Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2022 16:05
Static task
static1
Behavioral task
behavioral1
Sample
4176776e4a16cc6d1343173db03c7b94aa63eed6b98e1c1e1633638d749b25c2.exe
Resource
win10v2004-20220812-en
General
-
Target
4176776e4a16cc6d1343173db03c7b94aa63eed6b98e1c1e1633638d749b25c2.exe
-
Size
263KB
-
MD5
a5b980c246570ec52c0bf80b7d0bf1c9
-
SHA1
98d5398b41abe05f1f01058224e61f3bfa174966
-
SHA256
4176776e4a16cc6d1343173db03c7b94aa63eed6b98e1c1e1633638d749b25c2
-
SHA512
9a31dc5f3079180ffc2f64e77b03237f2a5df78108f7ac9f10b2d8ca2e1efe5a3457dbc2112495479bc2cd609c28659339ef74f7aed618359198b78871977253
-
SSDEEP
3072:ziDLsPVfdWGYH8T9H5MxS6pRkWdTWuapW/xhh0aBeV+FGyyVqTaz9RIlf3:z1m8x6pZd5aptTwFAPhilf
Malware Config
Extracted
redline
YT
65.21.5.58:48811
-
auth_value
fb878dde7f3b4ad1e1bc26d24db36d28
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1400-133-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
9347.exe982A.exe9F01.exe964214048-8a9Ah054og8jEcGP.exepid process 3984 9347.exe 3020 982A.exe 2380 9F01.exe 3128 964214048-8a9Ah054og8jEcGP.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9347.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9347.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
982A.exe9F01.exedescription pid process target process PID 3020 set thread context of 4896 3020 982A.exe vbc.exe PID 2380 set thread context of 2144 2380 9F01.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3384 3020 WerFault.exe 982A.exe 1020 2380 WerFault.exe 9F01.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
4176776e4a16cc6d1343173db03c7b94aa63eed6b98e1c1e1633638d749b25c2.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4176776e4a16cc6d1343173db03c7b94aa63eed6b98e1c1e1633638d749b25c2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4176776e4a16cc6d1343173db03c7b94aa63eed6b98e1c1e1633638d749b25c2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4176776e4a16cc6d1343173db03c7b94aa63eed6b98e1c1e1633638d749b25c2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4176776e4a16cc6d1343173db03c7b94aa63eed6b98e1c1e1633638d749b25c2.exepid process 1400 4176776e4a16cc6d1343173db03c7b94aa63eed6b98e1c1e1633638d749b25c2.exe 1400 4176776e4a16cc6d1343173db03c7b94aa63eed6b98e1c1e1633638d749b25c2.exe 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3032 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
4176776e4a16cc6d1343173db03c7b94aa63eed6b98e1c1e1633638d749b25c2.exepid process 1400 4176776e4a16cc6d1343173db03c7b94aa63eed6b98e1c1e1633638d749b25c2.exe 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
9347.exewmic.exeWMIC.exedescription pid process Token: SeDebugPrivilege 3984 9347.exe Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeIncreaseQuotaPrivilege 1104 wmic.exe Token: SeSecurityPrivilege 1104 wmic.exe Token: SeTakeOwnershipPrivilege 1104 wmic.exe Token: SeLoadDriverPrivilege 1104 wmic.exe Token: SeSystemProfilePrivilege 1104 wmic.exe Token: SeSystemtimePrivilege 1104 wmic.exe Token: SeProfSingleProcessPrivilege 1104 wmic.exe Token: SeIncBasePriorityPrivilege 1104 wmic.exe Token: SeCreatePagefilePrivilege 1104 wmic.exe Token: SeBackupPrivilege 1104 wmic.exe Token: SeRestorePrivilege 1104 wmic.exe Token: SeShutdownPrivilege 1104 wmic.exe Token: SeDebugPrivilege 1104 wmic.exe Token: SeSystemEnvironmentPrivilege 1104 wmic.exe Token: SeRemoteShutdownPrivilege 1104 wmic.exe Token: SeUndockPrivilege 1104 wmic.exe Token: SeManageVolumePrivilege 1104 wmic.exe Token: 33 1104 wmic.exe Token: 34 1104 wmic.exe Token: 35 1104 wmic.exe Token: 36 1104 wmic.exe Token: SeIncreaseQuotaPrivilege 1104 wmic.exe Token: SeSecurityPrivilege 1104 wmic.exe Token: SeTakeOwnershipPrivilege 1104 wmic.exe Token: SeLoadDriverPrivilege 1104 wmic.exe Token: SeSystemProfilePrivilege 1104 wmic.exe Token: SeSystemtimePrivilege 1104 wmic.exe Token: SeProfSingleProcessPrivilege 1104 wmic.exe Token: SeIncBasePriorityPrivilege 1104 wmic.exe Token: SeCreatePagefilePrivilege 1104 wmic.exe Token: SeBackupPrivilege 1104 wmic.exe Token: SeRestorePrivilege 1104 wmic.exe Token: SeShutdownPrivilege 1104 wmic.exe Token: SeDebugPrivilege 1104 wmic.exe Token: SeSystemEnvironmentPrivilege 1104 wmic.exe Token: SeRemoteShutdownPrivilege 1104 wmic.exe Token: SeUndockPrivilege 1104 wmic.exe Token: SeManageVolumePrivilege 1104 wmic.exe Token: 33 1104 wmic.exe Token: 34 1104 wmic.exe Token: 35 1104 wmic.exe Token: 36 1104 wmic.exe Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeIncreaseQuotaPrivilege 2732 WMIC.exe Token: SeSecurityPrivilege 2732 WMIC.exe Token: SeTakeOwnershipPrivilege 2732 WMIC.exe Token: SeLoadDriverPrivilege 2732 WMIC.exe Token: SeSystemProfilePrivilege 2732 WMIC.exe Token: SeSystemtimePrivilege 2732 WMIC.exe Token: SeProfSingleProcessPrivilege 2732 WMIC.exe Token: SeIncBasePriorityPrivilege 2732 WMIC.exe Token: SeCreatePagefilePrivilege 2732 WMIC.exe Token: SeBackupPrivilege 2732 WMIC.exe Token: SeRestorePrivilege 2732 WMIC.exe Token: SeShutdownPrivilege 2732 WMIC.exe Token: SeDebugPrivilege 2732 WMIC.exe Token: SeSystemEnvironmentPrivilege 2732 WMIC.exe Token: SeRemoteShutdownPrivilege 2732 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
982A.exe9F01.exe9347.exe964214048-8a9Ah054og8jEcGP.execmd.execmd.exedescription pid process target process PID 3032 wrote to memory of 3984 3032 9347.exe PID 3032 wrote to memory of 3984 3032 9347.exe PID 3032 wrote to memory of 3984 3032 9347.exe PID 3032 wrote to memory of 3020 3032 982A.exe PID 3032 wrote to memory of 3020 3032 982A.exe PID 3032 wrote to memory of 3020 3032 982A.exe PID 3032 wrote to memory of 2380 3032 9F01.exe PID 3032 wrote to memory of 2380 3032 9F01.exe PID 3032 wrote to memory of 2380 3032 9F01.exe PID 3032 wrote to memory of 5008 3032 explorer.exe PID 3032 wrote to memory of 5008 3032 explorer.exe PID 3032 wrote to memory of 5008 3032 explorer.exe PID 3032 wrote to memory of 5008 3032 explorer.exe PID 3032 wrote to memory of 3528 3032 explorer.exe PID 3032 wrote to memory of 3528 3032 explorer.exe PID 3032 wrote to memory of 3528 3032 explorer.exe PID 3032 wrote to memory of 4972 3032 explorer.exe PID 3032 wrote to memory of 4972 3032 explorer.exe PID 3032 wrote to memory of 4972 3032 explorer.exe PID 3032 wrote to memory of 4972 3032 explorer.exe PID 3032 wrote to memory of 4576 3032 explorer.exe PID 3032 wrote to memory of 4576 3032 explorer.exe PID 3032 wrote to memory of 4576 3032 explorer.exe PID 3032 wrote to memory of 3456 3032 explorer.exe PID 3032 wrote to memory of 3456 3032 explorer.exe PID 3032 wrote to memory of 3456 3032 explorer.exe PID 3032 wrote to memory of 3456 3032 explorer.exe PID 3032 wrote to memory of 4052 3032 explorer.exe PID 3032 wrote to memory of 4052 3032 explorer.exe PID 3032 wrote to memory of 4052 3032 explorer.exe PID 3032 wrote to memory of 4052 3032 explorer.exe PID 3032 wrote to memory of 3308 3032 explorer.exe PID 3032 wrote to memory of 3308 3032 explorer.exe PID 3032 wrote to memory of 3308 3032 explorer.exe PID 3032 wrote to memory of 3308 3032 explorer.exe PID 3032 wrote to memory of 2252 3032 explorer.exe PID 3032 wrote to memory of 2252 3032 explorer.exe PID 3032 wrote to memory of 2252 3032 explorer.exe PID 3032 wrote to memory of 4300 3032 explorer.exe PID 3032 wrote to memory of 4300 3032 explorer.exe PID 3032 wrote to memory of 4300 3032 explorer.exe PID 3032 wrote to memory of 4300 3032 explorer.exe PID 3020 wrote to memory of 4896 3020 982A.exe vbc.exe PID 3020 wrote to memory of 4896 3020 982A.exe vbc.exe PID 3020 wrote to memory of 4896 3020 982A.exe vbc.exe PID 3020 wrote to memory of 4896 3020 982A.exe vbc.exe PID 3020 wrote to memory of 4896 3020 982A.exe vbc.exe PID 2380 wrote to memory of 2144 2380 9F01.exe vbc.exe PID 2380 wrote to memory of 2144 2380 9F01.exe vbc.exe PID 2380 wrote to memory of 2144 2380 9F01.exe vbc.exe PID 2380 wrote to memory of 2144 2380 9F01.exe vbc.exe PID 2380 wrote to memory of 2144 2380 9F01.exe vbc.exe PID 3984 wrote to memory of 3128 3984 9347.exe 964214048-8a9Ah054og8jEcGP.exe PID 3984 wrote to memory of 3128 3984 9347.exe 964214048-8a9Ah054og8jEcGP.exe PID 3128 wrote to memory of 1104 3128 964214048-8a9Ah054og8jEcGP.exe wmic.exe PID 3128 wrote to memory of 1104 3128 964214048-8a9Ah054og8jEcGP.exe wmic.exe PID 3128 wrote to memory of 4856 3128 964214048-8a9Ah054og8jEcGP.exe cmd.exe PID 3128 wrote to memory of 4856 3128 964214048-8a9Ah054og8jEcGP.exe cmd.exe PID 4856 wrote to memory of 2732 4856 cmd.exe WMIC.exe PID 4856 wrote to memory of 2732 4856 cmd.exe WMIC.exe PID 3128 wrote to memory of 2248 3128 964214048-8a9Ah054og8jEcGP.exe cmd.exe PID 3128 wrote to memory of 2248 3128 964214048-8a9Ah054og8jEcGP.exe cmd.exe PID 2248 wrote to memory of 112 2248 cmd.exe WMIC.exe PID 2248 wrote to memory of 112 2248 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4176776e4a16cc6d1343173db03c7b94aa63eed6b98e1c1e1633638d749b25c2.exe"C:\Users\Admin\AppData\Local\Temp\4176776e4a16cc6d1343173db03c7b94aa63eed6b98e1c1e1633638d749b25c2.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\9347.exeC:\Users\Admin\AppData\Local\Temp\9347.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\964214048-8a9Ah054og8jEcGP.exe"C:\Users\Admin\AppData\Local\Temp\964214048-8a9Ah054og8jEcGP.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name4⤵
-
C:\Users\Admin\AppData\Local\Temp\982A.exeC:\Users\Admin\AppData\Local\Temp\982A.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 5162⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\9F01.exeC:\Users\Admin\AppData\Local\Temp\9F01.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 4922⤵
- Program crash
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3020 -ip 30201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2380 -ip 23801⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\9347.exeFilesize
922KB
MD50cec15477b0a89e89f78961fdd2f56b8
SHA148701957b74b12cfb521c8881ec9beac78f8866d
SHA25603de8297c43f7161e56416e5f7180bee53b5234f5c4f757cb0084b9603057351
SHA5121c8162b29d77035c23148cad569162f739ddc0c501fbf9dbc7cb06ffeaa7eb69d3f505aee167700eeba65fa6cab62ce92e3270b6d694f6f07192d8d3819ec595
-
C:\Users\Admin\AppData\Local\Temp\9347.exeFilesize
922KB
MD50cec15477b0a89e89f78961fdd2f56b8
SHA148701957b74b12cfb521c8881ec9beac78f8866d
SHA25603de8297c43f7161e56416e5f7180bee53b5234f5c4f757cb0084b9603057351
SHA5121c8162b29d77035c23148cad569162f739ddc0c501fbf9dbc7cb06ffeaa7eb69d3f505aee167700eeba65fa6cab62ce92e3270b6d694f6f07192d8d3819ec595
-
C:\Users\Admin\AppData\Local\Temp\964214048-8a9Ah054og8jEcGP.exeFilesize
4.5MB
MD5210d0e2a6972569ae0cc2e191610ede7
SHA174080b265b2f29cc0d2fac5b02034a9c4b6c9f22
SHA256bbdda1d7ec80b360df21e711400497bbeccf3b22bbd9723f5b869378a8a0557d
SHA512d7b51dd3334c37fbabc0c0047debfc52e7febc1a590a9974bbc0453d035b3b340b35eb0f4ab3d15c235a4f4d7092915e86a3d805fc173d21a1c7fdde12a94e2a
-
C:\Users\Admin\AppData\Local\Temp\964214048-8a9Ah054og8jEcGP.exeFilesize
4.5MB
MD5210d0e2a6972569ae0cc2e191610ede7
SHA174080b265b2f29cc0d2fac5b02034a9c4b6c9f22
SHA256bbdda1d7ec80b360df21e711400497bbeccf3b22bbd9723f5b869378a8a0557d
SHA512d7b51dd3334c37fbabc0c0047debfc52e7febc1a590a9974bbc0453d035b3b340b35eb0f4ab3d15c235a4f4d7092915e86a3d805fc173d21a1c7fdde12a94e2a
-
C:\Users\Admin\AppData\Local\Temp\982A.exeFilesize
750KB
MD5bba5e9388aceb3c1c83638a42cee6b13
SHA17538b896c3898f11e372e67accc83a598dacb29d
SHA2564255c0f0323f7b4b901bafeb51a5c7befce1043684bdfb9f504b2c1213b9be59
SHA512ebc14ccc6089d3ced0ed0619df5c56ea67cea5b15e564123c5fd825f77a7e59199748a5d523733b5b0f32813f14fc8dfa2f963053237a0c3c7e4affa553cd8cd
-
C:\Users\Admin\AppData\Local\Temp\982A.exeFilesize
750KB
MD5bba5e9388aceb3c1c83638a42cee6b13
SHA17538b896c3898f11e372e67accc83a598dacb29d
SHA2564255c0f0323f7b4b901bafeb51a5c7befce1043684bdfb9f504b2c1213b9be59
SHA512ebc14ccc6089d3ced0ed0619df5c56ea67cea5b15e564123c5fd825f77a7e59199748a5d523733b5b0f32813f14fc8dfa2f963053237a0c3c7e4affa553cd8cd
-
C:\Users\Admin\AppData\Local\Temp\9F01.exeFilesize
3.1MB
MD5df1aa71fc7fe2bc39f71b48b45d1a255
SHA19936734a8693be6429e66f3011584a9fc8094607
SHA256731fd196273e43c2d4ed578599d645bd0c297eb8dcce7ac79d5c968e0ba92e0f
SHA512abaae0d6df9f892a10808a7a7e532426c4f8c7b18771d902a5e2727b7c8dd1c2133ba3b3c488815da1b5da5b2b383180ebf87af4580fb04dab94c209d0ad75a2
-
C:\Users\Admin\AppData\Local\Temp\9F01.exeFilesize
3.1MB
MD5df1aa71fc7fe2bc39f71b48b45d1a255
SHA19936734a8693be6429e66f3011584a9fc8094607
SHA256731fd196273e43c2d4ed578599d645bd0c297eb8dcce7ac79d5c968e0ba92e0f
SHA512abaae0d6df9f892a10808a7a7e532426c4f8c7b18771d902a5e2727b7c8dd1c2133ba3b3c488815da1b5da5b2b383180ebf87af4580fb04dab94c209d0ad75a2
-
memory/112-212-0x0000000000000000-mapping.dmp
-
memory/1104-208-0x0000000000000000-mapping.dmp
-
memory/1400-132-0x00000000006F2000-0x0000000000702000-memory.dmpFilesize
64KB
-
memory/1400-135-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/1400-134-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/1400-133-0x00000000001F0000-0x00000000001F9000-memory.dmpFilesize
36KB
-
memory/2144-185-0x0000000000000000-mapping.dmp
-
memory/2144-187-0x00000000005C1000-0x000000000081E000-memory.dmpFilesize
2.4MB
-
memory/2144-199-0x00000000005C0000-0x000000000084E000-memory.dmpFilesize
2.6MB
-
memory/2144-188-0x00000000005C0000-0x000000000084E000-memory.dmpFilesize
2.6MB
-
memory/2248-211-0x0000000000000000-mapping.dmp
-
memory/2252-168-0x0000000000FF0000-0x0000000000FF7000-memory.dmpFilesize
28KB
-
memory/2252-184-0x0000000000FF0000-0x0000000000FF7000-memory.dmpFilesize
28KB
-
memory/2252-167-0x0000000000000000-mapping.dmp
-
memory/2252-169-0x0000000000FE0000-0x0000000000FED000-memory.dmpFilesize
52KB
-
memory/2380-142-0x0000000000000000-mapping.dmp
-
memory/2380-202-0x0000000000D50000-0x0000000001069000-memory.dmpFilesize
3.1MB
-
memory/2732-210-0x0000000000000000-mapping.dmp
-
memory/3020-139-0x0000000000000000-mapping.dmp
-
memory/3128-205-0x0000000000000000-mapping.dmp
-
memory/3308-165-0x0000000000780000-0x0000000000786000-memory.dmpFilesize
24KB
-
memory/3308-183-0x0000000000780000-0x0000000000786000-memory.dmpFilesize
24KB
-
memory/3308-164-0x0000000000000000-mapping.dmp
-
memory/3308-166-0x0000000000770000-0x000000000077B000-memory.dmpFilesize
44KB
-
memory/3456-159-0x0000000000EA0000-0x0000000000EC7000-memory.dmpFilesize
156KB
-
memory/3456-181-0x0000000000ED0000-0x0000000000EF2000-memory.dmpFilesize
136KB
-
memory/3456-161-0x0000000000ED0000-0x0000000000EF2000-memory.dmpFilesize
136KB
-
memory/3456-155-0x0000000000000000-mapping.dmp
-
memory/3528-173-0x0000000000520000-0x0000000000529000-memory.dmpFilesize
36KB
-
memory/3528-148-0x0000000000510000-0x000000000051F000-memory.dmpFilesize
60KB
-
memory/3528-147-0x0000000000520000-0x0000000000529000-memory.dmpFilesize
36KB
-
memory/3528-146-0x0000000000000000-mapping.dmp
-
memory/3984-149-0x0000000000790000-0x000000000087C000-memory.dmpFilesize
944KB
-
memory/3984-136-0x0000000000000000-mapping.dmp
-
memory/4052-160-0x0000000000000000-mapping.dmp
-
memory/4052-182-0x0000000000890000-0x0000000000895000-memory.dmpFilesize
20KB
-
memory/4052-163-0x0000000000880000-0x0000000000889000-memory.dmpFilesize
36KB
-
memory/4052-162-0x0000000000890000-0x0000000000895000-memory.dmpFilesize
20KB
-
memory/4300-201-0x0000000000E00000-0x0000000000E08000-memory.dmpFilesize
32KB
-
memory/4300-171-0x0000000000E00000-0x0000000000E08000-memory.dmpFilesize
32KB
-
memory/4300-170-0x0000000000000000-mapping.dmp
-
memory/4300-172-0x0000000000BF0000-0x0000000000BFB000-memory.dmpFilesize
44KB
-
memory/4576-158-0x0000000001080000-0x000000000108C000-memory.dmpFilesize
48KB
-
memory/4576-157-0x0000000001090000-0x0000000001096000-memory.dmpFilesize
24KB
-
memory/4576-180-0x0000000001090000-0x0000000001096000-memory.dmpFilesize
24KB
-
memory/4576-153-0x0000000000000000-mapping.dmp
-
memory/4856-209-0x0000000000000000-mapping.dmp
-
memory/4896-203-0x0000000004D50000-0x0000000004D62000-memory.dmpFilesize
72KB
-
memory/4896-213-0x0000000005130000-0x00000000051C2000-memory.dmpFilesize
584KB
-
memory/4896-174-0x0000000000000000-mapping.dmp
-
memory/4896-204-0x0000000004DB0000-0x0000000004DEC000-memory.dmpFilesize
240KB
-
memory/4896-217-0x00000000076B0000-0x0000000007BDC000-memory.dmpFilesize
5.2MB
-
memory/4896-216-0x00000000067A0000-0x0000000006962000-memory.dmpFilesize
1.8MB
-
memory/4896-200-0x0000000004E40000-0x0000000004F4A000-memory.dmpFilesize
1.0MB
-
memory/4896-215-0x00000000052D0000-0x0000000005336000-memory.dmpFilesize
408KB
-
memory/4896-175-0x0000000000600000-0x0000000000632000-memory.dmpFilesize
200KB
-
memory/4896-214-0x0000000005F20000-0x00000000064C4000-memory.dmpFilesize
5.6MB
-
memory/4896-194-0x0000000005350000-0x0000000005968000-memory.dmpFilesize
6.1MB
-
memory/4972-150-0x0000000000000000-mapping.dmp
-
memory/4972-152-0x0000000000890000-0x0000000000895000-memory.dmpFilesize
20KB
-
memory/4972-154-0x0000000000880000-0x0000000000889000-memory.dmpFilesize
36KB
-
memory/5008-145-0x0000000000000000-mapping.dmp
-
memory/5008-151-0x0000000000C10000-0x0000000000C17000-memory.dmpFilesize
28KB
-
memory/5008-156-0x0000000000C00000-0x0000000000C0B000-memory.dmpFilesize
44KB