Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
15-10-2022 16:56
Static task
static1
Behavioral task
behavioral1
Sample
7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe
Resource
win10-20220812-en
General
-
Target
7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe
-
Size
427KB
-
MD5
c34729173ecc820eb7674431597d78be
-
SHA1
884f343876a8bb0ebac63c28191c22c6f69590f8
-
SHA256
7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0
-
SHA512
f9c93a0c6f55217016fe5ba550e9948662901b9240662708ac93074bf9692427b73ce10864927026b118aeb6622a47cfa04976bbc9b482a31aef21a5c96786a0
-
SSDEEP
3072:yvGyYiSDnt1Et5CmPo8VGAnxoctr6Byd4TUISI:24UCp6n756BmlI
Malware Config
Extracted
redline
Nigh
80.66.87.20:80
-
auth_value
dab8506635d1dc134af4ebaedf4404eb
Signatures
-
Detects Smokeloader packer 3 IoCs
Processes:
resource yara_rule behavioral1/memory/4604-585-0x0000000000402E87-mapping.dmp family_smokeloader behavioral1/memory/4604-599-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/4604-618-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4876-309-0x000000000042210E-mapping.dmp family_redline behavioral1/memory/4876-374-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 5 IoCs
Processes:
SETUP_~1.EXEHwqujbjwlyvggktrainingadministrator_s.exeSETUP_~1.EXESETUP_~1.EXEHwqujbjwlyvggktrainingadministrator_s.exepid process 2764 SETUP_~1.EXE 4640 Hwqujbjwlyvggktrainingadministrator_s.exe 4852 SETUP_~1.EXE 4876 SETUP_~1.EXE 4604 Hwqujbjwlyvggktrainingadministrator_s.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
SETUP_~1.EXEHwqujbjwlyvggktrainingadministrator_s.exedescription pid process target process PID 2764 set thread context of 4876 2764 SETUP_~1.EXE SETUP_~1.EXE PID 4640 set thread context of 4604 4640 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
Hwqujbjwlyvggktrainingadministrator_s.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Hwqujbjwlyvggktrainingadministrator_s.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Hwqujbjwlyvggktrainingadministrator_s.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Hwqujbjwlyvggktrainingadministrator_s.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeSETUP_~1.EXEpowershell.exeSETUP_~1.EXEHwqujbjwlyvggktrainingadministrator_s.exepid process 1848 powershell.exe 1848 powershell.exe 1848 powershell.exe 2764 SETUP_~1.EXE 2764 SETUP_~1.EXE 3212 powershell.exe 3212 powershell.exe 3212 powershell.exe 4876 SETUP_~1.EXE 4876 SETUP_~1.EXE 4604 Hwqujbjwlyvggktrainingadministrator_s.exe 4604 Hwqujbjwlyvggktrainingadministrator_s.exe 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 2444 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Hwqujbjwlyvggktrainingadministrator_s.exepid process 4604 Hwqujbjwlyvggktrainingadministrator_s.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
SETUP_~1.EXEpowershell.exeHwqujbjwlyvggktrainingadministrator_s.exeSETUP_~1.EXEpowershell.exedescription pid process Token: SeDebugPrivilege 2764 SETUP_~1.EXE Token: SeDebugPrivilege 1848 powershell.exe Token: SeDebugPrivilege 4640 Hwqujbjwlyvggktrainingadministrator_s.exe Token: SeDebugPrivilege 4876 SETUP_~1.EXE Token: SeDebugPrivilege 3212 powershell.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exeSETUP_~1.EXEHwqujbjwlyvggktrainingadministrator_s.exedescription pid process target process PID 2684 wrote to memory of 2764 2684 7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe SETUP_~1.EXE PID 2684 wrote to memory of 2764 2684 7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe SETUP_~1.EXE PID 2684 wrote to memory of 2764 2684 7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe SETUP_~1.EXE PID 2764 wrote to memory of 1848 2764 SETUP_~1.EXE powershell.exe PID 2764 wrote to memory of 1848 2764 SETUP_~1.EXE powershell.exe PID 2764 wrote to memory of 1848 2764 SETUP_~1.EXE powershell.exe PID 2764 wrote to memory of 4640 2764 SETUP_~1.EXE Hwqujbjwlyvggktrainingadministrator_s.exe PID 2764 wrote to memory of 4640 2764 SETUP_~1.EXE Hwqujbjwlyvggktrainingadministrator_s.exe PID 2764 wrote to memory of 4640 2764 SETUP_~1.EXE Hwqujbjwlyvggktrainingadministrator_s.exe PID 2764 wrote to memory of 4852 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 4852 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 4852 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 4876 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 4876 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 4876 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 4876 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 4876 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 4876 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 4876 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 4876 2764 SETUP_~1.EXE SETUP_~1.EXE PID 4640 wrote to memory of 3212 4640 Hwqujbjwlyvggktrainingadministrator_s.exe powershell.exe PID 4640 wrote to memory of 3212 4640 Hwqujbjwlyvggktrainingadministrator_s.exe powershell.exe PID 4640 wrote to memory of 3212 4640 Hwqujbjwlyvggktrainingadministrator_s.exe powershell.exe PID 4640 wrote to memory of 4604 4640 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe PID 4640 wrote to memory of 4604 4640 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe PID 4640 wrote to memory of 4604 4640 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe PID 4640 wrote to memory of 4604 4640 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe PID 4640 wrote to memory of 4604 4640 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe PID 4640 wrote to memory of 4604 4640 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe"C:\Users\Admin\AppData\Local\Temp\7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exe"C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exeC:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exe4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SETUP_~1.EXE.logFilesize
1KB
MD594783fcf58c98f5ea0b416f441ad15eb
SHA1979a7c39c6a5dbed314bc41a22c4ccdca6db206b
SHA256117df0a0e80abf166ef148863dd82ba9e75c05b38ed3979d048f5fcc848ef905
SHA5129301306461cb978e91761b24b1d04339c2bff71771431987cd8dc373387c12feb81dbdbf272da1f7c045eade4ffff1976885ca705ca7cf9a40a6c4a7553aa06c
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD566382a4ca6c4dcf75ce41417d44be93e
SHA18132cbef1c12f8a89a68a6153ade4286bf130812
SHA256a70acce0f4c6ab59b88ce79d84c38d4abffe19b72b033250499b17d788a2db56
SHA5122bf66f2850f4a65220085c55a5b3c8866453104d78fe516e5bd6e3e47df783062ce4ea10de580f2eb0274ac8c3ce71965201c49ef55a78f307731ccc8600aadc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
45KB
MD55f640bd48e2547b4c1a7421f080f815f
SHA1a8f4a743f5b7da5cba7b8e6fb1d7ad4d67fefc6a
SHA256916c83c7c8d059aea295523b8b3f24e1e2436df894f7fae26c47c9bad04baa9c
SHA512a6ac100a351946b1bbb40c98aeda6e16e12f90f81063aff08c16d4d9afec8ed65c2cbcf25b42946627d67653f75740b1137dab625c99e9492ba35aba68b79a8e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD54ea28cee174041ee502c1eaa95c94767
SHA15d288da539555cc4a9151a6be8a24c7770eeb89e
SHA25638bc92d523d86ca46238399ba3276394be19bb82348f8c6d22c12c0ec151a6b0
SHA5125a5c44b2ee302792f73a252db54c6473c93907a82020769a840361abbbd52c0c6d36b8a2c1359ae6c6a0cb3620bc7dd4ce4cd3cddfdbc2457f3b4ed44d922d42
-
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exeFilesize
6KB
MD5d0b53e53092311bc055630adf3e4ccdc
SHA1bf66777607a1d968e3194fe047f9a0e03f249f28
SHA2560cdff2f53a06a63f46dd3e773c3ae99f1d29826975295407046d2d87f609fc3e
SHA51234ecfda7dcad85b6e29fe4a51d7798517d1c2432879eee547e254d251c7f21a52616af58c1a5ce6d50a6a505cf2d03a8e46a3d3a441ca18df1aa86ed9bc546c6
-
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exeFilesize
6KB
MD5d0b53e53092311bc055630adf3e4ccdc
SHA1bf66777607a1d968e3194fe047f9a0e03f249f28
SHA2560cdff2f53a06a63f46dd3e773c3ae99f1d29826975295407046d2d87f609fc3e
SHA51234ecfda7dcad85b6e29fe4a51d7798517d1c2432879eee547e254d251c7f21a52616af58c1a5ce6d50a6a505cf2d03a8e46a3d3a441ca18df1aa86ed9bc546c6
-
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exeFilesize
6KB
MD5d0b53e53092311bc055630adf3e4ccdc
SHA1bf66777607a1d968e3194fe047f9a0e03f249f28
SHA2560cdff2f53a06a63f46dd3e773c3ae99f1d29826975295407046d2d87f609fc3e
SHA51234ecfda7dcad85b6e29fe4a51d7798517d1c2432879eee547e254d251c7f21a52616af58c1a5ce6d50a6a505cf2d03a8e46a3d3a441ca18df1aa86ed9bc546c6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD54786de75433835fdc9d3d08edf8116ca
SHA12c6843f4b1992eeb9215c4d582a94c4ceb7284f9
SHA256d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb
SHA512e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD54786de75433835fdc9d3d08edf8116ca
SHA12c6843f4b1992eeb9215c4d582a94c4ceb7284f9
SHA256d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb
SHA512e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD54786de75433835fdc9d3d08edf8116ca
SHA12c6843f4b1992eeb9215c4d582a94c4ceb7284f9
SHA256d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb
SHA512e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD54786de75433835fdc9d3d08edf8116ca
SHA12c6843f4b1992eeb9215c4d582a94c4ceb7284f9
SHA256d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb
SHA512e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9
-
memory/1848-212-0x0000000000000000-mapping.dmp
-
memory/1848-293-0x0000000009850000-0x000000000986A000-memory.dmpFilesize
104KB
-
memory/1848-292-0x000000000A310000-0x000000000A988000-memory.dmpFilesize
6.5MB
-
memory/1848-281-0x0000000008B00000-0x0000000008B76000-memory.dmpFilesize
472KB
-
memory/1848-277-0x00000000089B0000-0x00000000089FB000-memory.dmpFilesize
300KB
-
memory/1848-276-0x0000000008220000-0x000000000823C000-memory.dmpFilesize
112KB
-
memory/1848-273-0x0000000008150000-0x00000000081B6000-memory.dmpFilesize
408KB
-
memory/1848-272-0x0000000007990000-0x00000000079F6000-memory.dmpFilesize
408KB
-
memory/1848-253-0x0000000007A50000-0x0000000008078000-memory.dmpFilesize
6.2MB
-
memory/1848-248-0x0000000005310000-0x0000000005346000-memory.dmpFilesize
216KB
-
memory/2764-142-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-181-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-138-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-139-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-140-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-141-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-115-0x0000000000000000-mapping.dmp
-
memory/2764-143-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-145-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-144-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-146-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-147-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-148-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-149-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-150-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-151-0x0000000000DA0000-0x0000000000DB2000-memory.dmpFilesize
72KB
-
memory/2764-152-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-153-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-154-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-155-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-156-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-157-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-158-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-159-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-160-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-161-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-162-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-163-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-164-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-165-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-166-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-167-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-168-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-169-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-170-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-171-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-172-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-173-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-174-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-175-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-177-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-178-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-176-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-179-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-180-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-137-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-182-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-196-0x0000000005F10000-0x0000000005FFA000-memory.dmpFilesize
936KB
-
memory/2764-197-0x0000000006100000-0x0000000006192000-memory.dmpFilesize
584KB
-
memory/2764-198-0x00000000061D0000-0x00000000061F2000-memory.dmpFilesize
136KB
-
memory/2764-200-0x0000000006540000-0x0000000006890000-memory.dmpFilesize
3.3MB
-
memory/2764-136-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-135-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-134-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-133-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-131-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-132-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-130-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-129-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-128-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-127-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-117-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-126-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-124-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-118-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-123-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-122-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-119-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-121-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/2764-120-0x0000000077C70000-0x0000000077DFE000-memory.dmpFilesize
1.6MB
-
memory/3212-462-0x0000000000000000-mapping.dmp
-
memory/4604-618-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4604-599-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4604-585-0x0000000000402E87-mapping.dmp
-
memory/4640-369-0x00000000008C0000-0x00000000008C8000-memory.dmpFilesize
32KB
-
memory/4640-298-0x0000000000000000-mapping.dmp
-
memory/4640-446-0x0000000005A00000-0x0000000005AC0000-memory.dmpFilesize
768KB
-
memory/4640-448-0x0000000005F00000-0x0000000006250000-memory.dmpFilesize
3.3MB
-
memory/4876-309-0x000000000042210E-mapping.dmp
-
memory/4876-374-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4876-430-0x00000000053C0000-0x00000000059C6000-memory.dmpFilesize
6.0MB
-
memory/4876-561-0x00000000065A0000-0x0000000006632000-memory.dmpFilesize
584KB
-
memory/4876-562-0x0000000006B40000-0x000000000703E000-memory.dmpFilesize
5.0MB
-
memory/4876-571-0x0000000006790000-0x00000000067E0000-memory.dmpFilesize
320KB
-
memory/4876-572-0x0000000008420000-0x00000000085E2000-memory.dmpFilesize
1.8MB
-
memory/4876-573-0x0000000008B20000-0x000000000904C000-memory.dmpFilesize
5.2MB
-
memory/4876-444-0x0000000005010000-0x000000000505B000-memory.dmpFilesize
300KB
-
memory/4876-440-0x0000000004E90000-0x0000000004ECE000-memory.dmpFilesize
248KB
-
memory/4876-436-0x0000000004E30000-0x0000000004E42000-memory.dmpFilesize
72KB
-
memory/4876-432-0x0000000004F00000-0x000000000500A000-memory.dmpFilesize
1.0MB