Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
18-11-2022 03:10
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
General
-
Target
file.exe
-
Size
164KB
-
MD5
873337968935ffd53fbb88ae86ba46f4
-
SHA1
066d215fea06483ab0c95035f3b4e99258887356
-
SHA256
dc0af5683ce510948ca084132a0fa0eda830021d744a8b8663800df28551babb
-
SHA512
8dcf86f9b668e06f1f8414cf319f48fd5262bf0d82ad3ea871a15f172f937ed106ee131f7f39e9bd85d5f2e23a5eaeab3e2a9108cb37f706dc59b9b2a2914b89
-
SSDEEP
3072:6f6nmm5dFLg85IiMlWYQw48qrh8dipYD0iytNR6GYSU/:6ymm5LyLSqCYD0iqR3Y
Malware Config
Extracted
redline
5m
chardhesha.xyz:81
jalocliche.xyz:81
-
auth_value
7c8e8b4b3a28fd1de43f43277f38b9e3
Extracted
vidar
55.7
1827
https://t.me/deadftx
https://www.ultimate-guitar.com/u/smbfupkuhrgc1
-
profile_id
1827
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2028-133-0x00000000006D0000-0x00000000006D9000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1020-149-0x00000000004221BA-mapping.dmp family_redline behavioral2/memory/1020-148-0x0000000000400000-0x000000000043E000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
E4B7.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ E4B7.exe -
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
E4B7.exeFB4E.exe63C.exeCF3.exepid process 1876 E4B7.exe 5096 FB4E.exe 1856 63C.exe 4220 CF3.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
E4B7.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion E4B7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion E4B7.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
FB4E.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation FB4E.exe -
Loads dropped DLL 2 IoCs
Processes:
FB4E.exepid process 5096 FB4E.exe 5096 FB4E.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\E4B7.exe themida C:\Users\Admin\AppData\Local\Temp\E4B7.exe themida behavioral2/memory/1876-142-0x0000000001000000-0x0000000001812000-memory.dmp themida behavioral2/memory/1876-150-0x0000000001000000-0x0000000001812000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
E4B7.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA E4B7.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
E4B7.exepid process 1876 E4B7.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
E4B7.exedescription pid process target process PID 1876 set thread context of 1020 1876 E4B7.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4308 5096 WerFault.exe FB4E.exe 3964 1856 WerFault.exe 63C.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
FB4E.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 FB4E.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString FB4E.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4360 timeout.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 165 Go-http-client/1.1 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 2028 file.exe 2028 file.exe 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2528 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
file.exepid process 2028 file.exe 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 2528 -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
63C.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1856 63C.exe Token: SeShutdownPrivilege 2528 Token: SeCreatePagefilePrivilege 2528 Token: SeShutdownPrivilege 2528 Token: SeCreatePagefilePrivilege 2528 Token: SeDebugPrivilege 1020 InstallUtil.exe Token: SeShutdownPrivilege 2528 Token: SeCreatePagefilePrivilege 2528 Token: SeShutdownPrivilege 2528 Token: SeCreatePagefilePrivilege 2528 Token: SeShutdownPrivilege 2528 Token: SeCreatePagefilePrivilege 2528 Token: SeShutdownPrivilege 2528 Token: SeCreatePagefilePrivilege 2528 -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
E4B7.exeFB4E.execmd.exedescription pid process target process PID 2528 wrote to memory of 1876 2528 E4B7.exe PID 2528 wrote to memory of 1876 2528 E4B7.exe PID 2528 wrote to memory of 5096 2528 FB4E.exe PID 2528 wrote to memory of 5096 2528 FB4E.exe PID 2528 wrote to memory of 5096 2528 FB4E.exe PID 1876 wrote to memory of 1020 1876 E4B7.exe InstallUtil.exe PID 1876 wrote to memory of 1020 1876 E4B7.exe InstallUtil.exe PID 1876 wrote to memory of 1020 1876 E4B7.exe InstallUtil.exe PID 1876 wrote to memory of 1020 1876 E4B7.exe InstallUtil.exe PID 1876 wrote to memory of 1020 1876 E4B7.exe InstallUtil.exe PID 1876 wrote to memory of 1020 1876 E4B7.exe InstallUtil.exe PID 1876 wrote to memory of 1020 1876 E4B7.exe InstallUtil.exe PID 1876 wrote to memory of 1020 1876 E4B7.exe InstallUtil.exe PID 2528 wrote to memory of 1856 2528 63C.exe PID 2528 wrote to memory of 1856 2528 63C.exe PID 2528 wrote to memory of 1856 2528 63C.exe PID 2528 wrote to memory of 4220 2528 CF3.exe PID 2528 wrote to memory of 4220 2528 CF3.exe PID 2528 wrote to memory of 3540 2528 explorer.exe PID 2528 wrote to memory of 3540 2528 explorer.exe PID 2528 wrote to memory of 3540 2528 explorer.exe PID 2528 wrote to memory of 3540 2528 explorer.exe PID 2528 wrote to memory of 3004 2528 explorer.exe PID 2528 wrote to memory of 3004 2528 explorer.exe PID 2528 wrote to memory of 3004 2528 explorer.exe PID 2528 wrote to memory of 1224 2528 explorer.exe PID 2528 wrote to memory of 1224 2528 explorer.exe PID 2528 wrote to memory of 1224 2528 explorer.exe PID 2528 wrote to memory of 1224 2528 explorer.exe PID 5096 wrote to memory of 4276 5096 FB4E.exe cmd.exe PID 5096 wrote to memory of 4276 5096 FB4E.exe cmd.exe PID 5096 wrote to memory of 4276 5096 FB4E.exe cmd.exe PID 4276 wrote to memory of 4360 4276 cmd.exe timeout.exe PID 4276 wrote to memory of 4360 4276 cmd.exe timeout.exe PID 4276 wrote to memory of 4360 4276 cmd.exe timeout.exe PID 2528 wrote to memory of 4380 2528 explorer.exe PID 2528 wrote to memory of 4380 2528 explorer.exe PID 2528 wrote to memory of 4380 2528 explorer.exe PID 2528 wrote to memory of 3640 2528 explorer.exe PID 2528 wrote to memory of 3640 2528 explorer.exe PID 2528 wrote to memory of 3640 2528 explorer.exe PID 2528 wrote to memory of 3640 2528 explorer.exe PID 2528 wrote to memory of 1160 2528 explorer.exe PID 2528 wrote to memory of 1160 2528 explorer.exe PID 2528 wrote to memory of 1160 2528 explorer.exe PID 2528 wrote to memory of 1160 2528 explorer.exe PID 2528 wrote to memory of 4648 2528 explorer.exe PID 2528 wrote to memory of 4648 2528 explorer.exe PID 2528 wrote to memory of 4648 2528 explorer.exe PID 2528 wrote to memory of 4648 2528 explorer.exe PID 2528 wrote to memory of 3480 2528 explorer.exe PID 2528 wrote to memory of 3480 2528 explorer.exe PID 2528 wrote to memory of 3480 2528 explorer.exe PID 2528 wrote to memory of 4832 2528 explorer.exe PID 2528 wrote to memory of 4832 2528 explorer.exe PID 2528 wrote to memory of 4832 2528 explorer.exe PID 2528 wrote to memory of 4832 2528 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\E4B7.exeC:\Users\Admin\AppData\Local\Temp\E4B7.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\FB4E.exeC:\Users\Admin\AppData\Local\Temp\FB4E.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\FB4E.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 19842⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\63C.exeC:\Users\Admin\AppData\Local\Temp\63C.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 12322⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\CF3.exeC:\Users\Admin\AppData\Local\Temp\CF3.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5096 -ip 50961⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1856 -ip 18561⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\Users\Admin\AppData\Local\Temp\63C.exeFilesize
293KB
MD52dee200193091be2f2321d921750c4ed
SHA14c5b6c7512be4d4e200c4141dc0e90bcabce4ca3
SHA2567330807028605eba5b4ecfaca0390b78cb04e4276d1de23eb95b407e1244ef12
SHA5124124e9bc1c7c587ce394ad35ec56fd3c6ec4466167df6e00ffa1d88b09b34fa69072d946337cad696223d31d85f8662ff9d5452c474d20cca06d91a8b9c608ad
-
C:\Users\Admin\AppData\Local\Temp\63C.exeFilesize
293KB
MD52dee200193091be2f2321d921750c4ed
SHA14c5b6c7512be4d4e200c4141dc0e90bcabce4ca3
SHA2567330807028605eba5b4ecfaca0390b78cb04e4276d1de23eb95b407e1244ef12
SHA5124124e9bc1c7c587ce394ad35ec56fd3c6ec4466167df6e00ffa1d88b09b34fa69072d946337cad696223d31d85f8662ff9d5452c474d20cca06d91a8b9c608ad
-
C:\Users\Admin\AppData\Local\Temp\CF3.exeFilesize
3.4MB
MD582a0ddf5bdbf6fbf9ce3756018b15a5a
SHA185fd0106591c051dd757508d792f77fb1c9d4b25
SHA256bf30e2e9edad080dc4976070260ac68887808ab44bea3721a3fca274e8faafa9
SHA51287d0e11d483351b1de5256969e1e25108b39c826e47d38e8155c9e9f278c4a0dd986de52b6a7762aeb70254128c99c4bbcbd96a8c18583d0463f545b34aa26ee
-
C:\Users\Admin\AppData\Local\Temp\CF3.exeFilesize
3.4MB
MD582a0ddf5bdbf6fbf9ce3756018b15a5a
SHA185fd0106591c051dd757508d792f77fb1c9d4b25
SHA256bf30e2e9edad080dc4976070260ac68887808ab44bea3721a3fca274e8faafa9
SHA51287d0e11d483351b1de5256969e1e25108b39c826e47d38e8155c9e9f278c4a0dd986de52b6a7762aeb70254128c99c4bbcbd96a8c18583d0463f545b34aa26ee
-
C:\Users\Admin\AppData\Local\Temp\E4B7.exeFilesize
2.8MB
MD5745f773e1f0077e555f1ef6884992c31
SHA1d9abc362cc2d05688d7b9f36f23180d1809b72ee
SHA25698980b5d5796c559c08ea5b20a4a459048087758b1149767af47788ea3388fdd
SHA5122959b3ea037e45e11dcec6159c317384837ff6e1aaa715fbabb41f89a52dd3f3079ed9b0c359da952d08ea012eddae921cd465908a3d5a7fb2bebf49b2fba8fd
-
C:\Users\Admin\AppData\Local\Temp\E4B7.exeFilesize
2.8MB
MD5745f773e1f0077e555f1ef6884992c31
SHA1d9abc362cc2d05688d7b9f36f23180d1809b72ee
SHA25698980b5d5796c559c08ea5b20a4a459048087758b1149767af47788ea3388fdd
SHA5122959b3ea037e45e11dcec6159c317384837ff6e1aaa715fbabb41f89a52dd3f3079ed9b0c359da952d08ea012eddae921cd465908a3d5a7fb2bebf49b2fba8fd
-
C:\Users\Admin\AppData\Local\Temp\FB4E.exeFilesize
274KB
MD539e947318bd7c04280e9266f4b6c0a35
SHA11568c064c8aa24f17549fbbff895fc7eae574dcd
SHA256ce3c6cc7e3d80c26246bb01b910992d8c77b1c3f30ec28b79346f15224a3c746
SHA51205361abdf59148b763bb5705587a01d8309a5db3b6a8006b70793459af8e48db8c801d41917af9d96e2b74f154a58822d24c4f7585a84f2c5ec43d2f39fb1db2
-
C:\Users\Admin\AppData\Local\Temp\FB4E.exeFilesize
274KB
MD539e947318bd7c04280e9266f4b6c0a35
SHA11568c064c8aa24f17549fbbff895fc7eae574dcd
SHA256ce3c6cc7e3d80c26246bb01b910992d8c77b1c3f30ec28b79346f15224a3c746
SHA51205361abdf59148b763bb5705587a01d8309a5db3b6a8006b70793459af8e48db8c801d41917af9d96e2b74f154a58822d24c4f7585a84f2c5ec43d2f39fb1db2
-
memory/1020-220-0x0000000007AD0000-0x0000000007FFC000-memory.dmpFilesize
5.2MB
-
memory/1020-218-0x00000000073D0000-0x0000000007592000-memory.dmpFilesize
1.8MB
-
memory/1020-153-0x0000000005AD0000-0x00000000060E8000-memory.dmpFilesize
6.1MB
-
memory/1020-217-0x00000000068E0000-0x0000000006946000-memory.dmpFilesize
408KB
-
memory/1020-149-0x00000000004221BA-mapping.dmp
-
memory/1020-148-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1020-156-0x00000000055E0000-0x000000000561C000-memory.dmpFilesize
240KB
-
memory/1020-155-0x0000000005580000-0x0000000005592000-memory.dmpFilesize
72KB
-
memory/1020-154-0x0000000005650000-0x000000000575A000-memory.dmpFilesize
1.0MB
-
memory/1160-224-0x0000000000C20000-0x0000000000C25000-memory.dmpFilesize
20KB
-
memory/1160-225-0x0000000000C10000-0x0000000000C19000-memory.dmpFilesize
36KB
-
memory/1160-223-0x0000000000000000-mapping.dmp
-
memory/1160-243-0x0000000000C20000-0x0000000000C25000-memory.dmpFilesize
20KB
-
memory/1224-240-0x0000000000C10000-0x0000000000C15000-memory.dmpFilesize
20KB
-
memory/1224-209-0x0000000000C00000-0x0000000000C09000-memory.dmpFilesize
36KB
-
memory/1224-208-0x0000000000C10000-0x0000000000C15000-memory.dmpFilesize
20KB
-
memory/1224-207-0x0000000000000000-mapping.dmp
-
memory/1856-236-0x00000000008B9000-0x00000000008EA000-memory.dmpFilesize
196KB
-
memory/1856-233-0x00000000008B9000-0x00000000008EA000-memory.dmpFilesize
196KB
-
memory/1856-163-0x00000000008B9000-0x00000000008EA000-memory.dmpFilesize
196KB
-
memory/1856-165-0x0000000004BB0000-0x0000000005154000-memory.dmpFilesize
5.6MB
-
memory/1856-166-0x0000000000400000-0x00000000005AE000-memory.dmpFilesize
1.7MB
-
memory/1856-164-0x0000000000810000-0x000000000084E000-memory.dmpFilesize
248KB
-
memory/1856-157-0x0000000000000000-mapping.dmp
-
memory/1856-171-0x0000000005160000-0x00000000051F2000-memory.dmpFilesize
584KB
-
memory/1856-237-0x0000000000400000-0x00000000005AE000-memory.dmpFilesize
1.7MB
-
memory/1876-150-0x0000000001000000-0x0000000001812000-memory.dmpFilesize
8.1MB
-
memory/1876-144-0x00007FFC109D0000-0x00007FFC11491000-memory.dmpFilesize
10.8MB
-
memory/1876-139-0x0000000001000000-0x0000000001812000-memory.dmpFilesize
8.1MB
-
memory/1876-136-0x0000000000000000-mapping.dmp
-
memory/1876-142-0x0000000001000000-0x0000000001812000-memory.dmpFilesize
8.1MB
-
memory/1876-143-0x00007FFC2FB50000-0x00007FFC2FD45000-memory.dmpFilesize
2.0MB
-
memory/1876-152-0x00007FFC109D0000-0x00007FFC11491000-memory.dmpFilesize
10.8MB
-
memory/1876-151-0x00007FFC2FB50000-0x00007FFC2FD45000-memory.dmpFilesize
2.0MB
-
memory/2028-132-0x0000000000899000-0x00000000008A9000-memory.dmpFilesize
64KB
-
memory/2028-133-0x00000000006D0000-0x00000000006D9000-memory.dmpFilesize
36KB
-
memory/2028-134-0x0000000000400000-0x000000000058E000-memory.dmpFilesize
1.6MB
-
memory/2028-135-0x0000000000400000-0x000000000058E000-memory.dmpFilesize
1.6MB
-
memory/3004-205-0x0000000001240000-0x0000000001249000-memory.dmpFilesize
36KB
-
memory/3004-204-0x0000000000000000-mapping.dmp
-
memory/3004-239-0x0000000001240000-0x0000000001249000-memory.dmpFilesize
36KB
-
memory/3004-206-0x0000000001230000-0x000000000123F000-memory.dmpFilesize
60KB
-
memory/3480-230-0x0000000000CD0000-0x0000000000CD7000-memory.dmpFilesize
28KB
-
memory/3480-245-0x0000000000CD0000-0x0000000000CD7000-memory.dmpFilesize
28KB
-
memory/3480-229-0x0000000000000000-mapping.dmp
-
memory/3480-231-0x0000000000CC0000-0x0000000000CCD000-memory.dmpFilesize
52KB
-
memory/3540-195-0x0000000000000000-mapping.dmp
-
memory/3540-238-0x0000000000CB0000-0x0000000000CB7000-memory.dmpFilesize
28KB
-
memory/3540-202-0x0000000000CA0000-0x0000000000CAB000-memory.dmpFilesize
44KB
-
memory/3540-201-0x0000000000CB0000-0x0000000000CB7000-memory.dmpFilesize
28KB
-
memory/3640-222-0x0000000000A40000-0x0000000000A67000-memory.dmpFilesize
156KB
-
memory/3640-219-0x0000000000000000-mapping.dmp
-
memory/3640-221-0x0000000000A70000-0x0000000000A92000-memory.dmpFilesize
136KB
-
memory/3640-242-0x0000000000A70000-0x0000000000A92000-memory.dmpFilesize
136KB
-
memory/4220-189-0x000002B72B020000-0x000002B72B07C000-memory.dmpFilesize
368KB
-
memory/4220-187-0x0000000000860000-0x000000000105E000-memory.dmpFilesize
8.0MB
-
memory/4220-203-0x0000000000860000-0x000000000105E000-memory.dmpFilesize
8.0MB
-
memory/4220-183-0x00007FFC2E370000-0x00007FFC2E40E000-memory.dmpFilesize
632KB
-
memory/4220-167-0x0000000000000000-mapping.dmp
-
memory/4276-210-0x0000000000000000-mapping.dmp
-
memory/4360-211-0x0000000000000000-mapping.dmp
-
memory/4380-214-0x00000000008A0000-0x00000000008AC000-memory.dmpFilesize
48KB
-
memory/4380-241-0x00000000008B0000-0x00000000008B6000-memory.dmpFilesize
24KB
-
memory/4380-212-0x0000000000000000-mapping.dmp
-
memory/4380-213-0x00000000008B0000-0x00000000008B6000-memory.dmpFilesize
24KB
-
memory/4648-227-0x0000000000630000-0x0000000000636000-memory.dmpFilesize
24KB
-
memory/4648-226-0x0000000000000000-mapping.dmp
-
memory/4648-244-0x0000000000630000-0x0000000000636000-memory.dmpFilesize
24KB
-
memory/4648-228-0x0000000000620000-0x000000000062B000-memory.dmpFilesize
44KB
-
memory/4832-232-0x0000000000000000-mapping.dmp
-
memory/4832-235-0x0000000000C70000-0x0000000000C7B000-memory.dmpFilesize
44KB
-
memory/4832-234-0x0000000000C80000-0x0000000000C88000-memory.dmpFilesize
32KB
-
memory/4832-246-0x0000000000C80000-0x0000000000C88000-memory.dmpFilesize
32KB
-
memory/5096-175-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/5096-162-0x0000000000400000-0x00000000005A9000-memory.dmpFilesize
1.7MB
-
memory/5096-215-0x0000000000829000-0x0000000000855000-memory.dmpFilesize
176KB
-
memory/5096-160-0x0000000000829000-0x0000000000855000-memory.dmpFilesize
176KB
-
memory/5096-161-0x0000000000740000-0x000000000078A000-memory.dmpFilesize
296KB
-
memory/5096-216-0x0000000000400000-0x00000000005A9000-memory.dmpFilesize
1.7MB
-
memory/5096-145-0x0000000000000000-mapping.dmp