Analysis
-
max time kernel
30s -
max time network
59s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
05-12-2023 17:10
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20231127-en
General
-
Target
file.exe
-
Size
269KB
-
MD5
9cad5b4d70563e0502bd9448fda8d17c
-
SHA1
f081a4b20fe8899994867490ae1329c6d90de47d
-
SHA256
3ff3a06b10b6158ac51d74487dd5c108dc113b3e7a2bb598e37c2d02e37f4631
-
SHA512
112b75f557b7ad76405eec278fbbeb8efaea3ad1b58f3954a63d1f72121db29e0d7a760d4f2627f6293bd20acfa51163d3ce9549132cf19ad963602032c46dff
-
SSDEEP
3072:KHl3/MPPIYsGkrWxEuTABIsO9UL0RzPlQmUucvTtcSZk2d:g30YayWxpTQ+UL05vUbp
Malware Config
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
Extracted
redline
1205-55000
38.47.221.193:34368
Extracted
redline
redtest
107.173.58.91:32870
Signatures
-
Raccoon Stealer V2 payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1108-23-0x0000000000250000-0x0000000000266000-memory.dmp family_raccoon_v2 behavioral1/memory/1108-24-0x0000000000400000-0x0000000002ABF000-memory.dmp family_raccoon_v2 behavioral1/memory/1108-110-0x0000000000400000-0x0000000002ABF000-memory.dmp family_raccoon_v2 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/3020-53-0x0000000000960000-0x00000000012E2000-memory.dmp family_redline behavioral1/memory/2340-155-0x0000000000080000-0x00000000000BC000-memory.dmp family_redline behavioral1/memory/2340-160-0x0000000000080000-0x00000000000BC000-memory.dmp family_redline behavioral1/memory/2340-163-0x0000000007220000-0x0000000007260000-memory.dmp family_redline behavioral1/memory/2340-158-0x0000000000080000-0x00000000000BC000-memory.dmp family_redline behavioral1/memory/3020-172-0x0000000000960000-0x00000000012E2000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1376 -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\20FA.exe themida behavioral1/memory/3020-53-0x0000000000960000-0x00000000012E2000-memory.dmp themida behavioral1/memory/3020-172-0x0000000000960000-0x00000000012E2000-memory.dmp themida -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
file.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 2120 tasklist.exe 1052 tasklist.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepid process 2044 file.exe 2044 file.exe 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 1376 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1376 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
file.exepid process 2044 file.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1376 1376 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1376 1376 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\196A.exeC:\Users\Admin\AppData\Local\Temp\196A.exe1⤵
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1C39.dll1⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1C39.dll2⤵
-
C:\Users\Admin\AppData\Local\Temp\20FA.exeC:\Users\Admin\AppData\Local\Temp\20FA.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\2511.exeC:\Users\Admin\AppData\Local\Temp\2511.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd /k cmd < Properly & exit2⤵
-
C:\Windows\SysWOW64\cmd.execmd3⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe"4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir 290384⤵
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Rod + Animation 29038\t4⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost4⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\14712\29038\Imported.pif29038\Imported.pif 29038\t4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Mandatory + Aging + Fathers + Granny + Plymouth 29038\Imported.pif4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\286C.exeC:\Users\Admin\AppData\Local\Temp\286C.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\14712\29038\jsc.exeC:\Users\Admin\AppData\Local\Temp\14712\29038\jsc.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\14712\29038\Imported.pifFilesize
923KB
MD5935fbadaf795660acc74f19a21537d1f
SHA1c8df7452b2fc422cecc481fd117520b58d022477
SHA2564d560e98c7a387c176abc99d68c46784a411ef05da6da8ed176537a9bfda0ae2
SHA512261a4415c5b844a84500b1af724d3194b45677a984db222a31b48476a719970eb1bb60d149bf22daef5098ead7be04c7067cade97e2ea57787d2d6cc8875e106
-
C:\Users\Admin\AppData\Local\Temp\14712\29038\Imported.pifFilesize
923KB
MD5935fbadaf795660acc74f19a21537d1f
SHA1c8df7452b2fc422cecc481fd117520b58d022477
SHA2564d560e98c7a387c176abc99d68c46784a411ef05da6da8ed176537a9bfda0ae2
SHA512261a4415c5b844a84500b1af724d3194b45677a984db222a31b48476a719970eb1bb60d149bf22daef5098ead7be04c7067cade97e2ea57787d2d6cc8875e106
-
C:\Users\Admin\AppData\Local\Temp\14712\29038\jsc.exeFilesize
45KB
MD5f1feead2143c07ca411d82a29fa964af
SHA12198e7bf402773757bb2a25311ffd2644e5a1645
SHA2568f2800ac8af72e8038e146b3988a30651952f20ed6cdf7be3ae4709fbb026af1
SHA512e7e2266ec862a793da7cea01c926b7a874453cf2efb0b4b77776c26042dc2ded74f17c390fad97bd2d8c0c4971a1b9d9e6c705a13edbc9e48570922e5e6cc9df
-
C:\Users\Admin\AppData\Local\Temp\14712\29038\jsc.exeFilesize
45KB
MD5f1feead2143c07ca411d82a29fa964af
SHA12198e7bf402773757bb2a25311ffd2644e5a1645
SHA2568f2800ac8af72e8038e146b3988a30651952f20ed6cdf7be3ae4709fbb026af1
SHA512e7e2266ec862a793da7cea01c926b7a874453cf2efb0b4b77776c26042dc2ded74f17c390fad97bd2d8c0c4971a1b9d9e6c705a13edbc9e48570922e5e6cc9df
-
C:\Users\Admin\AppData\Local\Temp\14712\29038\tFilesize
614KB
MD502d4ae697716161ea028f0ef737f9cda
SHA1bb31eec1c0d404e72f59f37f88bfdb537a82e1b4
SHA25653d67750aad9c7da47f1e28c94cce121074a8be1ef846cbf588826b459be2b6f
SHA5120984c16f3a32b80c6a1ae84d39ce0ce3d3100857b04b1e3a5303d81ac3b14fbe934c70f1b13bd827e1a6137e03f24273e98c7a31f8970079d21eb11d60c8baf1
-
C:\Users\Admin\AppData\Local\Temp\14712\AgingFilesize
265KB
MD5c724d5bd5c18d2bbe5fe2c7946c1b6b2
SHA17beed9c36d52db96557049da7fb3fd9765ab06da
SHA25686b3e35e182ef64c4119084416a1009c365629360d954a4a9a53ec6d737a2d8f
SHA5128841cb5ff4425ecaa89f691510276e42cb68450514439766d1e82769f0a498295961681e02bd2c0251b082e50eee599a516b19f7dde345a30f81f743f94e48a7
-
C:\Users\Admin\AppData\Local\Temp\14712\AnimationFilesize
156KB
MD55dbdebec65c149f9303357aeb35f3f13
SHA1971b53aad088edbbd9185c5390b82e41324e964b
SHA25650e9ea749c805b70e45e35d0ec59f5380e5ff8f0b677d099e19b3d6b782163c6
SHA512df410166f1eff8f08453dc110227e947f3c94de59da6a4c5953ff27d8d133df3acad89640f948d4133f4e367809a754f43586bf397acd01133cb291111b7f065
-
C:\Users\Admin\AppData\Local\Temp\14712\FathersFilesize
134KB
MD519840b560c884e4575f325fbf6dde028
SHA158a5840b9163d586ea83535d02197a30fe04f3d0
SHA256698f94e57b0edc595e35cd9ea0a6ded21fd383c559e349b2d4b6bae01a0a445f
SHA5121a3921f8a9a3fd2d0394b811dbfa0fffdc72be5047fe17533cdeae3d2ec6cbdf5a0951a0744f0c1a372de809f3af502ff940fc679f3ff40d0eb55cb78b9d460e
-
C:\Users\Admin\AppData\Local\Temp\14712\GrannyFilesize
290KB
MD54ee0ce02c9a6966cf83884c8b614077f
SHA12052c40fbc6ae0bd2fc085161e42e500556c27dd
SHA256ec33283a90016ceae05ad793143d10679d430c2aa3fc2d1026f6c6acc5b028fb
SHA5128dbee460fb43696834f62352852f58fdb6e4f160dcdfb1d4a7d81b2fe8cfb730e797af4c97095abbbce19f5569afac6da3eeadb6465ff5c216b6a4e79964a4df
-
C:\Users\Admin\AppData\Local\Temp\14712\MandatoryFilesize
161KB
MD5f95a9af4657f69267464287ead8d12d2
SHA16171891ae7a8206b76ef4d9cf88f274987f21485
SHA25696aa51fdf657cdc4e28744f2383ad53d45085d7f312264c9d786c751bc778307
SHA5120ee28b7b6a767958058c775a1df42e81a97151b37511686902b29f54d0bc5769d10978c297a90f166018cd34fbc5d85f8f146576a19d78ddc5ed37083de1f6d3
-
C:\Users\Admin\AppData\Local\Temp\14712\PlymouthFilesize
74KB
MD5265a4f252616accea4a910e76e612f0b
SHA17002ca5e385a2bfa58200c08fd2821acf0072122
SHA25622424b9c63b2b5d882cc25335dbfb2f1872c1186f43fe1caf16d87b808f6e3e9
SHA512f77dfe13c67ba3235bc1dc88041a7266430bedd6f35d3f2ba0c46314346de61305256b144eb9c49842edb4d21741e31161fbe025a92cb85b7aeface781cdd5e4
-
C:\Users\Admin\AppData\Local\Temp\14712\ProperlyFilesize
12KB
MD5fdf171249c22f3f45c53408bfa0d2f2b
SHA195e96312015058c60c83a8e38733371311722593
SHA256b0d4a9769a644c418419050c5b2b7f796f06a7d4c48010e8498e2596c7a935bd
SHA51252d21473972162cd29e403d1e3eee209ac5e4c2051a7e07455ec96971a94f5ac045ba3c539066bf5abd2fe3995334a4683f58f0f11dc5c28488ae1dbce91968d
-
C:\Users\Admin\AppData\Local\Temp\14712\RodFilesize
477KB
MD54ea38f8c80b7060a80c79ab03d5d1c7c
SHA1cfddc34a9e809c7c3f9fc0e457522bfb0457ab67
SHA256b4ea21811ef45cd914cefd4fa272715c295e7673bfdd3976ef4c1b7c2f00a85a
SHA5120e2e22e503b9938fe356aaef78197621f98ece3c705a2451b6b87ccd50cff92a67d809f81673b66e58ea8c5f82ffb28e955a8eac2782a00430a134fe522cc06a
-
C:\Users\Admin\AppData\Local\Temp\196A.exeFilesize
291KB
MD51de5eb2944545479b07139c4b4227cb4
SHA16baf1786af938b22a92b5f515f9d4ee131e6495a
SHA256876ba20dfdae7014531937bf45a1a94757b01e72ae4e6ce5bee66665f1763dd1
SHA51275322c0a9f12a74a69fc342c24ab3fe622dff26545f679b4baa9ffca6e1962e13d7455146bf332db24162aac595d31f5d9f28a4c8dc5685bd94e8ce87aec023a
-
C:\Users\Admin\AppData\Local\Temp\196A.exeFilesize
291KB
MD51de5eb2944545479b07139c4b4227cb4
SHA16baf1786af938b22a92b5f515f9d4ee131e6495a
SHA256876ba20dfdae7014531937bf45a1a94757b01e72ae4e6ce5bee66665f1763dd1
SHA51275322c0a9f12a74a69fc342c24ab3fe622dff26545f679b4baa9ffca6e1962e13d7455146bf332db24162aac595d31f5d9f28a4c8dc5685bd94e8ce87aec023a
-
C:\Users\Admin\AppData\Local\Temp\1C39.dllFilesize
1.1MB
MD5388019abfe8ecf3eb4b714ea2d4810b1
SHA13a1ebaae3faa856e623b710338bf70153591f083
SHA256396e7a08b60f64e0e8c1355daf5a01c7fdd7f3b62f794bfb7fb6f8735de1869e
SHA5125af012db0c7440413a25babe967a9ea2bbdb939bb78c0045bbaecb30767b8f9e5e0107b2c723b3bc88e0d36ceb8e42be8511f4711ec41a89809c77f4533b5dd1
-
C:\Users\Admin\AppData\Local\Temp\20FA.exeFilesize
923KB
MD525f523d015b6f7a4242d9b664f8490ec
SHA1466701a7b66d81a786ac2203947248d46cded1da
SHA256df71713a3c0ed074a1d98ee46abed2460c482f4ec89d4b53bc6930be745c2327
SHA51275e6b341b152739e1ab685c4956dd262df4135bc87211b3d76dce0dda19d2696e3197a6bf846ccbbe5007490b49daa5c59c3df37d3acd666245acc3f377535d9
-
C:\Users\Admin\AppData\Local\Temp\2511.exeFilesize
1.3MB
MD5bf1229435270f85c47a561c29ee5e1e0
SHA1129857639c5cb4feffb0a674be2baf81f1c90bd3
SHA25608ac62d87943f67a0ec0a16d1f9c3f7dc9cef7479afed610847fbb926c9cd1af
SHA512941cb25b836e769dfe68f42df7ba4ee8b9e4e2fac2bd985b3a8b2d1da53c04f46f2380d8977f3a22650b2be37b962f4a7f54552699ebdfdf93adfce2643d966d
-
C:\Users\Admin\AppData\Local\Temp\286C.exeFilesize
923KB
MD54670e8a2bf7ec155ba99c7fc789016fe
SHA1c160f1f1ef42838347085052f20e8e3112c6dde5
SHA2569eb883b8e4e3f9a0acd404ee9d3baa3c9912a27d3ce50631f9c218509cc3b5ed
SHA512749f417fcb49bac730e9e6382b899345ebec85afbaac25e0b421a69d81d5ff41efa4becc636576e2e07bcf61fa37319335980a8fa427683e64ca71c99b266b76
-
C:\Users\Admin\AppData\Local\Temp\286C.exeFilesize
923KB
MD54670e8a2bf7ec155ba99c7fc789016fe
SHA1c160f1f1ef42838347085052f20e8e3112c6dde5
SHA2569eb883b8e4e3f9a0acd404ee9d3baa3c9912a27d3ce50631f9c218509cc3b5ed
SHA512749f417fcb49bac730e9e6382b899345ebec85afbaac25e0b421a69d81d5ff41efa4becc636576e2e07bcf61fa37319335980a8fa427683e64ca71c99b266b76
-
\Users\Admin\AppData\Local\Temp\14712\29038\Imported.pifFilesize
923KB
MD5935fbadaf795660acc74f19a21537d1f
SHA1c8df7452b2fc422cecc481fd117520b58d022477
SHA2564d560e98c7a387c176abc99d68c46784a411ef05da6da8ed176537a9bfda0ae2
SHA512261a4415c5b844a84500b1af724d3194b45677a984db222a31b48476a719970eb1bb60d149bf22daef5098ead7be04c7067cade97e2ea57787d2d6cc8875e106
-
\Users\Admin\AppData\Local\Temp\14712\29038\jsc.exeFilesize
45KB
MD5f1feead2143c07ca411d82a29fa964af
SHA12198e7bf402773757bb2a25311ffd2644e5a1645
SHA2568f2800ac8af72e8038e146b3988a30651952f20ed6cdf7be3ae4709fbb026af1
SHA512e7e2266ec862a793da7cea01c926b7a874453cf2efb0b4b77776c26042dc2ded74f17c390fad97bd2d8c0c4971a1b9d9e6c705a13edbc9e48570922e5e6cc9df
-
\Users\Admin\AppData\Local\Temp\1C39.dllFilesize
918KB
MD5e20b124244f78af726674ba7f08eda45
SHA191c70bd9f2c52d36e348b02d62792d37a773ba6f
SHA2562147583b0417a6301317048b033a9489f6e0795a5fd6af6a3be3b8753f20065c
SHA512b6f161923d7db56b79348e2a4a6f2d6a8f7629fb0d4f98bb2eeb2878e423d58ae7f0ce2bfb3c3cc9b1e5ac9dd258837c441b78e75c6d74ba12ca9dd67c3cca68
-
memory/676-108-0x0000000000060000-0x000000000006C000-memory.dmpFilesize
48KB
-
memory/676-107-0x0000000000060000-0x000000000006C000-memory.dmpFilesize
48KB
-
memory/1108-110-0x0000000000400000-0x0000000002ABF000-memory.dmpFilesize
38.7MB
-
memory/1108-109-0x0000000000270000-0x0000000000370000-memory.dmpFilesize
1024KB
-
memory/1108-22-0x0000000000270000-0x0000000000370000-memory.dmpFilesize
1024KB
-
memory/1108-23-0x0000000000250000-0x0000000000266000-memory.dmpFilesize
88KB
-
memory/1108-24-0x0000000000400000-0x0000000002ABF000-memory.dmpFilesize
38.7MB
-
memory/1376-4-0x0000000003990000-0x00000000039A6000-memory.dmpFilesize
88KB
-
memory/1504-94-0x0000000000080000-0x00000000000EB000-memory.dmpFilesize
428KB
-
memory/1504-90-0x00000000000F0000-0x0000000000165000-memory.dmpFilesize
468KB
-
memory/1504-104-0x0000000000080000-0x00000000000EB000-memory.dmpFilesize
428KB
-
memory/1504-88-0x0000000000080000-0x00000000000EB000-memory.dmpFilesize
428KB
-
memory/1944-86-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1944-112-0x0000000074000000-0x00000000746EE000-memory.dmpFilesize
6.9MB
-
memory/1944-75-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1944-89-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1944-81-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1944-83-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/1944-77-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1944-84-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1944-106-0x0000000000CE0000-0x0000000000D20000-memory.dmpFilesize
256KB
-
memory/1944-105-0x0000000074000000-0x00000000746EE000-memory.dmpFilesize
6.9MB
-
memory/1944-79-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2044-3-0x0000000000400000-0x0000000000B9E000-memory.dmpFilesize
7.6MB
-
memory/2044-5-0x0000000000400000-0x0000000000B9E000-memory.dmpFilesize
7.6MB
-
memory/2044-2-0x0000000000220000-0x000000000022B000-memory.dmpFilesize
44KB
-
memory/2044-1-0x0000000000CF0000-0x0000000000DF0000-memory.dmpFilesize
1024KB
-
memory/2044-8-0x0000000000220000-0x000000000022B000-memory.dmpFilesize
44KB
-
memory/2340-160-0x0000000000080000-0x00000000000BC000-memory.dmpFilesize
240KB
-
memory/2340-163-0x0000000007220000-0x0000000007260000-memory.dmpFilesize
256KB
-
memory/2340-162-0x0000000074000000-0x00000000746EE000-memory.dmpFilesize
6.9MB
-
memory/2340-155-0x0000000000080000-0x00000000000BC000-memory.dmpFilesize
240KB
-
memory/2340-158-0x0000000000080000-0x00000000000BC000-memory.dmpFilesize
240KB
-
memory/2340-180-0x0000000074000000-0x00000000746EE000-memory.dmpFilesize
6.9MB
-
memory/2520-31-0x0000000002320000-0x0000000002444000-memory.dmpFilesize
1.1MB
-
memory/2520-42-0x0000000002450000-0x0000000002558000-memory.dmpFilesize
1.0MB
-
memory/2520-40-0x0000000002450000-0x0000000002558000-memory.dmpFilesize
1.0MB
-
memory/2520-37-0x0000000002450000-0x0000000002558000-memory.dmpFilesize
1.0MB
-
memory/2520-36-0x0000000002450000-0x0000000002558000-memory.dmpFilesize
1.0MB
-
memory/2520-30-0x0000000000140000-0x0000000000146000-memory.dmpFilesize
24KB
-
memory/2520-28-0x0000000010000000-0x000000001028E000-memory.dmpFilesize
2.6MB
-
memory/2528-66-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2528-145-0x0000000000400000-0x0000000000552000-memory.dmpFilesize
1.3MB
-
memory/2960-149-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/3020-54-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-44-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-45-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-47-0x0000000076440000-0x0000000076487000-memory.dmpFilesize
284KB
-
memory/3020-48-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-50-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-67-0x0000000002C00000-0x0000000002C40000-memory.dmpFilesize
256KB
-
memory/3020-53-0x0000000000960000-0x00000000012E2000-memory.dmpFilesize
9.5MB
-
memory/3020-65-0x0000000074000000-0x00000000746EE000-memory.dmpFilesize
6.9MB
-
memory/3020-136-0x0000000076440000-0x0000000076487000-memory.dmpFilesize
284KB
-
memory/3020-137-0x0000000074000000-0x00000000746EE000-memory.dmpFilesize
6.9MB
-
memory/3020-135-0x0000000000960000-0x00000000012E2000-memory.dmpFilesize
9.5MB
-
memory/3020-139-0x0000000076440000-0x0000000076487000-memory.dmpFilesize
284KB
-
memory/3020-144-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-143-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-142-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-141-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-140-0x0000000076440000-0x0000000076487000-memory.dmpFilesize
284KB
-
memory/3020-56-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-58-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-59-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-64-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-61-0x00000000778E0000-0x00000000778E2000-memory.dmpFilesize
8KB
-
memory/3020-55-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-52-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-51-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-49-0x0000000076440000-0x0000000076487000-memory.dmpFilesize
284KB
-
memory/3020-46-0x0000000076440000-0x0000000076487000-memory.dmpFilesize
284KB
-
memory/3020-165-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-167-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-170-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-172-0x0000000000960000-0x00000000012E2000-memory.dmpFilesize
9.5MB
-
memory/3020-173-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-175-0x0000000074000000-0x00000000746EE000-memory.dmpFilesize
6.9MB
-
memory/3020-177-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-176-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-174-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-171-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-169-0x0000000076440000-0x0000000076487000-memory.dmpFilesize
284KB
-
memory/3020-168-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-166-0x0000000077190000-0x00000000772A0000-memory.dmpFilesize
1.1MB
-
memory/3020-38-0x0000000000960000-0x00000000012E2000-memory.dmpFilesize
9.5MB