Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
21-06-2022 13:31
Static task
static1
General
-
Target
a3fc095ba7646c29164dff3962fc4914d05d0ef5faa0a2f365cf6b089b3948bc.exe
-
Size
282KB
-
MD5
7101a0aa574c3151f4420ff88a6e62f3
-
SHA1
d5e0d9d5d50f8acb9fb37bbc2f83064b446fd9d6
-
SHA256
a3fc095ba7646c29164dff3962fc4914d05d0ef5faa0a2f365cf6b089b3948bc
-
SHA512
688a7a8b85af2e21ee768abbb26d48e0f395a89f9bbcf14477bd9956b94adea3f2a0b9f36dad83a017d990b9766fa23ff54906a862d3f1cc6c11f4c998b9620b
Malware Config
Extracted
vidar
52.6
1415
https://t.me/tg_dailylessons
https://busshi.moe/@olegf9844xx
-
profile_id
1415
Extracted
redline
USAeuTEST
193.106.191.246:23196
-
auth_value
7dbf5ba6d421c1b0e8ce8d5867af4537
Extracted
redline
mario2
193.106.191.129:80
-
auth_value
4ef7e3fec3a418b2f0233b604d0560d9
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/192-677-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
suricata: ET MALWARE Vidar/Arkei/Megumin Stealer Keywords Retrieved
-
suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
suricata: ET MALWARE W32/Agent.OGR!tr.pws Stealer
-
Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral1/memory/3792-275-0x00000000007D0000-0x000000000081B000-memory.dmp family_vidar behavioral1/memory/3792-276-0x0000000000400000-0x000000000067D000-memory.dmp family_vidar behavioral1/memory/3792-508-0x0000000000400000-0x000000000067D000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
25E7.exe31BF.exe4817.exe25E7.exepid process 768 25E7.exe 3792 31BF.exe 1780 4817.exe 848 25E7.exe -
Deletes itself 1 IoCs
Processes:
pid process 3068 -
Loads dropped DLL 2 IoCs
Processes:
31BF.exepid process 3792 31BF.exe 3792 31BF.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
25E7.exe4817.exedescription pid process target process PID 768 set thread context of 848 768 25E7.exe 25E7.exe PID 1780 set thread context of 192 1780 4817.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
a3fc095ba7646c29164dff3962fc4914d05d0ef5faa0a2f365cf6b089b3948bc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a3fc095ba7646c29164dff3962fc4914d05d0ef5faa0a2f365cf6b089b3948bc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a3fc095ba7646c29164dff3962fc4914d05d0ef5faa0a2f365cf6b089b3948bc.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a3fc095ba7646c29164dff3962fc4914d05d0ef5faa0a2f365cf6b089b3948bc.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
31BF.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 31BF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 31BF.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3280 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a3fc095ba7646c29164dff3962fc4914d05d0ef5faa0a2f365cf6b089b3948bc.exepid process 3488 a3fc095ba7646c29164dff3962fc4914d05d0ef5faa0a2f365cf6b089b3948bc.exe 3488 a3fc095ba7646c29164dff3962fc4914d05d0ef5faa0a2f365cf6b089b3948bc.exe 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3068 -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
a3fc095ba7646c29164dff3962fc4914d05d0ef5faa0a2f365cf6b089b3948bc.exepid process 3488 a3fc095ba7646c29164dff3962fc4914d05d0ef5faa0a2f365cf6b089b3948bc.exe 3068 3068 3068 3068 -
Suspicious use of AdjustPrivilegeToken 38 IoCs
Processes:
powershell.exe25E7.exe25E7.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1144 powershell.exe Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeDebugPrivilege 768 25E7.exe Token: SeDebugPrivilege 848 25E7.exe Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeDebugPrivilege 192 InstallUtil.exe Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
25E7.execmd.exe4817.exedescription pid process target process PID 3068 wrote to memory of 768 3068 25E7.exe PID 3068 wrote to memory of 768 3068 25E7.exe PID 3068 wrote to memory of 768 3068 25E7.exe PID 3068 wrote to memory of 3792 3068 31BF.exe PID 3068 wrote to memory of 3792 3068 31BF.exe PID 3068 wrote to memory of 3792 3068 31BF.exe PID 768 wrote to memory of 1144 768 25E7.exe powershell.exe PID 768 wrote to memory of 1144 768 25E7.exe powershell.exe PID 768 wrote to memory of 1144 768 25E7.exe powershell.exe PID 3068 wrote to memory of 1780 3068 4817.exe PID 3068 wrote to memory of 1780 3068 4817.exe PID 3068 wrote to memory of 1780 3068 4817.exe PID 3068 wrote to memory of 1332 3068 explorer.exe PID 3068 wrote to memory of 1332 3068 explorer.exe PID 3068 wrote to memory of 1332 3068 explorer.exe PID 3068 wrote to memory of 1332 3068 explorer.exe PID 3068 wrote to memory of 3156 3068 explorer.exe PID 3068 wrote to memory of 3156 3068 explorer.exe PID 3068 wrote to memory of 3156 3068 explorer.exe PID 768 wrote to memory of 3136 768 25E7.exe cmd.exe PID 768 wrote to memory of 3136 768 25E7.exe cmd.exe PID 768 wrote to memory of 3136 768 25E7.exe cmd.exe PID 3136 wrote to memory of 3280 3136 cmd.exe timeout.exe PID 3136 wrote to memory of 3280 3136 cmd.exe timeout.exe PID 3136 wrote to memory of 3280 3136 cmd.exe timeout.exe PID 1780 wrote to memory of 2604 1780 4817.exe InstallUtil.exe PID 1780 wrote to memory of 2604 1780 4817.exe InstallUtil.exe PID 1780 wrote to memory of 2604 1780 4817.exe InstallUtil.exe PID 768 wrote to memory of 848 768 25E7.exe 25E7.exe PID 768 wrote to memory of 848 768 25E7.exe 25E7.exe PID 768 wrote to memory of 848 768 25E7.exe 25E7.exe PID 768 wrote to memory of 848 768 25E7.exe 25E7.exe PID 768 wrote to memory of 848 768 25E7.exe 25E7.exe PID 768 wrote to memory of 848 768 25E7.exe 25E7.exe PID 768 wrote to memory of 848 768 25E7.exe 25E7.exe PID 768 wrote to memory of 848 768 25E7.exe 25E7.exe PID 1780 wrote to memory of 192 1780 4817.exe InstallUtil.exe PID 1780 wrote to memory of 192 1780 4817.exe InstallUtil.exe PID 1780 wrote to memory of 192 1780 4817.exe InstallUtil.exe PID 1780 wrote to memory of 192 1780 4817.exe InstallUtil.exe PID 1780 wrote to memory of 192 1780 4817.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3fc095ba7646c29164dff3962fc4914d05d0ef5faa0a2f365cf6b089b3948bc.exe"C:\Users\Admin\AppData\Local\Temp\a3fc095ba7646c29164dff3962fc4914d05d0ef5faa0a2f365cf6b089b3948bc.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\25E7.exeC:\Users\Admin\AppData\Local\Temp\25E7.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 10;Start-Sleep -Seconds 10;2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 152⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 153⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\25E7.exeC:\Users\Admin\AppData\Local\Temp\25E7.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\31BF.exeC:\Users\Admin\AppData\Local\Temp\31BF.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\4817.exeC:\Users\Admin\AppData\Local\Temp\4817.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\25E7.exe.logFilesize
710B
MD50f7e8ddf64c503df6ef2a2e21db58272
SHA1f5ee233b786f93605cdd9f91ac4a68d8d9334bf9
SHA2567102e134d51a9dbad02c448087baaaa3336c5571626177158c967f788d1a2e14
SHA51279821afbf2d9a5104a810e3fcead177cda6934029b08691563b882616a2564e015cc662e376787aba29833e89602d4de0143bcefa4c097551a0604cc47b60455
-
C:\Users\Admin\AppData\Local\Temp\25E7.exeFilesize
857KB
MD5e05e8f5d45e55c5d238f3b112b077ca1
SHA1466203c2d920723eaa3cca76939ad37fd42320b5
SHA25660d613e0e98945c023b210635a37142933823d9a06c16ab55676ea6051a93c30
SHA512abdfeb3b886dd424029a129b36cf76826f795e37496dc215b6eb451b7837c9bd03641757f9784f151a31b50d35b8e656e4de3b362eb097f0882a58e8ea27b980
-
C:\Users\Admin\AppData\Local\Temp\25E7.exeFilesize
857KB
MD5e05e8f5d45e55c5d238f3b112b077ca1
SHA1466203c2d920723eaa3cca76939ad37fd42320b5
SHA25660d613e0e98945c023b210635a37142933823d9a06c16ab55676ea6051a93c30
SHA512abdfeb3b886dd424029a129b36cf76826f795e37496dc215b6eb451b7837c9bd03641757f9784f151a31b50d35b8e656e4de3b362eb097f0882a58e8ea27b980
-
C:\Users\Admin\AppData\Local\Temp\25E7.exeFilesize
857KB
MD5e05e8f5d45e55c5d238f3b112b077ca1
SHA1466203c2d920723eaa3cca76939ad37fd42320b5
SHA25660d613e0e98945c023b210635a37142933823d9a06c16ab55676ea6051a93c30
SHA512abdfeb3b886dd424029a129b36cf76826f795e37496dc215b6eb451b7837c9bd03641757f9784f151a31b50d35b8e656e4de3b362eb097f0882a58e8ea27b980
-
C:\Users\Admin\AppData\Local\Temp\31BF.exeFilesize
387KB
MD57232e9decef4097791ea75d1eb91bf4e
SHA1509b0bf958aa1e4f55957c7bf76095ecfc8fe16a
SHA2566f6dd67166668f9495e3d0ac6a431f63f45c9d931ddd65a8400a7aeb71f7fac4
SHA51288e006c359b948a96c74cac13a90708c3494c6a4d07609a65fe4232f94e4e7a4a6feddffb3232f4b89ffac0ef20125c8eac7e4a3fc80a89ee8bffff4d5dffbb8
-
C:\Users\Admin\AppData\Local\Temp\31BF.exeFilesize
387KB
MD57232e9decef4097791ea75d1eb91bf4e
SHA1509b0bf958aa1e4f55957c7bf76095ecfc8fe16a
SHA2566f6dd67166668f9495e3d0ac6a431f63f45c9d931ddd65a8400a7aeb71f7fac4
SHA51288e006c359b948a96c74cac13a90708c3494c6a4d07609a65fe4232f94e4e7a4a6feddffb3232f4b89ffac0ef20125c8eac7e4a3fc80a89ee8bffff4d5dffbb8
-
C:\Users\Admin\AppData\Local\Temp\4817.exeFilesize
1.6MB
MD5df9cc49add3e01f23c63b0f73469f752
SHA16f8199ae9280e13671f5eb5715b093cd93f6732e
SHA256b18d30fdfaa2f3469131da279fe2a64ed3cf6c1cbc8785ea1ba6e7596ae85419
SHA51209100b76b4d0ba5a417da4a68977ed0a9eba8563cc5866e0cf912234ebded7598c482967e1812c143868c43c49eb882f82588dfafc041698b814c564decfc9b5
-
C:\Users\Admin\AppData\Local\Temp\4817.exeFilesize
1.6MB
MD5df9cc49add3e01f23c63b0f73469f752
SHA16f8199ae9280e13671f5eb5715b093cd93f6732e
SHA256b18d30fdfaa2f3469131da279fe2a64ed3cf6c1cbc8785ea1ba6e7596ae85419
SHA51209100b76b4d0ba5a417da4a68977ed0a9eba8563cc5866e0cf912234ebded7598c482967e1812c143868c43c49eb882f82588dfafc041698b814c564decfc9b5
-
\ProgramData\mozglue.dllFilesize
133KB
MD58f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
\ProgramData\nss3.dllFilesize
1.2MB
MD5bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
memory/192-720-0x0000000004F70000-0x0000000004FBB000-memory.dmpFilesize
300KB
-
memory/192-677-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/192-784-0x0000000006FF0000-0x0000000007040000-memory.dmpFilesize
320KB
-
memory/768-157-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-182-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-212-0x0000000004F30000-0x0000000004FF2000-memory.dmpFilesize
776KB
-
memory/768-597-0x00000000053A0000-0x0000000005432000-memory.dmpFilesize
584KB
-
memory/768-191-0x00000000005E0000-0x00000000006BC000-memory.dmpFilesize
880KB
-
memory/768-187-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-519-0x0000000005220000-0x000000000526C000-memory.dmpFilesize
304KB
-
memory/768-517-0x0000000004FF0000-0x00000000050B2000-memory.dmpFilesize
776KB
-
memory/768-186-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-185-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-184-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-183-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-181-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-180-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-179-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-178-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-177-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-176-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-175-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-174-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-172-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-173-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-171-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-170-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-154-0x0000000000000000-mapping.dmp
-
memory/768-169-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-156-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-168-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-158-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-159-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-160-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-161-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-162-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-166-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-163-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-165-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/768-167-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/848-741-0x0000000007B00000-0x000000000802C000-memory.dmpFilesize
5.2MB
-
memory/848-698-0x0000000005810000-0x0000000005822000-memory.dmpFilesize
72KB
-
memory/848-727-0x00000000068F0000-0x0000000006DEE000-memory.dmpFilesize
5.0MB
-
memory/848-599-0x000000000041814E-mapping.dmp
-
memory/848-731-0x0000000005DA0000-0x0000000005DBE000-memory.dmpFilesize
120KB
-
memory/848-740-0x0000000007400000-0x00000000075C2000-memory.dmpFilesize
1.8MB
-
memory/848-707-0x0000000005870000-0x00000000058AE000-memory.dmpFilesize
248KB
-
memory/848-659-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/848-700-0x0000000005940000-0x0000000005A4A000-memory.dmpFilesize
1.0MB
-
memory/848-696-0x0000000005DE0000-0x00000000063E6000-memory.dmpFilesize
6.0MB
-
memory/1144-219-0x0000000000000000-mapping.dmp
-
memory/1144-319-0x0000000007F50000-0x0000000007F6C000-memory.dmpFilesize
112KB
-
memory/1144-301-0x0000000007F70000-0x0000000007FD6000-memory.dmpFilesize
408KB
-
memory/1144-300-0x0000000007DB0000-0x0000000007E16000-memory.dmpFilesize
408KB
-
memory/1144-361-0x0000000009FC0000-0x000000000A638000-memory.dmpFilesize
6.5MB
-
memory/1144-362-0x0000000009570000-0x000000000958A000-memory.dmpFilesize
104KB
-
memory/1144-331-0x00000000087E0000-0x0000000008856000-memory.dmpFilesize
472KB
-
memory/1144-291-0x00000000075B0000-0x00000000075D2000-memory.dmpFilesize
136KB
-
memory/1144-307-0x00000000080E0000-0x0000000008430000-memory.dmpFilesize
3.3MB
-
memory/1144-274-0x0000000007710000-0x0000000007D38000-memory.dmpFilesize
6.2MB
-
memory/1144-269-0x0000000004C60000-0x0000000004C96000-memory.dmpFilesize
216KB
-
memory/1144-321-0x0000000008480000-0x00000000084CB000-memory.dmpFilesize
300KB
-
memory/1332-408-0x0000000000000000-mapping.dmp
-
memory/1332-510-0x00000000010A0000-0x000000000110B000-memory.dmpFilesize
428KB
-
memory/1332-494-0x00000000010A0000-0x000000000110B000-memory.dmpFilesize
428KB
-
memory/1332-493-0x0000000001110000-0x0000000001184000-memory.dmpFilesize
464KB
-
memory/1780-595-0x000000000E860000-0x000000000E9A5000-memory.dmpFilesize
1.3MB
-
memory/1780-509-0x00000000033F0000-0x000000000354E000-memory.dmpFilesize
1.4MB
-
memory/1780-512-0x00000000033F0000-0x000000000354E000-memory.dmpFilesize
1.4MB
-
memory/1780-492-0x0000000002FE0000-0x00000000033E9000-memory.dmpFilesize
4.0MB
-
memory/1780-363-0x0000000000000000-mapping.dmp
-
memory/1780-511-0x0000000002FE0000-0x00000000033E9000-memory.dmpFilesize
4.0MB
-
memory/3136-536-0x0000000000000000-mapping.dmp
-
memory/3156-443-0x0000000000000000-mapping.dmp
-
memory/3156-448-0x00000000003D0000-0x00000000003D7000-memory.dmpFilesize
28KB
-
memory/3156-451-0x00000000003C0000-0x00000000003CC000-memory.dmpFilesize
48KB
-
memory/3280-542-0x0000000000000000-mapping.dmp
-
memory/3488-137-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-127-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-151-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-136-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-149-0x0000000000400000-0x0000000000B3A000-memory.dmpFilesize
7.2MB
-
memory/3488-135-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-147-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-131-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-145-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-116-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-153-0x0000000000400000-0x0000000000B3A000-memory.dmpFilesize
7.2MB
-
memory/3488-117-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-144-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-143-0x0000000000B40000-0x0000000000BEE000-memory.dmpFilesize
696KB
-
memory/3488-142-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-118-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-141-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-140-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-139-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-119-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-150-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-146-0x0000000000B40000-0x0000000000BEE000-memory.dmpFilesize
696KB
-
memory/3488-148-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-120-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-134-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-133-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-132-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-130-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-129-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-128-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-126-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-152-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-125-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-124-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-123-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-122-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3488-121-0x0000000077CD0000-0x0000000077E5E000-memory.dmpFilesize
1.6MB
-
memory/3792-275-0x00000000007D0000-0x000000000081B000-memory.dmpFilesize
300KB
-
memory/3792-276-0x0000000000400000-0x000000000067D000-memory.dmpFilesize
2.5MB
-
memory/3792-508-0x0000000000400000-0x000000000067D000-memory.dmpFilesize
2.5MB
-
memory/3792-199-0x0000000000000000-mapping.dmp