Analysis
-
max time kernel
151s -
max time network
184s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
28-09-2021 05:22
Static task
static1
Behavioral task
behavioral1
Sample
133c10454108aa86301f79a03aa24046.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
133c10454108aa86301f79a03aa24046.exe
Resource
win10-en-20210920
General
-
Target
133c10454108aa86301f79a03aa24046.exe
-
Size
650KB
-
MD5
133c10454108aa86301f79a03aa24046
-
SHA1
21439179cb8700406d57332079ab311d08b0c9bf
-
SHA256
de0cb500125d733becbdeb53cf7b3f1bace4dc91e54805007718970124ef6797
-
SHA512
8b2a492a5732c89c2e347270e9b1df4db26b79fefd6feae115b35a22b0851c7973fb0ecc9b6c6187791bf720d71a7b69374d81abf63f0ed73faed4efbee79fbe
Malware Config
Extracted
asyncrat
0.5.7B
18
185.157.160.136:1973
df4Rtg34dFjwr
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
BitRAT Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/640-103-0x0000000000400000-0x00000000007CE000-memory.dmp family_bitrat behavioral1/memory/640-104-0x000000000068A488-mapping.dmp family_bitrat behavioral1/memory/640-106-0x0000000000400000-0x00000000007CE000-memory.dmp family_bitrat -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Windows\Microsoft.NET\Framework\v4.0.30319\Unknown.dll acprotect \Windows\Microsoft.NET\Framework\v4.0.30319\Unknown.dll acprotect -
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1608-63-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1608-64-0x000000000040C68E-mapping.dmp asyncrat behavioral1/memory/1608-66-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1608-69-0x0000000000830000-0x000000000084B000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
Processes:
ilsqvi.exepid process 1768 ilsqvi.exe -
Processes:
resource yara_rule behavioral1/memory/1940-107-0x0000000000400000-0x00000000008DC000-memory.dmp upx behavioral1/memory/1940-110-0x0000000000400000-0x00000000008DC000-memory.dmp upx -
Loads dropped DLL 3 IoCs
Processes:
powershell.exeRegAsm.exepid process 668 powershell.exe 668 powershell.exe 1580 RegAsm.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
133c10454108aa86301f79a03aa24046.exeilsqvi.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run 133c10454108aa86301f79a03aa24046.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\cp = "C:\\Users\\Admin\\AppData\\Roaming\\cf\\ct.exe" 133c10454108aa86301f79a03aa24046.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run ilsqvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\bm = "C:\\Users\\Admin\\AppData\\Roaming\\bp\\bg.exe" ilsqvi.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
RegAsm.exepid process 640 RegAsm.exe 640 RegAsm.exe 640 RegAsm.exe 640 RegAsm.exe 640 RegAsm.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
133c10454108aa86301f79a03aa24046.exeilsqvi.exeRegAsm.exeRegAsm.exedescription pid process target process PID 1652 set thread context of 1608 1652 133c10454108aa86301f79a03aa24046.exe RegAsm.exe PID 1768 set thread context of 640 1768 ilsqvi.exe RegAsm.exe PID 640 set thread context of 1940 640 RegAsm.exe RegAsm.exe PID 1940 set thread context of 1580 1940 RegAsm.exe RegAsm.exe -
Drops file in Windows directory 26 IoCs
Processes:
RegAsm.exeRegAsm.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\msvcp140.dll RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\nss3.dll RegAsm.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\External RegAsm.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-convert-l1-1-0.dll RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-multibyte-l1-1-0.dll RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-runtime-l1-1-0.dll RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-string-l1-1-0.dll RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\softokn3.dll RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-locale-l1-1-0.dll RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-math-l1-1-0.dll RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-time-l1-1-0.dll RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\mozglue.dll RegAsm.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Unknown.dll RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\License.XenArmor RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-filesystem-l1-1-0.dll RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-stdio-l1-1-0.dll RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\freebl3.dll RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Unknown.dll RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\License.XenArmor RegAsm.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\License.XenArmor RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-conio-l1-1-0_not.dll RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-environment-l1-1-0.dll RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-heap-l1-1-0.dll RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\api-ms-win-crt-utility-l1-1-0.dll RegAsm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\External\ComponentsExt\vcruntime140.dll RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeRegAsm.exeRegAsm.exepid process 668 powershell.exe 1608 RegAsm.exe 668 powershell.exe 1580 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
RegAsm.exepowershell.exeRegAsm.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1608 RegAsm.exe Token: SeDebugPrivilege 668 powershell.exe Token: SeDebugPrivilege 640 RegAsm.exe Token: SeShutdownPrivilege 640 RegAsm.exe Token: SeDebugPrivilege 1580 RegAsm.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
133c10454108aa86301f79a03aa24046.exeilsqvi.exeRegAsm.exepid process 1652 133c10454108aa86301f79a03aa24046.exe 1768 ilsqvi.exe 640 RegAsm.exe 640 RegAsm.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
133c10454108aa86301f79a03aa24046.exeRegAsm.execmd.exepowershell.exeilsqvi.exeRegAsm.exeRegAsm.exedescription pid process target process PID 1652 wrote to memory of 1608 1652 133c10454108aa86301f79a03aa24046.exe RegAsm.exe PID 1652 wrote to memory of 1608 1652 133c10454108aa86301f79a03aa24046.exe RegAsm.exe PID 1652 wrote to memory of 1608 1652 133c10454108aa86301f79a03aa24046.exe RegAsm.exe PID 1652 wrote to memory of 1608 1652 133c10454108aa86301f79a03aa24046.exe RegAsm.exe PID 1652 wrote to memory of 1608 1652 133c10454108aa86301f79a03aa24046.exe RegAsm.exe PID 1652 wrote to memory of 1608 1652 133c10454108aa86301f79a03aa24046.exe RegAsm.exe PID 1652 wrote to memory of 1608 1652 133c10454108aa86301f79a03aa24046.exe RegAsm.exe PID 1652 wrote to memory of 1608 1652 133c10454108aa86301f79a03aa24046.exe RegAsm.exe PID 1652 wrote to memory of 1608 1652 133c10454108aa86301f79a03aa24046.exe RegAsm.exe PID 1652 wrote to memory of 1608 1652 133c10454108aa86301f79a03aa24046.exe RegAsm.exe PID 1652 wrote to memory of 1608 1652 133c10454108aa86301f79a03aa24046.exe RegAsm.exe PID 1652 wrote to memory of 1608 1652 133c10454108aa86301f79a03aa24046.exe RegAsm.exe PID 1608 wrote to memory of 1688 1608 RegAsm.exe cmd.exe PID 1608 wrote to memory of 1688 1608 RegAsm.exe cmd.exe PID 1608 wrote to memory of 1688 1608 RegAsm.exe cmd.exe PID 1608 wrote to memory of 1688 1608 RegAsm.exe cmd.exe PID 1688 wrote to memory of 668 1688 cmd.exe powershell.exe PID 1688 wrote to memory of 668 1688 cmd.exe powershell.exe PID 1688 wrote to memory of 668 1688 cmd.exe powershell.exe PID 1688 wrote to memory of 668 1688 cmd.exe powershell.exe PID 668 wrote to memory of 1768 668 powershell.exe ilsqvi.exe PID 668 wrote to memory of 1768 668 powershell.exe ilsqvi.exe PID 668 wrote to memory of 1768 668 powershell.exe ilsqvi.exe PID 668 wrote to memory of 1768 668 powershell.exe ilsqvi.exe PID 1768 wrote to memory of 640 1768 ilsqvi.exe RegAsm.exe PID 1768 wrote to memory of 640 1768 ilsqvi.exe RegAsm.exe PID 1768 wrote to memory of 640 1768 ilsqvi.exe RegAsm.exe PID 1768 wrote to memory of 640 1768 ilsqvi.exe RegAsm.exe PID 1768 wrote to memory of 640 1768 ilsqvi.exe RegAsm.exe PID 1768 wrote to memory of 640 1768 ilsqvi.exe RegAsm.exe PID 1768 wrote to memory of 640 1768 ilsqvi.exe RegAsm.exe PID 1768 wrote to memory of 640 1768 ilsqvi.exe RegAsm.exe PID 1768 wrote to memory of 640 1768 ilsqvi.exe RegAsm.exe PID 1768 wrote to memory of 640 1768 ilsqvi.exe RegAsm.exe PID 1768 wrote to memory of 640 1768 ilsqvi.exe RegAsm.exe PID 1768 wrote to memory of 640 1768 ilsqvi.exe RegAsm.exe PID 1768 wrote to memory of 640 1768 ilsqvi.exe RegAsm.exe PID 1768 wrote to memory of 640 1768 ilsqvi.exe RegAsm.exe PID 1768 wrote to memory of 640 1768 ilsqvi.exe RegAsm.exe PID 640 wrote to memory of 1940 640 RegAsm.exe RegAsm.exe PID 640 wrote to memory of 1940 640 RegAsm.exe RegAsm.exe PID 640 wrote to memory of 1940 640 RegAsm.exe RegAsm.exe PID 640 wrote to memory of 1940 640 RegAsm.exe RegAsm.exe PID 640 wrote to memory of 1940 640 RegAsm.exe RegAsm.exe PID 640 wrote to memory of 1940 640 RegAsm.exe RegAsm.exe PID 640 wrote to memory of 1940 640 RegAsm.exe RegAsm.exe PID 640 wrote to memory of 1940 640 RegAsm.exe RegAsm.exe PID 640 wrote to memory of 1940 640 RegAsm.exe RegAsm.exe PID 640 wrote to memory of 1940 640 RegAsm.exe RegAsm.exe PID 640 wrote to memory of 1940 640 RegAsm.exe RegAsm.exe PID 1940 wrote to memory of 1580 1940 RegAsm.exe RegAsm.exe PID 1940 wrote to memory of 1580 1940 RegAsm.exe RegAsm.exe PID 1940 wrote to memory of 1580 1940 RegAsm.exe RegAsm.exe PID 1940 wrote to memory of 1580 1940 RegAsm.exe RegAsm.exe PID 1940 wrote to memory of 1580 1940 RegAsm.exe RegAsm.exe PID 1940 wrote to memory of 1580 1940 RegAsm.exe RegAsm.exe PID 1940 wrote to memory of 1580 1940 RegAsm.exe RegAsm.exe PID 1940 wrote to memory of 1580 1940 RegAsm.exe RegAsm.exe PID 1940 wrote to memory of 1580 1940 RegAsm.exe RegAsm.exe PID 1940 wrote to memory of 1580 1940 RegAsm.exe RegAsm.exe PID 1940 wrote to memory of 1580 1940 RegAsm.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\133c10454108aa86301f79a03aa24046.exe"C:\Users\Admin\AppData\Local\Temp\133c10454108aa86301f79a03aa24046.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ilsqvi.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ilsqvi.exe"'4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ilsqvi.exe"C:\Users\Admin\AppData\Local\Temp\ilsqvi.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe-a "C:\Users\Admin\AppData\Local\acfb42a5\plg\a1YihafY.json"7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe-a "C:\Users\Admin\AppData\Local\Temp\unk.xml"8⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ilsqvi.exeMD5
bdc628b212725c5fd4287591393cb44e
SHA1ae1d2f0c1480c0cbd02703d41ae76c36fc011be8
SHA25678f869f3203033c6b2d25c30d545f8bb6d701357b4d870e2707f92a68790dce9
SHA5126edca221ccc9db764a88898ca1aa7ff6c3e50c4720321ea59c811d7876749428aef9261486f7ac7b1d6c0ddefa1b6399a105449885c7d20ca591ca3645a1fadd
-
C:\Users\Admin\AppData\Local\Temp\ilsqvi.exeMD5
bdc628b212725c5fd4287591393cb44e
SHA1ae1d2f0c1480c0cbd02703d41ae76c36fc011be8
SHA25678f869f3203033c6b2d25c30d545f8bb6d701357b4d870e2707f92a68790dce9
SHA5126edca221ccc9db764a88898ca1aa7ff6c3e50c4720321ea59c811d7876749428aef9261486f7ac7b1d6c0ddefa1b6399a105449885c7d20ca591ca3645a1fadd
-
C:\Users\Admin\AppData\Local\Temp\unk.xmlMD5
67efe59fbf8aaf3e8de7d67dab21c2a7
SHA10869d3ea3b16639ed4a0803acea1c476e199b16c
SHA25663ca5c5c3cf4be4765115926225c060d89ef54d6f6fc3ec284cb3ecb398b0cb1
SHA51275f162ff2cc23dd7df018109264f157727fdecc869e3f493e4d0bed26b4429ab00fc9724a5ea420488ba1b4b102a07992357c0d3567c7acea6dd5333cd8cebbb
-
C:\Users\Admin\AppData\Local\acfb42a5\plg\a1YihafY.jsonMD5
67efe59fbf8aaf3e8de7d67dab21c2a7
SHA10869d3ea3b16639ed4a0803acea1c476e199b16c
SHA25663ca5c5c3cf4be4765115926225c060d89ef54d6f6fc3ec284cb3ecb398b0cb1
SHA51275f162ff2cc23dd7df018109264f157727fdecc869e3f493e4d0bed26b4429ab00fc9724a5ea420488ba1b4b102a07992357c0d3567c7acea6dd5333cd8cebbb
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\License.XenArmorMD5
4f3bde9212e17ef18226866d6ac739b6
SHA1732733bec8314beb81437e60876ffa75e72ae6cd
SHA256212173a405c78d70f90e8ec0699a60ed2f4a9f3a8070de62eabd666c268fb174
SHA51210b7cdae0b9a7b0f8e1bfc66a60675fa9b25c523864d5ae3da243f4e6e4c5194f3bd92af57ac956157442f66414bdd3393d0a1e5ba4ef0f192561e8524d4e744
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\License.XenArmorMD5
bf5da170f7c9a8eae88d1cb1a191ff80
SHA1dd1b991a1b03587a5d1edc94e919a2070e325610
SHA256e5d5110feb21939d82d962981aeaaafc4643b40a9b87cbed800ace82135d57cd
SHA5129e32247d8556fd6efffbf7b6b9c325652d8c4b223b0fa38020879171476a49ab1f64d8897b5d8d92b79c5484fd9d5899be26ca5f664ee1f9c2acb0857084121e
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Unknown.dllMD5
86114faba7e1ec4a667d2bcb2e23f024
SHA1670df6e1ba1dc6bece046e8b2e573dd36748245e
SHA256568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d
SHA512d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f
-
\Users\Admin\AppData\Local\Temp\ilsqvi.exeMD5
bdc628b212725c5fd4287591393cb44e
SHA1ae1d2f0c1480c0cbd02703d41ae76c36fc011be8
SHA25678f869f3203033c6b2d25c30d545f8bb6d701357b4d870e2707f92a68790dce9
SHA5126edca221ccc9db764a88898ca1aa7ff6c3e50c4720321ea59c811d7876749428aef9261486f7ac7b1d6c0ddefa1b6399a105449885c7d20ca591ca3645a1fadd
-
\Users\Admin\AppData\Local\Temp\ilsqvi.exeMD5
bdc628b212725c5fd4287591393cb44e
SHA1ae1d2f0c1480c0cbd02703d41ae76c36fc011be8
SHA25678f869f3203033c6b2d25c30d545f8bb6d701357b4d870e2707f92a68790dce9
SHA5126edca221ccc9db764a88898ca1aa7ff6c3e50c4720321ea59c811d7876749428aef9261486f7ac7b1d6c0ddefa1b6399a105449885c7d20ca591ca3645a1fadd
-
\Windows\Microsoft.NET\Framework\v4.0.30319\Unknown.dllMD5
86114faba7e1ec4a667d2bcb2e23f024
SHA1670df6e1ba1dc6bece046e8b2e573dd36748245e
SHA256568da887725ccfdc4c5aae3ff66792fe60eca4e0818338f6a8434be66a6fe46d
SHA512d26ee0da6ccd4022982cf848c46e40f6781b667e39d0c5daf5ea8d74c44e55c55a5f7590a4d2a60aa1911358ca783c4276a9b4e6311c4cea20df1ebd4f7f457f
-
memory/640-106-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/640-104-0x000000000068A488-mapping.dmp
-
memory/640-103-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/668-74-0x0000000004700000-0x0000000004701000-memory.dmpFilesize
4KB
-
memory/668-75-0x0000000002200000-0x0000000002E4A000-memory.dmpFilesize
12.3MB
-
memory/668-86-0x0000000005750000-0x0000000005751000-memory.dmpFilesize
4KB
-
memory/668-93-0x0000000006250000-0x0000000006251000-memory.dmpFilesize
4KB
-
memory/668-94-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/668-80-0x0000000005660000-0x0000000005661000-memory.dmpFilesize
4KB
-
memory/668-77-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/668-76-0x0000000002690000-0x0000000002691000-memory.dmpFilesize
4KB
-
memory/668-85-0x0000000005700000-0x0000000005701000-memory.dmpFilesize
4KB
-
memory/668-71-0x0000000000000000-mapping.dmp
-
memory/668-73-0x0000000000940000-0x0000000000941000-memory.dmpFilesize
4KB
-
memory/1580-111-0x0000000000400000-0x00000000006FE000-memory.dmpFilesize
3.0MB
-
memory/1580-112-0x00000000006FC1D0-mapping.dmp
-
memory/1580-114-0x0000000000400000-0x00000000006FE000-memory.dmpFilesize
3.0MB
-
memory/1608-69-0x0000000000830000-0x000000000084B000-memory.dmpFilesize
108KB
-
memory/1608-64-0x000000000040C68E-mapping.dmp
-
memory/1608-66-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1608-68-0x0000000001320000-0x0000000001321000-memory.dmpFilesize
4KB
-
memory/1608-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1652-62-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB
-
memory/1688-70-0x0000000000000000-mapping.dmp
-
memory/1768-98-0x0000000000000000-mapping.dmp
-
memory/1940-110-0x0000000000400000-0x00000000008DC000-memory.dmpFilesize
4.9MB
-
memory/1940-108-0x00000000008D9FE0-mapping.dmp
-
memory/1940-107-0x0000000000400000-0x00000000008DC000-memory.dmpFilesize
4.9MB