Analysis
-
max time kernel
151s -
max time network
132s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
06-12-2022 14:31
Static task
static1
Behavioral task
behavioral1
Sample
4697ba3dd7344e258c0e9b0610a3fa4e3e41a6c6b03b81a5ab13c32824c729c5.exe
Resource
win10-20220901-en
General
-
Target
4697ba3dd7344e258c0e9b0610a3fa4e3e41a6c6b03b81a5ab13c32824c729c5.exe
-
Size
377KB
-
MD5
09d3e9b4c962319455719076104dbf66
-
SHA1
eaaf7964b79d7a25e4045a94b246260a759c434b
-
SHA256
4697ba3dd7344e258c0e9b0610a3fa4e3e41a6c6b03b81a5ab13c32824c729c5
-
SHA512
a1c100cd31d9fe47128f332b27ce0c11987a101e2e1b13b7ae4edf9c2be207c1409b7d23a8bf8b1d71f35a5e29e614e534fc746e028be09d0f4616b04de9fe84
-
SSDEEP
6144:EIAqvLz5e3+V+k5GNtqJyVEc/3AId/yigBfCtPMk:EIAofk32wSgVZ/QiyzB
Malware Config
Extracted
redline
YT
65.21.5.58:48811
-
auth_value
fb878dde7f3b4ad1e1bc26d24db36d28
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3052-129-0x0000000000030000-0x0000000000039000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
27CB.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 27CB.exe -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
27CB.exe2914.exepid process 4372 27CB.exe 3748 2914.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
27CB.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 27CB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 27CB.exe -
Deletes itself 1 IoCs
Processes:
pid process 3036 -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\27CB.exe themida C:\Users\Admin\AppData\Local\Temp\27CB.exe themida behavioral1/memory/4372-203-0x0000000000EE0000-0x00000000013E0000-memory.dmp themida behavioral1/memory/4372-547-0x0000000000EE0000-0x00000000013E0000-memory.dmp themida -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Processes:
27CB.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 27CB.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
27CB.exepid process 4372 27CB.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
27CB.exe2914.exedescription pid process target process PID 4372 set thread context of 3816 4372 27CB.exe InstallUtil.exe PID 3748 set thread context of 4716 3748 2914.exe vbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4852 3748 WerFault.exe 2914.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
4697ba3dd7344e258c0e9b0610a3fa4e3e41a6c6b03b81a5ab13c32824c729c5.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4697ba3dd7344e258c0e9b0610a3fa4e3e41a6c6b03b81a5ab13c32824c729c5.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4697ba3dd7344e258c0e9b0610a3fa4e3e41a6c6b03b81a5ab13c32824c729c5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4697ba3dd7344e258c0e9b0610a3fa4e3e41a6c6b03b81a5ab13c32824c729c5.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4697ba3dd7344e258c0e9b0610a3fa4e3e41a6c6b03b81a5ab13c32824c729c5.exepid process 3052 4697ba3dd7344e258c0e9b0610a3fa4e3e41a6c6b03b81a5ab13c32824c729c5.exe 3052 4697ba3dd7344e258c0e9b0610a3fa4e3e41a6c6b03b81a5ab13c32824c729c5.exe 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3036 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
4697ba3dd7344e258c0e9b0610a3fa4e3e41a6c6b03b81a5ab13c32824c729c5.exepid process 3052 4697ba3dd7344e258c0e9b0610a3fa4e3e41a6c6b03b81a5ab13c32824c729c5.exe 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 -
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
27CB.exeInstallUtil.exevbc.exedescription pid process Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeDebugPrivilege 4372 27CB.exe Token: SeDebugPrivilege 3816 InstallUtil.exe Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeDebugPrivilege 4716 vbc.exe Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
27CB.exe2914.exedescription pid process target process PID 3036 wrote to memory of 4372 3036 27CB.exe PID 3036 wrote to memory of 4372 3036 27CB.exe PID 3036 wrote to memory of 3748 3036 2914.exe PID 3036 wrote to memory of 3748 3036 2914.exe PID 3036 wrote to memory of 3748 3036 2914.exe PID 3036 wrote to memory of 2300 3036 explorer.exe PID 3036 wrote to memory of 2300 3036 explorer.exe PID 3036 wrote to memory of 2300 3036 explorer.exe PID 3036 wrote to memory of 2300 3036 explorer.exe PID 3036 wrote to memory of 4608 3036 explorer.exe PID 3036 wrote to memory of 4608 3036 explorer.exe PID 3036 wrote to memory of 4608 3036 explorer.exe PID 3036 wrote to memory of 3688 3036 explorer.exe PID 3036 wrote to memory of 3688 3036 explorer.exe PID 3036 wrote to memory of 3688 3036 explorer.exe PID 3036 wrote to memory of 3688 3036 explorer.exe PID 3036 wrote to memory of 4316 3036 explorer.exe PID 3036 wrote to memory of 4316 3036 explorer.exe PID 3036 wrote to memory of 4316 3036 explorer.exe PID 3036 wrote to memory of 1888 3036 explorer.exe PID 3036 wrote to memory of 1888 3036 explorer.exe PID 3036 wrote to memory of 1888 3036 explorer.exe PID 3036 wrote to memory of 1888 3036 explorer.exe PID 3036 wrote to memory of 4924 3036 explorer.exe PID 3036 wrote to memory of 4924 3036 explorer.exe PID 3036 wrote to memory of 4924 3036 explorer.exe PID 3036 wrote to memory of 4924 3036 explorer.exe PID 3036 wrote to memory of 4476 3036 explorer.exe PID 3036 wrote to memory of 4476 3036 explorer.exe PID 3036 wrote to memory of 4476 3036 explorer.exe PID 3036 wrote to memory of 4476 3036 explorer.exe PID 3036 wrote to memory of 4972 3036 explorer.exe PID 3036 wrote to memory of 4972 3036 explorer.exe PID 3036 wrote to memory of 4972 3036 explorer.exe PID 3036 wrote to memory of 2100 3036 explorer.exe PID 3036 wrote to memory of 2100 3036 explorer.exe PID 3036 wrote to memory of 2100 3036 explorer.exe PID 3036 wrote to memory of 2100 3036 explorer.exe PID 4372 wrote to memory of 3792 4372 27CB.exe InstallUtil.exe PID 4372 wrote to memory of 3792 4372 27CB.exe InstallUtil.exe PID 4372 wrote to memory of 3792 4372 27CB.exe InstallUtil.exe PID 4372 wrote to memory of 2036 4372 27CB.exe InstallUtil.exe PID 4372 wrote to memory of 2036 4372 27CB.exe InstallUtil.exe PID 4372 wrote to memory of 2036 4372 27CB.exe InstallUtil.exe PID 4372 wrote to memory of 3816 4372 27CB.exe InstallUtil.exe PID 4372 wrote to memory of 3816 4372 27CB.exe InstallUtil.exe PID 4372 wrote to memory of 3816 4372 27CB.exe InstallUtil.exe PID 4372 wrote to memory of 3816 4372 27CB.exe InstallUtil.exe PID 4372 wrote to memory of 3816 4372 27CB.exe InstallUtil.exe PID 4372 wrote to memory of 3816 4372 27CB.exe InstallUtil.exe PID 4372 wrote to memory of 3816 4372 27CB.exe InstallUtil.exe PID 4372 wrote to memory of 3816 4372 27CB.exe InstallUtil.exe PID 3748 wrote to memory of 4716 3748 2914.exe vbc.exe PID 3748 wrote to memory of 4716 3748 2914.exe vbc.exe PID 3748 wrote to memory of 4716 3748 2914.exe vbc.exe PID 3748 wrote to memory of 4716 3748 2914.exe vbc.exe PID 3748 wrote to memory of 4716 3748 2914.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4697ba3dd7344e258c0e9b0610a3fa4e3e41a6c6b03b81a5ab13c32824c729c5.exe"C:\Users\Admin\AppData\Local\Temp\4697ba3dd7344e258c0e9b0610a3fa4e3e41a6c6b03b81a5ab13c32824c729c5.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\27CB.exeC:\Users\Admin\AppData\Local\Temp\27CB.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2914.exeC:\Users\Admin\AppData\Local\Temp\2914.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 5002⤵
- Program crash
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\27CB.exeFilesize
1.5MB
MD5d1964c1b30d01262eccaee06c600d726
SHA1e213ef1a963cc1825b9183742bb2af555da72efe
SHA25606ece311c226daf62863e5791def4efee02dacfeacc6b7635095d0a63b715a99
SHA51202d5f5d71ef785dbc9a2c7bf960d60a19a7eeba3ae8227442c21ba153fc2443e0d1e5ec8319e70a55defcb1057f43d4f41602ba2089a64615dc3aaa8569d47a5
-
C:\Users\Admin\AppData\Local\Temp\27CB.exeFilesize
1.5MB
MD5d1964c1b30d01262eccaee06c600d726
SHA1e213ef1a963cc1825b9183742bb2af555da72efe
SHA25606ece311c226daf62863e5791def4efee02dacfeacc6b7635095d0a63b715a99
SHA51202d5f5d71ef785dbc9a2c7bf960d60a19a7eeba3ae8227442c21ba153fc2443e0d1e5ec8319e70a55defcb1057f43d4f41602ba2089a64615dc3aaa8569d47a5
-
C:\Users\Admin\AppData\Local\Temp\2914.exeFilesize
510KB
MD52c7867a1749edef10274f3e34b047865
SHA1c2009f052e54f3c788e1872e7ac6f4d5fea218f9
SHA2568845215ed3299ff3381580ab3c1e1feb69d8c44361bc15d64b57a597147a74c7
SHA51260b503650f7f4ca7d14cfa7dabc1cda68eee8f0e34800fb160f44b3af9135bf27b15c57e26f19301baa1eb4eb6a6191cfa70d8ca28361db71969f7c0c3435e68
-
C:\Users\Admin\AppData\Local\Temp\2914.exeFilesize
510KB
MD52c7867a1749edef10274f3e34b047865
SHA1c2009f052e54f3c788e1872e7ac6f4d5fea218f9
SHA2568845215ed3299ff3381580ab3c1e1feb69d8c44361bc15d64b57a597147a74c7
SHA51260b503650f7f4ca7d14cfa7dabc1cda68eee8f0e34800fb160f44b3af9135bf27b15c57e26f19301baa1eb4eb6a6191cfa70d8ca28361db71969f7c0c3435e68
-
memory/1888-551-0x0000000003600000-0x0000000003627000-memory.dmpFilesize
156KB
-
memory/1888-310-0x0000000000000000-mapping.dmp
-
memory/1888-515-0x0000000003630000-0x0000000003652000-memory.dmpFilesize
136KB
-
memory/2100-647-0x0000000000AC0000-0x0000000000ACB000-memory.dmpFilesize
44KB
-
memory/2100-624-0x0000000000AD0000-0x0000000000AD8000-memory.dmpFilesize
32KB
-
memory/2100-429-0x0000000000000000-mapping.dmp
-
memory/2300-228-0x0000000000000000-mapping.dmp
-
memory/2300-658-0x0000000000D30000-0x0000000000D37000-memory.dmpFilesize
28KB
-
memory/2300-362-0x0000000000D20000-0x0000000000D2B000-memory.dmpFilesize
44KB
-
memory/2300-332-0x0000000000D30000-0x0000000000D37000-memory.dmpFilesize
28KB
-
memory/3036-190-0x00000000022A0000-0x00000000022B0000-memory.dmpFilesize
64KB
-
memory/3036-163-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-192-0x00000000022A0000-0x00000000022B0000-memory.dmpFilesize
64KB
-
memory/3036-191-0x00000000022A0000-0x00000000022B0000-memory.dmpFilesize
64KB
-
memory/3036-189-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-185-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-186-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-187-0x00000000022A0000-0x00000000022B0000-memory.dmpFilesize
64KB
-
memory/3036-188-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-181-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-184-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-182-0x0000000000770000-0x0000000000780000-memory.dmpFilesize
64KB
-
memory/3036-179-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-178-0x0000000000660000-0x0000000000670000-memory.dmpFilesize
64KB
-
memory/3036-176-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-175-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-174-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-173-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-172-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-169-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-166-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-165-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-164-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-156-0x0000000000660000-0x0000000000670000-memory.dmpFilesize
64KB
-
memory/3036-158-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3036-161-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3052-148-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-134-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-152-0x00000000005F1000-0x0000000000606000-memory.dmpFilesize
84KB
-
memory/3052-151-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-150-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-149-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-132-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-147-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-146-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-145-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-144-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-143-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-142-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-141-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-140-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-139-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-138-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-137-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-136-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-135-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-130-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-153-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/3052-133-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-118-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-131-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/3052-129-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/3052-128-0x00000000005F1000-0x0000000000606000-memory.dmpFilesize
84KB
-
memory/3052-127-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-126-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-125-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-117-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-124-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-123-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-119-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-120-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-122-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3052-121-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3688-435-0x00000000008A0000-0x00000000008A5000-memory.dmpFilesize
20KB
-
memory/3688-481-0x0000000000890000-0x0000000000899000-memory.dmpFilesize
36KB
-
memory/3688-664-0x00000000008A0000-0x00000000008A5000-memory.dmpFilesize
20KB
-
memory/3688-263-0x0000000000000000-mapping.dmp
-
memory/3748-200-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3748-204-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3748-214-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3748-215-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3748-216-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3748-217-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3748-218-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3748-212-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3748-201-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3748-198-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3748-199-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3748-208-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3748-206-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3748-211-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3748-213-0x0000000077470000-0x00000000775FE000-memory.dmpFilesize
1.6MB
-
memory/3748-196-0x0000000000000000-mapping.dmp
-
memory/3816-659-0x0000000005490000-0x00000000054DB000-memory.dmpFilesize
300KB
-
memory/3816-656-0x0000000005320000-0x000000000535E000-memory.dmpFilesize
248KB
-
memory/3816-534-0x000000000041B576-mapping.dmp
-
memory/3816-654-0x00000000052B0000-0x00000000052C2000-memory.dmpFilesize
72KB
-
memory/3816-652-0x0000000005380000-0x000000000548A000-memory.dmpFilesize
1.0MB
-
memory/3816-651-0x0000000005820000-0x0000000005E26000-memory.dmpFilesize
6.0MB
-
memory/3816-665-0x0000000006330000-0x000000000682E000-memory.dmpFilesize
5.0MB
-
memory/3816-667-0x0000000005640000-0x00000000056A6000-memory.dmpFilesize
408KB
-
memory/3816-628-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3816-675-0x0000000006210000-0x00000000062A2000-memory.dmpFilesize
584KB
-
memory/3816-681-0x0000000007890000-0x0000000007A52000-memory.dmpFilesize
1.8MB
-
memory/3816-682-0x0000000007F90000-0x00000000084BC000-memory.dmpFilesize
5.2MB
-
memory/4316-305-0x0000000000560000-0x000000000056C000-memory.dmpFilesize
48KB
-
memory/4316-285-0x0000000000000000-mapping.dmp
-
memory/4316-302-0x0000000000570000-0x0000000000576000-memory.dmpFilesize
24KB
-
memory/4316-645-0x0000000000570000-0x0000000000576000-memory.dmpFilesize
24KB
-
memory/4372-553-0x00007FFF16CB0000-0x00007FFF16E8B000-memory.dmpFilesize
1.9MB
-
memory/4372-209-0x00000158116F0000-0x0000015811768000-memory.dmpFilesize
480KB
-
memory/4372-203-0x0000000000EE0000-0x00000000013E0000-memory.dmpFilesize
5.0MB
-
memory/4372-472-0x0000000000EE0000-0x00000000013E0000-memory.dmpFilesize
5.0MB
-
memory/4372-205-0x0000000000EE0000-0x00000000013E0000-memory.dmpFilesize
5.0MB
-
memory/4372-193-0x0000000000000000-mapping.dmp
-
memory/4372-477-0x00007FFF16CB0000-0x00007FFF16E8B000-memory.dmpFilesize
1.9MB
-
memory/4372-210-0x00007FFF16CB0000-0x00007FFF16E8B000-memory.dmpFilesize
1.9MB
-
memory/4372-547-0x0000000000EE0000-0x00000000013E0000-memory.dmpFilesize
5.0MB
-
memory/4476-676-0x0000000000C60000-0x0000000000C66000-memory.dmpFilesize
24KB
-
memory/4476-596-0x0000000000C60000-0x0000000000C66000-memory.dmpFilesize
24KB
-
memory/4476-621-0x0000000000C50000-0x0000000000C5B000-memory.dmpFilesize
44KB
-
memory/4476-365-0x0000000000000000-mapping.dmp
-
memory/4608-590-0x00000000005F0000-0x00000000005F9000-memory.dmpFilesize
36KB
-
memory/4608-255-0x00000000005F0000-0x00000000005F9000-memory.dmpFilesize
36KB
-
memory/4608-247-0x0000000000000000-mapping.dmp
-
memory/4608-257-0x00000000005E0000-0x00000000005EF000-memory.dmpFilesize
60KB
-
memory/4716-755-0x00000000096C0000-0x000000000970B000-memory.dmpFilesize
300KB
-
memory/4716-731-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4716-695-0x000000000041B576-mapping.dmp
-
memory/4924-557-0x00000000003E0000-0x00000000003E5000-memory.dmpFilesize
20KB
-
memory/4924-593-0x00000000003D0000-0x00000000003D9000-memory.dmpFilesize
36KB
-
memory/4924-337-0x0000000000000000-mapping.dmp
-
memory/4972-426-0x0000000000880000-0x0000000000887000-memory.dmpFilesize
28KB
-
memory/4972-431-0x00000000005F0000-0x00000000005FD000-memory.dmpFilesize
52KB
-
memory/4972-663-0x0000000000880000-0x0000000000887000-memory.dmpFilesize
28KB
-
memory/4972-396-0x0000000000000000-mapping.dmp