Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10_x64 -
resource
win10 -
submitted
15-10-2020 18:27
Static task
static1
Behavioral task
behavioral1
Sample
bemaji.exe
Resource
win7v200722
General
-
Target
bemaji.exe
-
Size
135KB
-
MD5
6cc41d1ccd61ccdb3857703f83959aca
-
SHA1
caf89ae09f7435dcef4e886b056d020ee34925cf
-
SHA256
91647ac947d5d5d3a0dc69e98070bfc2f9841d7839b579d69c524b02869a497f
-
SHA512
4adde26f8e13509a6ead86ebe23b7b45742e4dea5faf364b0559f0b5142b8faa2e8331e79528e60af1e290804e9ebbc29cba94833cede3e723b83b55fd7bcc8e
Malware Config
Extracted
smokeloader
2020
http://sm15sdsd.xyz/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 6 IoCs
Processes:
6288.exe676B.execbxe.exe676B.exeykubb.exeykubb.exepid process 1552 6288.exe 1688 676B.exe 1348 cbxe.exe 3076 676B.exe 2612 ykubb.exe 212 ykubb.exe -
Deletes itself 1 IoCs
Processes:
pid process 3028 -
Loads dropped DLL 1 IoCs
Processes:
bemaji.exepid process 3984 bemaji.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Windows directory 2 IoCs
Processes:
6288.exedescription ioc process File opened for modification C:\Windows\Tasks\cbxe.job 6288.exe File created C:\Windows\Tasks\cbxe.job 6288.exe -
Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ykubb.exebemaji.exe676B.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 ykubb.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc ykubb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bemaji.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bemaji.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 676B.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 ykubb.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service 676B.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc ykubb.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service ykubb.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service ykubb.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bemaji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 676B.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service 676B.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 676B.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 676B.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1226 IoCs
Processes:
bemaji.exepid process 3984 bemaji.exe 3984 bemaji.exe 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 -
Suspicious behavior: MapViewOfSection 32 IoCs
Processes:
bemaji.exeykubb.exepid process 3984 bemaji.exe 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 3028 2612 ykubb.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 Token: SeShutdownPrivilege 3028 Token: SeCreatePagefilePrivilege 3028 -
Suspicious use of WriteProcessMemory 77 IoCs
Processes:
676B.exedescription pid process target process PID 3028 wrote to memory of 1552 3028 6288.exe PID 3028 wrote to memory of 1552 3028 6288.exe PID 3028 wrote to memory of 1552 3028 6288.exe PID 3028 wrote to memory of 1688 3028 676B.exe PID 3028 wrote to memory of 1688 3028 676B.exe PID 3028 wrote to memory of 1688 3028 676B.exe PID 3028 wrote to memory of 1828 3028 explorer.exe PID 3028 wrote to memory of 1828 3028 explorer.exe PID 3028 wrote to memory of 1828 3028 explorer.exe PID 3028 wrote to memory of 1828 3028 explorer.exe PID 3028 wrote to memory of 2424 3028 explorer.exe PID 3028 wrote to memory of 2424 3028 explorer.exe PID 3028 wrote to memory of 2424 3028 explorer.exe PID 3028 wrote to memory of 1680 3028 explorer.exe PID 3028 wrote to memory of 1680 3028 explorer.exe PID 3028 wrote to memory of 1680 3028 explorer.exe PID 3028 wrote to memory of 1680 3028 explorer.exe PID 3028 wrote to memory of 3756 3028 explorer.exe PID 3028 wrote to memory of 3756 3028 explorer.exe PID 3028 wrote to memory of 3756 3028 explorer.exe PID 3028 wrote to memory of 3756 3028 explorer.exe PID 3028 wrote to memory of 3012 3028 explorer.exe PID 3028 wrote to memory of 3012 3028 explorer.exe PID 3028 wrote to memory of 3012 3028 explorer.exe PID 3028 wrote to memory of 3012 3028 explorer.exe PID 3028 wrote to memory of 2184 3028 explorer.exe PID 3028 wrote to memory of 2184 3028 explorer.exe PID 3028 wrote to memory of 2184 3028 explorer.exe PID 3028 wrote to memory of 4004 3028 explorer.exe PID 3028 wrote to memory of 4004 3028 explorer.exe PID 3028 wrote to memory of 4004 3028 explorer.exe PID 3028 wrote to memory of 4004 3028 explorer.exe PID 3028 wrote to memory of 1344 3028 explorer.exe PID 3028 wrote to memory of 1344 3028 explorer.exe PID 3028 wrote to memory of 1344 3028 explorer.exe PID 3028 wrote to memory of 2532 3028 explorer.exe PID 3028 wrote to memory of 2532 3028 explorer.exe PID 3028 wrote to memory of 2532 3028 explorer.exe PID 3028 wrote to memory of 2532 3028 explorer.exe PID 3028 wrote to memory of 2368 3028 explorer.exe PID 3028 wrote to memory of 2368 3028 explorer.exe PID 3028 wrote to memory of 2368 3028 explorer.exe PID 3028 wrote to memory of 1988 3028 explorer.exe PID 3028 wrote to memory of 1988 3028 explorer.exe PID 3028 wrote to memory of 1988 3028 explorer.exe PID 3028 wrote to memory of 1988 3028 explorer.exe PID 3028 wrote to memory of 1176 3028 explorer.exe PID 3028 wrote to memory of 1176 3028 explorer.exe PID 3028 wrote to memory of 1176 3028 explorer.exe PID 3028 wrote to memory of 1176 3028 explorer.exe PID 3028 wrote to memory of 1576 3028 explorer.exe PID 3028 wrote to memory of 1576 3028 explorer.exe PID 3028 wrote to memory of 1576 3028 explorer.exe PID 3028 wrote to memory of 1576 3028 explorer.exe PID 3028 wrote to memory of 3716 3028 explorer.exe PID 3028 wrote to memory of 3716 3028 explorer.exe PID 3028 wrote to memory of 3716 3028 explorer.exe PID 3028 wrote to memory of 1500 3028 explorer.exe PID 3028 wrote to memory of 1500 3028 explorer.exe PID 3028 wrote to memory of 1500 3028 explorer.exe PID 3028 wrote to memory of 1500 3028 explorer.exe PID 1688 wrote to memory of 3076 1688 676B.exe 676B.exe PID 1688 wrote to memory of 3076 1688 676B.exe 676B.exe PID 1688 wrote to memory of 3076 1688 676B.exe 676B.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bemaji.exe"C:\Users\Admin\AppData\Local\Temp\bemaji.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3984
-
C:\Users\Admin\AppData\Local\Temp\6288.exeC:\Users\Admin\AppData\Local\Temp\6288.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1552
-
C:\Users\Admin\AppData\Local\Temp\676B.exeC:\Users\Admin\AppData\Local\Temp\676B.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\676B.exeC:\Users\Admin\AppData\Local\Temp\676B.exe /C2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3076 -
C:\Users\Admin\AppData\Roaming\Microsoft\Qwuzp\ykubb.exeC:\Users\Admin\AppData\Roaming\Microsoft\Qwuzp\ykubb.exe2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:2612 -
C:\Users\Admin\AppData\Roaming\Microsoft\Qwuzp\ykubb.exeC:\Users\Admin\AppData\Roaming\Microsoft\Qwuzp\ykubb.exe /C3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:212 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵PID:1824
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn bmdlvetaz /tr "\"C:\Users\Admin\AppData\Local\Temp\676B.exe\" /I bmdlvetaz" /SC ONCE /Z /ST 18:27 /ET 18:392⤵
- Creates scheduled task(s)
PID:1984
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1828
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2424
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1680
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3756
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3012
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2184
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4004
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1344
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2532
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2368
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1988
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1176
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1576
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3716
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1500
-
C:\ProgramData\hdxus\cbxe.exeC:\ProgramData\hdxus\cbxe.exe start1⤵
- Executes dropped EXE
PID:1348
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\hdxus\cbxe.exeMD5
0e23988a7ad64e9f03a2a7c3e9637330
SHA18a7827bb2ecc1a57f23a489f034d7c9629523eaf
SHA25663e7464225916f05a6dc4576721fae7a3a449fdab81072f28ba9a4bf5e9a54f9
SHA512046f6813425def94526334eb1adbf9a06af1a32b3d0ea921813c977e084dfea31b294014876bad47d911d9c66d7e67cba5d9caa21e9856a00c4a2b895d3d1b48
-
C:\ProgramData\hdxus\cbxe.exeMD5
0e23988a7ad64e9f03a2a7c3e9637330
SHA18a7827bb2ecc1a57f23a489f034d7c9629523eaf
SHA25663e7464225916f05a6dc4576721fae7a3a449fdab81072f28ba9a4bf5e9a54f9
SHA512046f6813425def94526334eb1adbf9a06af1a32b3d0ea921813c977e084dfea31b294014876bad47d911d9c66d7e67cba5d9caa21e9856a00c4a2b895d3d1b48
-
C:\Users\Admin\AppData\Local\Temp\6288.exeMD5
0e23988a7ad64e9f03a2a7c3e9637330
SHA18a7827bb2ecc1a57f23a489f034d7c9629523eaf
SHA25663e7464225916f05a6dc4576721fae7a3a449fdab81072f28ba9a4bf5e9a54f9
SHA512046f6813425def94526334eb1adbf9a06af1a32b3d0ea921813c977e084dfea31b294014876bad47d911d9c66d7e67cba5d9caa21e9856a00c4a2b895d3d1b48
-
C:\Users\Admin\AppData\Local\Temp\6288.exeMD5
0e23988a7ad64e9f03a2a7c3e9637330
SHA18a7827bb2ecc1a57f23a489f034d7c9629523eaf
SHA25663e7464225916f05a6dc4576721fae7a3a449fdab81072f28ba9a4bf5e9a54f9
SHA512046f6813425def94526334eb1adbf9a06af1a32b3d0ea921813c977e084dfea31b294014876bad47d911d9c66d7e67cba5d9caa21e9856a00c4a2b895d3d1b48
-
C:\Users\Admin\AppData\Local\Temp\676B.exeMD5
7bfc9747a217ec58395bd59f876e389f
SHA12c4b1d4a484e193e26327339ed38a4f05fd637dd
SHA256f2704a029672c04f28e738da8d859163ac807b158261e6a48edb279a132743ff
SHA51222959911f63bc551ee26aba716c0f2e6bd5ccc55c610fdf7474cd687886e74fcd4b6ca0158694f31961ee9692fbcf00003995444cd97551f6ed34d71e6340b76
-
C:\Users\Admin\AppData\Local\Temp\676B.exeMD5
7bfc9747a217ec58395bd59f876e389f
SHA12c4b1d4a484e193e26327339ed38a4f05fd637dd
SHA256f2704a029672c04f28e738da8d859163ac807b158261e6a48edb279a132743ff
SHA51222959911f63bc551ee26aba716c0f2e6bd5ccc55c610fdf7474cd687886e74fcd4b6ca0158694f31961ee9692fbcf00003995444cd97551f6ed34d71e6340b76
-
C:\Users\Admin\AppData\Local\Temp\676B.exeMD5
7bfc9747a217ec58395bd59f876e389f
SHA12c4b1d4a484e193e26327339ed38a4f05fd637dd
SHA256f2704a029672c04f28e738da8d859163ac807b158261e6a48edb279a132743ff
SHA51222959911f63bc551ee26aba716c0f2e6bd5ccc55c610fdf7474cd687886e74fcd4b6ca0158694f31961ee9692fbcf00003995444cd97551f6ed34d71e6340b76
-
C:\Users\Admin\AppData\Roaming\Microsoft\Qwuzp\ykubb.datMD5
36f426bb6f57d516bba81629e9932a06
SHA18e893b73e3e8cfc103eb151a6fcbeed69771db99
SHA256ee0d2cf73f9e912b25975abedfb3e99aaf4017990359dd68e5c8ecd3549e5819
SHA5123e6d90cc1665577fd9f1ed3d812100cd76a13176ca0fa72c1fbf3f80bfda96459c8ff2ff0d83059f5388e68ffa1add5ef44a31c46d20ad73f16f44e70bf5341c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Qwuzp\ykubb.exeMD5
7bfc9747a217ec58395bd59f876e389f
SHA12c4b1d4a484e193e26327339ed38a4f05fd637dd
SHA256f2704a029672c04f28e738da8d859163ac807b158261e6a48edb279a132743ff
SHA51222959911f63bc551ee26aba716c0f2e6bd5ccc55c610fdf7474cd687886e74fcd4b6ca0158694f31961ee9692fbcf00003995444cd97551f6ed34d71e6340b76
-
C:\Users\Admin\AppData\Roaming\Microsoft\Qwuzp\ykubb.exeMD5
7bfc9747a217ec58395bd59f876e389f
SHA12c4b1d4a484e193e26327339ed38a4f05fd637dd
SHA256f2704a029672c04f28e738da8d859163ac807b158261e6a48edb279a132743ff
SHA51222959911f63bc551ee26aba716c0f2e6bd5ccc55c610fdf7474cd687886e74fcd4b6ca0158694f31961ee9692fbcf00003995444cd97551f6ed34d71e6340b76
-
C:\Users\Admin\AppData\Roaming\Microsoft\Qwuzp\ykubb.exeMD5
7bfc9747a217ec58395bd59f876e389f
SHA12c4b1d4a484e193e26327339ed38a4f05fd637dd
SHA256f2704a029672c04f28e738da8d859163ac807b158261e6a48edb279a132743ff
SHA51222959911f63bc551ee26aba716c0f2e6bd5ccc55c610fdf7474cd687886e74fcd4b6ca0158694f31961ee9692fbcf00003995444cd97551f6ed34d71e6340b76
-
\Users\Admin\AppData\Local\Temp\554B.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
memory/212-1359-0x00000000027B0000-0x00000000027B1000-memory.dmpFilesize
4KB
-
memory/212-1357-0x0000000000000000-mapping.dmp
-
memory/1176-491-0x00000000001A0000-0x00000000001A9000-memory.dmpFilesize
36KB
-
memory/1176-474-0x0000000000000000-mapping.dmp
-
memory/1176-500-0x00000000001B0000-0x00000000001B5000-memory.dmpFilesize
20KB
-
memory/1344-245-0x0000000000B70000-0x0000000000B7C000-memory.dmpFilesize
48KB
-
memory/1344-248-0x0000000000B80000-0x0000000000B86000-memory.dmpFilesize
24KB
-
memory/1344-235-0x0000000000000000-mapping.dmp
-
memory/1348-1313-0x0000000000961000-0x0000000000962000-memory.dmpFilesize
4KB
-
memory/1348-1317-0x00000000012A0000-0x00000000012A1000-memory.dmpFilesize
4KB
-
memory/1500-665-0x0000000002A20000-0x0000000002A28000-memory.dmpFilesize
32KB
-
memory/1500-656-0x0000000002A10000-0x0000000002A1C000-memory.dmpFilesize
48KB
-
memory/1500-639-0x0000000000000000-mapping.dmp
-
memory/1552-4-0x0000000000000000-mapping.dmp
-
memory/1552-116-0x00000000009A6000-0x00000000009A7000-memory.dmpFilesize
4KB
-
memory/1552-119-0x0000000002630000-0x0000000002631000-memory.dmpFilesize
4KB
-
memory/1576-552-0x0000000002A20000-0x0000000002A26000-memory.dmpFilesize
24KB
-
memory/1576-544-0x0000000002A10000-0x0000000002A1B000-memory.dmpFilesize
44KB
-
memory/1576-531-0x0000000000000000-mapping.dmp
-
memory/1680-54-0x0000000000000000-mapping.dmp
-
memory/1680-57-0x0000000000230000-0x0000000000239000-memory.dmpFilesize
36KB
-
memory/1680-58-0x0000000000240000-0x0000000000244000-memory.dmpFilesize
16KB
-
memory/1688-7-0x0000000000000000-mapping.dmp
-
memory/1824-1361-0x0000000000000000-mapping.dmp
-
memory/1828-16-0x0000000002A10000-0x0000000002A7B000-memory.dmpFilesize
428KB
-
memory/1828-18-0x0000000002A80000-0x0000000002AF5000-memory.dmpFilesize
468KB
-
memory/1828-11-0x0000000000000000-mapping.dmp
-
memory/1984-1356-0x0000000000000000-mapping.dmp
-
memory/1988-437-0x00000000001E0000-0x0000000000202000-memory.dmpFilesize
136KB
-
memory/1988-429-0x00000000001B0000-0x00000000001D7000-memory.dmpFilesize
156KB
-
memory/1988-415-0x0000000000000000-mapping.dmp
-
memory/2184-145-0x0000000000000000-mapping.dmp
-
memory/2184-150-0x0000000000F20000-0x0000000000F2E000-memory.dmpFilesize
56KB
-
memory/2184-152-0x0000000000F30000-0x0000000000F39000-memory.dmpFilesize
36KB
-
memory/2368-367-0x0000000000620000-0x0000000000629000-memory.dmpFilesize
36KB
-
memory/2368-354-0x0000000000000000-mapping.dmp
-
memory/2368-374-0x0000000000630000-0x0000000000635000-memory.dmpFilesize
20KB
-
memory/2424-29-0x0000000000000000-mapping.dmp
-
memory/2424-33-0x0000000000780000-0x000000000078C000-memory.dmpFilesize
48KB
-
memory/2424-34-0x0000000000790000-0x0000000000797000-memory.dmpFilesize
28KB
-
memory/2532-290-0x0000000000000000-mapping.dmp
-
memory/2532-306-0x0000000002B20000-0x0000000002B24000-memory.dmpFilesize
16KB
-
memory/2532-301-0x0000000002B10000-0x0000000002B19000-memory.dmpFilesize
36KB
-
memory/2612-1353-0x0000000000000000-mapping.dmp
-
memory/2612-1360-0x00000000020F0000-0x0000000002127000-memory.dmpFilesize
220KB
-
memory/3012-110-0x0000000000000000-mapping.dmp
-
memory/3012-117-0x0000000002A20000-0x0000000002A27000-memory.dmpFilesize
28KB
-
memory/3012-114-0x0000000002A10000-0x0000000002A1B000-memory.dmpFilesize
44KB
-
memory/3028-40-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-32-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-66-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-67-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-68-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-69-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-70-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-71-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-72-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-74-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-73-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-75-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-76-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-77-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-78-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-79-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-80-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-82-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-81-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-84-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-86-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-3-0x0000000000FD0000-0x0000000000FE6000-memory.dmpFilesize
88KB
-
memory/3028-88-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-89-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-10-0x0000000002FF0000-0x000000000305B000-memory.dmpFilesize
428KB
-
memory/3028-12-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-91-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-95-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-93-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-98-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-100-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-101-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-104-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-109-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-106-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-64-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-63-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-62-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-61-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-60-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-139-0x0000000002FF0000-0x0000000002FFC000-memory.dmpFilesize
48KB
-
memory/3028-59-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-56-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-55-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-13-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-14-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-15-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-226-0x0000000002FF0000-0x0000000002FFC000-memory.dmpFilesize
48KB
-
memory/3028-53-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-50-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-49-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-48-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-47-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-46-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-45-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-43-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-44-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-400-0x0000000002FF0000-0x0000000002FFC000-memory.dmpFilesize
48KB
-
memory/3028-407-0x0000000002FF0000-0x0000000002FFC000-memory.dmpFilesize
48KB
-
memory/3028-42-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-41-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-17-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-39-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-38-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-37-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-36-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-35-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-65-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-569-0x0000000002FF0000-0x0000000002FFC000-memory.dmpFilesize
48KB
-
memory/3028-19-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-20-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-21-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-31-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-30-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-27-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-25-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-24-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-22-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3028-23-0x0000000001000000-0x000000000100A000-memory.dmpFilesize
40KB
-
memory/3076-1240-0x0000000000000000-mapping.dmp
-
memory/3076-1352-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/3716-611-0x00000000010D0000-0x00000000010D7000-memory.dmpFilesize
28KB
-
memory/3716-602-0x00000000010C0000-0x00000000010CD000-memory.dmpFilesize
52KB
-
memory/3716-586-0x0000000000000000-mapping.dmp
-
memory/3756-92-0x0000000002A20000-0x0000000002A2A000-memory.dmpFilesize
40KB
-
memory/3756-90-0x0000000002A10000-0x0000000002A1B000-memory.dmpFilesize
44KB
-
memory/3756-87-0x0000000000000000-mapping.dmp
-
memory/3984-0-0x0000000000A66000-0x0000000000A67000-memory.dmpFilesize
4KB
-
memory/3984-1-0x00000000025B0000-0x00000000025B1000-memory.dmpFilesize
4KB
-
memory/4004-199-0x0000000002E40000-0x0000000002E45000-memory.dmpFilesize
20KB
-
memory/4004-195-0x0000000002E30000-0x0000000002E39000-memory.dmpFilesize
36KB
-
memory/4004-188-0x0000000000000000-mapping.dmp