Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
26-12-2022 10:12
Static task
static1
Behavioral task
behavioral1
Sample
66eca40a043f64457ccaea3ecce8dfe8321d5bd9410d0e93b5b125a0dd0f2a6c.exe
Resource
win10-20220812-en
General
-
Target
66eca40a043f64457ccaea3ecce8dfe8321d5bd9410d0e93b5b125a0dd0f2a6c.exe
-
Size
231KB
-
MD5
f53cb60c5e91aaac4d3a153d5aaa8b39
-
SHA1
5b7aa93cf6e05097722fbdadd01af1e63b3134a3
-
SHA256
66eca40a043f64457ccaea3ecce8dfe8321d5bd9410d0e93b5b125a0dd0f2a6c
-
SHA512
917ecc1dc83bb13ac317928e12ccbc082bde11f586f962db4bf05e7768a4ce48070bc0946f9890144b8c443b60dcc50fc1264a2b620e3626b770276bd98490ac
-
SSDEEP
3072:3Rr5LXszX5r1tjIhtZVYJjxeTOhRzhllS1g/tK80MWinRM7lTLrcSb54VIcVTuh:vLczZwDDJTOzzhrtK8yinGlvbIr
Malware Config
Extracted
redline
11
79.137.202.18:45218
-
auth_value
107e09eee63158d2488feb03dac75204
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
2E24.exe34EC.exepid process 3804 2E24.exe 2340 34EC.exe -
Deletes itself 1 IoCs
Processes:
pid process 2068 -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
34EC.exedescription pid process target process PID 2340 set thread context of 4948 2340 34EC.exe vbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4560 2340 WerFault.exe 34EC.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
66eca40a043f64457ccaea3ecce8dfe8321d5bd9410d0e93b5b125a0dd0f2a6c.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 66eca40a043f64457ccaea3ecce8dfe8321d5bd9410d0e93b5b125a0dd0f2a6c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 66eca40a043f64457ccaea3ecce8dfe8321d5bd9410d0e93b5b125a0dd0f2a6c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 66eca40a043f64457ccaea3ecce8dfe8321d5bd9410d0e93b5b125a0dd0f2a6c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
66eca40a043f64457ccaea3ecce8dfe8321d5bd9410d0e93b5b125a0dd0f2a6c.exepid process 2196 66eca40a043f64457ccaea3ecce8dfe8321d5bd9410d0e93b5b125a0dd0f2a6c.exe 2196 66eca40a043f64457ccaea3ecce8dfe8321d5bd9410d0e93b5b125a0dd0f2a6c.exe 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2068 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
66eca40a043f64457ccaea3ecce8dfe8321d5bd9410d0e93b5b125a0dd0f2a6c.exepid process 2196 66eca40a043f64457ccaea3ecce8dfe8321d5bd9410d0e93b5b125a0dd0f2a6c.exe 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 2068 -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
vbc.exedescription pid process Token: SeShutdownPrivilege 2068 Token: SeCreatePagefilePrivilege 2068 Token: SeShutdownPrivilege 2068 Token: SeCreatePagefilePrivilege 2068 Token: SeShutdownPrivilege 2068 Token: SeCreatePagefilePrivilege 2068 Token: SeShutdownPrivilege 2068 Token: SeCreatePagefilePrivilege 2068 Token: SeShutdownPrivilege 2068 Token: SeCreatePagefilePrivilege 2068 Token: SeShutdownPrivilege 2068 Token: SeCreatePagefilePrivilege 2068 Token: SeShutdownPrivilege 2068 Token: SeCreatePagefilePrivilege 2068 Token: SeDebugPrivilege 4948 vbc.exe Token: SeShutdownPrivilege 2068 Token: SeCreatePagefilePrivilege 2068 Token: SeShutdownPrivilege 2068 Token: SeCreatePagefilePrivilege 2068 -
Suspicious use of WriteProcessMemory 56 IoCs
Processes:
34EC.exe2E24.exedescription pid process target process PID 2068 wrote to memory of 3804 2068 2E24.exe PID 2068 wrote to memory of 3804 2068 2E24.exe PID 2068 wrote to memory of 3804 2068 2E24.exe PID 2068 wrote to memory of 2340 2068 34EC.exe PID 2068 wrote to memory of 2340 2068 34EC.exe PID 2068 wrote to memory of 2340 2068 34EC.exe PID 2068 wrote to memory of 4368 2068 explorer.exe PID 2068 wrote to memory of 4368 2068 explorer.exe PID 2068 wrote to memory of 4368 2068 explorer.exe PID 2068 wrote to memory of 4368 2068 explorer.exe PID 2068 wrote to memory of 5104 2068 explorer.exe PID 2068 wrote to memory of 5104 2068 explorer.exe PID 2068 wrote to memory of 5104 2068 explorer.exe PID 2340 wrote to memory of 4948 2340 34EC.exe vbc.exe PID 2340 wrote to memory of 4948 2340 34EC.exe vbc.exe PID 2340 wrote to memory of 4948 2340 34EC.exe vbc.exe PID 2340 wrote to memory of 4948 2340 34EC.exe vbc.exe PID 2340 wrote to memory of 4948 2340 34EC.exe vbc.exe PID 2068 wrote to memory of 2264 2068 explorer.exe PID 2068 wrote to memory of 2264 2068 explorer.exe PID 2068 wrote to memory of 2264 2068 explorer.exe PID 2068 wrote to memory of 2264 2068 explorer.exe PID 2068 wrote to memory of 3944 2068 explorer.exe PID 2068 wrote to memory of 3944 2068 explorer.exe PID 2068 wrote to memory of 3944 2068 explorer.exe PID 2068 wrote to memory of 4220 2068 explorer.exe PID 2068 wrote to memory of 4220 2068 explorer.exe PID 2068 wrote to memory of 4220 2068 explorer.exe PID 2068 wrote to memory of 4220 2068 explorer.exe PID 2068 wrote to memory of 4624 2068 explorer.exe PID 2068 wrote to memory of 4624 2068 explorer.exe PID 2068 wrote to memory of 4624 2068 explorer.exe PID 2068 wrote to memory of 4624 2068 explorer.exe PID 2068 wrote to memory of 592 2068 explorer.exe PID 2068 wrote to memory of 592 2068 explorer.exe PID 2068 wrote to memory of 592 2068 explorer.exe PID 2068 wrote to memory of 592 2068 explorer.exe PID 2068 wrote to memory of 2284 2068 explorer.exe PID 2068 wrote to memory of 2284 2068 explorer.exe PID 2068 wrote to memory of 2284 2068 explorer.exe PID 2068 wrote to memory of 744 2068 explorer.exe PID 2068 wrote to memory of 744 2068 explorer.exe PID 2068 wrote to memory of 744 2068 explorer.exe PID 2068 wrote to memory of 744 2068 explorer.exe PID 3804 wrote to memory of 4876 3804 2E24.exe vbc.exe PID 3804 wrote to memory of 4876 3804 2E24.exe vbc.exe PID 3804 wrote to memory of 4876 3804 2E24.exe vbc.exe PID 3804 wrote to memory of 1128 3804 2E24.exe vbc.exe PID 3804 wrote to memory of 1128 3804 2E24.exe vbc.exe PID 3804 wrote to memory of 1128 3804 2E24.exe vbc.exe PID 3804 wrote to memory of 2192 3804 2E24.exe vbc.exe PID 3804 wrote to memory of 2192 3804 2E24.exe vbc.exe PID 3804 wrote to memory of 2192 3804 2E24.exe vbc.exe PID 3804 wrote to memory of 3576 3804 2E24.exe vbc.exe PID 3804 wrote to memory of 3576 3804 2E24.exe vbc.exe PID 3804 wrote to memory of 3576 3804 2E24.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\66eca40a043f64457ccaea3ecce8dfe8321d5bd9410d0e93b5b125a0dd0f2a6c.exe"C:\Users\Admin\AppData\Local\Temp\66eca40a043f64457ccaea3ecce8dfe8321d5bd9410d0e93b5b125a0dd0f2a6c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\2E24.exeC:\Users\Admin\AppData\Local\Temp\2E24.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\34EC.exeC:\Users\Admin\AppData\Local\Temp\34EC.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 2362⤵
- Program crash
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2E24.exeFilesize
67KB
MD5666d8f33d37064fd5d14e2166c9bfa69
SHA13b27df9335a9b2efe9da1057e9f8312a72d1ca9d
SHA2567fddf1b75f50d43214867f367223f2d241d62ae63deea334d051c0ee19d18157
SHA512ac3c993f019bb402db474fda65d587ae7717725eea9b3a869acd3530543b7b94d354f19474f6b1c7fc760b5b22622328def2bef26e3900c186b16e8a3d3b90df
-
C:\Users\Admin\AppData\Local\Temp\2E24.exeFilesize
67KB
MD5666d8f33d37064fd5d14e2166c9bfa69
SHA13b27df9335a9b2efe9da1057e9f8312a72d1ca9d
SHA2567fddf1b75f50d43214867f367223f2d241d62ae63deea334d051c0ee19d18157
SHA512ac3c993f019bb402db474fda65d587ae7717725eea9b3a869acd3530543b7b94d354f19474f6b1c7fc760b5b22622328def2bef26e3900c186b16e8a3d3b90df
-
C:\Users\Admin\AppData\Local\Temp\34EC.exeFilesize
403KB
MD59997129d3e41ae79381957203470b051
SHA196dedfa4c05585d8d957a80a6dc816424fc60308
SHA256d5ee046c945c2742f492c96a01eed8a4d92c3cc3f7d1d3c45c12e9162ec08255
SHA5122e1664c8bab30869775ef59a53cc29ae418866a4974ce9a8014b0918694eb10bdd7d76646156d6b731057e897846d8f70c86f0fe4581d72117a4d08a4e61788b
-
C:\Users\Admin\AppData\Local\Temp\34EC.exeFilesize
403KB
MD59997129d3e41ae79381957203470b051
SHA196dedfa4c05585d8d957a80a6dc816424fc60308
SHA256d5ee046c945c2742f492c96a01eed8a4d92c3cc3f7d1d3c45c12e9162ec08255
SHA5122e1664c8bab30869775ef59a53cc29ae418866a4974ce9a8014b0918694eb10bdd7d76646156d6b731057e897846d8f70c86f0fe4581d72117a4d08a4e61788b
-
memory/592-401-0x0000000000000000-mapping.dmp
-
memory/592-642-0x00000000003D0000-0x00000000003D6000-memory.dmpFilesize
24KB
-
memory/592-656-0x00000000003C0000-0x00000000003CB000-memory.dmpFilesize
44KB
-
memory/592-1024-0x00000000003D0000-0x00000000003D6000-memory.dmpFilesize
24KB
-
memory/744-474-0x0000000000000000-mapping.dmp
-
memory/744-658-0x0000000000610000-0x0000000000618000-memory.dmpFilesize
32KB
-
memory/744-659-0x0000000000600000-0x000000000060B000-memory.dmpFilesize
44KB
-
memory/744-1025-0x0000000000610000-0x0000000000618000-memory.dmpFilesize
32KB
-
memory/2196-134-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-153-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-129-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-136-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-135-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-139-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-138-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-137-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-140-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-141-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-142-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-143-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-144-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-145-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-146-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-147-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-148-0x00000000006AA000-0x00000000006BA000-memory.dmpFilesize
64KB
-
memory/2196-149-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-150-0x0000000000460000-0x00000000005AA000-memory.dmpFilesize
1.3MB
-
memory/2196-151-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-152-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/2196-132-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-154-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-155-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-156-0x00000000006AA000-0x00000000006BA000-memory.dmpFilesize
64KB
-
memory/2196-157-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/2196-133-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-131-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-130-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-121-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-128-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-127-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-126-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-125-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-122-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-120-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-124-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2196-123-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2264-494-0x0000000000130000-0x0000000000135000-memory.dmpFilesize
20KB
-
memory/2264-530-0x0000000000120000-0x0000000000129000-memory.dmpFilesize
36KB
-
memory/2264-243-0x0000000000000000-mapping.dmp
-
memory/2264-661-0x0000000000130000-0x0000000000135000-memory.dmpFilesize
20KB
-
memory/2284-439-0x0000000000000000-mapping.dmp
-
memory/2284-458-0x0000000000190000-0x000000000019D000-memory.dmpFilesize
52KB
-
memory/2284-453-0x00000000001A0000-0x00000000001A7000-memory.dmpFilesize
28KB
-
memory/2284-660-0x00000000001A0000-0x00000000001A7000-memory.dmpFilesize
28KB
-
memory/2340-185-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2340-178-0x0000000000000000-mapping.dmp
-
memory/2340-180-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2340-181-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/2340-183-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-237-0x00000000007B0000-0x00000000007C6000-memory.dmpFilesize
88KB
-
memory/3804-162-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-186-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-182-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-174-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-158-0x0000000000000000-mapping.dmp
-
memory/3804-190-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-192-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-160-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-187-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-161-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-189-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-173-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-184-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-166-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-176-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-172-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-163-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-177-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-170-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-171-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-403-0x0000000002A50000-0x0000000002A70000-memory.dmpFilesize
128KB
-
memory/3804-167-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-164-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-165-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-169-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3804-368-0x0000000004FD0000-0x0000000005036000-memory.dmpFilesize
408KB
-
memory/3804-175-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/3944-296-0x00000000003D0000-0x00000000003DC000-memory.dmpFilesize
48KB
-
memory/3944-291-0x00000000003E0000-0x00000000003E6000-memory.dmpFilesize
24KB
-
memory/3944-284-0x0000000000000000-mapping.dmp
-
memory/3944-657-0x00000000003E0000-0x00000000003E6000-memory.dmpFilesize
24KB
-
memory/4220-825-0x0000000000150000-0x0000000000172000-memory.dmpFilesize
136KB
-
memory/4220-599-0x0000000000120000-0x0000000000147000-memory.dmpFilesize
156KB
-
memory/4220-323-0x0000000000000000-mapping.dmp
-
memory/4220-595-0x0000000000150000-0x0000000000172000-memory.dmpFilesize
136KB
-
memory/4368-376-0x0000000002DE0000-0x0000000002DEB000-memory.dmpFilesize
44KB
-
memory/4368-191-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/4368-193-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/4368-194-0x0000000077D40000-0x0000000077ECE000-memory.dmpFilesize
1.6MB
-
memory/4368-188-0x0000000000000000-mapping.dmp
-
memory/4368-339-0x0000000002DF0000-0x0000000002DF7000-memory.dmpFilesize
28KB
-
memory/4624-363-0x0000000000000000-mapping.dmp
-
memory/4624-1023-0x00000000006C0000-0x00000000006C5000-memory.dmpFilesize
20KB
-
memory/4624-637-0x00000000006C0000-0x00000000006C5000-memory.dmpFilesize
20KB
-
memory/4624-640-0x00000000006B0000-0x00000000006B9000-memory.dmpFilesize
36KB
-
memory/4948-1026-0x000000000A6A0000-0x000000000A716000-memory.dmpFilesize
472KB
-
memory/4948-499-0x0000000009110000-0x000000000921A000-memory.dmpFilesize
1.0MB
-
memory/4948-235-0x000000000041B58A-mapping.dmp
-
memory/4948-1027-0x000000000A720000-0x000000000A770000-memory.dmpFilesize
320KB
-
memory/4948-342-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4948-554-0x0000000006A60000-0x0000000006AAB000-memory.dmpFilesize
300KB
-
memory/4948-534-0x0000000006A20000-0x0000000006A5E000-memory.dmpFilesize
248KB
-
memory/4948-662-0x00000000092C0000-0x0000000009352000-memory.dmpFilesize
584KB
-
memory/4948-663-0x000000000A120000-0x000000000A61E000-memory.dmpFilesize
5.0MB
-
memory/4948-687-0x000000000A7F0000-0x000000000A9B2000-memory.dmpFilesize
1.8MB
-
memory/4948-688-0x000000000AEF0000-0x000000000B41C000-memory.dmpFilesize
5.2MB
-
memory/4948-491-0x0000000009610000-0x0000000009C16000-memory.dmpFilesize
6.0MB
-
memory/4948-514-0x00000000069C0000-0x00000000069D2000-memory.dmpFilesize
72KB
-
memory/5104-636-0x0000000000BA0000-0x0000000000BA9000-memory.dmpFilesize
36KB
-
memory/5104-211-0x0000000000000000-mapping.dmp
-
memory/5104-244-0x0000000000BA0000-0x0000000000BA9000-memory.dmpFilesize
36KB
-
memory/5104-248-0x0000000000B90000-0x0000000000B9F000-memory.dmpFilesize
60KB