Overview
overview
10Static
static
2bbea59df3...7e.exe
windows7-x64
102bbea59df3...7e.exe
windows10-1703-x64
102bbea59df3...7e.exe
windows10-2004-x64
102bbea59df3...7e.exe
windows11-21h2-x64
2bbea59df3...7e.exe
android-10-x64
2bbea59df3...7e.exe
android-11-x64
2bbea59df3...7e.exe
android-9-x86
2bbea59df3...7e.exe
macos-10.15-amd64
12bbea59df3...7e.exe
debian-9-armhf
2bbea59df3...7e.exe
debian-9-mips
2bbea59df3...7e.exe
debian-9-mipsel
2bbea59df3...7e.exe
ubuntu-18.04-amd64
Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
19-08-2022 03:47
Static task
static1
Behavioral task
behavioral1
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win10-20220812-en
Behavioral task
behavioral3
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral4
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
win11-20220223-en
Behavioral task
behavioral5
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
android-x64-20220621-en
Behavioral task
behavioral6
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
android-x64-arm64-20220621-en
Behavioral task
behavioral7
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
android-x86-arm-20220621-en
Behavioral task
behavioral8
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
macos-20220504-en
Behavioral task
behavioral9
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral10
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral11
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral12
Sample
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe
-
Size
2.2MB
-
MD5
b5f1a37cbd6c8a4690942fd254270ce1
-
SHA1
e31e9c0d978a340445572bbb4b07fd2d5f9cb6ec
-
SHA256
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e
-
SHA512
6a7a39a9511d3bbe42a90d0a8c6a7e97d6427b8d68fc303b1b6dc2c3737ba7c875ccf44683ca792aab92daba43ffea32da93066acb64005f2e7532ce011b6996
Malware Config
Extracted
asyncrat
0.5.7B
Default
76.8.53.133:62520
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
dwwm.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe asyncrat behavioral2/memory/3876-307-0x0000000000EB0000-0x0000000000EC2000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\dwwm.exe asyncrat C:\Users\Admin\AppData\Roaming\dwwm.exe asyncrat -
Executes dropped EXE 2 IoCs
Processes:
Kxtwaidanpqpiuhprlehfsshclientip.exedwwm.exepid process 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe 2592 dwwm.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exeInstallUtil.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\Keahz = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tbsztbbv\\Keahz.exe\"" 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\DBqQu = "C:\\Users\\Admin\\AppData\\Roaming\\DBqQu\\DBqQu.exe" InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exedescription pid process target process PID 2716 set thread context of 4304 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 400 timeout.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
powershell.exe2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exeInstallUtil.exeKxtwaidanpqpiuhprlehfsshclientip.exepid process 4040 powershell.exe 4040 powershell.exe 4040 powershell.exe 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe 4304 InstallUtil.exe 4304 InstallUtil.exe 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exepowershell.exeInstallUtil.exeKxtwaidanpqpiuhprlehfsshclientip.exedwwm.exedescription pid process Token: SeDebugPrivilege 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Token: SeDebugPrivilege 4040 powershell.exe Token: SeDebugPrivilege 4304 InstallUtil.exe Token: SeDebugPrivilege 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe Token: SeDebugPrivilege 2592 dwwm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 4304 InstallUtil.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exeKxtwaidanpqpiuhprlehfsshclientip.execmd.execmd.exedescription pid process target process PID 2716 wrote to memory of 4040 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe powershell.exe PID 2716 wrote to memory of 4040 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe powershell.exe PID 2716 wrote to memory of 4040 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe powershell.exe PID 2716 wrote to memory of 3876 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Kxtwaidanpqpiuhprlehfsshclientip.exe PID 2716 wrote to memory of 3876 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Kxtwaidanpqpiuhprlehfsshclientip.exe PID 2716 wrote to memory of 3876 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe Kxtwaidanpqpiuhprlehfsshclientip.exe PID 2716 wrote to memory of 3144 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 2716 wrote to memory of 3144 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 2716 wrote to memory of 3144 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 2716 wrote to memory of 3164 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 2716 wrote to memory of 3164 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 2716 wrote to memory of 3164 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 2716 wrote to memory of 4304 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 2716 wrote to memory of 4304 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 2716 wrote to memory of 4304 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 2716 wrote to memory of 4304 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 2716 wrote to memory of 4304 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 2716 wrote to memory of 4304 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 2716 wrote to memory of 4304 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 2716 wrote to memory of 4304 2716 2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe InstallUtil.exe PID 3876 wrote to memory of 4680 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 3876 wrote to memory of 4680 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 3876 wrote to memory of 4680 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 3876 wrote to memory of 4528 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 3876 wrote to memory of 4528 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 3876 wrote to memory of 4528 3876 Kxtwaidanpqpiuhprlehfsshclientip.exe cmd.exe PID 4680 wrote to memory of 1192 4680 cmd.exe schtasks.exe PID 4680 wrote to memory of 1192 4680 cmd.exe schtasks.exe PID 4680 wrote to memory of 1192 4680 cmd.exe schtasks.exe PID 4528 wrote to memory of 400 4528 cmd.exe timeout.exe PID 4528 wrote to memory of 400 4528 cmd.exe timeout.exe PID 4528 wrote to memory of 400 4528 cmd.exe timeout.exe PID 4528 wrote to memory of 2592 4528 cmd.exe dwwm.exe PID 4528 wrote to memory of 2592 4528 cmd.exe dwwm.exe PID 4528 wrote to memory of 2592 4528 cmd.exe dwwm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe"C:\Users\Admin\AppData\Local\Temp\2bbea59df3d821b3be653542b95a261bec805a7dacbdd117beaef7b3c8586a7e.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe"C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dwwm" /tr '"C:\Users\Admin\AppData\Roaming\dwwm.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "dwwm" /tr '"C:\Users\Admin\AppData\Roaming\dwwm.exe"'4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF61.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\dwwm.exe"C:\Users\Admin\AppData\Roaming\dwwm.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
C:\Users\Admin\AppData\Local\Temp\Kxtwaidanpqpiuhprlehfsshclientip.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
C:\Users\Admin\AppData\Local\Temp\tmpF61.tmp.batFilesize
147B
MD5bf754ab39a1932ff589fd23895e29ea2
SHA19c62536f9e267ad0ff95be761bf5a7c19fcfc17c
SHA256dd838b802b235186f1089e80ecceeea3e28c95869dbf49dbca2ce303b4a2e97b
SHA5123043ca688b9aaa2315cdabcfe3dc2479824e3b4533c63cd3a952b3d07d74af959fe6cbb4f7795a84c48581f4a6a6c1837a45ab7bb7d49012d82e2f26ec7f2d1e
-
C:\Users\Admin\AppData\Roaming\dwwm.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
C:\Users\Admin\AppData\Roaming\dwwm.exeFilesize
45KB
MD509483dc605208384bf243df58a997193
SHA1a0498cb4b34e5e0236304fc406c4e82e767ceb0e
SHA256fcc37d35f86fb13150c8b3277382a76bfab0e22d7159f6addf86d302def260df
SHA512767742ef725ae1e20556918a19c1d0607542b3a62a4ec5eb1859e20b6a5986185c4501c6f234500cad177330f6facb2ff351ea612c29d279c3c4d40fbf435b28
-
memory/400-405-0x0000000000000000-mapping.dmp
-
memory/1192-391-0x0000000000000000-mapping.dmp
-
memory/2592-466-0x0000000000000000-mapping.dmp
-
memory/2716-162-0x0000000005B40000-0x0000000005B84000-memory.dmpFilesize
272KB
-
memory/2716-145-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-124-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-125-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-166-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-127-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-128-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-129-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-130-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-131-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-132-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-168-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-134-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-135-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-136-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-137-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-138-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-139-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-140-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-141-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-142-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-143-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-144-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-167-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-146-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-147-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-148-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-149-0x0000000000F10000-0x0000000001144000-memory.dmpFilesize
2.2MB
-
memory/2716-150-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-151-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-152-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-153-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-154-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-155-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-156-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-157-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-158-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-159-0x00000000058C0000-0x0000000005AA6000-memory.dmpFilesize
1.9MB
-
memory/2716-160-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-161-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-122-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-163-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-164-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-165-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-126-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-123-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-133-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-169-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-170-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-171-0x0000000005BE0000-0x0000000005C02000-memory.dmpFilesize
136KB
-
memory/2716-172-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-173-0x0000000005E10000-0x0000000006160000-memory.dmpFilesize
3.3MB
-
memory/2716-174-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-175-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-176-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-177-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-178-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-179-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-180-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-181-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-182-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-183-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-184-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-116-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-117-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-118-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-119-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-120-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2716-121-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/3876-365-0x00000000059F0000-0x0000000005A8C000-memory.dmpFilesize
624KB
-
memory/3876-272-0x0000000000000000-mapping.dmp
-
memory/3876-307-0x0000000000EB0000-0x0000000000EC2000-memory.dmpFilesize
72KB
-
memory/4040-247-0x0000000007B00000-0x0000000007B66000-memory.dmpFilesize
408KB
-
memory/4040-251-0x0000000007F10000-0x0000000007F5B000-memory.dmpFilesize
300KB
-
memory/4040-266-0x00000000098F0000-0x0000000009F68000-memory.dmpFilesize
6.5MB
-
memory/4040-267-0x0000000009010000-0x000000000902A000-memory.dmpFilesize
104KB
-
memory/4040-250-0x0000000007AD0000-0x0000000007AEC000-memory.dmpFilesize
112KB
-
memory/4040-255-0x0000000008290000-0x0000000008306000-memory.dmpFilesize
472KB
-
memory/4040-186-0x0000000000000000-mapping.dmp
-
memory/4040-246-0x0000000007830000-0x0000000007896000-memory.dmpFilesize
408KB
-
memory/4040-222-0x00000000046F0000-0x0000000004726000-memory.dmpFilesize
216KB
-
memory/4040-227-0x00000000071F0000-0x0000000007818000-memory.dmpFilesize
6.2MB
-
memory/4304-310-0x000000000047F6AE-mapping.dmp
-
memory/4304-524-0x0000000000CE0000-0x0000000000CEA000-memory.dmpFilesize
40KB
-
memory/4304-462-0x0000000004FE0000-0x0000000004FF8000-memory.dmpFilesize
96KB
-
memory/4304-345-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/4304-522-0x0000000005EF0000-0x0000000005F82000-memory.dmpFilesize
584KB
-
memory/4304-349-0x00000000052A0000-0x000000000579E000-memory.dmpFilesize
5.0MB
-
memory/4528-379-0x0000000000000000-mapping.dmp
-
memory/4680-377-0x0000000000000000-mapping.dmp