Analysis
-
max time kernel
48s -
max time network
67s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 19:38
Static task
static1
Behavioral task
behavioral1
Sample
PREVENTIVO 56768.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
PREVENTIVO 56768.exe
Resource
win10v20201028
General
-
Target
PREVENTIVO 56768.exe
-
Size
2.1MB
-
MD5
fe5fef01ed18bdd75d39893c73326317
-
SHA1
448fcedd08737c03a3f2944cb0738e84aab5d3e9
-
SHA256
8978b5eb14061436a8d2249f9c92ac75d8307c83a09ea7aa3e6572f704b4335f
-
SHA512
d05cdc257bdb4ab1f4695463b92686f2c191a68ed22ce99b2db75c4ff5f46f7c41972e1ce3aa010525791633f0fa4ac5388a4d3fce4414efc0e5660f4f35e01e
Malware Config
Signatures
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
Processes:
resource yara_rule behavioral2/memory/1036-7-0x00000000083B0000-0x00000000083B3000-memory.dmp coreentity -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Processes:
resource yara_rule behavioral2/memory/1036-8-0x00000000059C0000-0x0000000005B20000-memory.dmp rezer0 -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\Costura\8E3603ED8A0381E02887C1DBBE921340\32\sqlite.interop.dll upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PREVENTIVO 56768.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation PREVENTIVO 56768.exe -
Loads dropped DLL 1 IoCs
Processes:
PREVENTIVO 56768.exepid process 1172 PREVENTIVO 56768.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 13 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PREVENTIVO 56768.exedescription pid process target process PID 1036 set thread context of 1172 1036 PREVENTIVO 56768.exe PREVENTIVO 56768.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
PREVENTIVO 56768.exepid process 1172 PREVENTIVO 56768.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
PREVENTIVO 56768.exePREVENTIVO 56768.exepid process 1036 PREVENTIVO 56768.exe 1036 PREVENTIVO 56768.exe 1036 PREVENTIVO 56768.exe 1036 PREVENTIVO 56768.exe 1036 PREVENTIVO 56768.exe 1172 PREVENTIVO 56768.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PREVENTIVO 56768.exePREVENTIVO 56768.exedescription pid process Token: SeDebugPrivilege 1036 PREVENTIVO 56768.exe Token: SeDebugPrivilege 1172 PREVENTIVO 56768.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PREVENTIVO 56768.exepid process 1172 PREVENTIVO 56768.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
PREVENTIVO 56768.exedescription pid process target process PID 1036 wrote to memory of 580 1036 PREVENTIVO 56768.exe schtasks.exe PID 1036 wrote to memory of 580 1036 PREVENTIVO 56768.exe schtasks.exe PID 1036 wrote to memory of 580 1036 PREVENTIVO 56768.exe schtasks.exe PID 1036 wrote to memory of 2696 1036 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1036 wrote to memory of 2696 1036 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1036 wrote to memory of 2696 1036 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1036 wrote to memory of 1172 1036 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1036 wrote to memory of 1172 1036 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1036 wrote to memory of 1172 1036 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1036 wrote to memory of 1172 1036 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1036 wrote to memory of 1172 1036 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1036 wrote to memory of 1172 1036 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1036 wrote to memory of 1172 1036 PREVENTIVO 56768.exe PREVENTIVO 56768.exe PID 1036 wrote to memory of 1172 1036 PREVENTIVO 56768.exe PREVENTIVO 56768.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PREVENTIVO 56768.exe"C:\Users\Admin\AppData\Local\Temp\PREVENTIVO 56768.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mlmCiYoR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6A68.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PREVENTIVO 56768.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PREVENTIVO 56768.exe"{path}"2⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PREVENTIVO 56768.exe.logMD5
b4f7a6a57cb46d94b72410eb6a6d45a9
SHA169f3596ffa027202d391444b769ceea0ae14c5f7
SHA25623994ebe221a48ea16ebad51ae0d4b47ccd415ae10581f9405e588d4f6c2523b
SHA512be6da516e54c3a5b33ac2603137a2f8cf8445ff5961dd266faedf3627bae8979953d7ef305538df0151c609917a5b99bf5d023bdd32de50fd5c723950f90db5c
-
C:\Users\Admin\AppData\Local\Temp\tmp6A68.tmpMD5
02091e99c12c0cd866bf040379767d89
SHA1ca001aa37ab90046ac75130a5dbaf86d7bfbc8ec
SHA2560b2d6eadc3c5122a07e1a284c93bb8a0054facb2e2f1e1f6ecee6ccf62f2d05f
SHA512061856e253526c72f3787a928b42de861ecfac228989303b2856954f1bd690d2daaa3f4493a4e43fb2a431159ea91323a1fde9f7b9215b53b281087d77f76925
-
\Users\Admin\AppData\Local\Temp\Costura\8E3603ED8A0381E02887C1DBBE921340\32\sqlite.interop.dllMD5
e81aeac387c5db32b7f9b07d15e788e0
SHA1829be6eaf1cb0d82b2ddfc98272e1087f4a7a7c3
SHA25644f31f99f048bfc5195937353b5207332e455bcd5a722bcfd32cacfd93f60f06
SHA512cc6a96325a01c50c059706a1f4156f109e502ef9c0b0f5de209d1f52e7cc973cebc027f57ed988e9d1b8fca62746b60ee7430d608de95cdd0e5ac3cb61fbe32e
-
memory/580-12-0x0000000000000000-mapping.dmp
-
memory/1036-0-0x0000000073290000-0x000000007397E000-memory.dmpFilesize
6.9MB
-
memory/1036-1-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/1036-3-0x0000000007D10000-0x0000000007E9F000-memory.dmpFilesize
1.6MB
-
memory/1036-4-0x00000000085A0000-0x00000000085A1000-memory.dmpFilesize
4KB
-
memory/1036-5-0x0000000008240000-0x0000000008241000-memory.dmpFilesize
4KB
-
memory/1036-6-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/1036-7-0x00000000083B0000-0x00000000083B3000-memory.dmpFilesize
12KB
-
memory/1036-8-0x00000000059C0000-0x0000000005B20000-memory.dmpFilesize
1.4MB
-
memory/1036-9-0x0000000005B20000-0x0000000005B21000-memory.dmpFilesize
4KB
-
memory/1172-14-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-15-0x0000000000559CEE-mapping.dmp
-
memory/1172-16-0x0000000073290000-0x000000007397E000-memory.dmpFilesize
6.9MB
-
memory/1172-19-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-20-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-21-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-22-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-23-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-24-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-26-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-25-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-27-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-28-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-29-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-30-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-31-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-32-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-33-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-34-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-35-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-36-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-37-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-38-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-39-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-40-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-41-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-42-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-44-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-43-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-45-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-46-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-47-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-48-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-49-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-50-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-51-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-52-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-53-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-54-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-55-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-56-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-57-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-58-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-59-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-60-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-61-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-62-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-63-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-64-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-65-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-66-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-67-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-68-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-69-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-70-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-71-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-72-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-73-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-74-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-75-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-76-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-77-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-78-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-79-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-80-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-81-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-83-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-82-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-84-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-85-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-86-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-87-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-88-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-89-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-90-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-92-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-91-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-93-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-94-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-95-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-96-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-97-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-98-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-99-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-100-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-101-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-102-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-103-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-104-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-105-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-106-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-108-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-109-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-110-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-111-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-107-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-112-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-114-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-113-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-115-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-116-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-117-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-119-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-118-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-120-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-121-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-122-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-123-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-124-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-125-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-126-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-127-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-128-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-129-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-130-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-131-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-132-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-133-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-134-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-136-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-137-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-138-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-139-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-135-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-140-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-141-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-142-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-143-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-145-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-144-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-146-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-147-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-148-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-149-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-150-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-151-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-152-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-153-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-154-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-155-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-157-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-156-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-158-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-159-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-160-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-161-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-162-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-164-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-163-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-166-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-165-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-167-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-168-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-169-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-170-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-171-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-172-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-173-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-174-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-175-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-176-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-177-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-178-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-179-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-180-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-181-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-182-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-183-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-184-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-185-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-186-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-188-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-189-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-190-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-191-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-192-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-194-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-193-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-187-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-196-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-195-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-197-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-198-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-200-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-201-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-202-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-203-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-204-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-205-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-206-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-207-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-208-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-209-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-210-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-211-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-199-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-212-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-213-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-214-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-215-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-216-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-217-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-218-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-219-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-220-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-221-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-223-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-222-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-224-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-225-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-226-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-227-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-228-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-229-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-230-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-231-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-232-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-233-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-234-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-235-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-236-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-237-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-239-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-238-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-240-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-241-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-242-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-243-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-244-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-245-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-246-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-247-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-248-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-249-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-250-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-251-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-252-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-253-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-254-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-255-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-256-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-257-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-258-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-259-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-260-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-261-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-262-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-263-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-265-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-266-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-264-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-267-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-269-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-270-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-268-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-271-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-272-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-273-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-275-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-276-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-277-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-278-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-274-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-279-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-280-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-281-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-282-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-283-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-284-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-285-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-286-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-287-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-288-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-289-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-290-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-291-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-292-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-293-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-294-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-295-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-296-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-297-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-298-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-301-0x00000000062A0000-0x00000000062A1000-memory.dmpFilesize
4KB
-
memory/1172-304-0x0000000007450000-0x000000000748E000-memory.dmpFilesize
248KB
-
memory/1172-305-0x0000000009150000-0x0000000009151000-memory.dmpFilesize
4KB
-
memory/1172-306-0x00000000091A0000-0x00000000091A1000-memory.dmpFilesize
4KB
-
memory/1172-307-0x0000000007B10000-0x0000000007B9D000-memory.dmpFilesize
564KB
-
memory/1172-308-0x0000000005250000-0x00000000052A9000-memory.dmpFilesize
356KB
-
memory/1172-309-0x0000000007BA0000-0x0000000007BA1000-memory.dmpFilesize
4KB