Analysis
-
max time kernel
151s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
16-11-2021 12:01
Static task
static1
Behavioral task
behavioral1
Sample
5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe
Resource
win10-en-20211014
General
-
Target
5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe
-
Size
327KB
-
MD5
dee5b0dbf7cc9cbe66681d1c0c0db53a
-
SHA1
ff8ec995a114d98446800550df0ce547a4f24009
-
SHA256
5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd
-
SHA512
34cd9a762c087e98faee9175d001821ecbbaf5554dd5b7addcd9fff085a98ce63734c1b38b7d430fbac3a5276bc1ec4520f90739cbc4872233e4db73a45182b6
Malware Config
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Extracted
redline
185.159.80.90:38637
Extracted
raccoon
1.8.3-hotfix
ddf183af4241e3172885cf1b2c4c1fb4ee03d05a
-
url4cnc
http://91.219.236.27/capibar
http://5.181.156.92/capibar
http://91.219.236.207/capibar
http://185.225.19.18/capibar
http://91.219.237.227/capibar
https://t.me/capibar
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/612-145-0x0000000000418EEA-mapping.dmp family_redline behavioral1/memory/612-144-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/612-154-0x0000000005140000-0x0000000005746000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1456 created 1068 1456 WerFault.exe 5532.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 7 IoCs
Processes:
3489.exe3489.exe4AB2.exe5532.exe4AB2.exe6DEC.exe880C.exepid process 2964 3489.exe 3884 3489.exe 752 4AB2.exe 1068 5532.exe 612 4AB2.exe 3268 6DEC.exe 2304 880C.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
880C.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 880C.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 880C.exe -
Deletes itself 1 IoCs
Processes:
pid process 3004 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\880C.exe themida behavioral1/memory/2304-168-0x0000000000B70000-0x0000000000B71000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
880C.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 880C.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
880C.exepid process 2304 880C.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe3489.exe4AB2.exedescription pid process target process PID 2744 set thread context of 3252 2744 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe PID 2964 set thread context of 3884 2964 3489.exe 3489.exe PID 752 set thread context of 612 752 4AB2.exe 4AB2.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1456 1068 WerFault.exe 5532.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe3489.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3489.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3489.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3489.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exepid process 3252 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe 3252 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3004 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe3489.exepid process 3252 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe 3884 3489.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
WerFault.exe4AB2.exe880C.exedescription pid process Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeRestorePrivilege 1456 WerFault.exe Token: SeBackupPrivilege 1456 WerFault.exe Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeDebugPrivilege 1456 WerFault.exe Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeDebugPrivilege 612 4AB2.exe Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeDebugPrivilege 2304 880C.exe Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe3489.exe4AB2.exedescription pid process target process PID 2744 wrote to memory of 3252 2744 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe PID 2744 wrote to memory of 3252 2744 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe PID 2744 wrote to memory of 3252 2744 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe PID 2744 wrote to memory of 3252 2744 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe PID 2744 wrote to memory of 3252 2744 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe PID 2744 wrote to memory of 3252 2744 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe 5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe PID 3004 wrote to memory of 2964 3004 3489.exe PID 3004 wrote to memory of 2964 3004 3489.exe PID 3004 wrote to memory of 2964 3004 3489.exe PID 2964 wrote to memory of 3884 2964 3489.exe 3489.exe PID 2964 wrote to memory of 3884 2964 3489.exe 3489.exe PID 2964 wrote to memory of 3884 2964 3489.exe 3489.exe PID 2964 wrote to memory of 3884 2964 3489.exe 3489.exe PID 2964 wrote to memory of 3884 2964 3489.exe 3489.exe PID 2964 wrote to memory of 3884 2964 3489.exe 3489.exe PID 3004 wrote to memory of 752 3004 4AB2.exe PID 3004 wrote to memory of 752 3004 4AB2.exe PID 3004 wrote to memory of 752 3004 4AB2.exe PID 3004 wrote to memory of 1068 3004 5532.exe PID 3004 wrote to memory of 1068 3004 5532.exe PID 3004 wrote to memory of 1068 3004 5532.exe PID 752 wrote to memory of 612 752 4AB2.exe 4AB2.exe PID 752 wrote to memory of 612 752 4AB2.exe 4AB2.exe PID 752 wrote to memory of 612 752 4AB2.exe 4AB2.exe PID 752 wrote to memory of 612 752 4AB2.exe 4AB2.exe PID 752 wrote to memory of 612 752 4AB2.exe 4AB2.exe PID 752 wrote to memory of 612 752 4AB2.exe 4AB2.exe PID 752 wrote to memory of 612 752 4AB2.exe 4AB2.exe PID 752 wrote to memory of 612 752 4AB2.exe 4AB2.exe PID 3004 wrote to memory of 3268 3004 6DEC.exe PID 3004 wrote to memory of 3268 3004 6DEC.exe PID 3004 wrote to memory of 3268 3004 6DEC.exe PID 3004 wrote to memory of 2304 3004 880C.exe PID 3004 wrote to memory of 2304 3004 880C.exe PID 3004 wrote to memory of 2304 3004 880C.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe"C:\Users\Admin\AppData\Local\Temp\5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe"C:\Users\Admin\AppData\Local\Temp\5201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\3489.exeC:\Users\Admin\AppData\Local\Temp\3489.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3489.exeC:\Users\Admin\AppData\Local\Temp\3489.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\4AB2.exeC:\Users\Admin\AppData\Local\Temp\4AB2.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4AB2.exeC:\Users\Admin\AppData\Local\Temp\4AB2.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\5532.exeC:\Users\Admin\AppData\Local\Temp\5532.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 4802⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6DEC.exeC:\Users\Admin\AppData\Local\Temp\6DEC.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\880C.exeC:\Users\Admin\AppData\Local\Temp\880C.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4AB2.exe.logMD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
C:\Users\Admin\AppData\Local\Temp\3489.exeMD5
dee5b0dbf7cc9cbe66681d1c0c0db53a
SHA1ff8ec995a114d98446800550df0ce547a4f24009
SHA2565201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd
SHA51234cd9a762c087e98faee9175d001821ecbbaf5554dd5b7addcd9fff085a98ce63734c1b38b7d430fbac3a5276bc1ec4520f90739cbc4872233e4db73a45182b6
-
C:\Users\Admin\AppData\Local\Temp\3489.exeMD5
dee5b0dbf7cc9cbe66681d1c0c0db53a
SHA1ff8ec995a114d98446800550df0ce547a4f24009
SHA2565201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd
SHA51234cd9a762c087e98faee9175d001821ecbbaf5554dd5b7addcd9fff085a98ce63734c1b38b7d430fbac3a5276bc1ec4520f90739cbc4872233e4db73a45182b6
-
C:\Users\Admin\AppData\Local\Temp\3489.exeMD5
dee5b0dbf7cc9cbe66681d1c0c0db53a
SHA1ff8ec995a114d98446800550df0ce547a4f24009
SHA2565201ba2c701d2057290ed568a9f9cb03675ad4c4e518bca664079c596a2e80fd
SHA51234cd9a762c087e98faee9175d001821ecbbaf5554dd5b7addcd9fff085a98ce63734c1b38b7d430fbac3a5276bc1ec4520f90739cbc4872233e4db73a45182b6
-
C:\Users\Admin\AppData\Local\Temp\4AB2.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\4AB2.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\4AB2.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\5532.exeMD5
d985b4cfdceecc3c0fe4f3e4fda4e416
SHA1f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
SHA256a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
SHA512560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
-
C:\Users\Admin\AppData\Local\Temp\5532.exeMD5
d985b4cfdceecc3c0fe4f3e4fda4e416
SHA1f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
SHA256a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
SHA512560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
-
C:\Users\Admin\AppData\Local\Temp\6DEC.exeMD5
8f79110737dc06d512478b5f7d8d5c2b
SHA16c1cb2cb48d77ec4bb4e500f0fa7ab873d35e063
SHA256bf5031c61e39f9dfb379eba03181bfc5bdc63527c25588279fc9e2684e462c11
SHA512efc3b733905b6266d17c33ef8e091307ea6afcef2d1f292431ffc6701eb07d49197512d24d583f82781f9eccad4084c808ce547e82deaec28f1adac8251836e6
-
C:\Users\Admin\AppData\Local\Temp\6DEC.exeMD5
8f79110737dc06d512478b5f7d8d5c2b
SHA16c1cb2cb48d77ec4bb4e500f0fa7ab873d35e063
SHA256bf5031c61e39f9dfb379eba03181bfc5bdc63527c25588279fc9e2684e462c11
SHA512efc3b733905b6266d17c33ef8e091307ea6afcef2d1f292431ffc6701eb07d49197512d24d583f82781f9eccad4084c808ce547e82deaec28f1adac8251836e6
-
C:\Users\Admin\AppData\Local\Temp\880C.exeMD5
e6b720b5974e96b75819603792352565
SHA151319678ec88f9a9db23aac1270839d08acd2d74
SHA256caac7c774c5f0ed485f6d37a03479f32160699db0a9dff42c1df1fc425b764ec
SHA5121ad8a72daa0f3c01ddd3af7fde742818a458c8ca63bca78a03197532808f9762b80428ac3ef2de843419d341b2e6b26a3cc02f672389b777dae5e054c0d9fdf5
-
memory/612-144-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/612-158-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/612-151-0x00000000051C0000-0x00000000051C1000-memory.dmpFilesize
4KB
-
memory/612-152-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/612-153-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/612-150-0x0000000005750000-0x0000000005751000-memory.dmpFilesize
4KB
-
memory/612-182-0x0000000007490000-0x0000000007491000-memory.dmpFilesize
4KB
-
memory/612-181-0x0000000006D90000-0x0000000006D91000-memory.dmpFilesize
4KB
-
memory/612-177-0x0000000006120000-0x0000000006121000-memory.dmpFilesize
4KB
-
memory/612-145-0x0000000000418EEA-mapping.dmp
-
memory/612-154-0x0000000005140000-0x0000000005746000-memory.dmpFilesize
6.0MB
-
memory/612-170-0x0000000005570000-0x0000000005571000-memory.dmpFilesize
4KB
-
memory/752-135-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/752-128-0x0000000000000000-mapping.dmp
-
memory/752-139-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/752-134-0x00000000050B0000-0x0000000005126000-memory.dmpFilesize
472KB
-
memory/752-133-0x0000000005130000-0x0000000005131000-memory.dmpFilesize
4KB
-
memory/752-131-0x0000000000930000-0x0000000000931000-memory.dmpFilesize
4KB
-
memory/1068-141-0x0000000000440000-0x000000000058A000-memory.dmpFilesize
1.3MB
-
memory/1068-136-0x0000000000000000-mapping.dmp
-
memory/1068-140-0x0000000000440000-0x000000000058A000-memory.dmpFilesize
1.3MB
-
memory/1068-142-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2304-162-0x0000000000000000-mapping.dmp
-
memory/2304-188-0x0000000007920000-0x0000000007921000-memory.dmpFilesize
4KB
-
memory/2304-178-0x0000000006160000-0x0000000006161000-memory.dmpFilesize
4KB
-
memory/2304-168-0x0000000000B70000-0x0000000000B71000-memory.dmpFilesize
4KB
-
memory/2304-164-0x0000000077280000-0x000000007740E000-memory.dmpFilesize
1.6MB
-
memory/2744-118-0x0000000002410000-0x000000000255A000-memory.dmpFilesize
1.3MB
-
memory/2744-115-0x0000000002589000-0x000000000259A000-memory.dmpFilesize
68KB
-
memory/2964-127-0x00000000024D0000-0x00000000024D9000-memory.dmpFilesize
36KB
-
memory/2964-120-0x0000000000000000-mapping.dmp
-
memory/3004-119-0x0000000000650000-0x0000000000666000-memory.dmpFilesize
88KB
-
memory/3004-143-0x0000000002150000-0x0000000002166000-memory.dmpFilesize
88KB
-
memory/3252-116-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3252-117-0x0000000000402DD8-mapping.dmp
-
memory/3268-161-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/3268-160-0x0000000002070000-0x00000000020FF000-memory.dmpFilesize
572KB
-
memory/3268-159-0x0000000001FA0000-0x0000000001FEF000-memory.dmpFilesize
316KB
-
memory/3268-155-0x0000000000000000-mapping.dmp
-
memory/3884-125-0x0000000000402DD8-mapping.dmp