Analysis
-
max time kernel
152s -
max time network
168s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
20-10-2021 03:51
Static task
static1
Behavioral task
behavioral1
Sample
B3A5EDD96F0E9D42DA79564D4F9B8764CC52D07896A843F03FDC34C7CC23F338.exe
Resource
win7-en-20210920
General
-
Target
B3A5EDD96F0E9D42DA79564D4F9B8764CC52D07896A843F03FDC34C7CC23F338.exe
-
Size
46.0MB
-
MD5
0821c3d4dee7db77d2b4fe56f242143f
-
SHA1
5238e22879987f3ed2d524eb147d1859f184957b
-
SHA256
b3a5edd96f0e9d42da79564d4f9b8764cc52d07896a843f03fdc34c7cc23f338
-
SHA512
567035148517e9feffe094e1bccb5a8d2561051249a81cb5cbc250440c5e42a079fb6dd896853794168e49cd1fead9e1067930367bd572dfc6f56a9ec7fb5ad6
Malware Config
Extracted
asyncrat
0.5.7B
Default
pettbull.ddns.net:6606
pettbull.ddns.net:7707
pettbull.ddns.net:8808
AsyncMutex_6SI8OkPnk
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Extracted
quasar
1.4.0
PRO21
pettbull.ddns.net:4782
23e7ca58-8298-4c9f-b276-3466dcf2cfc0
-
encryption_key
DAE9E02E5E04D59D9AF2AA1D5E82248D5919AC6A
-
install_name
Windows Update.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Microsoft Windows
-
subdirectory
System32
Signatures
-
Quasar Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3796-194-0x0000000000400000-0x0000000000484000-memory.dmp family_quasar behavioral2/memory/3796-195-0x000000000047E7CE-mapping.dmp family_quasar -
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
suricata: ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
-
suricata: ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/932-147-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/932-148-0x000000000040C73E-mapping.dmp asyncrat -
Executes dropped EXE 6 IoCs
Processes:
svchost.exesvchost.exeHost.exeHost.exeepm_setup.exeepm_setup.tmppid process 1184 svchost.exe 932 svchost.exe 1288 Host.exe 3796 Host.exe 2892 epm_setup.exe 3264 epm_setup.tmp -
Drops startup file 3 IoCs
Processes:
PowerShell.exePowerShell.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exe PowerShell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exe PowerShell.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exe PowerShell.exe -
Loads dropped DLL 1 IoCs
Processes:
epm_setup.tmppid process 3264 epm_setup.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 29 api.ipify.org 30 api.ipify.org -
Suspicious use of SetThreadContext 2 IoCs
Processes:
svchost.exeHost.exedescription pid process target process PID 1184 set thread context of 932 1184 svchost.exe svchost.exe PID 1288 set thread context of 3796 1288 Host.exe Host.exe -
Drops file in Program Files directory 3 IoCs
Processes:
B3A5EDD96F0E9D42DA79564D4F9B8764CC52D07896A843F03FDC34C7CC23F338.exedescription ioc process File opened for modification C:\Program Files (x86)\EaseUS\EaseUS Partition Master Trial Edition\epm_setup.exe B3A5EDD96F0E9D42DA79564D4F9B8764CC52D07896A843F03FDC34C7CC23F338.exe File opened for modification C:\Program Files (x86)\EaseUS\EaseUS Partition Master Trial Edition\Uninstall.exe B3A5EDD96F0E9D42DA79564D4F9B8764CC52D07896A843F03FDC34C7CC23F338.exe File created C:\Program Files (x86)\EaseUS\EaseUS Partition Master Trial Edition\Uninstall.ini B3A5EDD96F0E9D42DA79564D4F9B8764CC52D07896A843F03FDC34C7CC23F338.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
PowerShell.exePowerShell.exepid process 432 PowerShell.exe 432 PowerShell.exe 432 PowerShell.exe 1532 PowerShell.exe 1532 PowerShell.exe 1532 PowerShell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
PowerShell.exesvchost.exePowerShell.exesvchost.exeHost.exeHost.exedescription pid process Token: SeDebugPrivilege 432 PowerShell.exe Token: SeDebugPrivilege 1184 svchost.exe Token: SeDebugPrivilege 1532 PowerShell.exe Token: SeDebugPrivilege 932 svchost.exe Token: SeDebugPrivilege 1288 Host.exe Token: SeDebugPrivilege 3796 Host.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
epm_setup.exeepm_setup.tmpHost.exepid process 2892 epm_setup.exe 3264 epm_setup.tmp 3796 Host.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
B3A5EDD96F0E9D42DA79564D4F9B8764CC52D07896A843F03FDC34C7CC23F338.exesvchost.exeHost.exeepm_setup.exedescription pid process target process PID 1780 wrote to memory of 1184 1780 B3A5EDD96F0E9D42DA79564D4F9B8764CC52D07896A843F03FDC34C7CC23F338.exe svchost.exe PID 1780 wrote to memory of 1184 1780 B3A5EDD96F0E9D42DA79564D4F9B8764CC52D07896A843F03FDC34C7CC23F338.exe svchost.exe PID 1780 wrote to memory of 1184 1780 B3A5EDD96F0E9D42DA79564D4F9B8764CC52D07896A843F03FDC34C7CC23F338.exe svchost.exe PID 1184 wrote to memory of 432 1184 svchost.exe PowerShell.exe PID 1184 wrote to memory of 432 1184 svchost.exe PowerShell.exe PID 1184 wrote to memory of 432 1184 svchost.exe PowerShell.exe PID 1184 wrote to memory of 932 1184 svchost.exe svchost.exe PID 1184 wrote to memory of 932 1184 svchost.exe svchost.exe PID 1184 wrote to memory of 932 1184 svchost.exe svchost.exe PID 1184 wrote to memory of 932 1184 svchost.exe svchost.exe PID 1184 wrote to memory of 932 1184 svchost.exe svchost.exe PID 1184 wrote to memory of 932 1184 svchost.exe svchost.exe PID 1184 wrote to memory of 932 1184 svchost.exe svchost.exe PID 1184 wrote to memory of 932 1184 svchost.exe svchost.exe PID 1780 wrote to memory of 1288 1780 B3A5EDD96F0E9D42DA79564D4F9B8764CC52D07896A843F03FDC34C7CC23F338.exe Host.exe PID 1780 wrote to memory of 1288 1780 B3A5EDD96F0E9D42DA79564D4F9B8764CC52D07896A843F03FDC34C7CC23F338.exe Host.exe PID 1780 wrote to memory of 1288 1780 B3A5EDD96F0E9D42DA79564D4F9B8764CC52D07896A843F03FDC34C7CC23F338.exe Host.exe PID 1288 wrote to memory of 1532 1288 Host.exe PowerShell.exe PID 1288 wrote to memory of 1532 1288 Host.exe PowerShell.exe PID 1288 wrote to memory of 1532 1288 Host.exe PowerShell.exe PID 1288 wrote to memory of 3796 1288 Host.exe Host.exe PID 1288 wrote to memory of 3796 1288 Host.exe Host.exe PID 1288 wrote to memory of 3796 1288 Host.exe Host.exe PID 1288 wrote to memory of 3796 1288 Host.exe Host.exe PID 1288 wrote to memory of 3796 1288 Host.exe Host.exe PID 1288 wrote to memory of 3796 1288 Host.exe Host.exe PID 1288 wrote to memory of 3796 1288 Host.exe Host.exe PID 1288 wrote to memory of 3796 1288 Host.exe Host.exe PID 1780 wrote to memory of 2892 1780 B3A5EDD96F0E9D42DA79564D4F9B8764CC52D07896A843F03FDC34C7CC23F338.exe epm_setup.exe PID 1780 wrote to memory of 2892 1780 B3A5EDD96F0E9D42DA79564D4F9B8764CC52D07896A843F03FDC34C7CC23F338.exe epm_setup.exe PID 1780 wrote to memory of 2892 1780 B3A5EDD96F0E9D42DA79564D4F9B8764CC52D07896A843F03FDC34C7CC23F338.exe epm_setup.exe PID 2892 wrote to memory of 3264 2892 epm_setup.exe epm_setup.tmp PID 2892 wrote to memory of 3264 2892 epm_setup.exe epm_setup.tmp PID 2892 wrote to memory of 3264 2892 epm_setup.exe epm_setup.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\B3A5EDD96F0E9D42DA79564D4F9B8764CC52D07896A843F03FDC34C7CC23F338.exe"C:\Users\Admin\AppData\Local\Temp\B3A5EDD96F0E9D42DA79564D4F9B8764CC52D07896A843F03FDC34C7CC23F338.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe"PowerShell" copy-item 'C:\Users\Admin\AppData\Roaming\svchost.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exe'3⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Host.exe"C:\Users\Admin\AppData\Roaming\Host.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe"PowerShell" copy-item 'C:\Users\Admin\AppData\Roaming\Host.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exe'3⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Host.exe"C:\Users\Admin\AppData\Roaming\Host.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\EaseUS\EaseUS Partition Master Trial Edition\epm_setup.exe"C:\Program Files (x86)\EaseUS\EaseUS Partition Master Trial Edition\epm_setup.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-UO5TG.tmp\epm_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-UO5TG.tmp\epm_setup.tmp" /SL5="$601F0,46887390,159744,C:\Program Files (x86)\EaseUS\EaseUS Partition Master Trial Edition\epm_setup.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\EaseUS\EaseUS Partition Master Trial Edition\epm_setup.exeMD5
2600cb19f2494e25c6e4bc928dd72d44
SHA1909254fdb5bd7f5065fdf1b269c0afae7a0e9ea6
SHA256a4d07928e3408fdc51b54f24b6aa47cd7fc6e47f16478d419512c136bf496b3e
SHA51260f56a2eba22d21ae7b4dcd40804b38266cb383aed6ca4a71c324b6c0cbba9f854ce1ff6c677d3ff0294747b4cc1c18b9656a484e31cb528f1e5d0c4c5ea6e47
-
C:\Program Files (x86)\EaseUS\EaseUS Partition Master Trial Edition\epm_setup.exeMD5
2600cb19f2494e25c6e4bc928dd72d44
SHA1909254fdb5bd7f5065fdf1b269c0afae7a0e9ea6
SHA256a4d07928e3408fdc51b54f24b6aa47cd7fc6e47f16478d419512c136bf496b3e
SHA51260f56a2eba22d21ae7b4dcd40804b38266cb383aed6ca4a71c324b6c0cbba9f854ce1ff6c677d3ff0294747b4cc1c18b9656a484e31cb528f1e5d0c4c5ea6e47
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Host.exe.logMD5
31f89a37dd1c6602132edf73d8fd1cb3
SHA18599db27f10e8b4201efbfebd42d3f3890a4b0b1
SHA25632165692323f0947ef81fea90865ed18e79ab0ec185ace6647ce15731de3f40e
SHA51209bce426d25500895ea274f054609cf6606deece3170911d0c875dd6ca0c3e61cebb02b32bda7ed07258a806f72e72c23d08a10ddcf36b1011742d4248362112
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PowerShell.exe.logMD5
6bf0e5945fb9da68e1b03bdaed5f6f8d
SHA1eed3802c8e4abe3b327c100c99c53d3bbcf8a33d
SHA256dda58fd16fee83a65c05936b1a070187f2c360024650ecaf857c5e060a6a55f1
SHA512977a393fdad2b162aa42194ddad6ec8bcab24f81980ff01b1c22c4d59ac268bb5ce947105c968de1a8a66b35023280a1e7709dfea5053385f87141389ebecb25
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svchost.exe.logMD5
31f89a37dd1c6602132edf73d8fd1cb3
SHA18599db27f10e8b4201efbfebd42d3f3890a4b0b1
SHA25632165692323f0947ef81fea90865ed18e79ab0ec185ace6647ce15731de3f40e
SHA51209bce426d25500895ea274f054609cf6606deece3170911d0c875dd6ca0c3e61cebb02b32bda7ed07258a806f72e72c23d08a10ddcf36b1011742d4248362112
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
1ceec1ee7828ffd80fa21b156ddc5db5
SHA1fbf53aebbd117c7cf51380b149f3e9b119635d7a
SHA256938a68a14187b60cb317ed6c1ce7ff374c5516889d72cbd007b78c966436d615
SHA512995c23781fab3d124b7f8b08650a17e787913feaea2085362a1573847f57fac68759e6d4221d0e8d04b9960587b9ab01917e0f7fdd4fcfdc2ff74a283d26479f
-
C:\Users\Admin\AppData\Local\Temp\is-UO5TG.tmp\epm_setup.tmpMD5
5c89dfa61730475598227eb55d61346a
SHA1ace61af8fbfb290e636871f4b8566dfa3d000e36
SHA256c75e56e754bbcdd7b27aca038ce2b0628708381bf83262b184e9fecb7d0b1307
SHA512be12398aa2d6b770c5fbeb99c8f9ee396a50f0e0539466af7e520885505c1bcf7f0ef75e0d297df20a6f9958cf76662b2930d70420d916974cd8644b6140409e
-
C:\Users\Admin\AppData\Local\Temp\is-UO5TG.tmp\epm_setup.tmpMD5
5c89dfa61730475598227eb55d61346a
SHA1ace61af8fbfb290e636871f4b8566dfa3d000e36
SHA256c75e56e754bbcdd7b27aca038ce2b0628708381bf83262b184e9fecb7d0b1307
SHA512be12398aa2d6b770c5fbeb99c8f9ee396a50f0e0539466af7e520885505c1bcf7f0ef75e0d297df20a6f9958cf76662b2930d70420d916974cd8644b6140409e
-
C:\Users\Admin\AppData\Roaming\Host.exeMD5
82d476c05f94eb8fad06b57f4899823e
SHA12739b763058cd8aae8efd0ff4e9cfa51b4c2c750
SHA256abb9f1457f48fb9219e3b5b3360ec892828db320230b24e21b87cdbc9be99658
SHA5129856a5b9bc6e0fa7562efd4de0ed0e0c11157ac4391d663fc15f13ebc1d2c9988a42c69c41ef1858697806f05a1f93754cf580213d14bb3b4e287fb08985b75f
-
C:\Users\Admin\AppData\Roaming\Host.exeMD5
82d476c05f94eb8fad06b57f4899823e
SHA12739b763058cd8aae8efd0ff4e9cfa51b4c2c750
SHA256abb9f1457f48fb9219e3b5b3360ec892828db320230b24e21b87cdbc9be99658
SHA5129856a5b9bc6e0fa7562efd4de0ed0e0c11157ac4391d663fc15f13ebc1d2c9988a42c69c41ef1858697806f05a1f93754cf580213d14bb3b4e287fb08985b75f
-
C:\Users\Admin\AppData\Roaming\Host.exeMD5
82d476c05f94eb8fad06b57f4899823e
SHA12739b763058cd8aae8efd0ff4e9cfa51b4c2c750
SHA256abb9f1457f48fb9219e3b5b3360ec892828db320230b24e21b87cdbc9be99658
SHA5129856a5b9bc6e0fa7562efd4de0ed0e0c11157ac4391d663fc15f13ebc1d2c9988a42c69c41ef1858697806f05a1f93754cf580213d14bb3b4e287fb08985b75f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exeMD5
82d476c05f94eb8fad06b57f4899823e
SHA12739b763058cd8aae8efd0ff4e9cfa51b4c2c750
SHA256abb9f1457f48fb9219e3b5b3360ec892828db320230b24e21b87cdbc9be99658
SHA5129856a5b9bc6e0fa7562efd4de0ed0e0c11157ac4391d663fc15f13ebc1d2c9988a42c69c41ef1858697806f05a1f93754cf580213d14bb3b4e287fb08985b75f
-
C:\Users\Admin\AppData\Roaming\svchost.exeMD5
38039e921eb17d1806f8f87bc318ad99
SHA19d407a9625317a56f8b777c1da4dec9c2f7e4e34
SHA256d27759d0225a1e39557bb7a460b9fdae16f6126adabbc06e4ab27ece6b84a437
SHA512ece169f7cc92a2d42b460a7c8cc30d1979a3acbdd02278c02a2a79f72ec478ce89b1191a859fd21409e9d68d2e000178a7375f9305b74695c2a874062079bbd3
-
C:\Users\Admin\AppData\Roaming\svchost.exeMD5
38039e921eb17d1806f8f87bc318ad99
SHA19d407a9625317a56f8b777c1da4dec9c2f7e4e34
SHA256d27759d0225a1e39557bb7a460b9fdae16f6126adabbc06e4ab27ece6b84a437
SHA512ece169f7cc92a2d42b460a7c8cc30d1979a3acbdd02278c02a2a79f72ec478ce89b1191a859fd21409e9d68d2e000178a7375f9305b74695c2a874062079bbd3
-
C:\Users\Admin\AppData\Roaming\svchost.exeMD5
38039e921eb17d1806f8f87bc318ad99
SHA19d407a9625317a56f8b777c1da4dec9c2f7e4e34
SHA256d27759d0225a1e39557bb7a460b9fdae16f6126adabbc06e4ab27ece6b84a437
SHA512ece169f7cc92a2d42b460a7c8cc30d1979a3acbdd02278c02a2a79f72ec478ce89b1191a859fd21409e9d68d2e000178a7375f9305b74695c2a874062079bbd3
-
\Users\Admin\AppData\Local\Temp\is-NFV9S.tmp\EuActiveOnline.dllMD5
08832f527ddc56fdfddb06e5b936e8ba
SHA15fc51d2d5e1e1d9460e1926cad5a540233b08993
SHA256602ea813c7aae972ce0643429a1bdcfa5a9807eac0188b11a54936a30f32edb6
SHA5129f9c748288e8eda9bd18c07551cf34c4f34240ab4cc1c46fac6449798325c97d6b466b76c317477d2c8b76701cf194e201beb15e938057d888eb2487e0092762
-
memory/432-132-0x0000000000F02000-0x0000000000F03000-memory.dmpFilesize
4KB
-
memory/432-129-0x00000000074F0000-0x00000000074F1000-memory.dmpFilesize
4KB
-
memory/432-134-0x0000000007EA0000-0x0000000007EA1000-memory.dmpFilesize
4KB
-
memory/432-135-0x0000000007D30000-0x0000000007D31000-memory.dmpFilesize
4KB
-
memory/432-136-0x0000000000C70000-0x0000000000C71000-memory.dmpFilesize
4KB
-
memory/432-140-0x0000000008AE0000-0x0000000008AE1000-memory.dmpFilesize
4KB
-
memory/432-141-0x0000000008A40000-0x0000000008A41000-memory.dmpFilesize
4KB
-
memory/432-142-0x0000000008A90000-0x0000000008A91000-memory.dmpFilesize
4KB
-
memory/432-144-0x0000000000C70000-0x0000000000C71000-memory.dmpFilesize
4KB
-
memory/432-145-0x0000000000F03000-0x0000000000F04000-memory.dmpFilesize
4KB
-
memory/432-124-0x0000000000C70000-0x0000000000C71000-memory.dmpFilesize
4KB
-
memory/432-123-0x0000000000C70000-0x0000000000C71000-memory.dmpFilesize
4KB
-
memory/432-122-0x0000000000000000-mapping.dmp
-
memory/432-126-0x0000000006D70000-0x0000000006D71000-memory.dmpFilesize
4KB
-
memory/432-127-0x0000000006BA0000-0x0000000006BA1000-memory.dmpFilesize
4KB
-
memory/432-131-0x0000000000F00000-0x0000000000F01000-memory.dmpFilesize
4KB
-
memory/432-130-0x0000000007660000-0x0000000007661000-memory.dmpFilesize
4KB
-
memory/432-125-0x0000000000DE0000-0x0000000000DE1000-memory.dmpFilesize
4KB
-
memory/432-133-0x0000000007470000-0x0000000007471000-memory.dmpFilesize
4KB
-
memory/432-128-0x00000000073A0000-0x00000000073A1000-memory.dmpFilesize
4KB
-
memory/932-148-0x000000000040C73E-mapping.dmp
-
memory/932-189-0x0000000005601000-0x0000000005602000-memory.dmpFilesize
4KB
-
memory/932-147-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1184-169-0x0000000002BF0000-0x0000000002BF1000-memory.dmpFilesize
4KB
-
memory/1184-120-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/1184-115-0x0000000000000000-mapping.dmp
-
memory/1184-164-0x0000000005400000-0x00000000058FE000-memory.dmpFilesize
5.0MB
-
memory/1184-121-0x0000000005900000-0x0000000005901000-memory.dmpFilesize
4KB
-
memory/1184-118-0x0000000000540000-0x0000000000541000-memory.dmpFilesize
4KB
-
memory/1184-146-0x0000000002AA0000-0x0000000002AB5000-memory.dmpFilesize
84KB
-
memory/1288-156-0x0000000000600000-0x0000000000601000-memory.dmpFilesize
4KB
-
memory/1288-209-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/1288-151-0x0000000000000000-mapping.dmp
-
memory/1288-208-0x0000000005050000-0x000000000554E000-memory.dmpFilesize
5.0MB
-
memory/1532-166-0x0000000004540000-0x0000000004541000-memory.dmpFilesize
4KB
-
memory/1532-168-0x0000000004542000-0x0000000004543000-memory.dmpFilesize
4KB
-
memory/1532-160-0x0000000000000000-mapping.dmp
-
memory/1532-162-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB
-
memory/1532-163-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB
-
memory/1532-188-0x0000000004543000-0x0000000004544000-memory.dmpFilesize
4KB
-
memory/1532-187-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB
-
memory/1532-178-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB
-
memory/2892-213-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2892-201-0x0000000000000000-mapping.dmp
-
memory/3264-207-0x0000000000000000-mapping.dmp
-
memory/3264-215-0x0000000002060000-0x0000000002061000-memory.dmpFilesize
4KB
-
memory/3796-195-0x000000000047E7CE-mapping.dmp
-
memory/3796-202-0x00000000056D0000-0x00000000056D1000-memory.dmpFilesize
4KB
-
memory/3796-212-0x0000000005660000-0x0000000005661000-memory.dmpFilesize
4KB
-
memory/3796-214-0x0000000005560000-0x0000000005A5E000-memory.dmpFilesize
5.0MB
-
memory/3796-194-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB