Analysis
-
max time kernel
152s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
07-12-2021 13:00
Static task
static1
Behavioral task
behavioral1
Sample
369b89160fc1e3c8b2ec374dfb220c264efc7d2df1bcb04cadec2dd038765523.exe
Resource
win10-en-20211104
General
-
Target
369b89160fc1e3c8b2ec374dfb220c264efc7d2df1bcb04cadec2dd038765523.exe
-
Size
319KB
-
MD5
5106aa3bd71ee4a75133d1cc18030874
-
SHA1
32c3cc7e79d7701466a1e1809f54c630e1cd330b
-
SHA256
369b89160fc1e3c8b2ec374dfb220c264efc7d2df1bcb04cadec2dd038765523
-
SHA512
1f58c1eb7eaa82235031e7c20c8d2d1a1a355bdb34d206564469bc391f57a54af4e3be06c82c59a7827fcc8eb6b48f51187a460f97df30eada76fd6174dc3074
Malware Config
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
Extracted
redline
195.133.47.114:38627
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/3284-137-0x0000000000EA0000-0x0000000000F08000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\A74A.exe family_redline C:\Users\Admin\AppData\Local\Temp\A74A.exe family_redline behavioral1/memory/2688-180-0x0000000000880000-0x00000000008EC000-memory.dmp family_redline behavioral1/memory/3872-212-0x0000000000D10000-0x0000000000D7C000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 7 IoCs
Processes:
4199.exeSmartClock.exe8980.exeA74A.exeC533.exeE30D.exeF57D.exepid process 744 4199.exe 2288 SmartClock.exe 3284 8980.exe 1160 A74A.exe 2688 C533.exe 1324 E30D.exe 3872 F57D.exe -
Deletes itself 1 IoCs
Processes:
pid process 3044 -
Drops startup file 1 IoCs
Processes:
4199.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk 4199.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
8980.exeC533.exeF57D.exepid process 3284 8980.exe 2688 C533.exe 3872 F57D.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2324 1324 WerFault.exe E30D.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
369b89160fc1e3c8b2ec374dfb220c264efc7d2df1bcb04cadec2dd038765523.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 369b89160fc1e3c8b2ec374dfb220c264efc7d2df1bcb04cadec2dd038765523.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 369b89160fc1e3c8b2ec374dfb220c264efc7d2df1bcb04cadec2dd038765523.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 369b89160fc1e3c8b2ec374dfb220c264efc7d2df1bcb04cadec2dd038765523.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
SmartClock.exepid process 2288 SmartClock.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
369b89160fc1e3c8b2ec374dfb220c264efc7d2df1bcb04cadec2dd038765523.exepid process 1768 369b89160fc1e3c8b2ec374dfb220c264efc7d2df1bcb04cadec2dd038765523.exe 1768 369b89160fc1e3c8b2ec374dfb220c264efc7d2df1bcb04cadec2dd038765523.exe 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 3044 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3044 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
369b89160fc1e3c8b2ec374dfb220c264efc7d2df1bcb04cadec2dd038765523.exepid process 1768 369b89160fc1e3c8b2ec374dfb220c264efc7d2df1bcb04cadec2dd038765523.exe -
Suspicious use of AdjustPrivilegeToken 51 IoCs
Processes:
8980.exeWerFault.exeC533.exeA74A.exeF57D.exedescription pid process Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeDebugPrivilege 3284 8980.exe Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeDebugPrivilege 2324 WerFault.exe Token: SeDebugPrivilege 2688 C533.exe Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeDebugPrivilege 1160 A74A.exe Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeDebugPrivilege 3872 F57D.exe Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 Token: SeShutdownPrivilege 3044 Token: SeCreatePagefilePrivilege 3044 -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
4199.exedescription pid process target process PID 3044 wrote to memory of 744 3044 4199.exe PID 3044 wrote to memory of 744 3044 4199.exe PID 3044 wrote to memory of 744 3044 4199.exe PID 744 wrote to memory of 2288 744 4199.exe SmartClock.exe PID 744 wrote to memory of 2288 744 4199.exe SmartClock.exe PID 744 wrote to memory of 2288 744 4199.exe SmartClock.exe PID 3044 wrote to memory of 3284 3044 8980.exe PID 3044 wrote to memory of 3284 3044 8980.exe PID 3044 wrote to memory of 3284 3044 8980.exe PID 3044 wrote to memory of 1160 3044 A74A.exe PID 3044 wrote to memory of 1160 3044 A74A.exe PID 3044 wrote to memory of 1160 3044 A74A.exe PID 3044 wrote to memory of 2688 3044 C533.exe PID 3044 wrote to memory of 2688 3044 C533.exe PID 3044 wrote to memory of 2688 3044 C533.exe PID 3044 wrote to memory of 1324 3044 E30D.exe PID 3044 wrote to memory of 1324 3044 E30D.exe PID 3044 wrote to memory of 3872 3044 F57D.exe PID 3044 wrote to memory of 3872 3044 F57D.exe PID 3044 wrote to memory of 3872 3044 F57D.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\369b89160fc1e3c8b2ec374dfb220c264efc7d2df1bcb04cadec2dd038765523.exe"C:\Users\Admin\AppData\Local\Temp\369b89160fc1e3c8b2ec374dfb220c264efc7d2df1bcb04cadec2dd038765523.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\4199.exeC:\Users\Admin\AppData\Local\Temp\4199.exe1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\AppData\Local\Temp\8980.exeC:\Users\Admin\AppData\Local\Temp\8980.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\A74A.exeC:\Users\Admin\AppData\Local\Temp\A74A.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\C533.exeC:\Users\Admin\AppData\Local\Temp\C533.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\E30D.exeC:\Users\Admin\AppData\Local\Temp\E30D.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1324 -s 4242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\F57D.exeC:\Users\Admin\AppData\Local\Temp\F57D.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4199.exeMD5
3ee62d032b2fbda45645c564bc72ca8f
SHA1ff4bf787601886b3f8b00e0b9302af816b53fef8
SHA256d7e4c9a60e7bc7c9b92a83f2138d3add16fdeface397bd00d31526b963e6ea4d
SHA5121a7c87bc9e05733d59a28fe1cc5cb89a226ccc28a906411ce355e6ac1e85e62727eb875edc5e9ad80295a9c87679fbd18683636a494c929e86b9aa0dd6798b2a
-
C:\Users\Admin\AppData\Local\Temp\4199.exeMD5
3ee62d032b2fbda45645c564bc72ca8f
SHA1ff4bf787601886b3f8b00e0b9302af816b53fef8
SHA256d7e4c9a60e7bc7c9b92a83f2138d3add16fdeface397bd00d31526b963e6ea4d
SHA5121a7c87bc9e05733d59a28fe1cc5cb89a226ccc28a906411ce355e6ac1e85e62727eb875edc5e9ad80295a9c87679fbd18683636a494c929e86b9aa0dd6798b2a
-
C:\Users\Admin\AppData\Local\Temp\8980.exeMD5
77ce7ab11225c5e723b7b1be0308e8c0
SHA1709a8df1d49f28cf8c293694bbbbd0f07735829b
SHA256d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496
SHA512f73582206397db625bdefbbaf8abdc1a820ae8054eb2ef2a3ed18c8e00e8365c7ad81013b33990e4304619b3834a1b8b15c782905204add158fca686e2c25c3b
-
C:\Users\Admin\AppData\Local\Temp\8980.exeMD5
77ce7ab11225c5e723b7b1be0308e8c0
SHA1709a8df1d49f28cf8c293694bbbbd0f07735829b
SHA256d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496
SHA512f73582206397db625bdefbbaf8abdc1a820ae8054eb2ef2a3ed18c8e00e8365c7ad81013b33990e4304619b3834a1b8b15c782905204add158fca686e2c25c3b
-
C:\Users\Admin\AppData\Local\Temp\A74A.exeMD5
3ba1d635fed88d8af279be91b7007bae
SHA162a1d59c746cdb51e699114f410749384a70cf73
SHA2563151b115c3370d5360286bfe3a053d0d543f0e5d21faa68fee167224e68d115a
SHA51283254fb484bd40740e5e0483dcc7fd8ce612033b00238494fdcdc5a5dcb3503195e0e2694edd5d848c07e2ddc61cafdb7d331afc4792ccd788837ebbce18bfeb
-
C:\Users\Admin\AppData\Local\Temp\A74A.exeMD5
3ba1d635fed88d8af279be91b7007bae
SHA162a1d59c746cdb51e699114f410749384a70cf73
SHA2563151b115c3370d5360286bfe3a053d0d543f0e5d21faa68fee167224e68d115a
SHA51283254fb484bd40740e5e0483dcc7fd8ce612033b00238494fdcdc5a5dcb3503195e0e2694edd5d848c07e2ddc61cafdb7d331afc4792ccd788837ebbce18bfeb
-
C:\Users\Admin\AppData\Local\Temp\C533.exeMD5
f80418f12c03a56ac2e8d8b189c13750
SHA1cd0b728375e4e178b50bca8ad65ce79aede30d37
SHA256cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716
SHA512e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196
-
C:\Users\Admin\AppData\Local\Temp\C533.exeMD5
f80418f12c03a56ac2e8d8b189c13750
SHA1cd0b728375e4e178b50bca8ad65ce79aede30d37
SHA256cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716
SHA512e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196
-
C:\Users\Admin\AppData\Local\Temp\E30D.exeMD5
180fc8466647515a888cba4bdacb60db
SHA1a6a5201f997c665603c9fe05a1d08add514337a3
SHA2563c8517c6cfab98c7fdda9f3a53e7178c0a42729a9473d53224788581e42bb116
SHA5124146285d11141ac567e0c574c3aa4f19201ad9825b2a605f5022a4305ac9860529bb4443ea80ac5ccb0e51873fa802c7d6fa8d13ac195cd35519b82ba3c3fa1b
-
C:\Users\Admin\AppData\Local\Temp\E30D.exeMD5
180fc8466647515a888cba4bdacb60db
SHA1a6a5201f997c665603c9fe05a1d08add514337a3
SHA2563c8517c6cfab98c7fdda9f3a53e7178c0a42729a9473d53224788581e42bb116
SHA5124146285d11141ac567e0c574c3aa4f19201ad9825b2a605f5022a4305ac9860529bb4443ea80ac5ccb0e51873fa802c7d6fa8d13ac195cd35519b82ba3c3fa1b
-
C:\Users\Admin\AppData\Local\Temp\F57D.exeMD5
f80418f12c03a56ac2e8d8b189c13750
SHA1cd0b728375e4e178b50bca8ad65ce79aede30d37
SHA256cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716
SHA512e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196
-
C:\Users\Admin\AppData\Local\Temp\F57D.exeMD5
f80418f12c03a56ac2e8d8b189c13750
SHA1cd0b728375e4e178b50bca8ad65ce79aede30d37
SHA256cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716
SHA512e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
3ee62d032b2fbda45645c564bc72ca8f
SHA1ff4bf787601886b3f8b00e0b9302af816b53fef8
SHA256d7e4c9a60e7bc7c9b92a83f2138d3add16fdeface397bd00d31526b963e6ea4d
SHA5121a7c87bc9e05733d59a28fe1cc5cb89a226ccc28a906411ce355e6ac1e85e62727eb875edc5e9ad80295a9c87679fbd18683636a494c929e86b9aa0dd6798b2a
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exeMD5
3ee62d032b2fbda45645c564bc72ca8f
SHA1ff4bf787601886b3f8b00e0b9302af816b53fef8
SHA256d7e4c9a60e7bc7c9b92a83f2138d3add16fdeface397bd00d31526b963e6ea4d
SHA5121a7c87bc9e05733d59a28fe1cc5cb89a226ccc28a906411ce355e6ac1e85e62727eb875edc5e9ad80295a9c87679fbd18683636a494c929e86b9aa0dd6798b2a
-
memory/744-127-0x0000000000400000-0x0000000000540000-memory.dmpFilesize
1.2MB
-
memory/744-126-0x0000000000540000-0x00000000005EE000-memory.dmpFilesize
696KB
-
memory/744-125-0x0000000000791000-0x0000000000811000-memory.dmpFilesize
512KB
-
memory/744-122-0x0000000000000000-mapping.dmp
-
memory/1160-157-0x0000000000AF0000-0x0000000000AF1000-memory.dmpFilesize
4KB
-
memory/1160-164-0x00000000052A0000-0x00000000058A6000-memory.dmpFilesize
6.0MB
-
memory/1160-154-0x0000000000000000-mapping.dmp
-
memory/1324-206-0x0000000000000000-mapping.dmp
-
memory/1768-119-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/1768-120-0x0000000000400000-0x00000000004D1000-memory.dmpFilesize
836KB
-
memory/2288-133-0x0000000000400000-0x0000000000540000-memory.dmpFilesize
1.2MB
-
memory/2288-132-0x0000000000540000-0x000000000068A000-memory.dmpFilesize
1.3MB
-
memory/2288-131-0x0000000000741000-0x00000000007C1000-memory.dmpFilesize
512KB
-
memory/2288-128-0x0000000000000000-mapping.dmp
-
memory/2688-185-0x0000000000880000-0x0000000000881000-memory.dmpFilesize
4KB
-
memory/2688-197-0x00000000059D0000-0x00000000059D1000-memory.dmpFilesize
4KB
-
memory/2688-195-0x00000000703C0000-0x000000007040B000-memory.dmpFilesize
300KB
-
memory/2688-193-0x0000000074B40000-0x0000000075E88000-memory.dmpFilesize
19.3MB
-
memory/2688-192-0x0000000076530000-0x0000000076AB4000-memory.dmpFilesize
5.5MB
-
memory/2688-187-0x0000000072170000-0x00000000721F0000-memory.dmpFilesize
512KB
-
memory/2688-184-0x0000000075E90000-0x0000000075F81000-memory.dmpFilesize
964KB
-
memory/2688-183-0x0000000001100000-0x000000000124A000-memory.dmpFilesize
1.3MB
-
memory/2688-182-0x0000000074970000-0x0000000074B32000-memory.dmpFilesize
1.8MB
-
memory/2688-181-0x0000000000DF0000-0x0000000000DF1000-memory.dmpFilesize
4KB
-
memory/2688-180-0x0000000000880000-0x00000000008EC000-memory.dmpFilesize
432KB
-
memory/2688-177-0x0000000000000000-mapping.dmp
-
memory/3044-121-0x00000000006C0000-0x00000000006D6000-memory.dmpFilesize
88KB
-
memory/3284-152-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/3284-147-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/3284-153-0x00000000703C0000-0x000000007040B000-memory.dmpFilesize
300KB
-
memory/3284-170-0x0000000006E00000-0x0000000006E01000-memory.dmpFilesize
4KB
-
memory/3284-171-0x0000000007500000-0x0000000007501000-memory.dmpFilesize
4KB
-
memory/3284-165-0x0000000006530000-0x0000000006531000-memory.dmpFilesize
4KB
-
memory/3284-143-0x0000000072170000-0x00000000721F0000-memory.dmpFilesize
512KB
-
memory/3284-141-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/3284-144-0x0000000005A20000-0x0000000005A21000-memory.dmpFilesize
4KB
-
memory/3284-145-0x0000000005370000-0x0000000005371000-memory.dmpFilesize
4KB
-
memory/3284-146-0x0000000000BD0000-0x0000000000D1A000-memory.dmpFilesize
1.3MB
-
memory/3284-167-0x00000000061B0000-0x00000000061B1000-memory.dmpFilesize
4KB
-
memory/3284-148-0x0000000005410000-0x0000000005411000-memory.dmpFilesize
4KB
-
memory/3284-140-0x0000000075E90000-0x0000000075F81000-memory.dmpFilesize
964KB
-
memory/3284-169-0x0000000006470000-0x0000000006471000-memory.dmpFilesize
4KB
-
memory/3284-150-0x0000000074B40000-0x0000000075E88000-memory.dmpFilesize
19.3MB
-
memory/3284-168-0x00000000062D0000-0x00000000062D1000-memory.dmpFilesize
4KB
-
memory/3284-151-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/3284-149-0x0000000076530000-0x0000000076AB4000-memory.dmpFilesize
5.5MB
-
memory/3284-139-0x0000000074970000-0x0000000074B32000-memory.dmpFilesize
1.8MB
-
memory/3284-138-0x0000000000B80000-0x0000000000B81000-memory.dmpFilesize
4KB
-
memory/3284-137-0x0000000000EA0000-0x0000000000F08000-memory.dmpFilesize
416KB
-
memory/3284-166-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/3284-134-0x0000000000000000-mapping.dmp
-
memory/3872-228-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/3872-212-0x0000000000D10000-0x0000000000D7C000-memory.dmpFilesize
432KB
-
memory/3872-213-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/3872-214-0x0000000002210000-0x0000000002255000-memory.dmpFilesize
276KB
-
memory/3872-215-0x0000000074970000-0x0000000074B32000-memory.dmpFilesize
1.8MB
-
memory/3872-216-0x0000000075E90000-0x0000000075F81000-memory.dmpFilesize
964KB
-
memory/3872-209-0x0000000000000000-mapping.dmp