Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2022 11:14
Static task
static1
General
-
Target
528049736d6b6647d3cc4216902bffca9c1aed8a8d669606129a811862f38914.exe
-
Size
145KB
-
MD5
da3326025a075eaba1f6b3d774efa8ad
-
SHA1
190b0825b184f64e1aaf809ecf9c38e64161ba39
-
SHA256
528049736d6b6647d3cc4216902bffca9c1aed8a8d669606129a811862f38914
-
SHA512
97b462223fca81ceeb1274b0611ce47a63cab408c715db2f505d3310f33cb889d0b9df615f066110c7e3d8a46711a60dee0175b9e15dd4a69ef2bfbd58849b96
-
SSDEEP
1536:ZOH8UxIs9UypeZR21/RIa7cqO12vT0HqZTPmMg+nXJGGSjln06Uj3jnbfxGhrs:ZOceT1/R57O12vYHeUuQpNe3jbfsh4
Malware Config
Extracted
asyncrat
0.5.7B
Default
45.154.98.214:6606
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Extracted
redline
fud
45.15.156.7:48638
-
auth_value
da2faefdcf53c9d85fcbb82d0cbf4876
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4544-133-0x0000000000640000-0x0000000000649000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4880-218-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3972-184-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
Processes:
CFE7.exeD382.exeF41B.exe1.exe12C.exeD382.exepid process 3136 CFE7.exe 260 D382.exe 4020 F41B.exe 4276 1.exe 3064 12C.exe 4880 D382.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
D382.exeF41B.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation D382.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation F41B.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
12C.exeD382.exedescription pid process target process PID 3064 set thread context of 3972 3064 12C.exe vbc.exe PID 260 set thread context of 4880 260 D382.exe D382.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1592 3136 WerFault.exe CFE7.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
528049736d6b6647d3cc4216902bffca9c1aed8a8d669606129a811862f38914.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 528049736d6b6647d3cc4216902bffca9c1aed8a8d669606129a811862f38914.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 528049736d6b6647d3cc4216902bffca9c1aed8a8d669606129a811862f38914.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 528049736d6b6647d3cc4216902bffca9c1aed8a8d669606129a811862f38914.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
528049736d6b6647d3cc4216902bffca9c1aed8a8d669606129a811862f38914.exepid process 4544 528049736d6b6647d3cc4216902bffca9c1aed8a8d669606129a811862f38914.exe 4544 528049736d6b6647d3cc4216902bffca9c1aed8a8d669606129a811862f38914.exe 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 684 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
528049736d6b6647d3cc4216902bffca9c1aed8a8d669606129a811862f38914.exepid process 4544 528049736d6b6647d3cc4216902bffca9c1aed8a8d669606129a811862f38914.exe 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 684 -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
powershell.exeCFE7.exe12C.exevbc.exeD382.exeD382.exedescription pid process Token: SeDebugPrivilege 4592 powershell.exe Token: SeDebugPrivilege 3136 CFE7.exe Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeDebugPrivilege 3064 12C.exe Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeDebugPrivilege 3972 vbc.exe Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeDebugPrivilege 260 D382.exe Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeDebugPrivilege 4880 D382.exe Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 Token: SeShutdownPrivilege 684 Token: SeCreatePagefilePrivilege 684 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
D382.exeF41B.exe12C.exedescription pid process target process PID 684 wrote to memory of 3136 684 CFE7.exe PID 684 wrote to memory of 3136 684 CFE7.exe PID 684 wrote to memory of 3136 684 CFE7.exe PID 684 wrote to memory of 260 684 D382.exe PID 684 wrote to memory of 260 684 D382.exe PID 684 wrote to memory of 260 684 D382.exe PID 260 wrote to memory of 4592 260 D382.exe powershell.exe PID 260 wrote to memory of 4592 260 D382.exe powershell.exe PID 260 wrote to memory of 4592 260 D382.exe powershell.exe PID 684 wrote to memory of 4020 684 F41B.exe PID 684 wrote to memory of 4020 684 F41B.exe PID 684 wrote to memory of 4020 684 F41B.exe PID 4020 wrote to memory of 4276 4020 F41B.exe 1.exe PID 4020 wrote to memory of 4276 4020 F41B.exe 1.exe PID 4020 wrote to memory of 4276 4020 F41B.exe 1.exe PID 684 wrote to memory of 3064 684 12C.exe PID 684 wrote to memory of 3064 684 12C.exe PID 684 wrote to memory of 3064 684 12C.exe PID 684 wrote to memory of 440 684 explorer.exe PID 684 wrote to memory of 440 684 explorer.exe PID 684 wrote to memory of 440 684 explorer.exe PID 684 wrote to memory of 440 684 explorer.exe PID 684 wrote to memory of 2632 684 explorer.exe PID 684 wrote to memory of 2632 684 explorer.exe PID 684 wrote to memory of 2632 684 explorer.exe PID 3064 wrote to memory of 3972 3064 12C.exe vbc.exe PID 3064 wrote to memory of 3972 3064 12C.exe vbc.exe PID 3064 wrote to memory of 3972 3064 12C.exe vbc.exe PID 3064 wrote to memory of 3972 3064 12C.exe vbc.exe PID 3064 wrote to memory of 3972 3064 12C.exe vbc.exe PID 3064 wrote to memory of 3972 3064 12C.exe vbc.exe PID 3064 wrote to memory of 3972 3064 12C.exe vbc.exe PID 3064 wrote to memory of 3972 3064 12C.exe vbc.exe PID 684 wrote to memory of 836 684 explorer.exe PID 684 wrote to memory of 836 684 explorer.exe PID 684 wrote to memory of 836 684 explorer.exe PID 684 wrote to memory of 836 684 explorer.exe PID 684 wrote to memory of 624 684 explorer.exe PID 684 wrote to memory of 624 684 explorer.exe PID 684 wrote to memory of 624 684 explorer.exe PID 684 wrote to memory of 1920 684 explorer.exe PID 684 wrote to memory of 1920 684 explorer.exe PID 684 wrote to memory of 1920 684 explorer.exe PID 684 wrote to memory of 1920 684 explorer.exe PID 684 wrote to memory of 5036 684 explorer.exe PID 684 wrote to memory of 5036 684 explorer.exe PID 684 wrote to memory of 5036 684 explorer.exe PID 684 wrote to memory of 5036 684 explorer.exe PID 684 wrote to memory of 2696 684 explorer.exe PID 684 wrote to memory of 2696 684 explorer.exe PID 684 wrote to memory of 2696 684 explorer.exe PID 684 wrote to memory of 2696 684 explorer.exe PID 684 wrote to memory of 724 684 explorer.exe PID 684 wrote to memory of 724 684 explorer.exe PID 684 wrote to memory of 724 684 explorer.exe PID 684 wrote to memory of 4692 684 explorer.exe PID 684 wrote to memory of 4692 684 explorer.exe PID 684 wrote to memory of 4692 684 explorer.exe PID 684 wrote to memory of 4692 684 explorer.exe PID 260 wrote to memory of 4880 260 D382.exe D382.exe PID 260 wrote to memory of 4880 260 D382.exe D382.exe PID 260 wrote to memory of 4880 260 D382.exe D382.exe PID 260 wrote to memory of 4880 260 D382.exe D382.exe PID 260 wrote to memory of 4880 260 D382.exe D382.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\528049736d6b6647d3cc4216902bffca9c1aed8a8d669606129a811862f38914.exe"C:\Users\Admin\AppData\Local\Temp\528049736d6b6647d3cc4216902bffca9c1aed8a8d669606129a811862f38914.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\CFE7.exeC:\Users\Admin\AppData\Local\Temp\CFE7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 12642⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\D382.exeC:\Users\Admin\AppData\Local\Temp\D382.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\D382.exeC:\Users\Admin\AppData\Local\Temp\D382.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\F41B.exeC:\Users\Admin\AppData\Local\Temp\F41B.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\12C.exeC:\Users\Admin\AppData\Local\Temp\12C.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3136 -ip 31361⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\D382.exe.logFilesize
1KB
MD57e88081fcf716d85992bb3af3d9b6454
SHA12153780fbc71061b0102a7a7b665349e1013e250
SHA2565ffb4a3ea94a6a53c4f88e2191c6fec5fd8a7336e367aa113fe8c12631e0c4d2
SHA512ec606e14367ae221c04f213a61a6f797034495121198e4788e3afa4aa8db67bf59c5c5210a56afae5557158e8923b013b371b84c7d64303618c5b4c57a2224f7
-
C:\Users\Admin\AppData\Local\Temp\12C.exeFilesize
9KB
MD552941006f1925c25e95e35d849b5123a
SHA1ac97512774715c70018e9275f05d41b1412e8a66
SHA2563e8378da9f1da38db2095a8683e2c1a2b8ceb0fab6a029a9a75b6f60cf129509
SHA512adf0b7d7bc460dd3022b87fb79c9774446e0b5b3b254f01c12cf16fe1b86bdf2589f5d952ef8a1de73b9629d2a950367109d344b4fb0df786dd039d7f1d63144
-
C:\Users\Admin\AppData\Local\Temp\12C.exeFilesize
9KB
MD552941006f1925c25e95e35d849b5123a
SHA1ac97512774715c70018e9275f05d41b1412e8a66
SHA2563e8378da9f1da38db2095a8683e2c1a2b8ceb0fab6a029a9a75b6f60cf129509
SHA512adf0b7d7bc460dd3022b87fb79c9774446e0b5b3b254f01c12cf16fe1b86bdf2589f5d952ef8a1de73b9629d2a950367109d344b4fb0df786dd039d7f1d63144
-
C:\Users\Admin\AppData\Local\Temp\CFE7.exeFilesize
431KB
MD55a9fd5240f5f626063abda8b483bd429
SHA1476d48e02c8a80bd0cdfae683d25fdeeb100b19a
SHA256df55c7b69820c19f1d89fab1a87d4aca1b2210cb8534e5c895f7e3bc56133a3f
SHA512cf21686d583274d45410e6a3219a7bbe9a9bb0ad0f05e04ec02dd0815ed5c8f35633d48db5bf5f6b3c1f1c3606218821d9ad1a100a09149b71130a63794e831d
-
C:\Users\Admin\AppData\Local\Temp\CFE7.exeFilesize
431KB
MD55a9fd5240f5f626063abda8b483bd429
SHA1476d48e02c8a80bd0cdfae683d25fdeeb100b19a
SHA256df55c7b69820c19f1d89fab1a87d4aca1b2210cb8534e5c895f7e3bc56133a3f
SHA512cf21686d583274d45410e6a3219a7bbe9a9bb0ad0f05e04ec02dd0815ed5c8f35633d48db5bf5f6b3c1f1c3606218821d9ad1a100a09149b71130a63794e831d
-
C:\Users\Admin\AppData\Local\Temp\D382.exeFilesize
699KB
MD5c6f4ffde851054ec2871e72833cd9d59
SHA1e688103c4fa3ca815732f0f70f37d11f69232e04
SHA25625502cd9907336216d2733d966787f67c47a6ea07a7895a4fa9f26e9206dd0e7
SHA51247264796515d6ef559b9f33f68011230ba242f5edfc47ea28cc1f788930a6e42f42c7c2963bf727ab67e86e859ae877a139af91dd0e7e95581a69888ad192fe4
-
C:\Users\Admin\AppData\Local\Temp\D382.exeFilesize
699KB
MD5c6f4ffde851054ec2871e72833cd9d59
SHA1e688103c4fa3ca815732f0f70f37d11f69232e04
SHA25625502cd9907336216d2733d966787f67c47a6ea07a7895a4fa9f26e9206dd0e7
SHA51247264796515d6ef559b9f33f68011230ba242f5edfc47ea28cc1f788930a6e42f42c7c2963bf727ab67e86e859ae877a139af91dd0e7e95581a69888ad192fe4
-
C:\Users\Admin\AppData\Local\Temp\D382.exeFilesize
699KB
MD5c6f4ffde851054ec2871e72833cd9d59
SHA1e688103c4fa3ca815732f0f70f37d11f69232e04
SHA25625502cd9907336216d2733d966787f67c47a6ea07a7895a4fa9f26e9206dd0e7
SHA51247264796515d6ef559b9f33f68011230ba242f5edfc47ea28cc1f788930a6e42f42c7c2963bf727ab67e86e859ae877a139af91dd0e7e95581a69888ad192fe4
-
C:\Users\Admin\AppData\Local\Temp\F41B.exeFilesize
466KB
MD52955a7fdcda8c0768d106b135a352173
SHA11de1f74183421d4f811af2dc469840c8d266eec9
SHA2563238f627cf753b195a814ad7a01bd16fa13616802e39f48a981c5c8703a2ff6f
SHA512c87bf10bc4eaaa912a74da441c3a3894535e54764e60a76c505c628e70e35822fcbe147aaabd117ddacbc88294ad16243c7f721400ac64178681633db8898bbb
-
C:\Users\Admin\AppData\Local\Temp\F41B.exeFilesize
466KB
MD52955a7fdcda8c0768d106b135a352173
SHA11de1f74183421d4f811af2dc469840c8d266eec9
SHA2563238f627cf753b195a814ad7a01bd16fa13616802e39f48a981c5c8703a2ff6f
SHA512c87bf10bc4eaaa912a74da441c3a3894535e54764e60a76c505c628e70e35822fcbe147aaabd117ddacbc88294ad16243c7f721400ac64178681633db8898bbb
-
C:\Windows\Temp\1.exeFilesize
369KB
MD54a32a16c5a3c79ade487c098ee71a2be
SHA1414b203eeb20ac7e74316fd2877ca4ebf52193df
SHA25661059bd8f3bdb2b07ca01c87efe6284b8b3b77ca63e9a063e0e9010774a482a4
SHA5126470c0269052bbccea48bfb5da80cdcf96fec71e0e45ae79a42acacd7c4d92139ccc6f122ab97e5b104fc93bee84891850a80aa9c835c0b31418f151517b1ee5
-
C:\Windows\Temp\1.exeFilesize
369KB
MD54a32a16c5a3c79ade487c098ee71a2be
SHA1414b203eeb20ac7e74316fd2877ca4ebf52193df
SHA25661059bd8f3bdb2b07ca01c87efe6284b8b3b77ca63e9a063e0e9010774a482a4
SHA5126470c0269052bbccea48bfb5da80cdcf96fec71e0e45ae79a42acacd7c4d92139ccc6f122ab97e5b104fc93bee84891850a80aa9c835c0b31418f151517b1ee5
-
memory/260-143-0x0000000005760000-0x0000000005782000-memory.dmpFilesize
136KB
-
memory/260-139-0x0000000000000000-mapping.dmp
-
memory/260-142-0x0000000000B80000-0x0000000000C30000-memory.dmpFilesize
704KB
-
memory/440-208-0x0000000000A70000-0x0000000000A77000-memory.dmpFilesize
28KB
-
memory/440-176-0x0000000000000000-mapping.dmp
-
memory/440-177-0x0000000000A70000-0x0000000000A77000-memory.dmpFilesize
28KB
-
memory/440-178-0x0000000000A60000-0x0000000000A6B000-memory.dmpFilesize
44KB
-
memory/624-191-0x0000000000C90000-0x0000000000C96000-memory.dmpFilesize
24KB
-
memory/624-211-0x0000000000C90000-0x0000000000C96000-memory.dmpFilesize
24KB
-
memory/624-190-0x0000000000000000-mapping.dmp
-
memory/624-192-0x0000000000C80000-0x0000000000C8C000-memory.dmpFilesize
48KB
-
memory/724-204-0x0000000000830000-0x000000000083D000-memory.dmpFilesize
52KB
-
memory/724-203-0x0000000000840000-0x0000000000847000-memory.dmpFilesize
28KB
-
memory/724-202-0x0000000000000000-mapping.dmp
-
memory/724-215-0x0000000000840000-0x0000000000847000-memory.dmpFilesize
28KB
-
memory/836-189-0x0000000000360000-0x0000000000369000-memory.dmpFilesize
36KB
-
memory/836-185-0x0000000000000000-mapping.dmp
-
memory/836-210-0x0000000000370000-0x0000000000375000-memory.dmpFilesize
20KB
-
memory/836-188-0x0000000000370000-0x0000000000375000-memory.dmpFilesize
20KB
-
memory/1920-195-0x0000000000B00000-0x0000000000B27000-memory.dmpFilesize
156KB
-
memory/1920-193-0x0000000000000000-mapping.dmp
-
memory/1920-212-0x0000000000B30000-0x0000000000B52000-memory.dmpFilesize
136KB
-
memory/1920-194-0x0000000000B30000-0x0000000000B52000-memory.dmpFilesize
136KB
-
memory/2632-209-0x0000000000BA0000-0x0000000000BA9000-memory.dmpFilesize
36KB
-
memory/2632-181-0x0000000000B90000-0x0000000000B9F000-memory.dmpFilesize
60KB
-
memory/2632-180-0x0000000000BA0000-0x0000000000BA9000-memory.dmpFilesize
36KB
-
memory/2632-179-0x0000000000000000-mapping.dmp
-
memory/2696-199-0x0000000000000000-mapping.dmp
-
memory/2696-200-0x0000000000CD0000-0x0000000000CD6000-memory.dmpFilesize
24KB
-
memory/2696-214-0x0000000000CD0000-0x0000000000CD6000-memory.dmpFilesize
24KB
-
memory/2696-201-0x0000000000CC0000-0x0000000000CCB000-memory.dmpFilesize
44KB
-
memory/3064-182-0x0000000005900000-0x000000000599C000-memory.dmpFilesize
624KB
-
memory/3064-175-0x0000000000450000-0x0000000000458000-memory.dmpFilesize
32KB
-
memory/3064-172-0x0000000000000000-mapping.dmp
-
memory/3136-154-0x00000000050A0000-0x00000000056B8000-memory.dmpFilesize
6.1MB
-
memory/3136-156-0x0000000005750000-0x000000000585A000-memory.dmpFilesize
1.0MB
-
memory/3136-170-0x0000000006610000-0x00000000067D2000-memory.dmpFilesize
1.8MB
-
memory/3136-153-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/3136-152-0x0000000002070000-0x00000000020A8000-memory.dmpFilesize
224KB
-
memory/3136-151-0x00000000005D0000-0x00000000005FA000-memory.dmpFilesize
168KB
-
memory/3136-155-0x0000000005730000-0x0000000005742000-memory.dmpFilesize
72KB
-
memory/3136-163-0x0000000006450000-0x00000000064A0000-memory.dmpFilesize
320KB
-
memory/3136-186-0x00000000005D0000-0x00000000005FA000-memory.dmpFilesize
168KB
-
memory/3136-187-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/3136-162-0x00000000063C0000-0x00000000063DE000-memory.dmpFilesize
120KB
-
memory/3136-161-0x0000000006340000-0x00000000063B6000-memory.dmpFilesize
472KB
-
memory/3136-160-0x0000000005B80000-0x0000000005C12000-memory.dmpFilesize
584KB
-
memory/3136-136-0x0000000000000000-mapping.dmp
-
memory/3136-150-0x0000000004A80000-0x0000000005024000-memory.dmpFilesize
5.6MB
-
memory/3136-157-0x0000000005880000-0x00000000058BC000-memory.dmpFilesize
240KB
-
memory/3136-171-0x00000000067E0000-0x0000000006D0C000-memory.dmpFilesize
5.2MB
-
memory/3972-184-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3972-183-0x0000000000000000-mapping.dmp
-
memory/4020-164-0x0000000000000000-mapping.dmp
-
memory/4276-167-0x0000000000000000-mapping.dmp
-
memory/4544-132-0x000000000066D000-0x000000000067D000-memory.dmpFilesize
64KB
-
memory/4544-135-0x0000000000400000-0x0000000000580000-memory.dmpFilesize
1.5MB
-
memory/4544-133-0x0000000000640000-0x0000000000649000-memory.dmpFilesize
36KB
-
memory/4544-134-0x0000000000400000-0x0000000000580000-memory.dmpFilesize
1.5MB
-
memory/4592-146-0x0000000005110000-0x0000000005738000-memory.dmpFilesize
6.2MB
-
memory/4592-144-0x0000000000000000-mapping.dmp
-
memory/4592-158-0x0000000007530000-0x0000000007BAA000-memory.dmpFilesize
6.5MB
-
memory/4592-159-0x00000000063B0000-0x00000000063CA000-memory.dmpFilesize
104KB
-
memory/4592-149-0x0000000005ED0000-0x0000000005EEE000-memory.dmpFilesize
120KB
-
memory/4592-148-0x00000000058B0000-0x0000000005916000-memory.dmpFilesize
408KB
-
memory/4592-147-0x0000000004FB0000-0x0000000005016000-memory.dmpFilesize
408KB
-
memory/4592-145-0x0000000002920000-0x0000000002956000-memory.dmpFilesize
216KB
-
memory/4692-207-0x0000000000B00000-0x0000000000B0B000-memory.dmpFilesize
44KB
-
memory/4692-206-0x0000000000B10000-0x0000000000B18000-memory.dmpFilesize
32KB
-
memory/4692-205-0x0000000000000000-mapping.dmp
-
memory/4692-216-0x0000000000B10000-0x0000000000B18000-memory.dmpFilesize
32KB
-
memory/4880-217-0x0000000000000000-mapping.dmp
-
memory/4880-218-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/5036-198-0x0000000000BD0000-0x0000000000BD9000-memory.dmpFilesize
36KB
-
memory/5036-213-0x0000000000BE0000-0x0000000000BE5000-memory.dmpFilesize
20KB
-
memory/5036-196-0x0000000000000000-mapping.dmp
-
memory/5036-197-0x0000000000BE0000-0x0000000000BE5000-memory.dmpFilesize
20KB