Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2022 17:50
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
328KB
-
MD5
36ac3d35c3212460c0679498503ba018
-
SHA1
3ba4f67dc6fa65d912677ff18bf0055d11f7a8e4
-
SHA256
cb0be07b155bc7c48557981e7c66ccdc103669b9c6b349e717e4576fa1f5f7e1
-
SHA512
2712dff536e6af8b780c247caa56c3ba99cbc5875eca4983ee046fd468ffad7481d747564829bcd365cebfdd5d160a9979435fd5256ffc8e8411a4aa4e02a54e
-
SSDEEP
6144:3r4yalazywdjd4js2J0tN3cnigabwVfs:3r4tazvd+QP3ciB
Malware Config
Extracted
danabot
198.15.112.179:443
185.62.56.245:443
153.92.223.225:443
192.119.70.159:443
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Extracted
systembc
141.98.82.229:4001
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3404-133-0x0000000000A30000-0x0000000000A39000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 110 2108 rundll32.exe 111 2108 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
6234.exeCE0F.exe26E.execaal.exepid process 4592 6234.exe 3180 CE0F.exe 4460 26E.exe 4956 caal.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
Processes:
26E.exedescription ioc process File created C:\Windows\Tasks\caal.job 26E.exe File opened for modification C:\Windows\Tasks\caal.job 26E.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4356 3180 WerFault.exe CE0F.exe 232 4592 WerFault.exe 6234.exe -
Checks SCSI registry key(s) 3 TTPs 39 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
svchost.exefile.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 3404 file.exe 3404 file.exe 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3068 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
file.exepid process 3404 file.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
svchost.exeCE0F.exedescription pid process Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 4536 svchost.exe Token: SeShutdownPrivilege 4536 svchost.exe Token: SeCreatePagefilePrivilege 4536 svchost.exe Token: SeDebugPrivilege 3180 CE0F.exe Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
6234.exedescription pid process target process PID 3068 wrote to memory of 4592 3068 6234.exe PID 3068 wrote to memory of 4592 3068 6234.exe PID 3068 wrote to memory of 4592 3068 6234.exe PID 4592 wrote to memory of 884 4592 6234.exe agentactivationruntimestarter.exe PID 4592 wrote to memory of 884 4592 6234.exe agentactivationruntimestarter.exe PID 4592 wrote to memory of 884 4592 6234.exe agentactivationruntimestarter.exe PID 3068 wrote to memory of 3180 3068 CE0F.exe PID 3068 wrote to memory of 3180 3068 CE0F.exe PID 3068 wrote to memory of 3180 3068 CE0F.exe PID 3068 wrote to memory of 4460 3068 26E.exe PID 3068 wrote to memory of 4460 3068 26E.exe PID 3068 wrote to memory of 4460 3068 26E.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe PID 4592 wrote to memory of 2108 4592 6234.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\6234.exeC:\Users\Admin\AppData\Local\Temp\6234.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 6322⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x398 0x4201⤵
-
C:\Users\Admin\AppData\Local\Temp\CE0F.exeC:\Users\Admin\AppData\Local\Temp\CE0F.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 13122⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\26E.exeC:\Users\Admin\AppData\Local\Temp\26E.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3180 -ip 31801⤵
-
C:\ProgramData\duohh\caal.exeC:\ProgramData\duohh\caal.exe start1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4592 -ip 45921⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\duohh\caal.exeFilesize
329KB
MD55a97df322aaa1061de7186b345a03a85
SHA11aa1df1b086e92c4d29435de5ec20897e531f862
SHA256ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9
SHA51222e36053ff0a2866295dda8be6bbaf912c55f882d54aab98e1b17712ceaa860f8f5ad8a1458fb89a3465c09cbbea37123d9d4cb6b09239f981debba866b08e13
-
C:\ProgramData\duohh\caal.exeFilesize
329KB
MD55a97df322aaa1061de7186b345a03a85
SHA11aa1df1b086e92c4d29435de5ec20897e531f862
SHA256ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9
SHA51222e36053ff0a2866295dda8be6bbaf912c55f882d54aab98e1b17712ceaa860f8f5ad8a1458fb89a3465c09cbbea37123d9d4cb6b09239f981debba866b08e13
-
C:\Users\Admin\AppData\Local\Temp\26E.exeFilesize
329KB
MD55a97df322aaa1061de7186b345a03a85
SHA11aa1df1b086e92c4d29435de5ec20897e531f862
SHA256ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9
SHA51222e36053ff0a2866295dda8be6bbaf912c55f882d54aab98e1b17712ceaa860f8f5ad8a1458fb89a3465c09cbbea37123d9d4cb6b09239f981debba866b08e13
-
C:\Users\Admin\AppData\Local\Temp\26E.exeFilesize
329KB
MD55a97df322aaa1061de7186b345a03a85
SHA11aa1df1b086e92c4d29435de5ec20897e531f862
SHA256ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9
SHA51222e36053ff0a2866295dda8be6bbaf912c55f882d54aab98e1b17712ceaa860f8f5ad8a1458fb89a3465c09cbbea37123d9d4cb6b09239f981debba866b08e13
-
C:\Users\Admin\AppData\Local\Temp\6234.exeFilesize
1.4MB
MD5cd577e77f56624510a124d667f7eb17e
SHA125c020ab8d6d36796ada2f93ec2edf0518217e90
SHA256e38852e0bb031d6f2f7cdd5abb49981d283edbf819d012d3644c1e1ad37705e7
SHA512852d6f8aa0e9b1d006b4a1b030f2752b5bcb57f3e1f65be2137dd9b2f01fbe0fc6cbed3cacedb8c2f9c1177697967e4815f6f3c370a58885fbcfe9026c3bc5d4
-
C:\Users\Admin\AppData\Local\Temp\6234.exeFilesize
1.4MB
MD5cd577e77f56624510a124d667f7eb17e
SHA125c020ab8d6d36796ada2f93ec2edf0518217e90
SHA256e38852e0bb031d6f2f7cdd5abb49981d283edbf819d012d3644c1e1ad37705e7
SHA512852d6f8aa0e9b1d006b4a1b030f2752b5bcb57f3e1f65be2137dd9b2f01fbe0fc6cbed3cacedb8c2f9c1177697967e4815f6f3c370a58885fbcfe9026c3bc5d4
-
C:\Users\Admin\AppData\Local\Temp\CE0F.exeFilesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
C:\Users\Admin\AppData\Local\Temp\CE0F.exeFilesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
memory/884-163-0x0000000000000000-mapping.dmp
-
memory/2108-202-0x0000000000000000-mapping.dmp
-
memory/3068-148-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/3068-153-0x00000000023F0000-0x0000000002400000-memory.dmpFilesize
64KB
-
memory/3068-144-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/3068-145-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/3068-146-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/3068-147-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/3068-142-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/3068-149-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/3068-150-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/3068-151-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/3068-152-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/3068-143-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/3068-154-0x00000000028B0000-0x00000000028C0000-memory.dmpFilesize
64KB
-
memory/3068-155-0x00000000028B0000-0x00000000028C0000-memory.dmpFilesize
64KB
-
memory/3068-156-0x00000000028B0000-0x00000000028C0000-memory.dmpFilesize
64KB
-
memory/3068-140-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/3068-141-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/3068-139-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/3068-160-0x00000000028B0000-0x00000000028C0000-memory.dmpFilesize
64KB
-
memory/3068-162-0x00000000028B0000-0x00000000028C0000-memory.dmpFilesize
64KB
-
memory/3068-161-0x00000000028B0000-0x00000000028C0000-memory.dmpFilesize
64KB
-
memory/3068-138-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/3068-137-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/3068-136-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/3180-168-0x0000000000000000-mapping.dmp
-
memory/3180-185-0x00000000069E0000-0x00000000069FE000-memory.dmpFilesize
120KB
-
memory/3180-191-0x0000000000400000-0x00000000005A5000-memory.dmpFilesize
1.6MB
-
memory/3180-190-0x0000000000748000-0x0000000000772000-memory.dmpFilesize
168KB
-
memory/3180-186-0x0000000000748000-0x0000000000772000-memory.dmpFilesize
168KB
-
memory/3180-172-0x0000000004DC0000-0x0000000005364000-memory.dmpFilesize
5.6MB
-
memory/3180-171-0x0000000000748000-0x0000000000772000-memory.dmpFilesize
168KB
-
memory/3180-173-0x00000000020D0000-0x0000000002107000-memory.dmpFilesize
220KB
-
memory/3180-174-0x0000000000400000-0x00000000005A5000-memory.dmpFilesize
1.6MB
-
memory/3180-175-0x0000000005370000-0x0000000005988000-memory.dmpFilesize
6.1MB
-
memory/3180-176-0x0000000004D60000-0x0000000004D72000-memory.dmpFilesize
72KB
-
memory/3180-177-0x0000000005990000-0x0000000005A9A000-memory.dmpFilesize
1.0MB
-
memory/3180-178-0x0000000005AA0000-0x0000000005ADC000-memory.dmpFilesize
240KB
-
memory/3180-179-0x0000000005DA0000-0x0000000005E06000-memory.dmpFilesize
408KB
-
memory/3180-180-0x0000000006460000-0x00000000064F2000-memory.dmpFilesize
584KB
-
memory/3180-181-0x0000000007400000-0x0000000007450000-memory.dmpFilesize
320KB
-
memory/3180-182-0x0000000007450000-0x00000000074C6000-memory.dmpFilesize
472KB
-
memory/3180-183-0x00000000075D0000-0x0000000007792000-memory.dmpFilesize
1.8MB
-
memory/3180-184-0x00000000077A0000-0x0000000007CCC000-memory.dmpFilesize
5.2MB
-
memory/3404-132-0x00000000004EF000-0x00000000004FF000-memory.dmpFilesize
64KB
-
memory/3404-133-0x0000000000A30000-0x0000000000A39000-memory.dmpFilesize
36KB
-
memory/3404-134-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/3404-135-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/4460-193-0x00000000005E0000-0x00000000005E9000-memory.dmpFilesize
36KB
-
memory/4460-194-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/4460-187-0x0000000000000000-mapping.dmp
-
memory/4460-192-0x00000000007EF000-0x0000000000800000-memory.dmpFilesize
68KB
-
memory/4460-195-0x00000000007EF000-0x0000000000800000-memory.dmpFilesize
68KB
-
memory/4592-164-0x00000000022D6000-0x00000000023FC000-memory.dmpFilesize
1.1MB
-
memory/4592-167-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/4592-166-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/4592-157-0x0000000000000000-mapping.dmp
-
memory/4592-200-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/4592-201-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/4592-165-0x0000000002500000-0x00000000027DB000-memory.dmpFilesize
2.9MB
-
memory/4592-203-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/4956-198-0x00000000005CA000-0x00000000005DA000-memory.dmpFilesize
64KB
-
memory/4956-199-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB