cd203fdadb48e5a0977606f06231233d6a7be62d88af033d5
-
C:\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
564KB
MD5a1d3624a30411262cfe25674dbd05051
SHA13d2c681609f5213a680955573e26f4e3a52025a9
SHA256172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f
SHA51259bc2190ff355409ac2d9d3fd197c6c6cddb89f25990b4cb2614a3cb6b8ca5a6cde931807290366cd203fdadb48e5a0977606f06231233d6a7be62d88af033d5
-
C:\Users\Admin\AppData\Roaming\SLED_PO_Template.pdfFilesize
113KB
MD540caa279a85473a57eb422c6dcee609f
SHA177a9ba6dcb39cfdd47230d87a3c566f024b645b4
SHA256e2d8e5e3093bf2eac1618ae744a5277ddc2eeef478632adc9157d50e8e74ab18
SHA5125ec4c71cfb5fc5104ef50c68a6f2041e67ca9d44ac1860551a3b5468f85e57be4c5395108aaf44b5c0e58b39ad826b32b27fc9267ded5638f62eaca374d4dc40
-
C:\Users\Admin\AppData\Roaming\SLED_PO_Template.pdfFilesize
113KB
MD540caa279a85473a57eb422c6dcee609f
SHA177a9ba6dcb39cfdd47230d87a3c566f024b645b4
SHA256e2d8e5e3093bf2eac1618ae744a5277ddc2eeef478632adc9157d50e8e74ab18
SHA5125ec4c71cfb5fc5104ef50c68a6f2041e67ca9d44ac1860551a3b5468f85e57be4c5395108aaf44b5c0e58b39ad826b32b27fc9267ded5638f62eaca374d4dc40
-
\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
564KB
MD5a1d3624a30411262cfe25674dbd05051
SHA13d2c681609f5213a680955573e26f4e3a52025a9
SHA256172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f
SHA51259bc2190ff355409ac2d9d3fd197c6c6cddb89f25990b4cb2614a3cb6b8ca5a6cde931807290366cd203fdadb48e5a0977606f06231233d6a7be62d88af033d5
-
\Users\Admin\AppData\Local\Temp\csrss.exeFilesize
564KB
MD5a1d3624a30411262cfe25674dbd05051
SHA13d2c681609f5213a680955573e26f4e3a52025a9
SHA256172316f80cc2a5ce9e4bcd5e53a99682440a8954a79b27636a7d82295e99495f
SHA51259bc2190ff355409ac2d9d3fd197c6c6cddb89f25990b4cb2614a3cb6b8ca5a6cde931807290366cd203fdadb48e5a0977606f06231233d6a7be62d88af033d5
-
memory/676-85-0x0000000000000000-mapping.dmp
-
memory/676-90-0x00000000740B0000-0x000000007465B000-memory.dmpFilesize
5.7MB
-
memory/676-100-0x00000000740B0000-0x000000007465B000-memory.dmpFilesize
5.7MB
-
memory/840-87-0x00000000740B0000-0x000000007465B000-memory.dmpFilesize
5.7MB
-
memory/840-82-0x00000000740B0000-0x000000007465B000-memory.dmpFilesize
5.7MB
-
memory/840-73-0x0000000000000000-mapping.dmp
-
memory/840-79-0x00000000740B0000-0x000000007465B000-memory.dmpFilesize
5.7MB
-
memory/1120-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmpFilesize
8KB
-
memory/1120-55-0x00000000740B0000-0x000000007465B000-memory.dmpFilesize
5.7MB
-
memory/1120-78-0x00000000740B0000-0x000000007465B000-memory.dmpFilesize
5.7MB
-
memory/1396-56-0x0000000000000000-mapping.dmp
-
memory/1724-59-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1724-80-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1724-70-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1724-83-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1724-84-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1724-58-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1724-61-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1724-68-0x0000000000410F55-mapping.dmp
-
memory/1724-63-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1724-66-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1908-88-0x0000000000000000-mapping.dmp