Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
07-12-2022 20:07
Static task
static1
Behavioral task
behavioral1
Sample
72f78b2cc3072ecada2f43aec0f2f003743d1bc03aaa0e95743aa3e5ddb169ec.exe
Resource
win10-20220812-en
General
-
Target
72f78b2cc3072ecada2f43aec0f2f003743d1bc03aaa0e95743aa3e5ddb169ec.exe
-
Size
264KB
-
MD5
4106a959726ef1b9cbfbb3b0fb7238de
-
SHA1
772d057c3443a8baa73b6101da08c1c72777ef5d
-
SHA256
72f78b2cc3072ecada2f43aec0f2f003743d1bc03aaa0e95743aa3e5ddb169ec
-
SHA512
a64554237a3ef290aa3d2c4d3c2d9af2ca5408007743985e24703d2f6580d34c60f0642af0b1891aa10083411abb8962f3dfd86059ed608073d64cb02fbbf81a
-
SSDEEP
3072:VaoezVNYdSf8qJHgv5R9dF3ZPBlCghZxw/BeVj97VhjgRpx9RIlf3:UPEKQFiM3shilf
Malware Config
Extracted
redline
YT
65.21.5.58:48811
-
auth_value
fb878dde7f3b4ad1e1bc26d24db36d28
Signatures
-
Detects Smokeloader packer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2584-135-0x00000000001D0000-0x00000000001D9000-memory.dmp family_smokeloader behavioral1/memory/2584-154-0x00000000001D0000-0x00000000001D9000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
2693.exe2D79.exe38C5.exepid process 4588 2693.exe 4800 2D79.exe 2204 38C5.exe -
Deletes itself 1 IoCs
Processes:
pid process 3064 -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
2D79.exe38C5.exedescription pid process target process PID 4800 set thread context of 1608 4800 2D79.exe vbc.exe PID 2204 set thread context of 1340 2204 38C5.exe vbc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1932 2204 WerFault.exe 38C5.exe 2232 4800 WerFault.exe 2D79.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
72f78b2cc3072ecada2f43aec0f2f003743d1bc03aaa0e95743aa3e5ddb169ec.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 72f78b2cc3072ecada2f43aec0f2f003743d1bc03aaa0e95743aa3e5ddb169ec.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 72f78b2cc3072ecada2f43aec0f2f003743d1bc03aaa0e95743aa3e5ddb169ec.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 72f78b2cc3072ecada2f43aec0f2f003743d1bc03aaa0e95743aa3e5ddb169ec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
72f78b2cc3072ecada2f43aec0f2f003743d1bc03aaa0e95743aa3e5ddb169ec.exepid process 2584 72f78b2cc3072ecada2f43aec0f2f003743d1bc03aaa0e95743aa3e5ddb169ec.exe 2584 72f78b2cc3072ecada2f43aec0f2f003743d1bc03aaa0e95743aa3e5ddb169ec.exe 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3064 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
72f78b2cc3072ecada2f43aec0f2f003743d1bc03aaa0e95743aa3e5ddb169ec.exepid process 2584 72f78b2cc3072ecada2f43aec0f2f003743d1bc03aaa0e95743aa3e5ddb169ec.exe 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
2693.exevbc.exedescription pid process Token: SeDebugPrivilege 4588 2693.exe Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeDebugPrivilege 1608 vbc.exe Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
38C5.exe2D79.exedescription pid process target process PID 3064 wrote to memory of 4588 3064 2693.exe PID 3064 wrote to memory of 4588 3064 2693.exe PID 3064 wrote to memory of 4588 3064 2693.exe PID 3064 wrote to memory of 4800 3064 2D79.exe PID 3064 wrote to memory of 4800 3064 2D79.exe PID 3064 wrote to memory of 4800 3064 2D79.exe PID 3064 wrote to memory of 2204 3064 38C5.exe PID 3064 wrote to memory of 2204 3064 38C5.exe PID 3064 wrote to memory of 2204 3064 38C5.exe PID 3064 wrote to memory of 4924 3064 explorer.exe PID 3064 wrote to memory of 4924 3064 explorer.exe PID 3064 wrote to memory of 4924 3064 explorer.exe PID 3064 wrote to memory of 4924 3064 explorer.exe PID 3064 wrote to memory of 5084 3064 explorer.exe PID 3064 wrote to memory of 5084 3064 explorer.exe PID 3064 wrote to memory of 5084 3064 explorer.exe PID 3064 wrote to memory of 4208 3064 explorer.exe PID 3064 wrote to memory of 4208 3064 explorer.exe PID 3064 wrote to memory of 4208 3064 explorer.exe PID 3064 wrote to memory of 4208 3064 explorer.exe PID 3064 wrote to memory of 3916 3064 explorer.exe PID 3064 wrote to memory of 3916 3064 explorer.exe PID 3064 wrote to memory of 3916 3064 explorer.exe PID 3064 wrote to memory of 4376 3064 explorer.exe PID 3064 wrote to memory of 4376 3064 explorer.exe PID 3064 wrote to memory of 4376 3064 explorer.exe PID 3064 wrote to memory of 4376 3064 explorer.exe PID 3064 wrote to memory of 4424 3064 explorer.exe PID 3064 wrote to memory of 4424 3064 explorer.exe PID 3064 wrote to memory of 4424 3064 explorer.exe PID 3064 wrote to memory of 4424 3064 explorer.exe PID 3064 wrote to memory of 4568 3064 explorer.exe PID 3064 wrote to memory of 4568 3064 explorer.exe PID 3064 wrote to memory of 4568 3064 explorer.exe PID 3064 wrote to memory of 4568 3064 explorer.exe PID 3064 wrote to memory of 508 3064 explorer.exe PID 3064 wrote to memory of 508 3064 explorer.exe PID 3064 wrote to memory of 508 3064 explorer.exe PID 3064 wrote to memory of 224 3064 explorer.exe PID 3064 wrote to memory of 224 3064 explorer.exe PID 3064 wrote to memory of 224 3064 explorer.exe PID 3064 wrote to memory of 224 3064 explorer.exe PID 2204 wrote to memory of 1340 2204 38C5.exe vbc.exe PID 2204 wrote to memory of 1340 2204 38C5.exe vbc.exe PID 2204 wrote to memory of 1340 2204 38C5.exe vbc.exe PID 2204 wrote to memory of 1340 2204 38C5.exe vbc.exe PID 4800 wrote to memory of 1608 4800 2D79.exe vbc.exe PID 4800 wrote to memory of 1608 4800 2D79.exe vbc.exe PID 4800 wrote to memory of 1608 4800 2D79.exe vbc.exe PID 4800 wrote to memory of 1608 4800 2D79.exe vbc.exe PID 4800 wrote to memory of 1608 4800 2D79.exe vbc.exe PID 2204 wrote to memory of 1340 2204 38C5.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\72f78b2cc3072ecada2f43aec0f2f003743d1bc03aaa0e95743aa3e5ddb169ec.exe"C:\Users\Admin\AppData\Local\Temp\72f78b2cc3072ecada2f43aec0f2f003743d1bc03aaa0e95743aa3e5ddb169ec.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2693.exeC:\Users\Admin\AppData\Local\Temp\2693.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2D79.exeC:\Users\Admin\AppData\Local\Temp\2D79.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 5002⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\38C5.exeC:\Users\Admin\AppData\Local\Temp\38C5.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 5002⤵
- Program crash
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2693.exeFilesize
922KB
MD50cec15477b0a89e89f78961fdd2f56b8
SHA148701957b74b12cfb521c8881ec9beac78f8866d
SHA25603de8297c43f7161e56416e5f7180bee53b5234f5c4f757cb0084b9603057351
SHA5121c8162b29d77035c23148cad569162f739ddc0c501fbf9dbc7cb06ffeaa7eb69d3f505aee167700eeba65fa6cab62ce92e3270b6d694f6f07192d8d3819ec595
-
C:\Users\Admin\AppData\Local\Temp\2693.exeFilesize
922KB
MD50cec15477b0a89e89f78961fdd2f56b8
SHA148701957b74b12cfb521c8881ec9beac78f8866d
SHA25603de8297c43f7161e56416e5f7180bee53b5234f5c4f757cb0084b9603057351
SHA5121c8162b29d77035c23148cad569162f739ddc0c501fbf9dbc7cb06ffeaa7eb69d3f505aee167700eeba65fa6cab62ce92e3270b6d694f6f07192d8d3819ec595
-
C:\Users\Admin\AppData\Local\Temp\2D79.exeFilesize
750KB
MD5bba5e9388aceb3c1c83638a42cee6b13
SHA17538b896c3898f11e372e67accc83a598dacb29d
SHA2564255c0f0323f7b4b901bafeb51a5c7befce1043684bdfb9f504b2c1213b9be59
SHA512ebc14ccc6089d3ced0ed0619df5c56ea67cea5b15e564123c5fd825f77a7e59199748a5d523733b5b0f32813f14fc8dfa2f963053237a0c3c7e4affa553cd8cd
-
C:\Users\Admin\AppData\Local\Temp\2D79.exeFilesize
750KB
MD5bba5e9388aceb3c1c83638a42cee6b13
SHA17538b896c3898f11e372e67accc83a598dacb29d
SHA2564255c0f0323f7b4b901bafeb51a5c7befce1043684bdfb9f504b2c1213b9be59
SHA512ebc14ccc6089d3ced0ed0619df5c56ea67cea5b15e564123c5fd825f77a7e59199748a5d523733b5b0f32813f14fc8dfa2f963053237a0c3c7e4affa553cd8cd
-
C:\Users\Admin\AppData\Local\Temp\38C5.exeFilesize
3.1MB
MD5df1aa71fc7fe2bc39f71b48b45d1a255
SHA19936734a8693be6429e66f3011584a9fc8094607
SHA256731fd196273e43c2d4ed578599d645bd0c297eb8dcce7ac79d5c968e0ba92e0f
SHA512abaae0d6df9f892a10808a7a7e532426c4f8c7b18771d902a5e2727b7c8dd1c2133ba3b3c488815da1b5da5b2b383180ebf87af4580fb04dab94c209d0ad75a2
-
C:\Users\Admin\AppData\Local\Temp\38C5.exeFilesize
3.1MB
MD5df1aa71fc7fe2bc39f71b48b45d1a255
SHA19936734a8693be6429e66f3011584a9fc8094607
SHA256731fd196273e43c2d4ed578599d645bd0c297eb8dcce7ac79d5c968e0ba92e0f
SHA512abaae0d6df9f892a10808a7a7e532426c4f8c7b18771d902a5e2727b7c8dd1c2133ba3b3c488815da1b5da5b2b383180ebf87af4580fb04dab94c209d0ad75a2
-
memory/224-660-0x00000000005D0000-0x00000000005D8000-memory.dmpFilesize
32KB
-
memory/224-734-0x00000000005D0000-0x00000000005D8000-memory.dmpFilesize
32KB
-
memory/224-464-0x0000000000000000-mapping.dmp
-
memory/224-661-0x00000000005C0000-0x00000000005CB000-memory.dmpFilesize
44KB
-
memory/508-429-0x0000000000000000-mapping.dmp
-
memory/508-452-0x0000000000690000-0x0000000000697000-memory.dmpFilesize
28KB
-
memory/508-459-0x0000000000680000-0x000000000068D000-memory.dmpFilesize
52KB
-
memory/508-662-0x0000000000690000-0x0000000000697000-memory.dmpFilesize
28KB
-
memory/1340-682-0x00000000049B14B0-mapping.dmp
-
memory/1608-774-0x0000000008E40000-0x0000000008E7E000-memory.dmpFilesize
248KB
-
memory/1608-683-0x000000000494B576-mapping.dmp
-
memory/1608-746-0x0000000004930000-0x0000000004962000-memory.dmpFilesize
200KB
-
memory/1608-769-0x0000000009350000-0x0000000009956000-memory.dmpFilesize
6.0MB
-
memory/1608-770-0x0000000008EA0000-0x0000000008FAA000-memory.dmpFilesize
1.0MB
-
memory/1608-772-0x0000000008DE0000-0x0000000008DF2000-memory.dmpFilesize
72KB
-
memory/1608-810-0x000000000B9D0000-0x000000000BEFC000-memory.dmpFilesize
5.2MB
-
memory/1608-776-0x0000000008FB0000-0x0000000008FFB000-memory.dmpFilesize
300KB
-
memory/1608-785-0x0000000009E60000-0x000000000A35E000-memory.dmpFilesize
5.0MB
-
memory/1608-809-0x000000000B2D0000-0x000000000B492000-memory.dmpFilesize
1.8MB
-
memory/1608-784-0x0000000009180000-0x0000000009212000-memory.dmpFilesize
584KB
-
memory/1608-788-0x0000000009220000-0x0000000009286000-memory.dmpFilesize
408KB
-
memory/2204-225-0x0000000000000000-mapping.dmp
-
memory/2204-700-0x0000000001310000-0x0000000001629000-memory.dmpFilesize
3.1MB
-
memory/2584-150-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-133-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-149-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-117-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-151-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-152-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-153-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-154-0x00000000001D0000-0x00000000001D9000-memory.dmpFilesize
36KB
-
memory/2584-155-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/2584-118-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-147-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-119-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-120-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-121-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-122-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-123-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-125-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-146-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-126-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-127-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-128-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-129-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-131-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-130-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-132-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-141-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-142-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-143-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-134-0x00000000004C0000-0x000000000060A000-memory.dmpFilesize
1.3MB
-
memory/2584-145-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-135-0x00000000001D0000-0x00000000001D9000-memory.dmpFilesize
36KB
-
memory/2584-136-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-140-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-148-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-144-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/2584-139-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-138-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-137-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3916-658-0x0000000000590000-0x0000000000596000-memory.dmpFilesize
24KB
-
memory/3916-328-0x0000000000580000-0x000000000058C000-memory.dmpFilesize
48KB
-
memory/3916-325-0x0000000000590000-0x0000000000596000-memory.dmpFilesize
24KB
-
memory/3916-316-0x0000000000000000-mapping.dmp
-
memory/4208-497-0x0000000000AC0000-0x0000000000AC5000-memory.dmpFilesize
20KB
-
memory/4208-533-0x0000000000AB0000-0x0000000000AB9000-memory.dmpFilesize
36KB
-
memory/4208-663-0x0000000000AC0000-0x0000000000AC5000-memory.dmpFilesize
20KB
-
memory/4208-294-0x0000000000000000-mapping.dmp
-
memory/4376-605-0x0000000003280000-0x00000000032A2000-memory.dmpFilesize
136KB
-
memory/4376-633-0x0000000003250000-0x0000000003277000-memory.dmpFilesize
156KB
-
memory/4376-340-0x0000000000000000-mapping.dmp
-
memory/4376-664-0x0000000003280000-0x00000000032A2000-memory.dmpFilesize
136KB
-
memory/4424-638-0x00000000009E0000-0x00000000009E5000-memory.dmpFilesize
20KB
-
memory/4424-368-0x0000000000000000-mapping.dmp
-
memory/4424-665-0x00000000009E0000-0x00000000009E5000-memory.dmpFilesize
20KB
-
memory/4424-641-0x00000000009D0000-0x00000000009D9000-memory.dmpFilesize
36KB
-
memory/4568-696-0x0000000000BC0000-0x0000000000BC6000-memory.dmpFilesize
24KB
-
memory/4568-400-0x0000000000000000-mapping.dmp
-
memory/4568-659-0x0000000000BB0000-0x0000000000BBB000-memory.dmpFilesize
44KB
-
memory/4568-642-0x0000000000BC0000-0x0000000000BC6000-memory.dmpFilesize
24KB
-
memory/4588-170-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-184-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-156-0x0000000000000000-mapping.dmp
-
memory/4588-224-0x0000000000720000-0x000000000080C000-memory.dmpFilesize
944KB
-
memory/4588-181-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-158-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-160-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-177-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-161-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-191-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-188-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-185-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-162-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-172-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-182-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-163-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-164-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-167-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-179-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-159-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-166-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-169-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-171-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-168-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-173-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4588-280-0x00000000050A0000-0x00000000050A6000-memory.dmpFilesize
24KB
-
memory/4800-187-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4800-183-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4800-176-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4800-186-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4800-174-0x0000000000000000-mapping.dmp
-
memory/4800-190-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4800-180-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4800-178-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4800-192-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4924-259-0x0000000000000000-mapping.dmp
-
memory/4924-416-0x0000000000960000-0x000000000096B000-memory.dmpFilesize
44KB
-
memory/4924-384-0x0000000000970000-0x0000000000977000-memory.dmpFilesize
28KB
-
memory/5084-600-0x0000000001010000-0x0000000001019000-memory.dmpFilesize
36KB
-
memory/5084-284-0x0000000001000000-0x000000000100F000-memory.dmpFilesize
60KB
-
memory/5084-278-0x0000000000000000-mapping.dmp
-
memory/5084-282-0x0000000001010000-0x0000000001019000-memory.dmpFilesize
36KB