Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
07-12-2022 17:43
Static task
static1
Behavioral task
behavioral1
Sample
8ab9b401a66305067a8ac41f8ebfd555d9021eaa29a57e3e3beac680949c846a.exe
Resource
win10-20220812-en
General
-
Target
8ab9b401a66305067a8ac41f8ebfd555d9021eaa29a57e3e3beac680949c846a.exe
-
Size
264KB
-
MD5
7c0f0f34c0c84ae7f5eb3f5ea3740845
-
SHA1
66caa0bd766a0b9b0e58c3c27bcde407e9fe9947
-
SHA256
8ab9b401a66305067a8ac41f8ebfd555d9021eaa29a57e3e3beac680949c846a
-
SHA512
4a1ebafd4ae9829be19c8c46f2b48ec91fc56c06c3b4d58be3636336139f6f502b545b988cf37fce9be2932ca0ce453854db26690fc2accae5c422fff19387dd
-
SSDEEP
3072:XaY5mRa0RWanfUgv5fT9qESzzFxQ2/SxHBL4OF4tBeVYMXhNlsi9RIlf3:KpftT9qESzzF2/OK4KeMXXxilf
Malware Config
Extracted
redline
YT
65.21.5.58:48811
-
auth_value
fb878dde7f3b4ad1e1bc26d24db36d28
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2384-141-0x00000000001E0000-0x00000000001E9000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
4EFB.exe5787.exe613C.exepid process 5060 4EFB.exe 2352 5787.exe 4148 613C.exe -
Deletes itself 1 IoCs
Processes:
pid process 2576 -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
5787.exe613C.exedescription pid process target process PID 2352 set thread context of 760 2352 5787.exe vbc.exe PID 4148 set thread context of 4212 4148 613C.exe vbc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4784 2352 WerFault.exe 5787.exe 4560 4148 WerFault.exe 613C.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
8ab9b401a66305067a8ac41f8ebfd555d9021eaa29a57e3e3beac680949c846a.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8ab9b401a66305067a8ac41f8ebfd555d9021eaa29a57e3e3beac680949c846a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8ab9b401a66305067a8ac41f8ebfd555d9021eaa29a57e3e3beac680949c846a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8ab9b401a66305067a8ac41f8ebfd555d9021eaa29a57e3e3beac680949c846a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8ab9b401a66305067a8ac41f8ebfd555d9021eaa29a57e3e3beac680949c846a.exepid process 2384 8ab9b401a66305067a8ac41f8ebfd555d9021eaa29a57e3e3beac680949c846a.exe 2384 8ab9b401a66305067a8ac41f8ebfd555d9021eaa29a57e3e3beac680949c846a.exe 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2576 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
8ab9b401a66305067a8ac41f8ebfd555d9021eaa29a57e3e3beac680949c846a.exepid process 2384 8ab9b401a66305067a8ac41f8ebfd555d9021eaa29a57e3e3beac680949c846a.exe 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 2576 -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
4EFB.exevbc.exedescription pid process Token: SeDebugPrivilege 5060 4EFB.exe Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeDebugPrivilege 760 vbc.exe Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 Token: SeShutdownPrivilege 2576 Token: SeCreatePagefilePrivilege 2576 -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
5787.exe613C.exedescription pid process target process PID 2576 wrote to memory of 5060 2576 4EFB.exe PID 2576 wrote to memory of 5060 2576 4EFB.exe PID 2576 wrote to memory of 5060 2576 4EFB.exe PID 2576 wrote to memory of 2352 2576 5787.exe PID 2576 wrote to memory of 2352 2576 5787.exe PID 2576 wrote to memory of 2352 2576 5787.exe PID 2576 wrote to memory of 4148 2576 613C.exe PID 2576 wrote to memory of 4148 2576 613C.exe PID 2576 wrote to memory of 4148 2576 613C.exe PID 2576 wrote to memory of 3848 2576 explorer.exe PID 2576 wrote to memory of 3848 2576 explorer.exe PID 2576 wrote to memory of 3848 2576 explorer.exe PID 2576 wrote to memory of 3848 2576 explorer.exe PID 2576 wrote to memory of 3348 2576 explorer.exe PID 2576 wrote to memory of 3348 2576 explorer.exe PID 2576 wrote to memory of 3348 2576 explorer.exe PID 2576 wrote to memory of 4732 2576 explorer.exe PID 2576 wrote to memory of 4732 2576 explorer.exe PID 2576 wrote to memory of 4732 2576 explorer.exe PID 2576 wrote to memory of 4732 2576 explorer.exe PID 2576 wrote to memory of 3476 2576 explorer.exe PID 2576 wrote to memory of 3476 2576 explorer.exe PID 2576 wrote to memory of 3476 2576 explorer.exe PID 2576 wrote to memory of 3584 2576 explorer.exe PID 2576 wrote to memory of 3584 2576 explorer.exe PID 2576 wrote to memory of 3584 2576 explorer.exe PID 2576 wrote to memory of 3584 2576 explorer.exe PID 2576 wrote to memory of 4924 2576 explorer.exe PID 2576 wrote to memory of 4924 2576 explorer.exe PID 2576 wrote to memory of 4924 2576 explorer.exe PID 2576 wrote to memory of 4924 2576 explorer.exe PID 2576 wrote to memory of 4868 2576 explorer.exe PID 2576 wrote to memory of 4868 2576 explorer.exe PID 2576 wrote to memory of 4868 2576 explorer.exe PID 2576 wrote to memory of 4868 2576 explorer.exe PID 2576 wrote to memory of 920 2576 explorer.exe PID 2576 wrote to memory of 920 2576 explorer.exe PID 2576 wrote to memory of 920 2576 explorer.exe PID 2576 wrote to memory of 192 2576 explorer.exe PID 2576 wrote to memory of 192 2576 explorer.exe PID 2576 wrote to memory of 192 2576 explorer.exe PID 2576 wrote to memory of 192 2576 explorer.exe PID 2352 wrote to memory of 760 2352 5787.exe vbc.exe PID 2352 wrote to memory of 760 2352 5787.exe vbc.exe PID 2352 wrote to memory of 760 2352 5787.exe vbc.exe PID 2352 wrote to memory of 760 2352 5787.exe vbc.exe PID 2352 wrote to memory of 760 2352 5787.exe vbc.exe PID 4148 wrote to memory of 4212 4148 613C.exe vbc.exe PID 4148 wrote to memory of 4212 4148 613C.exe vbc.exe PID 4148 wrote to memory of 4212 4148 613C.exe vbc.exe PID 4148 wrote to memory of 4212 4148 613C.exe vbc.exe PID 4148 wrote to memory of 4212 4148 613C.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ab9b401a66305067a8ac41f8ebfd555d9021eaa29a57e3e3beac680949c846a.exe"C:\Users\Admin\AppData\Local\Temp\8ab9b401a66305067a8ac41f8ebfd555d9021eaa29a57e3e3beac680949c846a.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\4EFB.exeC:\Users\Admin\AppData\Local\Temp\4EFB.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\5787.exeC:\Users\Admin\AppData\Local\Temp\5787.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 5042⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\613C.exeC:\Users\Admin\AppData\Local\Temp\613C.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 5002⤵
- Program crash
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4EFB.exeFilesize
922KB
MD50cec15477b0a89e89f78961fdd2f56b8
SHA148701957b74b12cfb521c8881ec9beac78f8866d
SHA25603de8297c43f7161e56416e5f7180bee53b5234f5c4f757cb0084b9603057351
SHA5121c8162b29d77035c23148cad569162f739ddc0c501fbf9dbc7cb06ffeaa7eb69d3f505aee167700eeba65fa6cab62ce92e3270b6d694f6f07192d8d3819ec595
-
C:\Users\Admin\AppData\Local\Temp\4EFB.exeFilesize
922KB
MD50cec15477b0a89e89f78961fdd2f56b8
SHA148701957b74b12cfb521c8881ec9beac78f8866d
SHA25603de8297c43f7161e56416e5f7180bee53b5234f5c4f757cb0084b9603057351
SHA5121c8162b29d77035c23148cad569162f739ddc0c501fbf9dbc7cb06ffeaa7eb69d3f505aee167700eeba65fa6cab62ce92e3270b6d694f6f07192d8d3819ec595
-
C:\Users\Admin\AppData\Local\Temp\5787.exeFilesize
750KB
MD5bba5e9388aceb3c1c83638a42cee6b13
SHA17538b896c3898f11e372e67accc83a598dacb29d
SHA2564255c0f0323f7b4b901bafeb51a5c7befce1043684bdfb9f504b2c1213b9be59
SHA512ebc14ccc6089d3ced0ed0619df5c56ea67cea5b15e564123c5fd825f77a7e59199748a5d523733b5b0f32813f14fc8dfa2f963053237a0c3c7e4affa553cd8cd
-
C:\Users\Admin\AppData\Local\Temp\5787.exeFilesize
750KB
MD5bba5e9388aceb3c1c83638a42cee6b13
SHA17538b896c3898f11e372e67accc83a598dacb29d
SHA2564255c0f0323f7b4b901bafeb51a5c7befce1043684bdfb9f504b2c1213b9be59
SHA512ebc14ccc6089d3ced0ed0619df5c56ea67cea5b15e564123c5fd825f77a7e59199748a5d523733b5b0f32813f14fc8dfa2f963053237a0c3c7e4affa553cd8cd
-
C:\Users\Admin\AppData\Local\Temp\613C.exeFilesize
3.1MB
MD5df1aa71fc7fe2bc39f71b48b45d1a255
SHA19936734a8693be6429e66f3011584a9fc8094607
SHA256731fd196273e43c2d4ed578599d645bd0c297eb8dcce7ac79d5c968e0ba92e0f
SHA512abaae0d6df9f892a10808a7a7e532426c4f8c7b18771d902a5e2727b7c8dd1c2133ba3b3c488815da1b5da5b2b383180ebf87af4580fb04dab94c209d0ad75a2
-
C:\Users\Admin\AppData\Local\Temp\613C.exeFilesize
3.1MB
MD5df1aa71fc7fe2bc39f71b48b45d1a255
SHA19936734a8693be6429e66f3011584a9fc8094607
SHA256731fd196273e43c2d4ed578599d645bd0c297eb8dcce7ac79d5c968e0ba92e0f
SHA512abaae0d6df9f892a10808a7a7e532426c4f8c7b18771d902a5e2727b7c8dd1c2133ba3b3c488815da1b5da5b2b383180ebf87af4580fb04dab94c209d0ad75a2
-
memory/192-693-0x00000000004D0000-0x00000000004D8000-memory.dmpFilesize
32KB
-
memory/192-449-0x0000000000000000-mapping.dmp
-
memory/192-628-0x00000000004D0000-0x00000000004D8000-memory.dmpFilesize
32KB
-
memory/192-629-0x00000000004C0000-0x00000000004CB000-memory.dmpFilesize
44KB
-
memory/760-776-0x00000000090E0000-0x000000000912B000-memory.dmpFilesize
300KB
-
memory/760-787-0x00000000092E0000-0x0000000009372000-memory.dmpFilesize
584KB
-
memory/760-769-0x0000000009440000-0x0000000009A46000-memory.dmpFilesize
6.0MB
-
memory/760-669-0x000000000041B576-mapping.dmp
-
memory/760-709-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/760-770-0x0000000008FD0000-0x00000000090DA000-memory.dmpFilesize
1.0MB
-
memory/760-772-0x0000000008F00000-0x0000000008F12000-memory.dmpFilesize
72KB
-
memory/760-774-0x0000000008F60000-0x0000000008F9E000-memory.dmpFilesize
248KB
-
memory/760-1048-0x000000000BC60000-0x000000000C18C000-memory.dmpFilesize
5.2MB
-
memory/760-1047-0x000000000B560000-0x000000000B722000-memory.dmpFilesize
1.8MB
-
memory/760-790-0x0000000009380000-0x00000000093E6000-memory.dmpFilesize
408KB
-
memory/760-784-0x0000000009F50000-0x000000000A44E000-memory.dmpFilesize
5.0MB
-
memory/920-640-0x0000000000720000-0x0000000000727000-memory.dmpFilesize
28KB
-
memory/920-419-0x0000000000000000-mapping.dmp
-
memory/920-439-0x0000000000720000-0x0000000000727000-memory.dmpFilesize
28KB
-
memory/920-444-0x0000000000710000-0x000000000071D000-memory.dmpFilesize
52KB
-
memory/2352-186-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2352-176-0x0000000000000000-mapping.dmp
-
memory/2352-183-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2352-192-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2352-194-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2352-185-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2352-190-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2352-187-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2352-188-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2352-180-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2352-182-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2352-181-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2352-179-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2352-178-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-124-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-155-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-125-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-126-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-128-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-129-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-146-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-130-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-131-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-132-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-133-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-134-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-135-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-136-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-137-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-123-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-145-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-122-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-121-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-147-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-157-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/2384-156-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-120-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-142-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-154-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-153-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-152-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-140-0x0000000000460000-0x00000000005AA000-memory.dmpFilesize
1.3MB
-
memory/2384-151-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-139-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-150-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-148-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-144-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-149-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-141-0x00000000001E0000-0x00000000001E9000-memory.dmpFilesize
36KB
-
memory/2384-138-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-143-0x0000000000400000-0x000000000045F000-memory.dmpFilesize
380KB
-
memory/3348-576-0x0000000000630000-0x0000000000639000-memory.dmpFilesize
36KB
-
memory/3348-274-0x0000000000000000-mapping.dmp
-
memory/3348-283-0x0000000000620000-0x000000000062F000-memory.dmpFilesize
60KB
-
memory/3348-281-0x0000000000630000-0x0000000000639000-memory.dmpFilesize
36KB
-
memory/3476-626-0x0000000000E40000-0x0000000000E46000-memory.dmpFilesize
24KB
-
memory/3476-313-0x0000000000000000-mapping.dmp
-
memory/3476-322-0x0000000000E40000-0x0000000000E46000-memory.dmpFilesize
24KB
-
memory/3476-326-0x0000000000E30000-0x0000000000E3C000-memory.dmpFilesize
48KB
-
memory/3584-544-0x00000000006B0000-0x00000000006D2000-memory.dmpFilesize
136KB
-
memory/3584-579-0x0000000000680000-0x00000000006A7000-memory.dmpFilesize
156KB
-
memory/3584-337-0x0000000000000000-mapping.dmp
-
memory/3848-435-0x0000000002F10000-0x0000000002F1B000-memory.dmpFilesize
44KB
-
memory/3848-403-0x0000000002F20000-0x0000000002F27000-memory.dmpFilesize
28KB
-
memory/3848-256-0x0000000000000000-mapping.dmp
-
memory/4148-223-0x0000000000000000-mapping.dmp
-
memory/4148-738-0x0000000000910000-0x0000000000C29000-memory.dmpFilesize
3.1MB
-
memory/4212-730-0x00000000004014B0-mapping.dmp
-
memory/4732-292-0x0000000000000000-mapping.dmp
-
memory/4732-646-0x0000000000830000-0x0000000000835000-memory.dmpFilesize
20KB
-
memory/4732-473-0x0000000000830000-0x0000000000835000-memory.dmpFilesize
20KB
-
memory/4732-478-0x0000000000820000-0x0000000000829000-memory.dmpFilesize
36KB
-
memory/4868-661-0x0000000000190000-0x0000000000196000-memory.dmpFilesize
24KB
-
memory/4868-387-0x0000000000000000-mapping.dmp
-
memory/4868-609-0x0000000000190000-0x0000000000196000-memory.dmpFilesize
24KB
-
memory/4868-627-0x0000000000180000-0x000000000018B000-memory.dmpFilesize
44KB
-
memory/4924-361-0x0000000000000000-mapping.dmp
-
memory/4924-582-0x0000000000440000-0x0000000000445000-memory.dmpFilesize
20KB
-
memory/4924-606-0x0000000000430000-0x0000000000439000-memory.dmpFilesize
36KB
-
memory/5060-175-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5060-169-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5060-174-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5060-173-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5060-193-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5060-189-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5060-168-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5060-172-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5060-171-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5060-510-0x0000000003150000-0x0000000003156000-memory.dmpFilesize
24KB
-
memory/5060-339-0x0000000000E60000-0x0000000000F4C000-memory.dmpFilesize
944KB
-
memory/5060-191-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5060-170-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5060-166-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5060-165-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5060-164-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5060-163-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5060-162-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5060-161-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5060-160-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5060-158-0x0000000000000000-mapping.dmp