Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2023 23:09
Static task
static1
Behavioral task
behavioral1
Sample
1847fe775124ff748eff65fde03a4cc3.exe
Resource
win7-20231215-en
General
-
Target
1847fe775124ff748eff65fde03a4cc3.exe
-
Size
394KB
-
MD5
1847fe775124ff748eff65fde03a4cc3
-
SHA1
84eb8486cd503e3ed4f64242cd6c18f8c939ee7f
-
SHA256
c9deff45942213d2e685f7b8c81568c35e7d93f99e22b260051dba54d4c60c8b
-
SHA512
1e215fc42fc1bca1f8dc56b4e180154462193e6f7847ba84b0d6821bcbebeebab203ad659e19bab1099f7fa5e6c9782c2c53ef40b5d4892fcc89ab56b7a77d6f
-
SSDEEP
12288:3LPv0G05zrYUlP7aOsjdccUiDe2tmlUiOQ:bH0GWzrRlfsh4ia
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral2/memory/3720-9-0x0000000000400000-0x0000000000454000-memory.dmp disable_win_def -
Processes:
DHender.exe1847fe775124ff748eff65fde03a4cc3.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" DHender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" DHender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" DHender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" DHender.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 1847fe775124ff748eff65fde03a4cc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 1847fe775124ff748eff65fde03a4cc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 1847fe775124ff748eff65fde03a4cc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 1847fe775124ff748eff65fde03a4cc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 1847fe775124ff748eff65fde03a4cc3.exe -
Modifies security service 2 TTPs 4 IoCs
Processes:
1847fe775124ff748eff65fde03a4cc3.exeDHender.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" 1847fe775124ff748eff65fde03a4cc3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinDefend\Start = "4" 1847fe775124ff748eff65fde03a4cc3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" DHender.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinDefend\Start = "4" DHender.exe -
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3720-9-0x0000000000400000-0x0000000000454000-memory.dmp family_quasar -
Processes:
1847fe775124ff748eff65fde03a4cc3.exeDHender.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1847fe775124ff748eff65fde03a4cc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" DHender.exe -
Processes:
1847fe775124ff748eff65fde03a4cc3.exeDHender.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1" 1847fe775124ff748eff65fde03a4cc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1" DHender.exe -
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral2/memory/880-8-0x0000000007EB0000-0x0000000007F0C000-memory.dmp rezer0 -
Executes dropped EXE 3 IoCs
Processes:
DHender.exeDHender.exeDHender.exepid process 2500 DHender.exe 3252 DHender.exe 3648 DHender.exe -
Processes:
1847fe775124ff748eff65fde03a4cc3.exeDHender.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 1847fe775124ff748eff65fde03a4cc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1" 1847fe775124ff748eff65fde03a4cc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\DisableAntiSpyware = "1" 1847fe775124ff748eff65fde03a4cc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" DHender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1" DHender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\DisableAntiSpyware = "1" DHender.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 1847fe775124ff748eff65fde03a4cc3.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
1847fe775124ff748eff65fde03a4cc3.exeDHender.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeTelemetry = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\1847fe775124ff748eff65fde03a4cc3.exe\"" 1847fe775124ff748eff65fde03a4cc3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OfficeTelemetry = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\1847fe775124ff748eff65fde03a4cc3.exe\"" 1847fe775124ff748eff65fde03a4cc3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeTelemetry = "\"C:\\Users\\Admin\\AppData\\Roaming\\DateVLog\\DHender.exe\"" DHender.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OfficeTelemetry = "\"C:\\Users\\Admin\\AppData\\Roaming\\DateVLog\\DHender.exe\"" DHender.exe -
Processes:
DHender.exe1847fe775124ff748eff65fde03a4cc3.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" DHender.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1847fe775124ff748eff65fde03a4cc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1847fe775124ff748eff65fde03a4cc3.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DHender.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 25 ip-api.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1847fe775124ff748eff65fde03a4cc3.exeDHender.exedescription pid process target process PID 880 set thread context of 3720 880 1847fe775124ff748eff65fde03a4cc3.exe 1847fe775124ff748eff65fde03a4cc3.exe PID 2500 set thread context of 3252 2500 DHender.exe DHender.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3172 schtasks.exe 4312 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
1847fe775124ff748eff65fde03a4cc3.exepowershell.exeDHender.exepowershell.exepid process 880 1847fe775124ff748eff65fde03a4cc3.exe 880 1847fe775124ff748eff65fde03a4cc3.exe 880 1847fe775124ff748eff65fde03a4cc3.exe 880 1847fe775124ff748eff65fde03a4cc3.exe 880 1847fe775124ff748eff65fde03a4cc3.exe 640 powershell.exe 640 powershell.exe 2500 DHender.exe 2500 DHender.exe 620 powershell.exe 620 powershell.exe 620 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
1847fe775124ff748eff65fde03a4cc3.exe1847fe775124ff748eff65fde03a4cc3.exepowershell.exeDHender.exeDHender.exepowershell.exedescription pid process Token: SeDebugPrivilege 880 1847fe775124ff748eff65fde03a4cc3.exe Token: SeDebugPrivilege 3720 1847fe775124ff748eff65fde03a4cc3.exe Token: SeDebugPrivilege 640 powershell.exe Token: SeDebugPrivilege 2500 DHender.exe Token: SeDebugPrivilege 3252 DHender.exe Token: SeDebugPrivilege 620 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
DHender.exepid process 3252 DHender.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
1847fe775124ff748eff65fde03a4cc3.exe1847fe775124ff748eff65fde03a4cc3.exeDHender.exeDHender.exedescription pid process target process PID 880 wrote to memory of 2068 880 1847fe775124ff748eff65fde03a4cc3.exe 1847fe775124ff748eff65fde03a4cc3.exe PID 880 wrote to memory of 2068 880 1847fe775124ff748eff65fde03a4cc3.exe 1847fe775124ff748eff65fde03a4cc3.exe PID 880 wrote to memory of 2068 880 1847fe775124ff748eff65fde03a4cc3.exe 1847fe775124ff748eff65fde03a4cc3.exe PID 880 wrote to memory of 3720 880 1847fe775124ff748eff65fde03a4cc3.exe 1847fe775124ff748eff65fde03a4cc3.exe PID 880 wrote to memory of 3720 880 1847fe775124ff748eff65fde03a4cc3.exe 1847fe775124ff748eff65fde03a4cc3.exe PID 880 wrote to memory of 3720 880 1847fe775124ff748eff65fde03a4cc3.exe 1847fe775124ff748eff65fde03a4cc3.exe PID 880 wrote to memory of 3720 880 1847fe775124ff748eff65fde03a4cc3.exe 1847fe775124ff748eff65fde03a4cc3.exe PID 880 wrote to memory of 3720 880 1847fe775124ff748eff65fde03a4cc3.exe 1847fe775124ff748eff65fde03a4cc3.exe PID 880 wrote to memory of 3720 880 1847fe775124ff748eff65fde03a4cc3.exe 1847fe775124ff748eff65fde03a4cc3.exe PID 880 wrote to memory of 3720 880 1847fe775124ff748eff65fde03a4cc3.exe 1847fe775124ff748eff65fde03a4cc3.exe PID 880 wrote to memory of 3720 880 1847fe775124ff748eff65fde03a4cc3.exe 1847fe775124ff748eff65fde03a4cc3.exe PID 3720 wrote to memory of 3172 3720 1847fe775124ff748eff65fde03a4cc3.exe schtasks.exe PID 3720 wrote to memory of 3172 3720 1847fe775124ff748eff65fde03a4cc3.exe schtasks.exe PID 3720 wrote to memory of 3172 3720 1847fe775124ff748eff65fde03a4cc3.exe schtasks.exe PID 3720 wrote to memory of 3592 3720 1847fe775124ff748eff65fde03a4cc3.exe schtasks.exe PID 3720 wrote to memory of 3592 3720 1847fe775124ff748eff65fde03a4cc3.exe schtasks.exe PID 3720 wrote to memory of 3592 3720 1847fe775124ff748eff65fde03a4cc3.exe schtasks.exe PID 3720 wrote to memory of 640 3720 1847fe775124ff748eff65fde03a4cc3.exe powershell.exe PID 3720 wrote to memory of 640 3720 1847fe775124ff748eff65fde03a4cc3.exe powershell.exe PID 3720 wrote to memory of 640 3720 1847fe775124ff748eff65fde03a4cc3.exe powershell.exe PID 3720 wrote to memory of 2500 3720 1847fe775124ff748eff65fde03a4cc3.exe DHender.exe PID 3720 wrote to memory of 2500 3720 1847fe775124ff748eff65fde03a4cc3.exe DHender.exe PID 3720 wrote to memory of 2500 3720 1847fe775124ff748eff65fde03a4cc3.exe DHender.exe PID 2500 wrote to memory of 3252 2500 DHender.exe DHender.exe PID 2500 wrote to memory of 3252 2500 DHender.exe DHender.exe PID 2500 wrote to memory of 3252 2500 DHender.exe DHender.exe PID 2500 wrote to memory of 3252 2500 DHender.exe DHender.exe PID 2500 wrote to memory of 3252 2500 DHender.exe DHender.exe PID 2500 wrote to memory of 3252 2500 DHender.exe DHender.exe PID 2500 wrote to memory of 3252 2500 DHender.exe DHender.exe PID 2500 wrote to memory of 3252 2500 DHender.exe DHender.exe PID 3252 wrote to memory of 4312 3252 DHender.exe schtasks.exe PID 3252 wrote to memory of 4312 3252 DHender.exe schtasks.exe PID 3252 wrote to memory of 4312 3252 DHender.exe schtasks.exe PID 3252 wrote to memory of 3912 3252 DHender.exe schtasks.exe PID 3252 wrote to memory of 3912 3252 DHender.exe schtasks.exe PID 3252 wrote to memory of 3912 3252 DHender.exe schtasks.exe PID 3252 wrote to memory of 620 3252 DHender.exe powershell.exe PID 3252 wrote to memory of 620 3252 DHender.exe powershell.exe PID 3252 wrote to memory of 620 3252 DHender.exe powershell.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
1847fe775124ff748eff65fde03a4cc3.exeDHender.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1847fe775124ff748eff65fde03a4cc3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" DHender.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1847fe775124ff748eff65fde03a4cc3.exe"C:\Users\Admin\AppData\Local\Temp\1847fe775124ff748eff65fde03a4cc3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1847fe775124ff748eff65fde03a4cc3.exe"C:\Users\Admin\AppData\Local\Temp\1847fe775124ff748eff65fde03a4cc3.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /delete /tn "OfficeTelemetry" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "\Microsoft\Windows\NetTrace\PerfTrack\Files\OfficeTelemetry" /SC MINUTE /MO 3 /RL HIGHEST /tr "C:\Users\Admin\AppData\Local\Temp\1847fe775124ff748eff65fde03a4cc3.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\DateVLog\DHender.exe"C:\Users\Admin\AppData\Roaming\DateVLog\DHender.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\DateVLog\DHender.exe"C:\Users\Admin\AppData\Roaming\DateVLog\DHender.exe"4⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /delete /tn "OfficeTelemetry" /f5⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "\Microsoft\Windows\NetTrace\PerfTrack\Files\OfficeTelemetry" /SC MINUTE /MO 3 /RL HIGHEST /tr "C:\Users\Admin\AppData\Roaming\DateVLog\DHender.exe" /f5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1847fe775124ff748eff65fde03a4cc3.exe"C:\Users\Admin\AppData\Local\Temp\1847fe775124ff748eff65fde03a4cc3.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\DateVLog\DHender.exeC:\Users\Admin\AppData\Roaming\DateVLog\DHender.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\DateVLog\DHender.exe"C:\Users\Admin\AppData\Roaming\DateVLog\DHender.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1847fe775124ff748eff65fde03a4cc3.exe.logFilesize
1KB
MD5400f1cc1a0a0ce1cdabda365ab3368ce
SHA11ecf683f14271d84f3b6063493dce00ff5f42075
SHA256c8fa64f4b69df13ed6408fd4a204f318a36c2f38c85d4a4d42adfc9173f73765
SHA51214c8cfd58d097e5e89c8cabe1e665173f1ccf604a9ef70cdcb84116e265f90819c19c891be408e0ad7e29086a5c2ea2883b7a7d1184878dbbac63e2cabcd1c45
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHender.exe.logMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xbsjsngg.tos.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\DateVLog\DHender.exeFilesize
268KB
MD53a9136d8abe467ea16d7a7ef832d90d5
SHA11606f640a679d5b028cae9e83e9e374a163462b3
SHA2563a9cd78f6f2978d5c46fdb6793a62f575cab1c0c74e384d24c7c70b4dc7a2c2c
SHA512b399e812c10cd795a21cd24730528704d4388c8291a1c49441126a16a2b3fd7f6861f2893e7bfb90dec6c103f77537235ed2c3038e31036f88839f261e23e032
-
C:\Users\Admin\AppData\Roaming\DateVLog\DHender.exeFilesize
394KB
MD51847fe775124ff748eff65fde03a4cc3
SHA184eb8486cd503e3ed4f64242cd6c18f8c939ee7f
SHA256c9deff45942213d2e685f7b8c81568c35e7d93f99e22b260051dba54d4c60c8b
SHA5121e215fc42fc1bca1f8dc56b4e180154462193e6f7847ba84b0d6821bcbebeebab203ad659e19bab1099f7fa5e6c9782c2c53ef40b5d4892fcc89ab56b7a77d6f
-
C:\Users\Admin\AppData\Roaming\DateVLog\settings.xmlFilesize
125B
MD53b7136d4b264700c10ca2e4c9b963c90
SHA18d78add3f55c0a9b52b89ce6810bb752a5e02465
SHA2563453cd9592968a4cb6b7e71c9f2f6e0d59038129bef42ca06527a4c21db9c4eb
SHA5128bb37a828d435794dcbe2c5379b1b9fd2bed41e47c965053c294f71628a96985b467c32f27f47ae2fa462932fe9dab0cb89b1c0999b78ed91c504625733b28ea
-
memory/620-104-0x000000006FAC0000-0x000000006FB0C000-memory.dmpFilesize
304KB
-
memory/620-116-0x0000000007070000-0x0000000007081000-memory.dmpFilesize
68KB
-
memory/620-115-0x0000000006DD0000-0x0000000006E73000-memory.dmpFilesize
652KB
-
memory/620-114-0x0000000004720000-0x0000000004730000-memory.dmpFilesize
64KB
-
memory/620-117-0x00000000070C0000-0x00000000070D4000-memory.dmpFilesize
80KB
-
memory/620-103-0x00000000060F0000-0x000000000613C000-memory.dmpFilesize
304KB
-
memory/620-119-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/620-89-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/620-90-0x0000000004720000-0x0000000004730000-memory.dmpFilesize
64KB
-
memory/620-101-0x0000000005390000-0x00000000056E4000-memory.dmpFilesize
3.3MB
-
memory/620-91-0x0000000004720000-0x0000000004730000-memory.dmpFilesize
64KB
-
memory/640-26-0x0000000004800000-0x0000000004810000-memory.dmpFilesize
64KB
-
memory/640-69-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/640-27-0x0000000004E40000-0x0000000005468000-memory.dmpFilesize
6.2MB
-
memory/640-24-0x0000000004640000-0x0000000004676000-memory.dmpFilesize
216KB
-
memory/640-29-0x00000000054E0000-0x0000000005546000-memory.dmpFilesize
408KB
-
memory/640-28-0x0000000004D00000-0x0000000004D22000-memory.dmpFilesize
136KB
-
memory/640-39-0x0000000005630000-0x0000000005984000-memory.dmpFilesize
3.3MB
-
memory/640-25-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/640-41-0x0000000005C70000-0x0000000005CBC000-memory.dmpFilesize
304KB
-
memory/640-40-0x0000000005BC0000-0x0000000005BDE000-memory.dmpFilesize
120KB
-
memory/640-56-0x0000000004800000-0x0000000004810000-memory.dmpFilesize
64KB
-
memory/640-57-0x0000000006E20000-0x0000000006EC3000-memory.dmpFilesize
652KB
-
memory/640-55-0x0000000004800000-0x0000000004810000-memory.dmpFilesize
64KB
-
memory/640-54-0x00000000061D0000-0x00000000061EE000-memory.dmpFilesize
120KB
-
memory/640-44-0x000000006FA90000-0x000000006FADC000-memory.dmpFilesize
304KB
-
memory/640-43-0x0000000006190000-0x00000000061C2000-memory.dmpFilesize
200KB
-
memory/640-42-0x000000007FBE0000-0x000000007FBF0000-memory.dmpFilesize
64KB
-
memory/640-59-0x0000000006EF0000-0x0000000006F0A000-memory.dmpFilesize
104KB
-
memory/640-58-0x0000000007550000-0x0000000007BCA000-memory.dmpFilesize
6.5MB
-
memory/640-60-0x0000000006F60000-0x0000000006F6A000-memory.dmpFilesize
40KB
-
memory/640-61-0x0000000007170000-0x0000000007206000-memory.dmpFilesize
600KB
-
memory/640-62-0x00000000070F0000-0x0000000007101000-memory.dmpFilesize
68KB
-
memory/640-63-0x0000000007120000-0x000000000712E000-memory.dmpFilesize
56KB
-
memory/640-64-0x0000000007130000-0x0000000007144000-memory.dmpFilesize
80KB
-
memory/640-65-0x0000000007230000-0x000000000724A000-memory.dmpFilesize
104KB
-
memory/640-66-0x0000000007210000-0x0000000007218000-memory.dmpFilesize
32KB
-
memory/880-8-0x0000000007EB0000-0x0000000007F0C000-memory.dmpFilesize
368KB
-
memory/880-13-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/880-1-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/880-0-0x0000000000240000-0x00000000002A8000-memory.dmpFilesize
416KB
-
memory/880-7-0x0000000007F50000-0x0000000007FEC000-memory.dmpFilesize
624KB
-
memory/880-6-0x0000000002590000-0x0000000002598000-memory.dmpFilesize
32KB
-
memory/880-2-0x00000000071E0000-0x00000000071F0000-memory.dmpFilesize
64KB
-
memory/880-3-0x00000000078A0000-0x0000000007E44000-memory.dmpFilesize
5.6MB
-
memory/880-5-0x00000000071D0000-0x00000000071DA000-memory.dmpFilesize
40KB
-
memory/880-4-0x00000000073F0000-0x0000000007482000-memory.dmpFilesize
584KB
-
memory/2500-77-0x0000000007C80000-0x0000000007C90000-memory.dmpFilesize
64KB
-
memory/2500-76-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/2500-81-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/3252-121-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/3252-82-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/3648-124-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/3648-125-0x0000000006FC0000-0x0000000006FD0000-memory.dmpFilesize
64KB
-
memory/3648-129-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/3720-9-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/3720-12-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/3720-14-0x0000000005290000-0x00000000052A0000-memory.dmpFilesize
64KB
-
memory/3720-20-0x0000000006740000-0x00000000067A6000-memory.dmpFilesize
408KB
-
memory/3720-21-0x0000000006A50000-0x0000000006A62000-memory.dmpFilesize
72KB
-
memory/3720-22-0x0000000006AB0000-0x0000000006AEC000-memory.dmpFilesize
240KB
-
memory/3720-75-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/4756-130-0x0000000005880000-0x0000000005890000-memory.dmpFilesize
64KB
-
memory/4756-128-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB
-
memory/4756-132-0x00000000746A0000-0x0000000074E50000-memory.dmpFilesize
7.7MB