Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2022 23:55
Static task
static1
Behavioral task
behavioral1
Sample
5f07867d08f9e18f24e897094f444162d940c68d05a3270738950fb3588c019e.exe
Resource
win10v2004-20220812-en
General
-
Target
5f07867d08f9e18f24e897094f444162d940c68d05a3270738950fb3588c019e.exe
-
Size
233KB
-
MD5
8b0cf2d7975da7bc1e95cb74e4228c11
-
SHA1
824afb11f34f0dbab38a738862326054bcdb28a7
-
SHA256
5f07867d08f9e18f24e897094f444162d940c68d05a3270738950fb3588c019e
-
SHA512
5227ec10548d954cff7a217034966a827c21379ac7fed4c5c54dba70fba0357745f8028e2098ea435448caf4b58a6b216ad0f1b5f08f378628eb12c911076f79
-
SSDEEP
3072:fXOftbVLxU8EHmW/FXUc0LN+QlSJ45fsUPK1ufNDmFuL:PqNVLxUHm4QR+qSSkcRI
Malware Config
Extracted
redline
rozena1114
jalocliche.xyz:81
chardhesha.xyz:81
-
auth_value
9fefd743a3b62bcd7c3e17a70fbdb3a8
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4808-133-0x00000000009D0000-0x00000000009D9000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2260-205-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
26AD.exe5C45.exe608C.exe63D9.exerovwer.exepid process 2612 26AD.exe 844 5C45.exe 1516 608C.exe 2504 63D9.exe 4124 rovwer.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
63D9.exerovwer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 63D9.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation rovwer.exe -
Loads dropped DLL 1 IoCs
Processes:
608C.exepid process 1516 608C.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
608C.exedescription pid process target process PID 1516 set thread context of 2260 1516 608C.exe ngentask.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3388 2504 WerFault.exe 63D9.exe 2904 2612 WerFault.exe 26AD.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
5f07867d08f9e18f24e897094f444162d940c68d05a3270738950fb3588c019e.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5f07867d08f9e18f24e897094f444162d940c68d05a3270738950fb3588c019e.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5f07867d08f9e18f24e897094f444162d940c68d05a3270738950fb3588c019e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5f07867d08f9e18f24e897094f444162d940c68d05a3270738950fb3588c019e.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5f07867d08f9e18f24e897094f444162d940c68d05a3270738950fb3588c019e.exepid process 4808 5f07867d08f9e18f24e897094f444162d940c68d05a3270738950fb3588c019e.exe 4808 5f07867d08f9e18f24e897094f444162d940c68d05a3270738950fb3588c019e.exe 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1272 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
5f07867d08f9e18f24e897094f444162d940c68d05a3270738950fb3588c019e.exepid process 4808 5f07867d08f9e18f24e897094f444162d940c68d05a3270738950fb3588c019e.exe 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 1272 -
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes:
26AD.exengentask.exedescription pid process Token: SeDebugPrivilege 2612 26AD.exe Token: SeShutdownPrivilege 1272 Token: SeCreatePagefilePrivilege 1272 Token: SeShutdownPrivilege 1272 Token: SeCreatePagefilePrivilege 1272 Token: SeShutdownPrivilege 1272 Token: SeCreatePagefilePrivilege 1272 Token: SeShutdownPrivilege 1272 Token: SeCreatePagefilePrivilege 1272 Token: SeShutdownPrivilege 1272 Token: SeCreatePagefilePrivilege 1272 Token: SeShutdownPrivilege 1272 Token: SeCreatePagefilePrivilege 1272 Token: SeShutdownPrivilege 1272 Token: SeCreatePagefilePrivilege 1272 Token: SeShutdownPrivilege 1272 Token: SeCreatePagefilePrivilege 1272 Token: SeShutdownPrivilege 1272 Token: SeCreatePagefilePrivilege 1272 Token: SeShutdownPrivilege 1272 Token: SeCreatePagefilePrivilege 1272 Token: SeShutdownPrivilege 1272 Token: SeCreatePagefilePrivilege 1272 Token: SeShutdownPrivilege 1272 Token: SeCreatePagefilePrivilege 1272 Token: SeShutdownPrivilege 1272 Token: SeCreatePagefilePrivilege 1272 Token: SeShutdownPrivilege 1272 Token: SeCreatePagefilePrivilege 1272 Token: SeDebugPrivilege 2260 ngentask.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
63D9.exerovwer.execmd.exe608C.exedescription pid process target process PID 1272 wrote to memory of 2612 1272 26AD.exe PID 1272 wrote to memory of 2612 1272 26AD.exe PID 1272 wrote to memory of 2612 1272 26AD.exe PID 1272 wrote to memory of 844 1272 5C45.exe PID 1272 wrote to memory of 844 1272 5C45.exe PID 1272 wrote to memory of 1516 1272 608C.exe PID 1272 wrote to memory of 1516 1272 608C.exe PID 1272 wrote to memory of 1516 1272 608C.exe PID 1272 wrote to memory of 2504 1272 63D9.exe PID 1272 wrote to memory of 2504 1272 63D9.exe PID 1272 wrote to memory of 2504 1272 63D9.exe PID 1272 wrote to memory of 4700 1272 explorer.exe PID 1272 wrote to memory of 4700 1272 explorer.exe PID 1272 wrote to memory of 4700 1272 explorer.exe PID 1272 wrote to memory of 4700 1272 explorer.exe PID 2504 wrote to memory of 4124 2504 63D9.exe rovwer.exe PID 2504 wrote to memory of 4124 2504 63D9.exe rovwer.exe PID 2504 wrote to memory of 4124 2504 63D9.exe rovwer.exe PID 1272 wrote to memory of 4324 1272 explorer.exe PID 1272 wrote to memory of 4324 1272 explorer.exe PID 1272 wrote to memory of 4324 1272 explorer.exe PID 1272 wrote to memory of 1592 1272 explorer.exe PID 1272 wrote to memory of 1592 1272 explorer.exe PID 1272 wrote to memory of 1592 1272 explorer.exe PID 1272 wrote to memory of 1592 1272 explorer.exe PID 4124 wrote to memory of 3892 4124 rovwer.exe schtasks.exe PID 4124 wrote to memory of 3892 4124 rovwer.exe schtasks.exe PID 4124 wrote to memory of 3892 4124 rovwer.exe schtasks.exe PID 4124 wrote to memory of 4960 4124 rovwer.exe cmd.exe PID 4124 wrote to memory of 4960 4124 rovwer.exe cmd.exe PID 4124 wrote to memory of 4960 4124 rovwer.exe cmd.exe PID 4960 wrote to memory of 2028 4960 cmd.exe cmd.exe PID 4960 wrote to memory of 2028 4960 cmd.exe cmd.exe PID 4960 wrote to memory of 2028 4960 cmd.exe cmd.exe PID 4960 wrote to memory of 3584 4960 cmd.exe cacls.exe PID 4960 wrote to memory of 3584 4960 cmd.exe cacls.exe PID 4960 wrote to memory of 3584 4960 cmd.exe cacls.exe PID 4960 wrote to memory of 1608 4960 cmd.exe cacls.exe PID 4960 wrote to memory of 1608 4960 cmd.exe cacls.exe PID 4960 wrote to memory of 1608 4960 cmd.exe cacls.exe PID 4960 wrote to memory of 4600 4960 cmd.exe cmd.exe PID 4960 wrote to memory of 4600 4960 cmd.exe cmd.exe PID 4960 wrote to memory of 4600 4960 cmd.exe cmd.exe PID 1272 wrote to memory of 4800 1272 explorer.exe PID 1272 wrote to memory of 4800 1272 explorer.exe PID 1272 wrote to memory of 4800 1272 explorer.exe PID 4960 wrote to memory of 2580 4960 cmd.exe cacls.exe PID 4960 wrote to memory of 2580 4960 cmd.exe cacls.exe PID 4960 wrote to memory of 2580 4960 cmd.exe cacls.exe PID 4960 wrote to memory of 2392 4960 cmd.exe cacls.exe PID 4960 wrote to memory of 2392 4960 cmd.exe cacls.exe PID 4960 wrote to memory of 2392 4960 cmd.exe cacls.exe PID 1272 wrote to memory of 5088 1272 explorer.exe PID 1272 wrote to memory of 5088 1272 explorer.exe PID 1272 wrote to memory of 5088 1272 explorer.exe PID 1272 wrote to memory of 5088 1272 explorer.exe PID 1516 wrote to memory of 5048 1516 608C.exe ngentask.exe PID 1516 wrote to memory of 5048 1516 608C.exe ngentask.exe PID 1516 wrote to memory of 5048 1516 608C.exe ngentask.exe PID 1272 wrote to memory of 5012 1272 explorer.exe PID 1272 wrote to memory of 5012 1272 explorer.exe PID 1272 wrote to memory of 5012 1272 explorer.exe PID 1272 wrote to memory of 5012 1272 explorer.exe PID 1516 wrote to memory of 2260 1516 608C.exe ngentask.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f07867d08f9e18f24e897094f444162d940c68d05a3270738950fb3588c019e.exe"C:\Users\Admin\AppData\Local\Temp\5f07867d08f9e18f24e897094f444162d940c68d05a3270738950fb3588c019e.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4808
-
C:\Users\Admin\AppData\Local\Temp\26AD.exeC:\Users\Admin\AppData\Local\Temp\26AD.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 12682⤵
- Program crash
PID:2904
-
C:\Users\Admin\AppData\Local\Temp\5C45.exeC:\Users\Admin\AppData\Local\Temp\5C45.exe1⤵
- Executes dropped EXE
PID:844
-
C:\Users\Admin\AppData\Local\Temp\608C.exeC:\Users\Admin\AppData\Local\Temp\608C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵PID:5048
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2260
-
C:\Users\Admin\AppData\Local\Temp\63D9.exeC:\Users\Admin\AppData\Local\Temp\63D9.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe" /F3⤵
- Creates scheduled task(s)
PID:3892 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rovwer.exe" /P "Admin:N"&&CACLS "rovwer.exe" /P "Admin:R" /E&&echo Y|CACLS "..\99e342142d" /P "Admin:N"&&CACLS "..\99e342142d" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:2028
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:N"4⤵PID:3584
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:R" /E4⤵PID:1608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:4600
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:N"4⤵PID:2580
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:R" /E4⤵PID:2392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 9202⤵
- Program crash
PID:3388
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4700
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2504 -ip 25041⤵PID:1872
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2612 -ip 26121⤵PID:2076
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4800
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5088
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5012
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4132
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1084
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4824
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\26AD.exeFilesize
319KB
MD5c3081b35d96559c5147e345cf0c8127d
SHA17f31fcebafe52b901946e2773ab5ac743b3642d4
SHA2562612070967bc7754b26d42b6846c7dc832c15e1fdd961daed92e202bea5677e9
SHA512fd621266def5a923689195faf31477002786ce112d0b5d9985c846fceac0bd1c0e5dc4af2bf7fe120708f6abde339fa788e7b5e3c19bbfa04b4e602fa3f540f7
-
C:\Users\Admin\AppData\Local\Temp\26AD.exeFilesize
319KB
MD5c3081b35d96559c5147e345cf0c8127d
SHA17f31fcebafe52b901946e2773ab5ac743b3642d4
SHA2562612070967bc7754b26d42b6846c7dc832c15e1fdd961daed92e202bea5677e9
SHA512fd621266def5a923689195faf31477002786ce112d0b5d9985c846fceac0bd1c0e5dc4af2bf7fe120708f6abde339fa788e7b5e3c19bbfa04b4e602fa3f540f7
-
C:\Users\Admin\AppData\Local\Temp\5C45.exeFilesize
3.0MB
MD572efc55b476245e5955a405c50c3574f
SHA182cc77bb5e47520209e6564513e45c7d39573115
SHA256899d0f9e8343dab899e302fa6bda0ec1bc4133f00fbb6d9215eea4b79ccf4ecb
SHA51201e2eec8c951815b0cd98904ad5758a6c7c73f8b3e4cb4fcaeb80d8cb4f68366d06b2a309b3349d2a22f8904ec815feaf33f7a599bf7d56b3ec38188071604b8
-
C:\Users\Admin\AppData\Local\Temp\5C45.exeFilesize
3.0MB
MD572efc55b476245e5955a405c50c3574f
SHA182cc77bb5e47520209e6564513e45c7d39573115
SHA256899d0f9e8343dab899e302fa6bda0ec1bc4133f00fbb6d9215eea4b79ccf4ecb
SHA51201e2eec8c951815b0cd98904ad5758a6c7c73f8b3e4cb4fcaeb80d8cb4f68366d06b2a309b3349d2a22f8904ec815feaf33f7a599bf7d56b3ec38188071604b8
-
C:\Users\Admin\AppData\Local\Temp\608C.exeFilesize
1.1MB
MD55e7c07b9aa0668fa2971747bb4fade1e
SHA17fae544f73f2a8fb7a340a20ec47f76370fbd487
SHA256431a1c4ceae3411f5476eed27fc30ebd55138afb4c4e9dac3db9d4b8addbb361
SHA5125c9c65c99f0c8a5aaa2beac1a0c4304a1cb2ea808eeb6bbe11c2852d6e9fbad8bb68faa5f778848dade617e1c5ee1fb9dae566d7a064b05fdaa30a03019b868f
-
C:\Users\Admin\AppData\Local\Temp\608C.exeFilesize
1.1MB
MD55e7c07b9aa0668fa2971747bb4fade1e
SHA17fae544f73f2a8fb7a340a20ec47f76370fbd487
SHA256431a1c4ceae3411f5476eed27fc30ebd55138afb4c4e9dac3db9d4b8addbb361
SHA5125c9c65c99f0c8a5aaa2beac1a0c4304a1cb2ea808eeb6bbe11c2852d6e9fbad8bb68faa5f778848dade617e1c5ee1fb9dae566d7a064b05fdaa30a03019b868f
-
C:\Users\Admin\AppData\Local\Temp\63D9.exeFilesize
271KB
MD5886bbe617de74a51e9809a85cda219ca
SHA1014c44deff747fdb42178133cdf9fad19bae78c4
SHA256801018205aab0553098d7ed4998f66aaf06a7d8d56c6ba8e6d284fd3202779a7
SHA5121aadc4b37ead8b5bd857c421081d35c756481206552dbaeeab1cd4e2d9da92e79f9d4b77483abc2bdd4f7f80b0bbe1c7f57fce910420789c53b1dc87cba139cc
-
C:\Users\Admin\AppData\Local\Temp\63D9.exeFilesize
271KB
MD5886bbe617de74a51e9809a85cda219ca
SHA1014c44deff747fdb42178133cdf9fad19bae78c4
SHA256801018205aab0553098d7ed4998f66aaf06a7d8d56c6ba8e6d284fd3202779a7
SHA5121aadc4b37ead8b5bd857c421081d35c756481206552dbaeeab1cd4e2d9da92e79f9d4b77483abc2bdd4f7f80b0bbe1c7f57fce910420789c53b1dc87cba139cc
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
271KB
MD5886bbe617de74a51e9809a85cda219ca
SHA1014c44deff747fdb42178133cdf9fad19bae78c4
SHA256801018205aab0553098d7ed4998f66aaf06a7d8d56c6ba8e6d284fd3202779a7
SHA5121aadc4b37ead8b5bd857c421081d35c756481206552dbaeeab1cd4e2d9da92e79f9d4b77483abc2bdd4f7f80b0bbe1c7f57fce910420789c53b1dc87cba139cc
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
271KB
MD5886bbe617de74a51e9809a85cda219ca
SHA1014c44deff747fdb42178133cdf9fad19bae78c4
SHA256801018205aab0553098d7ed4998f66aaf06a7d8d56c6ba8e6d284fd3202779a7
SHA5121aadc4b37ead8b5bd857c421081d35c756481206552dbaeeab1cd4e2d9da92e79f9d4b77483abc2bdd4f7f80b0bbe1c7f57fce910420789c53b1dc87cba139cc
-
C:\Users\Admin\AppData\Local\Temp\advapi32.dllFilesize
1.1MB
MD5486536825ff5e3219a8702319e064907
SHA134f7f9211e2fd9c166fb36ed1d4121ebd427bebd
SHA2566ab2023a2bd76692a694a812bf86c341696810c61666586c09a343832f05dc01
SHA512f77404db724b9f8e93d84f2f9f0cee10b05638bda4445facbfd262eca52f073e285c10f153133fc35f9a426eb84e87e8e0b320f2815b2405ca3ada7ac2fded4c
-
memory/844-152-0x0000000000000000-mapping.dmp
-
memory/1084-210-0x0000000000E90000-0x0000000000E97000-memory.dmpFilesize
28KB
-
memory/1084-209-0x0000000000000000-mapping.dmp
-
memory/1084-211-0x0000000000E80000-0x0000000000E8D000-memory.dmpFilesize
52KB
-
memory/1084-226-0x0000000000E90000-0x0000000000E97000-memory.dmpFilesize
28KB
-
memory/1516-175-0x0000000002DFC000-0x0000000002EFA000-memory.dmpFilesize
1016KB
-
memory/1516-158-0x00000000028DE000-0x0000000002DEC000-memory.dmpFilesize
5.1MB
-
memory/1516-178-0x0000000011160000-0x00000000112DF000-memory.dmpFilesize
1.5MB
-
memory/1516-216-0x0000000002DFC000-0x0000000002EFA000-memory.dmpFilesize
1016KB
-
memory/1516-155-0x0000000000000000-mapping.dmp
-
memory/1516-194-0x0000000011160000-0x00000000112DF000-memory.dmpFilesize
1.5MB
-
memory/1592-177-0x0000000000130000-0x0000000000139000-memory.dmpFilesize
36KB
-
memory/1592-173-0x0000000000000000-mapping.dmp
-
memory/1592-219-0x0000000000140000-0x0000000000145000-memory.dmpFilesize
20KB
-
memory/1592-176-0x0000000000140000-0x0000000000145000-memory.dmpFilesize
20KB
-
memory/1608-185-0x0000000000000000-mapping.dmp
-
memory/2028-181-0x0000000000000000-mapping.dmp
-
memory/2260-203-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2260-205-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2260-202-0x0000000000000000-mapping.dmp
-
memory/2392-189-0x0000000000000000-mapping.dmp
-
memory/2504-159-0x0000000000000000-mapping.dmp
-
memory/2504-168-0x0000000000A0D000-0x0000000000A2C000-memory.dmpFilesize
124KB
-
memory/2504-171-0x0000000000400000-0x0000000000846000-memory.dmpFilesize
4.3MB
-
memory/2504-170-0x00000000008D0000-0x000000000090E000-memory.dmpFilesize
248KB
-
memory/2580-188-0x0000000000000000-mapping.dmp
-
memory/2612-143-0x0000000004D00000-0x0000000004D92000-memory.dmpFilesize
584KB
-
memory/2612-147-0x0000000005C00000-0x0000000005C3C000-memory.dmpFilesize
240KB
-
memory/2612-150-0x0000000006750000-0x0000000006C7C000-memory.dmpFilesize
5.2MB
-
memory/2612-151-0x0000000000669000-0x000000000069A000-memory.dmpFilesize
196KB
-
memory/2612-141-0x0000000000400000-0x00000000005A8000-memory.dmpFilesize
1.7MB
-
memory/2612-136-0x0000000000000000-mapping.dmp
-
memory/2612-145-0x0000000005410000-0x000000000551A000-memory.dmpFilesize
1.0MB
-
memory/2612-149-0x0000000006580000-0x0000000006742000-memory.dmpFilesize
1.8MB
-
memory/2612-142-0x0000000004E20000-0x00000000053C4000-memory.dmpFilesize
5.6MB
-
memory/2612-139-0x0000000000669000-0x000000000069A000-memory.dmpFilesize
196KB
-
memory/2612-148-0x0000000005E80000-0x0000000005EE6000-memory.dmpFilesize
408KB
-
memory/2612-140-0x0000000002200000-0x000000000223E000-memory.dmpFilesize
248KB
-
memory/2612-144-0x00000000055E0000-0x0000000005BF8000-memory.dmpFilesize
6.1MB
-
memory/2612-183-0x0000000000669000-0x000000000069A000-memory.dmpFilesize
196KB
-
memory/2612-146-0x0000000005540000-0x0000000005552000-memory.dmpFilesize
72KB
-
memory/2612-184-0x0000000000400000-0x00000000005A8000-memory.dmpFilesize
1.7MB
-
memory/3584-182-0x0000000000000000-mapping.dmp
-
memory/3892-179-0x0000000000000000-mapping.dmp
-
memory/4124-163-0x0000000000000000-mapping.dmp
-
memory/4124-192-0x000000000087D000-0x000000000089C000-memory.dmpFilesize
124KB
-
memory/4124-193-0x0000000000400000-0x0000000000846000-memory.dmpFilesize
4.3MB
-
memory/4124-222-0x0000000000400000-0x0000000000846000-memory.dmpFilesize
4.3MB
-
memory/4124-221-0x000000000087D000-0x000000000089C000-memory.dmpFilesize
124KB
-
memory/4132-208-0x0000000000EF0000-0x0000000000EFB000-memory.dmpFilesize
44KB
-
memory/4132-207-0x0000000000F00000-0x0000000000F06000-memory.dmpFilesize
24KB
-
memory/4132-225-0x0000000000F00000-0x0000000000F06000-memory.dmpFilesize
24KB
-
memory/4132-206-0x0000000000000000-mapping.dmp
-
memory/4324-172-0x0000000000340000-0x000000000034F000-memory.dmpFilesize
60KB
-
memory/4324-169-0x0000000000000000-mapping.dmp
-
memory/4324-218-0x0000000000350000-0x0000000000359000-memory.dmpFilesize
36KB
-
memory/4324-174-0x0000000000350000-0x0000000000359000-memory.dmpFilesize
36KB
-
memory/4600-186-0x0000000000000000-mapping.dmp
-
memory/4700-162-0x0000000000000000-mapping.dmp
-
memory/4700-167-0x0000000000BC0000-0x0000000000BCB000-memory.dmpFilesize
44KB
-
memory/4700-164-0x0000000000BD0000-0x0000000000BD7000-memory.dmpFilesize
28KB
-
memory/4700-217-0x0000000000BD0000-0x0000000000BD7000-memory.dmpFilesize
28KB
-
memory/4800-191-0x0000000000780000-0x000000000078C000-memory.dmpFilesize
48KB
-
memory/4800-220-0x0000000000790000-0x0000000000796000-memory.dmpFilesize
24KB
-
memory/4800-190-0x0000000000790000-0x0000000000796000-memory.dmpFilesize
24KB
-
memory/4800-187-0x0000000000000000-mapping.dmp
-
memory/4808-132-0x0000000000A5E000-0x0000000000A74000-memory.dmpFilesize
88KB
-
memory/4808-135-0x0000000000400000-0x000000000083D000-memory.dmpFilesize
4.2MB
-
memory/4808-134-0x0000000000400000-0x000000000083D000-memory.dmpFilesize
4.2MB
-
memory/4808-133-0x00000000009D0000-0x00000000009D9000-memory.dmpFilesize
36KB
-
memory/4824-227-0x00000000010F0000-0x00000000010F8000-memory.dmpFilesize
32KB
-
memory/4824-212-0x0000000000000000-mapping.dmp
-
memory/4824-213-0x00000000010F0000-0x00000000010F8000-memory.dmpFilesize
32KB
-
memory/4824-214-0x00000000010E0000-0x00000000010EB000-memory.dmpFilesize
44KB
-
memory/4960-180-0x0000000000000000-mapping.dmp
-
memory/5012-199-0x0000000000000000-mapping.dmp
-
memory/5012-201-0x0000000000EF0000-0x0000000000EF9000-memory.dmpFilesize
36KB
-
memory/5012-200-0x0000000000F00000-0x0000000000F05000-memory.dmpFilesize
20KB
-
memory/5012-224-0x0000000000F00000-0x0000000000F05000-memory.dmpFilesize
20KB
-
memory/5048-198-0x0000000000000000-mapping.dmp
-
memory/5088-196-0x0000000000E00000-0x0000000000E22000-memory.dmpFilesize
136KB
-
memory/5088-223-0x0000000000E00000-0x0000000000E22000-memory.dmpFilesize
136KB
-
memory/5088-195-0x0000000000000000-mapping.dmp
-
memory/5088-197-0x0000000000BC0000-0x0000000000BE7000-memory.dmpFilesize
156KB