Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-09-2022 18:39
Static task
static1
Behavioral task
behavioral1
Sample
6658d1722940229f9e5b6242d842d47743a1b3a651601348de02db318018506f.exe
Resource
win10v2004-20220812-en
General
-
Target
6658d1722940229f9e5b6242d842d47743a1b3a651601348de02db318018506f.exe
-
Size
280KB
-
MD5
fff29c99cbdf93e61c1e587ba9258a08
-
SHA1
be90f599470b8c33cd0d62579f6cd4d237cd9a4a
-
SHA256
6658d1722940229f9e5b6242d842d47743a1b3a651601348de02db318018506f
-
SHA512
b05bb9ec8f9160a7628e2c62f1bebcf637ecf1f23a7a55398a22872d8a3ffe03f7f076fc28ec07759a13453256ae6f3fc0fb508fe67b20e42aca1f3081d608ea
-
SSDEEP
6144:/HXMbT0OdLqfp+kbxMenO+Znf05R81igavwVfX:/HXS0SGp+kbhHK5R8Y
Malware Config
Extracted
redline
LogsDiller Cloud (Sup: @mr_golds)
77.73.134.27:8163
-
auth_value
56c6f7b9024c076f0a96931453da7e56
Extracted
tofsee
svartalfheim.top
jotunheim.name
Signatures
-
Detects Smokeloader packer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4648-133-0x00000000004D0000-0x00000000004D9000-memory.dmp family_smokeloader behavioral1/memory/81340-200-0x0000000000DE0000-0x0000000000DE7000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/81832-143-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
7D.exe4F2.exe8CC.exeluwomrcd.exepid process 1456 7D.exe 52192 4F2.exe 81868 8CC.exe 2264 luwomrcd.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\eltnosis\ImagePath = "C:\\Windows\\SysWOW64\\eltnosis\\luwomrcd.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4F2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 4F2.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
7D.exeluwomrcd.exedescription pid process target process PID 1456 set thread context of 81832 1456 7D.exe AppLaunch.exe PID 2264 set thread context of 1320 2264 luwomrcd.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 81660 sc.exe 81740 sc.exe 81796 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
6658d1722940229f9e5b6242d842d47743a1b3a651601348de02db318018506f.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6658d1722940229f9e5b6242d842d47743a1b3a651601348de02db318018506f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6658d1722940229f9e5b6242d842d47743a1b3a651601348de02db318018506f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 6658d1722940229f9e5b6242d842d47743a1b3a651601348de02db318018506f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6658d1722940229f9e5b6242d842d47743a1b3a651601348de02db318018506f.exepid process 4648 6658d1722940229f9e5b6242d842d47743a1b3a651601348de02db318018506f.exe 4648 6658d1722940229f9e5b6242d842d47743a1b3a651601348de02db318018506f.exe 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2824 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
6658d1722940229f9e5b6242d842d47743a1b3a651601348de02db318018506f.exepid process 4648 6658d1722940229f9e5b6242d842d47743a1b3a651601348de02db318018506f.exe 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 2824 -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeShutdownPrivilege 2824 Token: SeCreatePagefilePrivilege 2824 Token: SeShutdownPrivilege 2824 Token: SeCreatePagefilePrivilege 2824 Token: SeShutdownPrivilege 2824 Token: SeCreatePagefilePrivilege 2824 Token: SeShutdownPrivilege 2824 Token: SeCreatePagefilePrivilege 2824 Token: SeShutdownPrivilege 2824 Token: SeCreatePagefilePrivilege 2824 Token: SeShutdownPrivilege 2824 Token: SeCreatePagefilePrivilege 2824 Token: SeShutdownPrivilege 2824 Token: SeCreatePagefilePrivilege 2824 Token: SeShutdownPrivilege 2824 Token: SeCreatePagefilePrivilege 2824 Token: SeShutdownPrivilege 2824 Token: SeCreatePagefilePrivilege 2824 Token: SeShutdownPrivilege 2824 Token: SeCreatePagefilePrivilege 2824 Token: SeDebugPrivilege 81832 AppLaunch.exe Token: SeShutdownPrivilege 2824 Token: SeCreatePagefilePrivilege 2824 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7D.exe4F2.exedescription pid process target process PID 2824 wrote to memory of 1456 2824 7D.exe PID 2824 wrote to memory of 1456 2824 7D.exe PID 2824 wrote to memory of 1456 2824 7D.exe PID 2824 wrote to memory of 52192 2824 4F2.exe PID 2824 wrote to memory of 52192 2824 4F2.exe PID 2824 wrote to memory of 52192 2824 4F2.exe PID 1456 wrote to memory of 81832 1456 7D.exe AppLaunch.exe PID 1456 wrote to memory of 81832 1456 7D.exe AppLaunch.exe PID 1456 wrote to memory of 81832 1456 7D.exe AppLaunch.exe PID 1456 wrote to memory of 81832 1456 7D.exe AppLaunch.exe PID 1456 wrote to memory of 81832 1456 7D.exe AppLaunch.exe PID 2824 wrote to memory of 81868 2824 8CC.exe PID 2824 wrote to memory of 81868 2824 8CC.exe PID 2824 wrote to memory of 81868 2824 8CC.exe PID 2824 wrote to memory of 81340 2824 explorer.exe PID 2824 wrote to memory of 81340 2824 explorer.exe PID 2824 wrote to memory of 81340 2824 explorer.exe PID 2824 wrote to memory of 81340 2824 explorer.exe PID 2824 wrote to memory of 81384 2824 explorer.exe PID 2824 wrote to memory of 81384 2824 explorer.exe PID 2824 wrote to memory of 81384 2824 explorer.exe PID 2824 wrote to memory of 81412 2824 explorer.exe PID 2824 wrote to memory of 81412 2824 explorer.exe PID 2824 wrote to memory of 81412 2824 explorer.exe PID 2824 wrote to memory of 81412 2824 explorer.exe PID 2824 wrote to memory of 81440 2824 explorer.exe PID 2824 wrote to memory of 81440 2824 explorer.exe PID 2824 wrote to memory of 81440 2824 explorer.exe PID 52192 wrote to memory of 81492 52192 4F2.exe cmd.exe PID 52192 wrote to memory of 81492 52192 4F2.exe cmd.exe PID 52192 wrote to memory of 81492 52192 4F2.exe cmd.exe PID 52192 wrote to memory of 81576 52192 4F2.exe cmd.exe PID 52192 wrote to memory of 81576 52192 4F2.exe cmd.exe PID 52192 wrote to memory of 81576 52192 4F2.exe cmd.exe PID 2824 wrote to memory of 81604 2824 explorer.exe PID 2824 wrote to memory of 81604 2824 explorer.exe PID 2824 wrote to memory of 81604 2824 explorer.exe PID 2824 wrote to memory of 81604 2824 explorer.exe PID 52192 wrote to memory of 81660 52192 4F2.exe sc.exe PID 52192 wrote to memory of 81660 52192 4F2.exe sc.exe PID 52192 wrote to memory of 81660 52192 4F2.exe sc.exe PID 2824 wrote to memory of 81716 2824 explorer.exe PID 2824 wrote to memory of 81716 2824 explorer.exe PID 2824 wrote to memory of 81716 2824 explorer.exe PID 2824 wrote to memory of 81716 2824 explorer.exe PID 52192 wrote to memory of 81740 52192 4F2.exe sc.exe PID 52192 wrote to memory of 81740 52192 4F2.exe sc.exe PID 52192 wrote to memory of 81740 52192 4F2.exe sc.exe PID 52192 wrote to memory of 81796 52192 4F2.exe sc.exe PID 52192 wrote to memory of 81796 52192 4F2.exe sc.exe PID 52192 wrote to memory of 81796 52192 4F2.exe sc.exe PID 2824 wrote to memory of 1144 2824 explorer.exe PID 2824 wrote to memory of 1144 2824 explorer.exe PID 2824 wrote to memory of 1144 2824 explorer.exe PID 2824 wrote to memory of 1144 2824 explorer.exe PID 52192 wrote to memory of 2812 52192 4F2.exe netsh.exe PID 52192 wrote to memory of 2812 52192 4F2.exe netsh.exe PID 52192 wrote to memory of 2812 52192 4F2.exe netsh.exe PID 2824 wrote to memory of 1296 2824 explorer.exe PID 2824 wrote to memory of 1296 2824 explorer.exe PID 2824 wrote to memory of 1296 2824 explorer.exe PID 2824 wrote to memory of 216 2824 explorer.exe PID 2824 wrote to memory of 216 2824 explorer.exe PID 2824 wrote to memory of 216 2824 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6658d1722940229f9e5b6242d842d47743a1b3a651601348de02db318018506f.exe"C:\Users\Admin\AppData\Local\Temp\6658d1722940229f9e5b6242d842d47743a1b3a651601348de02db318018506f.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\7D.exeC:\Users\Admin\AppData\Local\Temp\7D.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\4F2.exeC:\Users\Admin\AppData\Local\Temp\4F2.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\eltnosis\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\luwomrcd.exe" C:\Windows\SysWOW64\eltnosis\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create eltnosis binPath= "C:\Windows\SysWOW64\eltnosis\luwomrcd.exe /d\"C:\Users\Admin\AppData\Local\Temp\4F2.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description eltnosis "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start eltnosis2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Local\Temp\8CC.exeC:\Users\Admin\AppData\Local\Temp\8CC.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\eltnosis\luwomrcd.exeC:\Windows\SysWOW64\eltnosis\luwomrcd.exe /d"C:\Users\Admin\AppData\Local\Temp\4F2.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4F2.exeFilesize
280KB
MD59b178828fcd48828da65bb6e1b8a5255
SHA1e5256245c1ece1f0d62b6c0b26f0537d296a64ae
SHA256e9c02698fef6793fda4947b08333052bf142e43377ae6b0b74acd1ab15a59af3
SHA5126ce9e7f8633d96a2db9a7041c27610b8392706b2ae68d5c69a6634607a2a0c1810c6a1268e4a9e8ebe6f18739a77b38adb377b46fd2b52374e5b99dfbf8033dc
-
C:\Users\Admin\AppData\Local\Temp\4F2.exeFilesize
280KB
MD59b178828fcd48828da65bb6e1b8a5255
SHA1e5256245c1ece1f0d62b6c0b26f0537d296a64ae
SHA256e9c02698fef6793fda4947b08333052bf142e43377ae6b0b74acd1ab15a59af3
SHA5126ce9e7f8633d96a2db9a7041c27610b8392706b2ae68d5c69a6634607a2a0c1810c6a1268e4a9e8ebe6f18739a77b38adb377b46fd2b52374e5b99dfbf8033dc
-
C:\Users\Admin\AppData\Local\Temp\7D.exeFilesize
2.6MB
MD5d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8
SHA1ed7413773b7c9154c9aeed9d173f61577522e0db
SHA256576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983
SHA512858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5
-
C:\Users\Admin\AppData\Local\Temp\7D.exeFilesize
2.6MB
MD5d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8
SHA1ed7413773b7c9154c9aeed9d173f61577522e0db
SHA256576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983
SHA512858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5
-
C:\Users\Admin\AppData\Local\Temp\8CC.exeFilesize
395KB
MD5a864c7dcd49506486eb4a15632a34c03
SHA16f247530bd632cb53cdc0b7a8c466e2144c16d84
SHA256dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf
SHA51271ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72
-
C:\Users\Admin\AppData\Local\Temp\8CC.exeFilesize
395KB
MD5a864c7dcd49506486eb4a15632a34c03
SHA16f247530bd632cb53cdc0b7a8c466e2144c16d84
SHA256dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf
SHA51271ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72
-
C:\Users\Admin\AppData\Local\Temp\luwomrcd.exeFilesize
13.8MB
MD51e40525966c72ceb5744598698b79c2b
SHA1cc8574f9ab6a788001a620ad3c557ca7fc83d3ce
SHA25604516a01af40152fcbb914914c8bd631aa1ca924ab185d046e49dfe7782110d7
SHA512df0c997ad2e3620bc82f67236a4a9a63093e34248e52edeb27912632c6f8ad863f6c6a91af3826a5d987258a00b1a44d366ac7c0ba9a92c2ad7db8dbf2aaf98c
-
C:\Windows\SysWOW64\eltnosis\luwomrcd.exeFilesize
13.8MB
MD51e40525966c72ceb5744598698b79c2b
SHA1cc8574f9ab6a788001a620ad3c557ca7fc83d3ce
SHA25604516a01af40152fcbb914914c8bd631aa1ca924ab185d046e49dfe7782110d7
SHA512df0c997ad2e3620bc82f67236a4a9a63093e34248e52edeb27912632c6f8ad863f6c6a91af3826a5d987258a00b1a44d366ac7c0ba9a92c2ad7db8dbf2aaf98c
-
memory/216-198-0x0000000000D20000-0x0000000000D2B000-memory.dmpFilesize
44KB
-
memory/216-195-0x0000000000000000-mapping.dmp
-
memory/216-217-0x0000000000D30000-0x0000000000D38000-memory.dmpFilesize
32KB
-
memory/216-199-0x0000000000D30000-0x0000000000D38000-memory.dmpFilesize
32KB
-
memory/1144-182-0x0000000000000000-mapping.dmp
-
memory/1144-191-0x0000000000850000-0x000000000085B000-memory.dmpFilesize
44KB
-
memory/1144-189-0x0000000000860000-0x0000000000866000-memory.dmpFilesize
24KB
-
memory/1144-215-0x0000000000860000-0x0000000000866000-memory.dmpFilesize
24KB
-
memory/1296-192-0x0000000000000000-mapping.dmp
-
memory/1296-216-0x00000000009D0000-0x00000000009D7000-memory.dmpFilesize
28KB
-
memory/1296-196-0x00000000009D0000-0x00000000009D7000-memory.dmpFilesize
28KB
-
memory/1296-197-0x00000000009C0000-0x00000000009CD000-memory.dmpFilesize
52KB
-
memory/1320-201-0x0000000000000000-mapping.dmp
-
memory/1320-208-0x0000000000E10000-0x0000000000E25000-memory.dmpFilesize
84KB
-
memory/1320-202-0x0000000000E10000-0x0000000000E25000-memory.dmpFilesize
84KB
-
memory/1320-218-0x0000000000E10000-0x0000000000E25000-memory.dmpFilesize
84KB
-
memory/1456-136-0x0000000000000000-mapping.dmp
-
memory/2264-203-0x0000000000519000-0x000000000052A000-memory.dmpFilesize
68KB
-
memory/2264-205-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/2812-183-0x0000000000000000-mapping.dmp
-
memory/4648-132-0x000000000053E000-0x000000000054E000-memory.dmpFilesize
64KB
-
memory/4648-134-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/4648-135-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/4648-133-0x00000000004D0000-0x00000000004D9000-memory.dmpFilesize
36KB
-
memory/52192-139-0x0000000000000000-mapping.dmp
-
memory/52192-168-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/52192-185-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/52192-184-0x000000000052F000-0x0000000000540000-memory.dmpFilesize
68KB
-
memory/52192-167-0x00000000004D0000-0x00000000004E3000-memory.dmpFilesize
76KB
-
memory/52192-166-0x000000000052F000-0x0000000000540000-memory.dmpFilesize
68KB
-
memory/81340-156-0x0000000000DE0000-0x0000000000DE7000-memory.dmpFilesize
28KB
-
memory/81340-153-0x0000000000000000-mapping.dmp
-
memory/81340-157-0x0000000000DD0000-0x0000000000DDB000-memory.dmpFilesize
44KB
-
memory/81340-200-0x0000000000DE0000-0x0000000000DE7000-memory.dmpFilesize
28KB
-
memory/81384-159-0x0000000000530000-0x0000000000539000-memory.dmpFilesize
36KB
-
memory/81384-207-0x0000000000530000-0x0000000000539000-memory.dmpFilesize
36KB
-
memory/81384-158-0x0000000000000000-mapping.dmp
-
memory/81384-160-0x0000000000520000-0x000000000052F000-memory.dmpFilesize
60KB
-
memory/81412-163-0x0000000001230000-0x0000000001239000-memory.dmpFilesize
36KB
-
memory/81412-209-0x0000000001240000-0x0000000001245000-memory.dmpFilesize
20KB
-
memory/81412-161-0x0000000000000000-mapping.dmp
-
memory/81412-162-0x0000000001240000-0x0000000001245000-memory.dmpFilesize
20KB
-
memory/81440-212-0x0000000000FF0000-0x0000000000FF6000-memory.dmpFilesize
24KB
-
memory/81440-169-0x0000000000FF0000-0x0000000000FF6000-memory.dmpFilesize
24KB
-
memory/81440-164-0x0000000000000000-mapping.dmp
-
memory/81440-170-0x0000000000FE0000-0x0000000000FEC000-memory.dmpFilesize
48KB
-
memory/81492-165-0x0000000000000000-mapping.dmp
-
memory/81576-171-0x0000000000000000-mapping.dmp
-
memory/81604-176-0x0000000000800000-0x0000000000827000-memory.dmpFilesize
156KB
-
memory/81604-172-0x0000000000000000-mapping.dmp
-
memory/81604-175-0x0000000000830000-0x0000000000852000-memory.dmpFilesize
136KB
-
memory/81604-213-0x0000000000830000-0x0000000000852000-memory.dmpFilesize
136KB
-
memory/81660-174-0x0000000000000000-mapping.dmp
-
memory/81716-177-0x0000000000000000-mapping.dmp
-
memory/81716-181-0x0000000000D30000-0x0000000000D39000-memory.dmpFilesize
36KB
-
memory/81716-180-0x0000000000D40000-0x0000000000D45000-memory.dmpFilesize
20KB
-
memory/81716-214-0x0000000000D40000-0x0000000000D45000-memory.dmpFilesize
20KB
-
memory/81740-178-0x0000000000000000-mapping.dmp
-
memory/81796-179-0x0000000000000000-mapping.dmp
-
memory/81832-211-0x0000000006C70000-0x0000000006CC0000-memory.dmpFilesize
320KB
-
memory/81832-154-0x0000000004DC0000-0x0000000004DD2000-memory.dmpFilesize
72KB
-
memory/81832-155-0x0000000004E20000-0x0000000004E5C000-memory.dmpFilesize
240KB
-
memory/81832-194-0x0000000006D70000-0x000000000729C000-memory.dmpFilesize
5.2MB
-
memory/81832-193-0x0000000006670000-0x0000000006832000-memory.dmpFilesize
1.8MB
-
memory/81832-210-0x0000000006BF0000-0x0000000006C66000-memory.dmpFilesize
472KB
-
memory/81832-152-0x0000000004E90000-0x0000000004F9A000-memory.dmpFilesize
1.0MB
-
memory/81832-190-0x0000000005260000-0x00000000052C6000-memory.dmpFilesize
408KB
-
memory/81832-151-0x0000000005320000-0x0000000005938000-memory.dmpFilesize
6.1MB
-
memory/81832-187-0x0000000005EF0000-0x0000000006494000-memory.dmpFilesize
5.6MB
-
memory/81832-188-0x00000000051C0000-0x0000000005252000-memory.dmpFilesize
584KB
-
memory/81832-143-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/81832-142-0x0000000000000000-mapping.dmp
-
memory/81868-148-0x0000000000000000-mapping.dmp