Analysis
-
max time kernel
137s -
max time network
136s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 19:38
Static task
static1
Behavioral task
behavioral1
Sample
PREVENTIVO 56768.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
PREVENTIVO 56768.exe
Resource
win10v20201028
General
-
Target
PREVENTIVO 56768.exe
-
Size
2.1MB
-
MD5
fe5fef01ed18bdd75d39893c73326317
-
SHA1
448fcedd08737c03a3f2944cb0738e84aab5d3e9
-
SHA256
8978b5eb14061436a8d2249f9c92ac75d8307c83a09ea7aa3e6572f704b4335f
-
SHA512
d05cdc257bdb4ab1f4695463b92686f2c191a68ed22ce99b2db75c4ff5f46f7c41972e1ce3aa010525791633f0fa4ac5388a4d3fce4414efc0e5660f4f35e01e
Malware Config
Signatures
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
Processes:
resource yara_rule behavioral1/memory/1900-4-0x0000000000320000-0x0000000000323000-memory.dmp coreentity -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Processes:
resource yara_rule behavioral1/memory/1900-5-0x0000000009130000-0x0000000009290000-memory.dmp rezer0 -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\Costura\8E3603ED8A0381E02887C1DBBE921340\32\sqlite.interop.dll upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PREVENTIVO 56768.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\International\Geo\Nation PREVENTIVO 56768.exe -
Loads dropped DLL 1 IoCs
Processes:
PREVENTIVO 56768.exepid process 1088 PREVENTIVO 56768.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PREVENTIVO 56768.exedescription pid process target process PID 1900 set thread context of 1088 1900 PREVENTIVO 56768.exe PREVENTIVO 56768.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
PREVENTIVO 56768.exepid process 1088 PREVENTIVO 56768.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
PREVENTIVO 56768.exePREVENTIVO 56768.exepid process 1900 PREVENTIVO 56768.exe 1900 PREVENTIVO 56768.exe 1900 PREVENTIVO 56768.exe 1900 PREVENTIVO 56768.exe 1900 PREVENTIVO 56768.exe 1088 PREVENTIVO 56768.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PREVENTIVO 56768.exePREVENTIVO 56768.exedescription pid process Token: SeDebugPrivilege 1900 PREVENTIVO 56768.exe Token: SeDebugPrivilege 1088 PREVENTIVO 56768.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PREVENTIVO 56768.exepid process 1088 PREVENTIVO 56768.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
PREVENTIVO 56768.exedescription pid process target process PID 1900 wrote to memory of 1708 1900 PREVENTIVO 56768.exe schtasks.exe PID 1900 wrote to memory of 1708 1900 PREVENTIVO 56768.exe schtasks.exe PID 1900 wrote to memory of 1708 1900 PREVENTIVO 56768.exe schtasks.exe PID 1900 wrote to memory of 1708 1900 PREVENTIVO 56768.exe schtasks.exe PID 1900 wrote to memory of 936 1900 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1900 wrote to memory of 936 1900 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1900 wrote to memory of 936 1900 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1900 wrote to memory of 936 1900 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1900 wrote to memory of 1088 1900 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1900 wrote to memory of 1088 1900 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1900 wrote to memory of 1088 1900 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1900 wrote to memory of 1088 1900 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1900 wrote to memory of 1088 1900 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1900 wrote to memory of 1088 1900 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1900 wrote to memory of 1088 1900 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1900 wrote to memory of 1088 1900 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1900 wrote to memory of 1088 1900 PREVENTIVO 56768.exe PREVENTIVO 56768.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PREVENTIVO 56768.exe"C:\Users\Admin\AppData\Local\Temp\PREVENTIVO 56768.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mlmCiYoR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp23F5.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PREVENTIVO 56768.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PREVENTIVO 56768.exe"{path}"2⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp23F5.tmpMD5
2abb1e593fbe64b311a84ad889a0e7a2
SHA19f3e11cb459e3fd1ba2da05489dafeb757d0752e
SHA2566996a286fc4a44ae27f3c7d2e71d61be26802e1c76fbb842ebbc2ae8857f4c11
SHA512f195a8d1432b59d66ac80122acf163b3a67f404798ffaf158a59db35fd530a4d3cfdf265996e797c7354bc7b3ae516380ca6fb84da353bedd488570d159d5a79
-
\Users\Admin\AppData\Local\Temp\Costura\8E3603ED8A0381E02887C1DBBE921340\32\sqlite.interop.dllMD5
e81aeac387c5db32b7f9b07d15e788e0
SHA1829be6eaf1cb0d82b2ddfc98272e1087f4a7a7c3
SHA25644f31f99f048bfc5195937353b5207332e455bcd5a722bcfd32cacfd93f60f06
SHA512cc6a96325a01c50c059706a1f4156f109e502ef9c0b0f5de209d1f52e7cc973cebc027f57ed988e9d1b8fca62746b60ee7430d608de95cdd0e5ac3cb61fbe32e
-
memory/1088-153-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-147-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-301-0x00000000062A0000-0x00000000062F9000-memory.dmpFilesize
356KB
-
memory/1088-300-0x0000000000780000-0x000000000080D000-memory.dmpFilesize
564KB
-
memory/1088-299-0x00000000023E0000-0x000000000241E000-memory.dmpFilesize
248KB
-
memory/1088-8-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-297-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-296-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-295-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-12-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-15-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/1088-18-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-20-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-19-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-21-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-22-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-24-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-23-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-25-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-26-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-27-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-28-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-29-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-30-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-31-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-32-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-33-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-34-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-35-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-36-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-37-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-38-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-39-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-40-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-41-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-42-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-43-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-44-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-45-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-46-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-47-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-48-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-49-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-50-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-51-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-52-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-53-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-54-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-55-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-155-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-57-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-58-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-59-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-60-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-61-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-62-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-63-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-64-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-65-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-66-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-67-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-68-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-69-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-70-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-71-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-72-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-73-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-74-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-75-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-76-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-78-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-77-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-79-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-80-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-81-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-82-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-83-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-84-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-85-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-86-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-87-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-88-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-89-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-90-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-91-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-92-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-93-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-94-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-95-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-96-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-97-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-98-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-99-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-100-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-101-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-102-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-103-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-104-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-105-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-106-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-107-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-108-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-109-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-110-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-111-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-112-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-114-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-113-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-115-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-116-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-117-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-118-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-119-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-120-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-121-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-122-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-123-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-124-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-125-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-126-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-127-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-128-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-129-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-130-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-131-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-132-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-133-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-134-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-135-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-136-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-137-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-138-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-139-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-140-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-141-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-142-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-143-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-144-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-145-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-146-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-154-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-148-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-149-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-9-0x0000000000559CEE-mapping.dmp
-
memory/1088-151-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-152-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-150-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-10-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-56-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-156-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-157-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-158-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-159-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-160-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-161-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-162-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-163-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-164-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-165-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-166-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-167-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-168-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-169-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-170-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-171-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-172-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-173-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-174-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-175-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-176-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-177-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-178-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-179-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-180-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-181-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-182-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-183-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-184-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-185-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-186-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-187-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-188-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-189-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-190-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-191-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-192-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-193-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-194-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-195-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-196-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-197-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-198-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-199-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-200-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-201-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-202-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-203-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-204-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-205-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-206-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-207-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-208-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-209-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-210-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-211-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-212-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-213-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-214-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-215-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-216-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-217-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-218-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-219-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-220-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-221-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-222-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-223-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-224-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-225-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-226-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-227-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-228-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-229-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-230-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-231-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-232-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-233-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-234-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-235-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-236-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-237-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-238-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-239-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-240-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-241-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-242-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-243-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-244-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-245-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-246-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-247-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-248-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-249-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-250-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-251-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-252-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-253-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-254-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-255-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-256-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-257-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-258-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-259-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-260-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-261-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-263-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-262-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-264-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-265-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-266-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-267-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-268-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-269-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-270-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-271-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-272-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-273-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-274-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-275-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-276-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-277-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-278-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-279-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-281-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-282-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-280-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-283-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-284-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-285-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-286-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-287-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-288-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-289-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-290-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-291-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-292-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-293-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1088-294-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1708-6-0x0000000000000000-mapping.dmp
-
memory/1900-11-0x0000000000450000-0x0000000000480000-memory.dmpFilesize
192KB
-
memory/1900-5-0x0000000009130000-0x0000000009290000-memory.dmpFilesize
1.4MB
-
memory/1900-4-0x0000000000320000-0x0000000000323000-memory.dmpFilesize
12KB
-
memory/1900-3-0x0000000008180000-0x000000000830F000-memory.dmpFilesize
1.6MB
-
memory/1900-1-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/1900-0-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB