Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
26-09-2022 03:39
Static task
static1
Behavioral task
behavioral1
Sample
3ba84d2ab55a688aa11e96a1928b6e93aff1edcfc70ee2191c5bba731e5f3522.exe
Resource
win10-20220812-en
General
-
Target
3ba84d2ab55a688aa11e96a1928b6e93aff1edcfc70ee2191c5bba731e5f3522.exe
-
Size
170KB
-
MD5
d269585b3cb183070936730eeedeb198
-
SHA1
87a84ffc2202d9eb2bf06d9a351255477177cd73
-
SHA256
3ba84d2ab55a688aa11e96a1928b6e93aff1edcfc70ee2191c5bba731e5f3522
-
SHA512
8e304dbbe73367529248a45a39b4c3097d8d6d9b3769609b456c6d8aac21c8d814472e122ccba66fc3827192f359b5bd9b8ed2f24f56dc5ca4840bb75cf95d63
-
SSDEEP
3072:o2C7YNGmoir35Hshv5Rogat9nVCBYUXH2YlqL5x:dAssxogapY1
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @mr_golds)
77.73.134.27:7161
-
auth_value
4b2de03af6b6ac513ac597c2e6c1ad51
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2252-142-0x00000000001E0000-0x00000000001E9000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/102236-226-0x000000000042217E-mapping.dmp family_redline behavioral1/memory/102236-262-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
5F66.exe6B1F.exe6D62.exe80FA.exe85BE.exepid process 4624 5F66.exe 65012 6B1F.exe 77024 6D62.exe 4832 80FA.exe 4016 85BE.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\80FA.exe upx C:\Users\Admin\AppData\Local\Temp\80FA.exe upx behavioral1/memory/4832-301-0x0000000000220000-0x00000000014C8000-memory.dmp upx behavioral1/memory/4832-749-0x0000000000220000-0x00000000014C8000-memory.dmp upx behavioral1/memory/4832-1130-0x0000000000220000-0x00000000014C8000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
pid process 2592 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
5F66.exedescription pid process target process PID 4624 set thread context of 102236 4624 5F66.exe AppLaunch.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
3ba84d2ab55a688aa11e96a1928b6e93aff1edcfc70ee2191c5bba731e5f3522.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3ba84d2ab55a688aa11e96a1928b6e93aff1edcfc70ee2191c5bba731e5f3522.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3ba84d2ab55a688aa11e96a1928b6e93aff1edcfc70ee2191c5bba731e5f3522.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3ba84d2ab55a688aa11e96a1928b6e93aff1edcfc70ee2191c5bba731e5f3522.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3ba84d2ab55a688aa11e96a1928b6e93aff1edcfc70ee2191c5bba731e5f3522.exepid process 2252 3ba84d2ab55a688aa11e96a1928b6e93aff1edcfc70ee2191c5bba731e5f3522.exe 2252 3ba84d2ab55a688aa11e96a1928b6e93aff1edcfc70ee2191c5bba731e5f3522.exe 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2592 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
3ba84d2ab55a688aa11e96a1928b6e93aff1edcfc70ee2191c5bba731e5f3522.exepid process 2252 3ba84d2ab55a688aa11e96a1928b6e93aff1edcfc70ee2191c5bba731e5f3522.exe 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 2592 -
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
85BE.exeAppLaunch.exepowershell.exedescription pid process Token: SeShutdownPrivilege 2592 Token: SeCreatePagefilePrivilege 2592 Token: SeShutdownPrivilege 2592 Token: SeCreatePagefilePrivilege 2592 Token: SeShutdownPrivilege 2592 Token: SeCreatePagefilePrivilege 2592 Token: SeShutdownPrivilege 2592 Token: SeCreatePagefilePrivilege 2592 Token: SeShutdownPrivilege 2592 Token: SeCreatePagefilePrivilege 2592 Token: SeShutdownPrivilege 2592 Token: SeCreatePagefilePrivilege 2592 Token: SeShutdownPrivilege 2592 Token: SeCreatePagefilePrivilege 2592 Token: SeShutdownPrivilege 2592 Token: SeCreatePagefilePrivilege 2592 Token: SeShutdownPrivilege 2592 Token: SeCreatePagefilePrivilege 2592 Token: SeShutdownPrivilege 2592 Token: SeCreatePagefilePrivilege 2592 Token: SeShutdownPrivilege 2592 Token: SeCreatePagefilePrivilege 2592 Token: SeShutdownPrivilege 2592 Token: SeCreatePagefilePrivilege 2592 Token: SeShutdownPrivilege 2592 Token: SeCreatePagefilePrivilege 2592 Token: SeShutdownPrivilege 2592 Token: SeCreatePagefilePrivilege 2592 Token: SeDebugPrivilege 4016 85BE.exe Token: SeDebugPrivilege 102236 AppLaunch.exe Token: SeDebugPrivilege 6984 powershell.exe Token: SeShutdownPrivilege 2592 Token: SeCreatePagefilePrivilege 2592 Token: SeShutdownPrivilege 2592 Token: SeCreatePagefilePrivilege 2592 Token: SeShutdownPrivilege 2592 Token: SeCreatePagefilePrivilege 2592 -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
5F66.exe80FA.exedescription pid process target process PID 2592 wrote to memory of 4624 2592 5F66.exe PID 2592 wrote to memory of 4624 2592 5F66.exe PID 2592 wrote to memory of 4624 2592 5F66.exe PID 2592 wrote to memory of 65012 2592 6B1F.exe PID 2592 wrote to memory of 65012 2592 6B1F.exe PID 2592 wrote to memory of 65012 2592 6B1F.exe PID 2592 wrote to memory of 77024 2592 6D62.exe PID 2592 wrote to memory of 77024 2592 6D62.exe PID 2592 wrote to memory of 77024 2592 6D62.exe PID 4624 wrote to memory of 102236 4624 5F66.exe AppLaunch.exe PID 4624 wrote to memory of 102236 4624 5F66.exe AppLaunch.exe PID 4624 wrote to memory of 102236 4624 5F66.exe AppLaunch.exe PID 4624 wrote to memory of 102236 4624 5F66.exe AppLaunch.exe PID 4624 wrote to memory of 102236 4624 5F66.exe AppLaunch.exe PID 2592 wrote to memory of 4832 2592 80FA.exe PID 2592 wrote to memory of 4832 2592 80FA.exe PID 2592 wrote to memory of 4016 2592 85BE.exe PID 2592 wrote to memory of 4016 2592 85BE.exe PID 2592 wrote to memory of 4016 2592 85BE.exe PID 2592 wrote to memory of 4220 2592 explorer.exe PID 2592 wrote to memory of 4220 2592 explorer.exe PID 2592 wrote to memory of 4220 2592 explorer.exe PID 2592 wrote to memory of 4220 2592 explorer.exe PID 2592 wrote to memory of 820 2592 explorer.exe PID 2592 wrote to memory of 820 2592 explorer.exe PID 2592 wrote to memory of 820 2592 explorer.exe PID 2592 wrote to memory of 1444 2592 explorer.exe PID 2592 wrote to memory of 1444 2592 explorer.exe PID 2592 wrote to memory of 1444 2592 explorer.exe PID 2592 wrote to memory of 1444 2592 explorer.exe PID 2592 wrote to memory of 656 2592 explorer.exe PID 2592 wrote to memory of 656 2592 explorer.exe PID 2592 wrote to memory of 656 2592 explorer.exe PID 2592 wrote to memory of 500 2592 explorer.exe PID 2592 wrote to memory of 500 2592 explorer.exe PID 2592 wrote to memory of 500 2592 explorer.exe PID 2592 wrote to memory of 500 2592 explorer.exe PID 2592 wrote to memory of 4156 2592 explorer.exe PID 2592 wrote to memory of 4156 2592 explorer.exe PID 2592 wrote to memory of 4156 2592 explorer.exe PID 2592 wrote to memory of 4156 2592 explorer.exe PID 2592 wrote to memory of 2884 2592 explorer.exe PID 2592 wrote to memory of 2884 2592 explorer.exe PID 2592 wrote to memory of 2884 2592 explorer.exe PID 2592 wrote to memory of 2884 2592 explorer.exe PID 2592 wrote to memory of 5268 2592 explorer.exe PID 2592 wrote to memory of 5268 2592 explorer.exe PID 2592 wrote to memory of 5268 2592 explorer.exe PID 2592 wrote to memory of 5504 2592 explorer.exe PID 2592 wrote to memory of 5504 2592 explorer.exe PID 2592 wrote to memory of 5504 2592 explorer.exe PID 2592 wrote to memory of 5504 2592 explorer.exe PID 4832 wrote to memory of 6984 4832 80FA.exe powershell.exe PID 4832 wrote to memory of 6984 4832 80FA.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ba84d2ab55a688aa11e96a1928b6e93aff1edcfc70ee2191c5bba731e5f3522.exe"C:\Users\Admin\AppData\Local\Temp\3ba84d2ab55a688aa11e96a1928b6e93aff1edcfc70ee2191c5bba731e5f3522.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\5F66.exeC:\Users\Admin\AppData\Local\Temp\5F66.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6B1F.exeC:\Users\Admin\AppData\Local\Temp\6B1F.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6D62.exeC:\Users\Admin\AppData\Local\Temp\6D62.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\80FA.exeC:\Users\Admin\AppData\Local\Temp\80FA.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "Get-WmiObject Win32_PortConnector"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\85BE.exeC:\Users\Admin\AppData\Local\Temp\85BE.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5F66.exeFilesize
2.6MB
MD5caa086e140d4ffbc78a1a4c91869a973
SHA18d5b4f00412169130ffba2167e502601b007b526
SHA256bd245b6180cf30b67108be0b3afad151434f065c5590a3dae5d8568146090dc8
SHA512f94286f599ae3d87e06f1df6f8794e0c7e968237dfa734e69ee68432ef45eb5b7eb3b70287815b0b9225eb5b86f2a010a8c9708e54799c7c12a0d346ec4b1ff2
-
C:\Users\Admin\AppData\Local\Temp\5F66.exeFilesize
2.6MB
MD5caa086e140d4ffbc78a1a4c91869a973
SHA18d5b4f00412169130ffba2167e502601b007b526
SHA256bd245b6180cf30b67108be0b3afad151434f065c5590a3dae5d8568146090dc8
SHA512f94286f599ae3d87e06f1df6f8794e0c7e968237dfa734e69ee68432ef45eb5b7eb3b70287815b0b9225eb5b86f2a010a8c9708e54799c7c12a0d346ec4b1ff2
-
C:\Users\Admin\AppData\Local\Temp\6B1F.exeFilesize
317KB
MD58418c188bb06f391bcae84df7abcf97e
SHA19d339dc7b2605a48996a7573753e8d38f8654d9b
SHA2565f084905beab026985379a52ab06f97a1f12b6f3e884a91654c00635e51bf672
SHA512fac9ff19089259345d87d4bc1564a7427fa23bceba59525080cd48083116062286e7a19af865db8744137b7a83a8d5ca4d37080dbdfc978466e8c6bb717b58d4
-
C:\Users\Admin\AppData\Local\Temp\6B1F.exeFilesize
317KB
MD58418c188bb06f391bcae84df7abcf97e
SHA19d339dc7b2605a48996a7573753e8d38f8654d9b
SHA2565f084905beab026985379a52ab06f97a1f12b6f3e884a91654c00635e51bf672
SHA512fac9ff19089259345d87d4bc1564a7427fa23bceba59525080cd48083116062286e7a19af865db8744137b7a83a8d5ca4d37080dbdfc978466e8c6bb717b58d4
-
C:\Users\Admin\AppData\Local\Temp\6D62.exeFilesize
364KB
MD5330be0202568ff07f9a17cc23d6001b5
SHA13225af7da7656736fba329ca7545f22273026069
SHA2564fcca03bcaa0a7503d169479b9f0fc878fd193fb366b44700a6103b7f5c5075d
SHA512c91384437418dcf913722f6898dc863cdd2ec754ef9c4e7d45e57d39ea836bd72345f3e3a42310d233a0875fcb17f215e8f32a1924e12a99b96df01e8e2c40e4
-
C:\Users\Admin\AppData\Local\Temp\6D62.exeFilesize
364KB
MD5330be0202568ff07f9a17cc23d6001b5
SHA13225af7da7656736fba329ca7545f22273026069
SHA2564fcca03bcaa0a7503d169479b9f0fc878fd193fb366b44700a6103b7f5c5075d
SHA512c91384437418dcf913722f6898dc863cdd2ec754ef9c4e7d45e57d39ea836bd72345f3e3a42310d233a0875fcb17f215e8f32a1924e12a99b96df01e8e2c40e4
-
C:\Users\Admin\AppData\Local\Temp\80FA.exeFilesize
5.1MB
MD545d640b4d71a4417dc0e1281a1e4b3ba
SHA11f83180cd8f86acf65689d554c0f03c171834a67
SHA25678caaf3d7860d0fb05f04100968deea28e0ede31aa48456987f657bb20af908b
SHA5123b31796ff8a6a444657fa19e965cbc455cd707f7ebded1dea1ecab51a1b24472c263da832d8de40904729572e4d18cb7abe5355eb43c4d5115a6c73473e617c5
-
C:\Users\Admin\AppData\Local\Temp\80FA.exeFilesize
5.1MB
MD545d640b4d71a4417dc0e1281a1e4b3ba
SHA11f83180cd8f86acf65689d554c0f03c171834a67
SHA25678caaf3d7860d0fb05f04100968deea28e0ede31aa48456987f657bb20af908b
SHA5123b31796ff8a6a444657fa19e965cbc455cd707f7ebded1dea1ecab51a1b24472c263da832d8de40904729572e4d18cb7abe5355eb43c4d5115a6c73473e617c5
-
C:\Users\Admin\AppData\Local\Temp\85BE.exeFilesize
495KB
MD5af8881c2d64c8388e2f11c301bbe7f95
SHA1605163d12672e385ed797d2fced6291bff93198a
SHA256b8779766207a8d95a61e66235379705446b34f7c66eab6a4d763321f4597eece
SHA512901e863732287cfbeb2625d6a5733deb70d78cbf92104fb453a3a24c5e3ee37aeb99d2154eac52b2f35680d69782056057054c4cbdbaae945fd2c2677b92b835
-
C:\Users\Admin\AppData\Local\Temp\85BE.exeFilesize
495KB
MD5af8881c2d64c8388e2f11c301bbe7f95
SHA1605163d12672e385ed797d2fced6291bff93198a
SHA256b8779766207a8d95a61e66235379705446b34f7c66eab6a4d763321f4597eece
SHA512901e863732287cfbeb2625d6a5733deb70d78cbf92104fb453a3a24c5e3ee37aeb99d2154eac52b2f35680d69782056057054c4cbdbaae945fd2c2677b92b835
-
memory/500-568-0x0000000003290000-0x00000000032B2000-memory.dmpFilesize
136KB
-
memory/500-569-0x0000000003260000-0x0000000003287000-memory.dmpFilesize
156KB
-
memory/500-512-0x0000000000000000-mapping.dmp
-
memory/500-1129-0x0000000003290000-0x00000000032B2000-memory.dmpFilesize
136KB
-
memory/656-1120-0x0000000000ED0000-0x0000000000ED6000-memory.dmpFilesize
24KB
-
memory/656-509-0x0000000000EC0000-0x0000000000ECC000-memory.dmpFilesize
48KB
-
memory/656-508-0x0000000000ED0000-0x0000000000ED6000-memory.dmpFilesize
24KB
-
memory/656-492-0x0000000000000000-mapping.dmp
-
memory/820-429-0x0000000000FD0000-0x0000000000FD9000-memory.dmpFilesize
36KB
-
memory/820-430-0x0000000000FC0000-0x0000000000FCF000-memory.dmpFilesize
60KB
-
memory/820-422-0x0000000000000000-mapping.dmp
-
memory/820-1002-0x0000000000FD0000-0x0000000000FD9000-memory.dmpFilesize
36KB
-
memory/1444-432-0x0000000000000000-mapping.dmp
-
memory/1444-1121-0x0000000003040000-0x0000000003045000-memory.dmpFilesize
20KB
-
memory/1444-510-0x0000000003040000-0x0000000003045000-memory.dmpFilesize
20KB
-
memory/1444-511-0x0000000003030000-0x0000000003039000-memory.dmpFilesize
36KB
-
memory/2252-132-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-135-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-145-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-146-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-147-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-148-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-149-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-151-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-150-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-152-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-153-0x0000000000400000-0x0000000000585000-memory.dmpFilesize
1.5MB
-
memory/2252-144-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-142-0x00000000001E0000-0x00000000001E9000-memory.dmpFilesize
36KB
-
memory/2252-141-0x0000000000590000-0x00000000006DA000-memory.dmpFilesize
1.3MB
-
memory/2252-140-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-139-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-138-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-137-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-136-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-143-0x0000000000400000-0x0000000000585000-memory.dmpFilesize
1.5MB
-
memory/2252-134-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-133-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-130-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-129-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-128-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-127-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-126-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-125-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-124-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-123-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-122-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-121-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-116-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-120-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-119-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-118-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2252-117-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/2884-1132-0x00000000001B0000-0x00000000001B6000-memory.dmpFilesize
24KB
-
memory/2884-816-0x00000000001B0000-0x00000000001B6000-memory.dmpFilesize
24KB
-
memory/2884-635-0x0000000000000000-mapping.dmp
-
memory/2884-819-0x00000000001A0000-0x00000000001AB000-memory.dmpFilesize
44KB
-
memory/4016-359-0x0000000004F90000-0x0000000004FE4000-memory.dmpFilesize
336KB
-
memory/4016-502-0x0000000005870000-0x00000000058C4000-memory.dmpFilesize
336KB
-
memory/4016-302-0x0000000000000000-mapping.dmp
-
memory/4016-368-0x0000000005240000-0x00000000052A6000-memory.dmpFilesize
408KB
-
memory/4016-338-0x0000000000610000-0x0000000000692000-memory.dmpFilesize
520KB
-
memory/4016-346-0x0000000002A90000-0x0000000002B3E000-memory.dmpFilesize
696KB
-
memory/4016-360-0x0000000005000000-0x000000000504C000-memory.dmpFilesize
304KB
-
memory/4016-348-0x0000000004EC0000-0x0000000004F16000-memory.dmpFilesize
344KB
-
memory/4156-570-0x0000000000000000-mapping.dmp
-
memory/4156-758-0x0000000000790000-0x0000000000799000-memory.dmpFilesize
36KB
-
memory/4156-685-0x00000000007A0000-0x00000000007A5000-memory.dmpFilesize
20KB
-
memory/4220-1001-0x0000000000810000-0x0000000000817000-memory.dmpFilesize
28KB
-
memory/4220-431-0x0000000000800000-0x000000000080B000-memory.dmpFilesize
44KB
-
memory/4220-362-0x0000000000000000-mapping.dmp
-
memory/4220-428-0x0000000000810000-0x0000000000817000-memory.dmpFilesize
28KB
-
memory/4624-171-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4624-172-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4624-160-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4624-170-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4624-169-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4624-161-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4624-154-0x0000000000000000-mapping.dmp
-
memory/4624-168-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4624-167-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4624-158-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4624-162-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4624-164-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4624-156-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4624-159-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4624-165-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4624-157-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4624-166-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/4832-1130-0x0000000000220000-0x00000000014C8000-memory.dmpFilesize
18.7MB
-
memory/4832-749-0x0000000000220000-0x00000000014C8000-memory.dmpFilesize
18.7MB
-
memory/4832-301-0x0000000000220000-0x00000000014C8000-memory.dmpFilesize
18.7MB
-
memory/4832-298-0x0000000000000000-mapping.dmp
-
memory/5268-691-0x0000000000000000-mapping.dmp
-
memory/5268-1131-0x00000000001D0000-0x00000000001D7000-memory.dmpFilesize
28KB
-
memory/5268-754-0x00000000001C0000-0x00000000001CD000-memory.dmpFilesize
52KB
-
memory/5268-751-0x00000000001D0000-0x00000000001D7000-memory.dmpFilesize
28KB
-
memory/5504-871-0x0000000002F30000-0x0000000002F38000-memory.dmpFilesize
32KB
-
memory/5504-993-0x0000000002F20000-0x0000000002F2B000-memory.dmpFilesize
44KB
-
memory/5504-746-0x0000000000000000-mapping.dmp
-
memory/6984-1117-0x00000281D48A0000-0x00000281D4916000-memory.dmpFilesize
472KB
-
memory/6984-1106-0x0000000000000000-mapping.dmp
-
memory/6984-1111-0x00000281BC160000-0x00000281BC182000-memory.dmpFilesize
136KB
-
memory/65012-192-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/65012-190-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/65012-173-0x0000000000000000-mapping.dmp
-
memory/65012-175-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/65012-176-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/65012-177-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/65012-178-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/65012-179-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/65012-180-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/65012-182-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/65012-184-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/65012-188-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/65012-185-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/77024-187-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/77024-183-0x0000000000000000-mapping.dmp
-
memory/77024-189-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/77024-191-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/102236-226-0x000000000042217E-mapping.dmp
-
memory/102236-1004-0x000000000AC40000-0x000000000AC90000-memory.dmpFilesize
320KB
-
memory/102236-1013-0x000000000BA90000-0x000000000BC52000-memory.dmpFilesize
1.8MB
-
memory/102236-1014-0x000000000C190000-0x000000000C6BC000-memory.dmpFilesize
5.2MB
-
memory/102236-1003-0x000000000A980000-0x000000000A9F6000-memory.dmpFilesize
472KB
-
memory/102236-468-0x000000000A360000-0x000000000A3F2000-memory.dmpFilesize
584KB
-
memory/102236-262-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/102236-283-0x0000000009970000-0x0000000009F76000-memory.dmpFilesize
6.0MB
-
memory/102236-284-0x00000000094D0000-0x00000000095DA000-memory.dmpFilesize
1.0MB
-
memory/102236-286-0x0000000009400000-0x0000000009412000-memory.dmpFilesize
72KB
-
memory/102236-288-0x0000000009470000-0x00000000094AE000-memory.dmpFilesize
248KB
-
memory/102236-290-0x00000000095E0000-0x000000000962B000-memory.dmpFilesize
300KB
-
memory/102236-440-0x000000000A480000-0x000000000A97E000-memory.dmpFilesize
5.0MB