Analysis
-
max time kernel
164s -
max time network
176s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
07-12-2022 05:47
Static task
static1
General
-
Target
f22db49eb28bed665323bb791d0212a726ddc4c2c8abf0c90c8b33221ada9327.exe
-
Size
274KB
-
MD5
4b37463b99d718640c39c17913be9823
-
SHA1
ff04559f82f6172dcd40df67219adbab4297a8d0
-
SHA256
f22db49eb28bed665323bb791d0212a726ddc4c2c8abf0c90c8b33221ada9327
-
SHA512
3238389965842debee424428c33518c642bfc0440794a23c409b0f30b33c341bccf3003fd85e6c7cb971ccbcc99bd434153aa25351953b5935805c884fa8927f
-
SSDEEP
6144:H1fxU+meDCNl4QfoJy7RlfMCF7UEMusZ00:HtNmLNmQA2jFwEMus
Malware Config
Extracted
redline
YT
65.21.5.58:48811
-
auth_value
fb878dde7f3b4ad1e1bc26d24db36d28
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
91FA.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 91FA.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
gffdcdc91FA.exe947C.exepid process 2068 gffdcdc 3884 91FA.exe 2724 947C.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
91FA.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 91FA.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 91FA.exe -
Deletes itself 1 IoCs
Processes:
pid process 2420 -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\91FA.exe themida C:\Users\Admin\AppData\Local\Temp\91FA.exe themida behavioral1/memory/3884-201-0x0000000000AB0000-0x0000000000FB0000-memory.dmp themida behavioral1/memory/3884-240-0x0000000000AB0000-0x0000000000FB0000-memory.dmp themida -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Processes:
91FA.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 91FA.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
91FA.exepid process 3884 91FA.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
91FA.exe947C.exedescription pid process target process PID 3884 set thread context of 4664 3884 91FA.exe InstallUtil.exe PID 2724 set thread context of 4028 2724 947C.exe vbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4496 2724 WerFault.exe 947C.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
gffdcdcf22db49eb28bed665323bb791d0212a726ddc4c2c8abf0c90c8b33221ada9327.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gffdcdc Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f22db49eb28bed665323bb791d0212a726ddc4c2c8abf0c90c8b33221ada9327.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f22db49eb28bed665323bb791d0212a726ddc4c2c8abf0c90c8b33221ada9327.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f22db49eb28bed665323bb791d0212a726ddc4c2c8abf0c90c8b33221ada9327.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gffdcdc Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gffdcdc -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f22db49eb28bed665323bb791d0212a726ddc4c2c8abf0c90c8b33221ada9327.exepid process 2760 f22db49eb28bed665323bb791d0212a726ddc4c2c8abf0c90c8b33221ada9327.exe 2760 f22db49eb28bed665323bb791d0212a726ddc4c2c8abf0c90c8b33221ada9327.exe 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2420 -
Suspicious behavior: MapViewOfSection 20 IoCs
Processes:
f22db49eb28bed665323bb791d0212a726ddc4c2c8abf0c90c8b33221ada9327.exegffdcdcpid process 2760 f22db49eb28bed665323bb791d0212a726ddc4c2c8abf0c90c8b33221ada9327.exe 2068 gffdcdc 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 2420 -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
InstallUtil.exedescription pid process Token: SeShutdownPrivilege 2420 Token: SeCreatePagefilePrivilege 2420 Token: SeShutdownPrivilege 2420 Token: SeCreatePagefilePrivilege 2420 Token: SeShutdownPrivilege 2420 Token: SeCreatePagefilePrivilege 2420 Token: SeShutdownPrivilege 2420 Token: SeCreatePagefilePrivilege 2420 Token: SeShutdownPrivilege 2420 Token: SeCreatePagefilePrivilege 2420 Token: SeDebugPrivilege 4664 InstallUtil.exe Token: SeShutdownPrivilege 2420 Token: SeCreatePagefilePrivilege 2420 Token: SeShutdownPrivilege 2420 Token: SeCreatePagefilePrivilege 2420 Token: SeShutdownPrivilege 2420 Token: SeCreatePagefilePrivilege 2420 -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
91FA.exe947C.exedescription pid process target process PID 2420 wrote to memory of 3884 2420 91FA.exe PID 2420 wrote to memory of 3884 2420 91FA.exe PID 2420 wrote to memory of 2724 2420 947C.exe PID 2420 wrote to memory of 2724 2420 947C.exe PID 2420 wrote to memory of 2724 2420 947C.exe PID 2420 wrote to memory of 4248 2420 explorer.exe PID 2420 wrote to memory of 4248 2420 explorer.exe PID 2420 wrote to memory of 4248 2420 explorer.exe PID 2420 wrote to memory of 4248 2420 explorer.exe PID 3884 wrote to memory of 4664 3884 91FA.exe InstallUtil.exe PID 3884 wrote to memory of 4664 3884 91FA.exe InstallUtil.exe PID 3884 wrote to memory of 4664 3884 91FA.exe InstallUtil.exe PID 3884 wrote to memory of 4664 3884 91FA.exe InstallUtil.exe PID 3884 wrote to memory of 4664 3884 91FA.exe InstallUtil.exe PID 3884 wrote to memory of 4664 3884 91FA.exe InstallUtil.exe PID 3884 wrote to memory of 4664 3884 91FA.exe InstallUtil.exe PID 3884 wrote to memory of 4664 3884 91FA.exe InstallUtil.exe PID 2420 wrote to memory of 5092 2420 explorer.exe PID 2420 wrote to memory of 5092 2420 explorer.exe PID 2420 wrote to memory of 5092 2420 explorer.exe PID 2420 wrote to memory of 4560 2420 explorer.exe PID 2420 wrote to memory of 4560 2420 explorer.exe PID 2420 wrote to memory of 4560 2420 explorer.exe PID 2420 wrote to memory of 4560 2420 explorer.exe PID 2420 wrote to memory of 4872 2420 explorer.exe PID 2420 wrote to memory of 4872 2420 explorer.exe PID 2420 wrote to memory of 4872 2420 explorer.exe PID 2420 wrote to memory of 3176 2420 explorer.exe PID 2420 wrote to memory of 3176 2420 explorer.exe PID 2420 wrote to memory of 3176 2420 explorer.exe PID 2420 wrote to memory of 3176 2420 explorer.exe PID 2420 wrote to memory of 1560 2420 explorer.exe PID 2420 wrote to memory of 1560 2420 explorer.exe PID 2420 wrote to memory of 1560 2420 explorer.exe PID 2420 wrote to memory of 1560 2420 explorer.exe PID 2420 wrote to memory of 3348 2420 explorer.exe PID 2420 wrote to memory of 3348 2420 explorer.exe PID 2420 wrote to memory of 3348 2420 explorer.exe PID 2420 wrote to memory of 3348 2420 explorer.exe PID 2420 wrote to memory of 896 2420 explorer.exe PID 2420 wrote to memory of 896 2420 explorer.exe PID 2420 wrote to memory of 896 2420 explorer.exe PID 2420 wrote to memory of 2364 2420 explorer.exe PID 2420 wrote to memory of 2364 2420 explorer.exe PID 2420 wrote to memory of 2364 2420 explorer.exe PID 2420 wrote to memory of 2364 2420 explorer.exe PID 2724 wrote to memory of 4028 2724 947C.exe vbc.exe PID 2724 wrote to memory of 4028 2724 947C.exe vbc.exe PID 2724 wrote to memory of 4028 2724 947C.exe vbc.exe PID 2724 wrote to memory of 4028 2724 947C.exe vbc.exe PID 2724 wrote to memory of 4028 2724 947C.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f22db49eb28bed665323bb791d0212a726ddc4c2c8abf0c90c8b33221ada9327.exe"C:\Users\Admin\AppData\Local\Temp\f22db49eb28bed665323bb791d0212a726ddc4c2c8abf0c90c8b33221ada9327.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\gffdcdcC:\Users\Admin\AppData\Roaming\gffdcdc1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\91FA.exeC:\Users\Admin\AppData\Local\Temp\91FA.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\947C.exeC:\Users\Admin\AppData\Local\Temp\947C.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 5002⤵
- Program crash
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\91FA.exeFilesize
1.5MB
MD5d1964c1b30d01262eccaee06c600d726
SHA1e213ef1a963cc1825b9183742bb2af555da72efe
SHA25606ece311c226daf62863e5791def4efee02dacfeacc6b7635095d0a63b715a99
SHA51202d5f5d71ef785dbc9a2c7bf960d60a19a7eeba3ae8227442c21ba153fc2443e0d1e5ec8319e70a55defcb1057f43d4f41602ba2089a64615dc3aaa8569d47a5
-
C:\Users\Admin\AppData\Local\Temp\91FA.exeFilesize
1.5MB
MD5d1964c1b30d01262eccaee06c600d726
SHA1e213ef1a963cc1825b9183742bb2af555da72efe
SHA25606ece311c226daf62863e5791def4efee02dacfeacc6b7635095d0a63b715a99
SHA51202d5f5d71ef785dbc9a2c7bf960d60a19a7eeba3ae8227442c21ba153fc2443e0d1e5ec8319e70a55defcb1057f43d4f41602ba2089a64615dc3aaa8569d47a5
-
C:\Users\Admin\AppData\Local\Temp\947C.exeFilesize
510KB
MD52c7867a1749edef10274f3e34b047865
SHA1c2009f052e54f3c788e1872e7ac6f4d5fea218f9
SHA2568845215ed3299ff3381580ab3c1e1feb69d8c44361bc15d64b57a597147a74c7
SHA51260b503650f7f4ca7d14cfa7dabc1cda68eee8f0e34800fb160f44b3af9135bf27b15c57e26f19301baa1eb4eb6a6191cfa70d8ca28361db71969f7c0c3435e68
-
C:\Users\Admin\AppData\Local\Temp\947C.exeFilesize
510KB
MD52c7867a1749edef10274f3e34b047865
SHA1c2009f052e54f3c788e1872e7ac6f4d5fea218f9
SHA2568845215ed3299ff3381580ab3c1e1feb69d8c44361bc15d64b57a597147a74c7
SHA51260b503650f7f4ca7d14cfa7dabc1cda68eee8f0e34800fb160f44b3af9135bf27b15c57e26f19301baa1eb4eb6a6191cfa70d8ca28361db71969f7c0c3435e68
-
C:\Users\Admin\AppData\Roaming\gffdcdcFilesize
274KB
MD54b37463b99d718640c39c17913be9823
SHA1ff04559f82f6172dcd40df67219adbab4297a8d0
SHA256f22db49eb28bed665323bb791d0212a726ddc4c2c8abf0c90c8b33221ada9327
SHA5123238389965842debee424428c33518c642bfc0440794a23c409b0f30b33c341bccf3003fd85e6c7cb971ccbcc99bd434153aa25351953b5935805c884fa8927f
-
C:\Users\Admin\AppData\Roaming\gffdcdcFilesize
274KB
MD54b37463b99d718640c39c17913be9823
SHA1ff04559f82f6172dcd40df67219adbab4297a8d0
SHA256f22db49eb28bed665323bb791d0212a726ddc4c2c8abf0c90c8b33221ada9327
SHA5123238389965842debee424428c33518c642bfc0440794a23c409b0f30b33c341bccf3003fd85e6c7cb971ccbcc99bd434153aa25351953b5935805c884fa8927f
-
memory/896-491-0x0000000000130000-0x000000000013D000-memory.dmpFilesize
52KB
-
memory/896-485-0x0000000000140000-0x0000000000147000-memory.dmpFilesize
28KB
-
memory/896-461-0x0000000000000000-mapping.dmp
-
memory/896-745-0x0000000000140000-0x0000000000147000-memory.dmpFilesize
28KB
-
memory/1560-615-0x00000000004D0000-0x00000000004D5000-memory.dmpFilesize
20KB
-
memory/1560-648-0x00000000004C0000-0x00000000004C9000-memory.dmpFilesize
36KB
-
memory/1560-396-0x0000000000000000-mapping.dmp
-
memory/2068-179-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-182-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-167-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-191-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/2068-190-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/2068-189-0x0000000000470000-0x00000000005BA000-memory.dmpFilesize
1.3MB
-
memory/2068-188-0x00000000007C1000-0x00000000007D2000-memory.dmpFilesize
68KB
-
memory/2068-169-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-171-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-173-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-175-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-176-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-178-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-168-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-180-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-181-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-183-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-184-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-185-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-166-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-177-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-174-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-172-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-170-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-165-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-154-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-155-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-156-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-157-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-158-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-160-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-164-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-159-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-162-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2068-163-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2364-669-0x0000000000890000-0x000000000089B000-memory.dmpFilesize
44KB
-
memory/2364-668-0x00000000008A0000-0x00000000008A8000-memory.dmpFilesize
32KB
-
memory/2364-496-0x0000000000000000-mapping.dmp
-
memory/2724-196-0x0000000000000000-mapping.dmp
-
memory/2760-150-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-128-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-148-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-151-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-115-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-149-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-147-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-146-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-145-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-144-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-143-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-142-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/2760-141-0x0000000000550000-0x000000000069A000-memory.dmpFilesize
1.3MB
-
memory/2760-140-0x0000000000550000-0x000000000069A000-memory.dmpFilesize
1.3MB
-
memory/2760-139-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-138-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-137-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-136-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-135-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-134-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-133-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-132-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-124-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-131-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-129-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-125-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-130-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-123-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-121-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-152-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/2760-127-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-126-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-120-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-116-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-119-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-118-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/2760-117-0x0000000076EA0000-0x000000007702E000-memory.dmpFilesize
1.6MB
-
memory/3176-359-0x0000000000000000-mapping.dmp
-
memory/3176-574-0x00000000001A0000-0x00000000001C2000-memory.dmpFilesize
136KB
-
memory/3176-612-0x0000000000170000-0x0000000000197000-memory.dmpFilesize
156KB
-
memory/3348-653-0x0000000000810000-0x000000000081B000-memory.dmpFilesize
44KB
-
memory/3348-428-0x0000000000000000-mapping.dmp
-
memory/3348-649-0x0000000000820000-0x0000000000826000-memory.dmpFilesize
24KB
-
memory/3884-211-0x00007FFA25EB0000-0x00007FFA2608B000-memory.dmpFilesize
1.9MB
-
memory/3884-243-0x00007FFA25EB0000-0x00007FFA2608B000-memory.dmpFilesize
1.9MB
-
memory/3884-204-0x000001A64D100000-0x000001A64D178000-memory.dmpFilesize
480KB
-
memory/3884-240-0x0000000000AB0000-0x0000000000FB0000-memory.dmpFilesize
5.0MB
-
memory/3884-201-0x0000000000AB0000-0x0000000000FB0000-memory.dmpFilesize
5.0MB
-
memory/3884-195-0x0000000000AB0000-0x0000000000FB0000-memory.dmpFilesize
5.0MB
-
memory/3884-192-0x0000000000000000-mapping.dmp
-
memory/4028-677-0x000000000061B576-mapping.dmp
-
memory/4028-718-0x0000000000600000-0x0000000000632000-memory.dmpFilesize
200KB
-
memory/4248-382-0x00000000008F0000-0x00000000008F7000-memory.dmpFilesize
28KB
-
memory/4248-233-0x0000000000000000-mapping.dmp
-
memory/4248-671-0x00000000008F0000-0x00000000008F7000-memory.dmpFilesize
28KB
-
memory/4248-418-0x00000000008E0000-0x00000000008EB000-memory.dmpFilesize
44KB
-
memory/4560-495-0x00000000009F0000-0x00000000009F5000-memory.dmpFilesize
20KB
-
memory/4560-292-0x0000000000000000-mapping.dmp
-
memory/4560-748-0x00000000009F0000-0x00000000009F5000-memory.dmpFilesize
20KB
-
memory/4560-534-0x00000000009E0000-0x00000000009E9000-memory.dmpFilesize
36KB
-
memory/4664-647-0x0000000006660000-0x0000000006B5E000-memory.dmpFilesize
5.0MB
-
memory/4664-692-0x0000000006E30000-0x0000000006FF2000-memory.dmpFilesize
1.8MB
-
memory/4664-399-0x0000000005B50000-0x0000000006156000-memory.dmpFilesize
6.0MB
-
memory/4664-643-0x00000000059E0000-0x0000000005A72000-memory.dmpFilesize
584KB
-
memory/4664-422-0x0000000005660000-0x000000000569E000-memory.dmpFilesize
248KB
-
memory/4664-404-0x00000000056D0000-0x00000000057DA000-memory.dmpFilesize
1.0MB
-
memory/4664-236-0x000000000041B576-mapping.dmp
-
memory/4664-430-0x00000000057E0000-0x000000000582B000-memory.dmpFilesize
300KB
-
memory/4664-695-0x0000000007530000-0x0000000007A5C000-memory.dmpFilesize
5.2MB
-
memory/4664-660-0x0000000005A80000-0x0000000005AE6000-memory.dmpFilesize
408KB
-
memory/4664-319-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4664-413-0x0000000005600000-0x0000000005612000-memory.dmpFilesize
72KB
-
memory/4872-339-0x0000000000A80000-0x0000000000A86000-memory.dmpFilesize
24KB
-
memory/4872-670-0x0000000000A80000-0x0000000000A86000-memory.dmpFilesize
24KB
-
memory/4872-325-0x0000000000000000-mapping.dmp
-
memory/4872-343-0x00000000007F0000-0x00000000007FC000-memory.dmpFilesize
48KB
-
memory/5092-275-0x0000000000B30000-0x0000000000B3F000-memory.dmpFilesize
60KB
-
memory/5092-272-0x0000000000B40000-0x0000000000B49000-memory.dmpFilesize
36KB
-
memory/5092-262-0x0000000000000000-mapping.dmp
-
memory/5092-645-0x0000000000B40000-0x0000000000B49000-memory.dmpFilesize
36KB