Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
23-03-2023 01:00
Behavioral task
behavioral1
Sample
3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe
Resource
win10v2004-20230220-en
General
-
Target
3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe
-
Size
2.4MB
-
MD5
0e444044fdfea512ca18fc3396abb65b
-
SHA1
8b601ccad5b2a76967c0ca7579dc13d092307f34
-
SHA256
3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755
-
SHA512
7b58b88c7fbcd7b97d1a08f2145794beefa2960382140bac74f1f4fe630cdd0314cd9bceb599a32c56788df1e0e9dccf84c1598c52f9c581389327428696e119
-
SSDEEP
49152:bkcwlRFUh2b69Cs9MR3uh+tytRY1aLXYqIiiJd2EHt:bkdlRI3ceI1azYqWj
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 18 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 864 1476 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1388 1476 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1648 1476 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1536 1476 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1992 1476 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1876 1476 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1432 1476 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1400 1476 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1952 1476 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1892 1476 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 824 1476 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 328 1476 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1612 1476 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1532 1476 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 984 1476 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2036 1476 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1872 1476 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1920 1476 schtasks.exe -
Processes:
sppsvc.exe3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" sppsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" sppsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sppsvc.exe -
Processes:
resource yara_rule behavioral1/memory/1160-54-0x0000000001390000-0x0000000001608000-memory.dmp dcrat C:\Windows\AppPatch\AppPatch64\smss.exe dcrat C:\Program Files (x86)\Windows Portable Devices\sppsvc.exe dcrat C:\Program Files (x86)\Windows Portable Devices\sppsvc.exe dcrat behavioral1/memory/1596-84-0x00000000013E0000-0x0000000001658000-memory.dmp dcrat behavioral1/memory/1596-86-0x000000001B070000-0x000000001B0F0000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
Processes:
sppsvc.exepid process 1596 sppsvc.exe -
Processes:
3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exesppsvc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sppsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sppsvc.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe -
Drops file in Program Files directory 9 IoCs
Processes:
3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exedescription ioc process File created C:\Program Files (x86)\Windows Portable Devices\sppsvc.exe 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe File created C:\Program Files (x86)\Windows Media Player\it-IT\spoolsv.exe 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe File created C:\Program Files (x86)\Uninstall Information\spoolsv.exe 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe File created C:\Program Files (x86)\Uninstall Information\f3b6ecef712a24 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe File created C:\Program Files (x86)\Windows Defender\en-US\lsm.exe 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe File created C:\Program Files (x86)\Windows Defender\en-US\101b941d020240 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\sppsvc.exe 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe File created C:\Program Files (x86)\Windows Portable Devices\0a1fd5f707cd16 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe File created C:\Program Files (x86)\Windows Media Player\it-IT\f3b6ecef712a24 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe -
Drops file in Windows directory 4 IoCs
Processes:
3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exedescription ioc process File created C:\Windows\en-US\csrss.exe 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe File created C:\Windows\en-US\886983d96e3d3e 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe File created C:\Windows\AppPatch\AppPatch64\smss.exe 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe File created C:\Windows\AppPatch\AppPatch64\69ddcba757bf72 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 18 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 984 schtasks.exe 1388 schtasks.exe 1876 schtasks.exe 1892 schtasks.exe 328 schtasks.exe 1532 schtasks.exe 1648 schtasks.exe 1992 schtasks.exe 1400 schtasks.exe 1952 schtasks.exe 1432 schtasks.exe 2036 schtasks.exe 1872 schtasks.exe 1920 schtasks.exe 864 schtasks.exe 1536 schtasks.exe 824 schtasks.exe 1612 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exesppsvc.exepid process 1160 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe 1160 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe 1160 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe 1160 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe 1160 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe 1596 sppsvc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exesppsvc.exedescription pid process Token: SeDebugPrivilege 1160 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe Token: SeDebugPrivilege 1596 sppsvc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exedescription pid process target process PID 1160 wrote to memory of 1596 1160 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe sppsvc.exe PID 1160 wrote to memory of 1596 1160 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe sppsvc.exe PID 1160 wrote to memory of 1596 1160 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe sppsvc.exe PID 1160 wrote to memory of 1596 1160 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe sppsvc.exe PID 1160 wrote to memory of 1596 1160 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe sppsvc.exe -
System policy modification 1 TTPs 6 IoCs
Processes:
sppsvc.exe3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" sppsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" sppsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sppsvc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe"C:\Users\Admin\AppData\Local\Temp\3041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Windows Portable Devices\sppsvc.exe"C:\Program Files (x86)\Windows Portable Devices\sppsvc.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\en-US\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\en-US\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\en-US\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\it-IT\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Uninstall Information\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Uninstall Information\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\AppPatch\AppPatch64\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\AppPatch\AppPatch64\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\AppPatch\AppPatch64\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\en-US\lsm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\en-US\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\en-US\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Windows Portable Devices\sppsvc.exeFilesize
2.4MB
MD50e444044fdfea512ca18fc3396abb65b
SHA18b601ccad5b2a76967c0ca7579dc13d092307f34
SHA2563041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755
SHA5127b58b88c7fbcd7b97d1a08f2145794beefa2960382140bac74f1f4fe630cdd0314cd9bceb599a32c56788df1e0e9dccf84c1598c52f9c581389327428696e119
-
C:\Program Files (x86)\Windows Portable Devices\sppsvc.exeFilesize
2.4MB
MD50e444044fdfea512ca18fc3396abb65b
SHA18b601ccad5b2a76967c0ca7579dc13d092307f34
SHA2563041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755
SHA5127b58b88c7fbcd7b97d1a08f2145794beefa2960382140bac74f1f4fe630cdd0314cd9bceb599a32c56788df1e0e9dccf84c1598c52f9c581389327428696e119
-
C:\Windows\AppPatch\AppPatch64\smss.exeFilesize
2.4MB
MD50e444044fdfea512ca18fc3396abb65b
SHA18b601ccad5b2a76967c0ca7579dc13d092307f34
SHA2563041f94ecddb3116d07dc174c4297b43d022b48282df8acc25dfac2ffc5b0755
SHA5127b58b88c7fbcd7b97d1a08f2145794beefa2960382140bac74f1f4fe630cdd0314cd9bceb599a32c56788df1e0e9dccf84c1598c52f9c581389327428696e119
-
memory/1160-58-0x0000000000330000-0x0000000000346000-memory.dmpFilesize
88KB
-
memory/1160-64-0x00000000006F0000-0x00000000006FE000-memory.dmpFilesize
56KB
-
memory/1160-59-0x0000000000350000-0x000000000035A000-memory.dmpFilesize
40KB
-
memory/1160-60-0x00000000006A0000-0x00000000006F6000-memory.dmpFilesize
344KB
-
memory/1160-61-0x00000000004E0000-0x00000000004EC000-memory.dmpFilesize
48KB
-
memory/1160-62-0x00000000004F0000-0x00000000004FC000-memory.dmpFilesize
48KB
-
memory/1160-63-0x0000000000500000-0x000000000050C000-memory.dmpFilesize
48KB
-
memory/1160-54-0x0000000001390000-0x0000000001608000-memory.dmpFilesize
2.5MB
-
memory/1160-65-0x0000000000510000-0x0000000000518000-memory.dmpFilesize
32KB
-
memory/1160-57-0x0000000000310000-0x000000000032C000-memory.dmpFilesize
112KB
-
memory/1160-56-0x0000000000300000-0x000000000030E000-memory.dmpFilesize
56KB
-
memory/1160-55-0x000000001B150000-0x000000001B1D0000-memory.dmpFilesize
512KB
-
memory/1596-84-0x00000000013E0000-0x0000000001658000-memory.dmpFilesize
2.5MB
-
memory/1596-85-0x000000001B070000-0x000000001B0F0000-memory.dmpFilesize
512KB
-
memory/1596-86-0x000000001B070000-0x000000001B0F0000-memory.dmpFilesize
512KB