Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 11:51
Behavioral task
behavioral1
Sample
58a640b0c8d5935fa229131b64aa80ac.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
58a640b0c8d5935fa229131b64aa80ac.exe
Resource
win10v2004-20220901-en
General
-
Target
58a640b0c8d5935fa229131b64aa80ac.exe
-
Size
1.9MB
-
MD5
58a640b0c8d5935fa229131b64aa80ac
-
SHA1
4feba21e86b44b5f27cda4376d0f3a7ddc33b63b
-
SHA256
dfa8a3136cdf32e554997545432c51b3c8c712500b857140f6d7f9ad1b1789d6
-
SHA512
9d46b05dae64436c5327354162c43b08d02fdeef9f864917cca1dc407e43cbfc55a0fb782565d6cd8f7e5536577bcc68201dfbcbb9f7e67e6ec21fff7aaf758a
-
SSDEEP
49152:yfZwCTG65aYImGBMIBW2jX66ws6ij48N2w:Cw8JImGB7k2jXTLnAw
Malware Config
Extracted
eternity
http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion
-
payload_urls
http://167.88.170.23/w993.exe
http://167.88.170.23/s101.exe,http://167.88.170.23/101.exe,http://167.88.170.23/R101.exe
Signatures
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Executes dropped EXE 11 IoCs
Processes:
Pasta2.exePasta2.exePasta2.exePasta2.exePasta2.exePasta2.exePasta2.exePasta2.exePasta2.exePasta2.exePasta2.exepid process 3664 Pasta2.exe 768 Pasta2.exe 4088 Pasta2.exe 1480 Pasta2.exe 5096 Pasta2.exe 1188 Pasta2.exe 2324 Pasta2.exe 1040 Pasta2.exe 3852 Pasta2.exe 520 Pasta2.exe 4008 Pasta2.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
58a640b0c8d5935fa229131b64aa80ac.exePasta2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 58a640b0c8d5935fa229131b64aa80ac.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Pasta2.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Pasta2.exePasta2.exePasta2.exePasta2.exedescription pid process target process PID 3664 set thread context of 4088 3664 Pasta2.exe Pasta2.exe PID 1480 set thread context of 2324 1480 Pasta2.exe Pasta2.exe PID 5096 set thread context of 3852 5096 Pasta2.exe Pasta2.exe PID 520 set thread context of 4008 520 Pasta2.exe Pasta2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Modifies registry class 1 IoCs
Processes:
58a640b0c8d5935fa229131b64aa80ac.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings 58a640b0c8d5935fa229131b64aa80ac.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4196 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Pasta2.exePasta2.exePasta2.exepid process 3664 Pasta2.exe 3664 Pasta2.exe 1480 Pasta2.exe 1480 Pasta2.exe 5096 Pasta2.exe 5096 Pasta2.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Pasta2.exePasta2.exePasta2.exePasta2.exedescription pid process Token: SeDebugPrivilege 3664 Pasta2.exe Token: SeDebugPrivilege 1480 Pasta2.exe Token: SeDebugPrivilege 2324 Pasta2.exe Token: SeDebugPrivilege 5096 Pasta2.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 4196 EXCEL.EXE 4196 EXCEL.EXE 4196 EXCEL.EXE 4196 EXCEL.EXE 4196 EXCEL.EXE 4196 EXCEL.EXE 4196 EXCEL.EXE 4196 EXCEL.EXE 4196 EXCEL.EXE 4196 EXCEL.EXE 4196 EXCEL.EXE 4196 EXCEL.EXE -
Suspicious use of WriteProcessMemory 62 IoCs
Processes:
58a640b0c8d5935fa229131b64aa80ac.exePasta2.exePasta2.execmd.exePasta2.exePasta2.exePasta2.exedescription pid process target process PID 4180 wrote to memory of 4196 4180 58a640b0c8d5935fa229131b64aa80ac.exe EXCEL.EXE PID 4180 wrote to memory of 4196 4180 58a640b0c8d5935fa229131b64aa80ac.exe EXCEL.EXE PID 4180 wrote to memory of 4196 4180 58a640b0c8d5935fa229131b64aa80ac.exe EXCEL.EXE PID 4180 wrote to memory of 3664 4180 58a640b0c8d5935fa229131b64aa80ac.exe Pasta2.exe PID 4180 wrote to memory of 3664 4180 58a640b0c8d5935fa229131b64aa80ac.exe Pasta2.exe PID 4180 wrote to memory of 3664 4180 58a640b0c8d5935fa229131b64aa80ac.exe Pasta2.exe PID 3664 wrote to memory of 768 3664 Pasta2.exe Pasta2.exe PID 3664 wrote to memory of 768 3664 Pasta2.exe Pasta2.exe PID 3664 wrote to memory of 768 3664 Pasta2.exe Pasta2.exe PID 3664 wrote to memory of 4088 3664 Pasta2.exe Pasta2.exe PID 3664 wrote to memory of 4088 3664 Pasta2.exe Pasta2.exe PID 3664 wrote to memory of 4088 3664 Pasta2.exe Pasta2.exe PID 3664 wrote to memory of 4088 3664 Pasta2.exe Pasta2.exe PID 3664 wrote to memory of 4088 3664 Pasta2.exe Pasta2.exe PID 3664 wrote to memory of 4088 3664 Pasta2.exe Pasta2.exe PID 3664 wrote to memory of 4088 3664 Pasta2.exe Pasta2.exe PID 3664 wrote to memory of 4088 3664 Pasta2.exe Pasta2.exe PID 4088 wrote to memory of 4948 4088 Pasta2.exe cmd.exe PID 4088 wrote to memory of 4948 4088 Pasta2.exe cmd.exe PID 4088 wrote to memory of 4948 4088 Pasta2.exe cmd.exe PID 4948 wrote to memory of 4420 4948 cmd.exe chcp.com PID 4948 wrote to memory of 4420 4948 cmd.exe chcp.com PID 4948 wrote to memory of 4420 4948 cmd.exe chcp.com PID 4948 wrote to memory of 4548 4948 cmd.exe PING.EXE PID 4948 wrote to memory of 4548 4948 cmd.exe PING.EXE PID 4948 wrote to memory of 4548 4948 cmd.exe PING.EXE PID 4948 wrote to memory of 4272 4948 cmd.exe schtasks.exe PID 4948 wrote to memory of 4272 4948 cmd.exe schtasks.exe PID 4948 wrote to memory of 4272 4948 cmd.exe schtasks.exe PID 4948 wrote to memory of 1480 4948 cmd.exe Pasta2.exe PID 4948 wrote to memory of 1480 4948 cmd.exe Pasta2.exe PID 4948 wrote to memory of 1480 4948 cmd.exe Pasta2.exe PID 1480 wrote to memory of 1188 1480 Pasta2.exe Pasta2.exe PID 1480 wrote to memory of 1188 1480 Pasta2.exe Pasta2.exe PID 1480 wrote to memory of 1188 1480 Pasta2.exe Pasta2.exe PID 1480 wrote to memory of 2324 1480 Pasta2.exe Pasta2.exe PID 1480 wrote to memory of 2324 1480 Pasta2.exe Pasta2.exe PID 1480 wrote to memory of 2324 1480 Pasta2.exe Pasta2.exe PID 1480 wrote to memory of 2324 1480 Pasta2.exe Pasta2.exe PID 1480 wrote to memory of 2324 1480 Pasta2.exe Pasta2.exe PID 1480 wrote to memory of 2324 1480 Pasta2.exe Pasta2.exe PID 1480 wrote to memory of 2324 1480 Pasta2.exe Pasta2.exe PID 1480 wrote to memory of 2324 1480 Pasta2.exe Pasta2.exe PID 5096 wrote to memory of 1040 5096 Pasta2.exe Pasta2.exe PID 5096 wrote to memory of 1040 5096 Pasta2.exe Pasta2.exe PID 5096 wrote to memory of 1040 5096 Pasta2.exe Pasta2.exe PID 5096 wrote to memory of 3852 5096 Pasta2.exe Pasta2.exe PID 5096 wrote to memory of 3852 5096 Pasta2.exe Pasta2.exe PID 5096 wrote to memory of 3852 5096 Pasta2.exe Pasta2.exe PID 5096 wrote to memory of 3852 5096 Pasta2.exe Pasta2.exe PID 5096 wrote to memory of 3852 5096 Pasta2.exe Pasta2.exe PID 5096 wrote to memory of 3852 5096 Pasta2.exe Pasta2.exe PID 5096 wrote to memory of 3852 5096 Pasta2.exe Pasta2.exe PID 5096 wrote to memory of 3852 5096 Pasta2.exe Pasta2.exe PID 520 wrote to memory of 4008 520 Pasta2.exe Pasta2.exe PID 520 wrote to memory of 4008 520 Pasta2.exe Pasta2.exe PID 520 wrote to memory of 4008 520 Pasta2.exe Pasta2.exe PID 520 wrote to memory of 4008 520 Pasta2.exe Pasta2.exe PID 520 wrote to memory of 4008 520 Pasta2.exe Pasta2.exe PID 520 wrote to memory of 4008 520 Pasta2.exe Pasta2.exe PID 520 wrote to memory of 4008 520 Pasta2.exe Pasta2.exe PID 520 wrote to memory of 4008 520 Pasta2.exe Pasta2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58a640b0c8d5935fa229131b64aa80ac.exe"C:\Users\Admin\AppData\Local\Temp\58a640b0c8d5935fa229131b64aa80ac.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Pasta2.xlsx"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Pasta2.exe"C:\Users\Admin\AppData\Local\Temp\Pasta2.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Pasta2.exe"{path}"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Pasta2.exe"{path}"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "Pasta2" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\Pasta2.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.15⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "Pasta2" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe"C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe"{path}"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe"{path}"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exeC:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe"{path}"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe"{path}"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exeC:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exe"{path}"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Pasta2.exe.logFilesize
1KB
MD584e77a587d94307c0ac1357eb4d3d46f
SHA183cc900f9401f43d181207d64c5adba7a85edc1e
SHA256e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
SHA512aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691
-
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exeFilesize
1.8MB
MD568d348019229f619929995cf7f7dfa4d
SHA19e2f888c42d51f91c900bec478e703fe145e1a54
SHA2566a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077
SHA51231bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6
-
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exeFilesize
1.8MB
MD568d348019229f619929995cf7f7dfa4d
SHA19e2f888c42d51f91c900bec478e703fe145e1a54
SHA2566a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077
SHA51231bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6
-
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exeFilesize
1.8MB
MD568d348019229f619929995cf7f7dfa4d
SHA19e2f888c42d51f91c900bec478e703fe145e1a54
SHA2566a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077
SHA51231bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6
-
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exeFilesize
1.8MB
MD568d348019229f619929995cf7f7dfa4d
SHA19e2f888c42d51f91c900bec478e703fe145e1a54
SHA2566a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077
SHA51231bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6
-
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exeFilesize
1.8MB
MD568d348019229f619929995cf7f7dfa4d
SHA19e2f888c42d51f91c900bec478e703fe145e1a54
SHA2566a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077
SHA51231bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6
-
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exeFilesize
1.8MB
MD568d348019229f619929995cf7f7dfa4d
SHA19e2f888c42d51f91c900bec478e703fe145e1a54
SHA2566a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077
SHA51231bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6
-
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exeFilesize
1.8MB
MD568d348019229f619929995cf7f7dfa4d
SHA19e2f888c42d51f91c900bec478e703fe145e1a54
SHA2566a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077
SHA51231bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6
-
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exeFilesize
1.8MB
MD568d348019229f619929995cf7f7dfa4d
SHA19e2f888c42d51f91c900bec478e703fe145e1a54
SHA2566a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077
SHA51231bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6
-
C:\Users\Admin\AppData\Local\ServiceHub\Pasta2.exeFilesize
1.8MB
MD568d348019229f619929995cf7f7dfa4d
SHA19e2f888c42d51f91c900bec478e703fe145e1a54
SHA2566a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077
SHA51231bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6
-
C:\Users\Admin\AppData\Local\Temp\Pasta2.exeFilesize
1.8MB
MD568d348019229f619929995cf7f7dfa4d
SHA19e2f888c42d51f91c900bec478e703fe145e1a54
SHA2566a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077
SHA51231bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6
-
C:\Users\Admin\AppData\Local\Temp\Pasta2.exeFilesize
1.8MB
MD568d348019229f619929995cf7f7dfa4d
SHA19e2f888c42d51f91c900bec478e703fe145e1a54
SHA2566a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077
SHA51231bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6
-
C:\Users\Admin\AppData\Local\Temp\Pasta2.exeFilesize
1.8MB
MD568d348019229f619929995cf7f7dfa4d
SHA19e2f888c42d51f91c900bec478e703fe145e1a54
SHA2566a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077
SHA51231bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6
-
C:\Users\Admin\AppData\Local\Temp\Pasta2.exeFilesize
1.8MB
MD568d348019229f619929995cf7f7dfa4d
SHA19e2f888c42d51f91c900bec478e703fe145e1a54
SHA2566a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077
SHA51231bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6
-
C:\Users\Admin\AppData\Local\Temp\Pasta2.xlsxFilesize
12KB
MD590aede484ae01d0cb78f0f299229d2cf
SHA1b6f025ea1ac709a43674473d4d6fc212f427838c
SHA2565db8a6228ada1b2c2ad6db0e9f722c20a7a181a1976408d00428e78fa13437a3
SHA512fad8a105caf724e8c4321194e74f19f43a580aeacdae6426c6e77da19b7723d4cc23744721159b20573f28f16ec4399270b8512a88619793c4593c2744fa1374
-
memory/768-150-0x0000000000000000-mapping.dmp
-
memory/1040-169-0x0000000000000000-mapping.dmp
-
memory/1188-164-0x0000000000000000-mapping.dmp
-
memory/1480-160-0x0000000000000000-mapping.dmp
-
memory/2324-166-0x0000000000000000-mapping.dmp
-
memory/3664-147-0x0000000005630000-0x000000000563A000-memory.dmpFilesize
40KB
-
memory/3664-134-0x0000000000000000-mapping.dmp
-
memory/3664-145-0x00000000056B0000-0x000000000574C000-memory.dmpFilesize
624KB
-
memory/3664-144-0x0000000005570000-0x0000000005602000-memory.dmpFilesize
584KB
-
memory/3664-142-0x0000000000AD0000-0x0000000000CAE000-memory.dmpFilesize
1.9MB
-
memory/3664-143-0x0000000005B20000-0x00000000060C4000-memory.dmpFilesize
5.6MB
-
memory/3852-171-0x0000000000000000-mapping.dmp
-
memory/4008-180-0x0000000000000000-mapping.dmp
-
memory/4088-152-0x0000000000000000-mapping.dmp
-
memory/4088-153-0x0000000000400000-0x0000000000552000-memory.dmpFilesize
1.3MB
-
memory/4180-132-0x0000000000C00000-0x0000000000DE4000-memory.dmpFilesize
1.9MB
-
memory/4196-138-0x00007FFA76DF0000-0x00007FFA76E00000-memory.dmpFilesize
64KB
-
memory/4196-146-0x00007FFA74A00000-0x00007FFA74A10000-memory.dmpFilesize
64KB
-
memory/4196-140-0x00007FFA76DF0000-0x00007FFA76E00000-memory.dmpFilesize
64KB
-
memory/4196-133-0x0000000000000000-mapping.dmp
-
memory/4196-139-0x00007FFA76DF0000-0x00007FFA76E00000-memory.dmpFilesize
64KB
-
memory/4196-148-0x00007FFA74A00000-0x00007FFA74A10000-memory.dmpFilesize
64KB
-
memory/4196-178-0x00007FFA76DF0000-0x00007FFA76E00000-memory.dmpFilesize
64KB
-
memory/4196-141-0x00007FFA76DF0000-0x00007FFA76E00000-memory.dmpFilesize
64KB
-
memory/4196-137-0x00007FFA76DF0000-0x00007FFA76E00000-memory.dmpFilesize
64KB
-
memory/4196-175-0x00007FFA76DF0000-0x00007FFA76E00000-memory.dmpFilesize
64KB
-
memory/4196-176-0x00007FFA76DF0000-0x00007FFA76E00000-memory.dmpFilesize
64KB
-
memory/4196-177-0x00007FFA76DF0000-0x00007FFA76E00000-memory.dmpFilesize
64KB
-
memory/4272-159-0x0000000000000000-mapping.dmp
-
memory/4420-157-0x0000000000000000-mapping.dmp
-
memory/4548-158-0x0000000000000000-mapping.dmp
-
memory/4948-156-0x0000000000000000-mapping.dmp