Analysis
-
max time kernel
112s -
max time network
130s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
23-11-2020 14:55
Static task
static1
Behavioral task
behavioral1
Sample
Invoice_Payment Form_163142.xlsm
Resource
win7v20201028
General
-
Target
Invoice_Payment Form_163142.xlsm
-
Size
51KB
-
MD5
583fcbda6de9764fc9d5d2c21856a3ce
-
SHA1
53b2b1303a2dd6c1f7ad7a5ea9de2838e79380d9
-
SHA256
5d4fdf219371a9d83d31b7e21cd1103b309f124e36dc1a4790e052efe760990f
-
SHA512
93f37f35fcc4e3d7b3540c8b01b00303d087984c87087529239ccf9eee20d5b32c3c13c6f93b8a912b29b2921dbda70b2f2d1b0445efd01bb6cb804f6f9f53b1
Malware Config
Extracted
smokeloader
2020
http://penodux.com/xsmkld/index.php
http://tommusikirtyur.com/xsmkld/index.php
http://ploaernysannyer.com/xsmkld/index.php
http://dersmasfannyer.com/xsmkld/index.php
http://derdsgdannyer.com/xsmkld/index.php
Extracted
dridex
10444
175.126.167.148:443
173.249.20.233:8043
162.241.204.233:4443
138.122.143.40:8043
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1401.dll cryptone \Users\Admin\AppData\Local\Temp\1401.dll cryptone -
Processes:
resource yara_rule behavioral2/memory/2112-16-0x0000000004B00000-0x0000000004B3D000-memory.dmp dridex_ldr behavioral2/memory/1620-85-0x0000000010000000-0x000000001001D000-memory.dmp dridex_ldr -
Executes dropped EXE 2 IoCs
Processes:
wggyqqff.exe1C20.exepid process 1768 wggyqqff.exe 1620 1C20.exe -
Loads dropped DLL 2 IoCs
Processes:
wggyqqff.exeregsvr32.exepid process 1768 wggyqqff.exe 2112 regsvr32.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
wggyqqff.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wggyqqff.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wggyqqff.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wggyqqff.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1272 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
wggyqqff.exepid process 1768 wggyqqff.exe 1768 wggyqqff.exe 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 2352 -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
wggyqqff.exepid process 1768 wggyqqff.exe 2352 2352 2352 2352 2352 2352 -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 1272 EXCEL.EXE 1272 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 1272 EXCEL.EXE 1272 EXCEL.EXE 1272 EXCEL.EXE 1272 EXCEL.EXE 1272 EXCEL.EXE 1272 EXCEL.EXE 1272 EXCEL.EXE 1272 EXCEL.EXE 1272 EXCEL.EXE 1272 EXCEL.EXE 1272 EXCEL.EXE 1272 EXCEL.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
EXCEL.EXEregsvr32.exedescription pid process target process PID 1272 wrote to memory of 1768 1272 EXCEL.EXE wggyqqff.exe PID 1272 wrote to memory of 1768 1272 EXCEL.EXE wggyqqff.exe PID 1272 wrote to memory of 1768 1272 EXCEL.EXE wggyqqff.exe PID 2352 wrote to memory of 3860 2352 regsvr32.exe PID 2352 wrote to memory of 3860 2352 regsvr32.exe PID 3860 wrote to memory of 2112 3860 regsvr32.exe regsvr32.exe PID 3860 wrote to memory of 2112 3860 regsvr32.exe regsvr32.exe PID 3860 wrote to memory of 2112 3860 regsvr32.exe regsvr32.exe PID 2352 wrote to memory of 1620 2352 1C20.exe PID 2352 wrote to memory of 1620 2352 1C20.exe PID 2352 wrote to memory of 1620 2352 1C20.exe PID 2352 wrote to memory of 3396 2352 explorer.exe PID 2352 wrote to memory of 3396 2352 explorer.exe PID 2352 wrote to memory of 3396 2352 explorer.exe PID 2352 wrote to memory of 3396 2352 explorer.exe PID 2352 wrote to memory of 2908 2352 explorer.exe PID 2352 wrote to memory of 2908 2352 explorer.exe PID 2352 wrote to memory of 2908 2352 explorer.exe PID 2352 wrote to memory of 2564 2352 explorer.exe PID 2352 wrote to memory of 2564 2352 explorer.exe PID 2352 wrote to memory of 2564 2352 explorer.exe PID 2352 wrote to memory of 2564 2352 explorer.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Invoice_Payment Form_163142.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\IjkPol\wggyqqff.exe"C:\Users\Admin\IjkPol\wggyqqff.exe" 02⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1401.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1401.dll2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1C20.exeC:\Users\Admin\AppData\Local\Temp\1C20.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1401.dllMD5
0ca63fc69b7983bbecce6722abff8e86
SHA1f63b03836896bbb8a19baac85c05ca8a9e73054b
SHA2562f38ab60dc994e973ed1269a8d0c0e534235f2e39c29af52f899ecf089908dc1
SHA51234348595fa082d26961731c8fac19719c2a1998b308e8dc68be4435a23f61feb2f5131d660dce9f581ad6dd169a48ffe6c717a7212ec0d666fe08a3676e70e91
-
C:\Users\Admin\AppData\Local\Temp\1C20.exeMD5
2f66e11030122a8e381f5806543f45a2
SHA18760dae8485027db5d36bfb634b438f1f433e842
SHA25630ce3fd6112a662fe576a70816ffab8f9c0b1cabe93ab14c1a5cd85d3a37b510
SHA512d9ee3eb3b21042a114b06fb3e949771662ae5e08a691336c8080f315640250e3f50f48127b5fab8ba8ad2298e9e97ff4bbe9dbea0022d48a9eb2ab566e726292
-
C:\Users\Admin\AppData\Local\Temp\1C20.exeMD5
2f66e11030122a8e381f5806543f45a2
SHA18760dae8485027db5d36bfb634b438f1f433e842
SHA25630ce3fd6112a662fe576a70816ffab8f9c0b1cabe93ab14c1a5cd85d3a37b510
SHA512d9ee3eb3b21042a114b06fb3e949771662ae5e08a691336c8080f315640250e3f50f48127b5fab8ba8ad2298e9e97ff4bbe9dbea0022d48a9eb2ab566e726292
-
C:\Users\Admin\IjkPol\wggyqqff.exeMD5
c966ec47c0480c3a6be2a1231a83c8a1
SHA1b15e12449be1ea174dfd224935fa6d78e1c58f5a
SHA2564b1f2c18b149fd0e878c362ffba50bb553d7bea93a795b33e398d032dc0b7663
SHA51235b3b6e9aebaa447f2cbf6a9fb7d24985475870285c6ea1bde7b8ccfd3ea956761691e44103d391ec89d8af6f43d73627a09c1c36b19f24caeab1453edd69f5e
-
C:\Users\Admin\IjkPol\wggyqqff.exeMD5
c966ec47c0480c3a6be2a1231a83c8a1
SHA1b15e12449be1ea174dfd224935fa6d78e1c58f5a
SHA2564b1f2c18b149fd0e878c362ffba50bb553d7bea93a795b33e398d032dc0b7663
SHA51235b3b6e9aebaa447f2cbf6a9fb7d24985475870285c6ea1bde7b8ccfd3ea956761691e44103d391ec89d8af6f43d73627a09c1c36b19f24caeab1453edd69f5e
-
\Users\Admin\AppData\Local\Temp\1401.dllMD5
0ca63fc69b7983bbecce6722abff8e86
SHA1f63b03836896bbb8a19baac85c05ca8a9e73054b
SHA2562f38ab60dc994e973ed1269a8d0c0e534235f2e39c29af52f899ecf089908dc1
SHA51234348595fa082d26961731c8fac19719c2a1998b308e8dc68be4435a23f61feb2f5131d660dce9f581ad6dd169a48ffe6c717a7212ec0d666fe08a3676e70e91
-
\Users\Admin\AppData\Local\Temp\45E1.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
memory/724-249-0x0000000000FA0000-0x0000000000FAE000-memory.dmpFilesize
56KB
-
memory/724-251-0x0000000000FB0000-0x0000000000FB9000-memory.dmpFilesize
36KB
-
memory/724-243-0x0000000000000000-mapping.dmp
-
memory/1272-4-0x000001FC5F78A000-0x000001FC5F78F000-memory.dmpFilesize
20KB
-
memory/1272-0-0x00007FF8D98C0000-0x00007FF8D9EF7000-memory.dmpFilesize
6.2MB
-
memory/1272-3-0x000001FC5F787000-0x000001FC5F78A000-memory.dmpFilesize
12KB
-
memory/1620-17-0x0000000000000000-mapping.dmp
-
memory/1620-85-0x0000000010000000-0x000000001001D000-memory.dmpFilesize
116KB
-
memory/1768-7-0x0000000000000000-mapping.dmp
-
memory/2112-16-0x0000000004B00000-0x0000000004B3D000-memory.dmpFilesize
244KB
-
memory/2112-14-0x0000000000000000-mapping.dmp
-
memory/2136-349-0x0000000000000000-mapping.dmp
-
memory/2136-357-0x00000000008F0000-0x00000000008FC000-memory.dmpFilesize
48KB
-
memory/2136-362-0x0000000000900000-0x0000000000906000-memory.dmpFilesize
24KB
-
memory/2152-530-0x0000000000000000-mapping.dmp
-
memory/2152-541-0x0000000000A00000-0x0000000000A0D000-memory.dmpFilesize
52KB
-
memory/2152-546-0x0000000000A10000-0x0000000000A17000-memory.dmpFilesize
28KB
-
memory/2352-1257-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-399-0x0000000000AA0000-0x0000000000AAC000-memory.dmpFilesize
48KB
-
memory/2352-3024-0x0000000000AD0000-0x0000000000ADB000-memory.dmpFilesize
44KB
-
memory/2352-3022-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-3021-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-237-0x0000000000AA0000-0x0000000000AAC000-memory.dmpFilesize
48KB
-
memory/2352-3020-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-3019-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-3018-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-3017-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-3016-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-3015-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-339-0x0000000000AA0000-0x0000000000AAC000-memory.dmpFilesize
48KB
-
memory/2352-3014-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-3013-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-3012-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1270-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-405-0x0000000000AA0000-0x0000000000AAC000-memory.dmpFilesize
48KB
-
memory/2352-3011-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-3010-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-3008-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-3009-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-3007-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-3006-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-518-0x0000000000AA0000-0x0000000000AAC000-memory.dmpFilesize
48KB
-
memory/2352-3005-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-3004-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-20-0x0000000000A90000-0x0000000000AFB000-memory.dmpFilesize
428KB
-
memory/2352-820-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-825-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-829-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-833-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-843-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-838-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-849-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-859-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-854-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-864-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-870-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-877-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-874-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-881-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-885-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-893-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-889-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-901-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-897-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-904-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-908-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-912-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-920-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-916-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-929-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-925-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-933-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-937-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-945-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-941-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1269-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-952-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-957-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-965-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-961-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-969-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-973-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-980-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-984-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-976-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-986-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-992-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-989-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-995-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-998-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1001-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1004-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1007-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1010-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1013-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1016-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1019-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1022-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1028-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1025-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1031-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1034-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1037-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1040-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1043-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1045-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1048-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1051-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1052-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1054-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1056-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1057-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1059-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1064-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1065-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1062-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1067-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1068-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1071-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1072-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1076-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1078-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1079-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1074-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-1244-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1245-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1246-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1247-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1248-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1249-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1250-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1251-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1252-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1253-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1254-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1255-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1256-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-11-0x0000000000A60000-0x0000000000A76000-memory.dmpFilesize
88KB
-
memory/2352-1258-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1259-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1261-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1262-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1263-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1260-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1264-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1265-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1267-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1266-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1268-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-949-0x0000000000A90000-0x0000000000A97000-memory.dmpFilesize
28KB
-
memory/2352-3003-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2990-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1272-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1273-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1274-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1275-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1276-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1277-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1278-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1279-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1280-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1281-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1282-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1283-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1284-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1285-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1286-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1287-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1288-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1289-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1290-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1291-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1292-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1293-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1294-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1295-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1296-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1297-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1298-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1299-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1300-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1301-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1303-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1302-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1304-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1305-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1306-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1308-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1307-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1309-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1310-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1311-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1312-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1313-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1314-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1315-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1317-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1316-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1318-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1319-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1321-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1320-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1322-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2945-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2946-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2947-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2948-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2949-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2950-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2952-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2951-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2953-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2954-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2955-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2957-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2956-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2958-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2960-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2959-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2961-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2962-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2963-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2964-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2965-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2966-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2967-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2968-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2969-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2971-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2970-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2972-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2974-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2973-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2975-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2976-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2977-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2978-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2979-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2980-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2981-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2982-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2983-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2984-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2985-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2986-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2987-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2988-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2989-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-1271-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2991-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2992-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2993-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2994-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2995-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2996-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2997-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2998-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-3000-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-2999-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-3001-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2352-3002-0x0000000000A90000-0x0000000000A9B000-memory.dmpFilesize
44KB
-
memory/2564-105-0x00000000005E0000-0x00000000005EB000-memory.dmpFilesize
44KB
-
memory/2564-101-0x0000000000000000-mapping.dmp
-
memory/2564-107-0x00000000005F0000-0x00000000005FA000-memory.dmpFilesize
40KB
-
memory/2908-66-0x00000000008B0000-0x00000000008BC000-memory.dmpFilesize
48KB
-
memory/2908-63-0x0000000000000000-mapping.dmp
-
memory/2908-69-0x00000000008C0000-0x00000000008C7000-memory.dmpFilesize
28KB
-
memory/2968-185-0x0000000000000000-mapping.dmp
-
memory/2968-186-0x0000000000E10000-0x0000000000E1B000-memory.dmpFilesize
44KB
-
memory/2968-189-0x0000000000E20000-0x0000000000E27000-memory.dmpFilesize
28KB
-
memory/3396-21-0x0000000000000000-mapping.dmp
-
memory/3396-29-0x0000000000D20000-0x0000000000D95000-memory.dmpFilesize
468KB
-
memory/3396-27-0x0000000000CB0000-0x0000000000D1B000-memory.dmpFilesize
428KB
-
memory/3488-305-0x0000000001250000-0x0000000001255000-memory.dmpFilesize
20KB
-
memory/3488-303-0x0000000001240000-0x0000000001249000-memory.dmpFilesize
36KB
-
memory/3488-296-0x0000000000000000-mapping.dmp
-
memory/3680-427-0x0000000000D00000-0x0000000000D22000-memory.dmpFilesize
136KB
-
memory/3680-422-0x0000000000CD0000-0x0000000000CF7000-memory.dmpFilesize
156KB
-
memory/3680-411-0x0000000000000000-mapping.dmp
-
memory/3816-469-0x0000000000000000-mapping.dmp
-
memory/3816-483-0x00000000004E0000-0x00000000004E6000-memory.dmpFilesize
24KB
-
memory/3816-478-0x00000000004D0000-0x00000000004DB000-memory.dmpFilesize
44KB
-
memory/3860-12-0x0000000000000000-mapping.dmp