Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-12-2021 12:13
Static task
static1
Behavioral task
behavioral1
Sample
14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe
Resource
win10-en-20211208
General
-
Target
14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe
-
Size
171KB
-
MD5
c0c7acf8d97daee036c98c8f6f9ec516
-
SHA1
eeb59fc2f44b3365196f82fb91b347fa9ac65b46
-
SHA256
14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e
-
SHA512
20ddfd298b16e6f90107215a6c4c700fb65715403059d280e0c3cc71f74319c9638173fe7e98c2b7b467403c88209bbdd7eb49e8a5d4a420e3df3571b9fa1032
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
Extracted
icedid
3372020928
jeliskvosh.com
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2372-136-0x00000000013C0000-0x0000000001429000-memory.dmp family_redline behavioral1/memory/1404-157-0x0000000000010000-0x00000000000B6000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2000 created 2236 2000 WerFault.exe regsvr32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
D32A.exe1390.exe1390.exe3736.exe5A4F.exepid process 616 D32A.exe 1084 1390.exe 1384 1390.exe 2372 3736.exe 1404 5A4F.exe -
Deletes itself 1 IoCs
Processes:
pid process 3036 -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 2236 regsvr32.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
3736.exe5A4F.exepid process 2372 3736.exe 1404 5A4F.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe1390.exedescription pid process target process PID 3552 set thread context of 536 3552 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe PID 1084 set thread context of 1384 1084 1390.exe 1390.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2000 2236 WerFault.exe regsvr32.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe1390.exeD32A.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1390.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1390.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D32A.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D32A.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D32A.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1390.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exepid process 536 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe 536 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3036 -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exeD32A.exe1390.exepid process 536 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe 616 D32A.exe 1384 1390.exe 3036 3036 3036 3036 -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
WerFault.exedescription pid process Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeDebugPrivilege 2000 WerFault.exe Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe1390.exedescription pid process target process PID 3552 wrote to memory of 536 3552 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe PID 3552 wrote to memory of 536 3552 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe PID 3552 wrote to memory of 536 3552 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe PID 3552 wrote to memory of 536 3552 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe PID 3552 wrote to memory of 536 3552 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe PID 3552 wrote to memory of 536 3552 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe 14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe PID 3036 wrote to memory of 616 3036 D32A.exe PID 3036 wrote to memory of 616 3036 D32A.exe PID 3036 wrote to memory of 616 3036 D32A.exe PID 3036 wrote to memory of 1084 3036 1390.exe PID 3036 wrote to memory of 1084 3036 1390.exe PID 3036 wrote to memory of 1084 3036 1390.exe PID 1084 wrote to memory of 1384 1084 1390.exe 1390.exe PID 1084 wrote to memory of 1384 1084 1390.exe 1390.exe PID 1084 wrote to memory of 1384 1084 1390.exe 1390.exe PID 1084 wrote to memory of 1384 1084 1390.exe 1390.exe PID 1084 wrote to memory of 1384 1084 1390.exe 1390.exe PID 1084 wrote to memory of 1384 1084 1390.exe 1390.exe PID 3036 wrote to memory of 2372 3036 3736.exe PID 3036 wrote to memory of 2372 3036 3736.exe PID 3036 wrote to memory of 2372 3036 3736.exe PID 3036 wrote to memory of 1404 3036 5A4F.exe PID 3036 wrote to memory of 1404 3036 5A4F.exe PID 3036 wrote to memory of 1404 3036 5A4F.exe PID 3036 wrote to memory of 3500 3036 explorer.exe PID 3036 wrote to memory of 3500 3036 explorer.exe PID 3036 wrote to memory of 3500 3036 explorer.exe PID 3036 wrote to memory of 3500 3036 explorer.exe PID 3036 wrote to memory of 1564 3036 explorer.exe PID 3036 wrote to memory of 1564 3036 explorer.exe PID 3036 wrote to memory of 1564 3036 explorer.exe PID 3036 wrote to memory of 2236 3036 regsvr32.exe PID 3036 wrote to memory of 2236 3036 regsvr32.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe"C:\Users\Admin\AppData\Local\Temp\14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe"C:\Users\Admin\AppData\Local\Temp\14e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:536
-
C:\Users\Admin\AppData\Local\Temp\D32A.exeC:\Users\Admin\AppData\Local\Temp\D32A.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:616
-
C:\Users\Admin\AppData\Local\Temp\1390.exeC:\Users\Admin\AppData\Local\Temp\1390.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\1390.exeC:\Users\Admin\AppData\Local\Temp\1390.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1384
-
C:\Users\Admin\AppData\Local\Temp\3736.exeC:\Users\Admin\AppData\Local\Temp\3736.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2372
-
C:\Users\Admin\AppData\Local\Temp\5A4F.exeC:\Users\Admin\AppData\Local\Temp\5A4F.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1404
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3500
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1564
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\972A.dll1⤵
- Loads dropped DLL
PID:2236 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2236 -s 5042⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2000
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1390.exeMD5
c0c7acf8d97daee036c98c8f6f9ec516
SHA1eeb59fc2f44b3365196f82fb91b347fa9ac65b46
SHA25614e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e
SHA51220ddfd298b16e6f90107215a6c4c700fb65715403059d280e0c3cc71f74319c9638173fe7e98c2b7b467403c88209bbdd7eb49e8a5d4a420e3df3571b9fa1032
-
C:\Users\Admin\AppData\Local\Temp\1390.exeMD5
c0c7acf8d97daee036c98c8f6f9ec516
SHA1eeb59fc2f44b3365196f82fb91b347fa9ac65b46
SHA25614e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e
SHA51220ddfd298b16e6f90107215a6c4c700fb65715403059d280e0c3cc71f74319c9638173fe7e98c2b7b467403c88209bbdd7eb49e8a5d4a420e3df3571b9fa1032
-
C:\Users\Admin\AppData\Local\Temp\1390.exeMD5
c0c7acf8d97daee036c98c8f6f9ec516
SHA1eeb59fc2f44b3365196f82fb91b347fa9ac65b46
SHA25614e958e8f2ecd20ebe1a3bb32394d55d710f31a354f66c31a896fb48788b701e
SHA51220ddfd298b16e6f90107215a6c4c700fb65715403059d280e0c3cc71f74319c9638173fe7e98c2b7b467403c88209bbdd7eb49e8a5d4a420e3df3571b9fa1032
-
C:\Users\Admin\AppData\Local\Temp\3736.exeMD5
0cefed061e2a2241ecd302d7790a2f80
SHA15f119195af2db118c5fbac21634bea00f5d5b8da
SHA256014ad60fd2c294dd8fb63c022961e17df1ba74bb1209a64634112913edc44983
SHA5127b7e4460dad4f176b11a66a37bbc1b2fd2c7e042c5e949c72edcc3c93d9bb9d210d8ecc95d8aad533c761947958e008c4ced8b5faef9319ebb5bf29752381cba
-
C:\Users\Admin\AppData\Local\Temp\3736.exeMD5
0cefed061e2a2241ecd302d7790a2f80
SHA15f119195af2db118c5fbac21634bea00f5d5b8da
SHA256014ad60fd2c294dd8fb63c022961e17df1ba74bb1209a64634112913edc44983
SHA5127b7e4460dad4f176b11a66a37bbc1b2fd2c7e042c5e949c72edcc3c93d9bb9d210d8ecc95d8aad533c761947958e008c4ced8b5faef9319ebb5bf29752381cba
-
C:\Users\Admin\AppData\Local\Temp\5A4F.exeMD5
a73c4054b630f348c4ffb1f5939c8c02
SHA18fc966305d9810ffd1aa4c79344a06892be5c9d4
SHA256db8c5ef558a72c5075366149d86e43f8b22c7af51ae71d0456d2c44116a80835
SHA512a53605fe5de2730089db38b58f4b007a081438015119f8742adf99534cff5e7e64c6c5d85bf1f289a4be1a677c7481f5d5d9a2c18d0259ada78c1d7343e8e0cd
-
C:\Users\Admin\AppData\Local\Temp\5A4F.exeMD5
a73c4054b630f348c4ffb1f5939c8c02
SHA18fc966305d9810ffd1aa4c79344a06892be5c9d4
SHA256db8c5ef558a72c5075366149d86e43f8b22c7af51ae71d0456d2c44116a80835
SHA512a53605fe5de2730089db38b58f4b007a081438015119f8742adf99534cff5e7e64c6c5d85bf1f289a4be1a677c7481f5d5d9a2c18d0259ada78c1d7343e8e0cd
-
C:\Users\Admin\AppData\Local\Temp\972A.dllMD5
d59fa2838f83e31ef0d2bd34bd86ef40
SHA1d9115b1a962256b6accabfee45c5654f3ee64a47
SHA25632de1e4b5582279bf16bfcad4c55b5e0f1151afddb2a96013442b3158f4a02d8
SHA51292a9888556706f4f3bf33e6cdfeddca958780438c73a6749e18b4a59b866b96e67c1736cf557ed470ae095c3385bb0818c4199bc00d2c088a5179029c587a93f
-
C:\Users\Admin\AppData\Local\Temp\D32A.exeMD5
265ed6f79387305a37bd4a598403adf1
SHA1c0647e1d4a77715a54141e4898bebcd322f3d9da
SHA2561c10d4f9c74cbfb4478aa18e3430ea14c07da31ca819ffb8bea5d6e30218bff5
SHA5121a7c615cab3ebe9910282b01bec5f5eb9558f40d716c4b0914e15d3d8b59e7d4bc37569575c8d9ba612613e1298f3f390d0bbaa153975f40ec262cea27b58b62
-
C:\Users\Admin\AppData\Local\Temp\D32A.exeMD5
265ed6f79387305a37bd4a598403adf1
SHA1c0647e1d4a77715a54141e4898bebcd322f3d9da
SHA2561c10d4f9c74cbfb4478aa18e3430ea14c07da31ca819ffb8bea5d6e30218bff5
SHA5121a7c615cab3ebe9910282b01bec5f5eb9558f40d716c4b0914e15d3d8b59e7d4bc37569575c8d9ba612613e1298f3f390d0bbaa153975f40ec262cea27b58b62
-
\Users\Admin\AppData\Local\Temp\972A.dllMD5
d59fa2838f83e31ef0d2bd34bd86ef40
SHA1d9115b1a962256b6accabfee45c5654f3ee64a47
SHA25632de1e4b5582279bf16bfcad4c55b5e0f1151afddb2a96013442b3158f4a02d8
SHA51292a9888556706f4f3bf33e6cdfeddca958780438c73a6749e18b4a59b866b96e67c1736cf557ed470ae095c3385bb0818c4199bc00d2c088a5179029c587a93f
-
memory/536-115-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/536-116-0x0000000000402F47-mapping.dmp
-
memory/616-124-0x00000000001E0000-0x00000000001E9000-memory.dmpFilesize
36KB
-
memory/616-125-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/616-120-0x0000000000000000-mapping.dmp
-
memory/1084-127-0x0000000000000000-mapping.dmp
-
memory/1384-131-0x0000000000402F47-mapping.dmp
-
memory/1404-168-0x0000000074E30000-0x00000000753B4000-memory.dmpFilesize
5.5MB
-
memory/1404-171-0x0000000002360000-0x00000000023A5000-memory.dmpFilesize
276KB
-
memory/1404-173-0x0000000004E10000-0x0000000004E11000-memory.dmpFilesize
4KB
-
memory/1404-172-0x0000000071270000-0x00000000712BB000-memory.dmpFilesize
300KB
-
memory/1404-169-0x0000000076250000-0x0000000077598000-memory.dmpFilesize
19.3MB
-
memory/1404-163-0x0000000072100000-0x0000000072180000-memory.dmpFilesize
512KB
-
memory/1404-161-0x0000000000010000-0x0000000000011000-memory.dmpFilesize
4KB
-
memory/1404-160-0x0000000074BC0000-0x0000000074CB1000-memory.dmpFilesize
964KB
-
memory/1404-159-0x00000000754F0000-0x00000000756B2000-memory.dmpFilesize
1.8MB
-
memory/1404-158-0x00000000023F0000-0x00000000023F1000-memory.dmpFilesize
4KB
-
memory/1404-157-0x0000000000010000-0x00000000000B6000-memory.dmpFilesize
664KB
-
memory/1404-154-0x0000000000000000-mapping.dmp
-
memory/1564-175-0x0000000000000000-mapping.dmp
-
memory/1564-179-0x0000000000AB0000-0x0000000000ABC000-memory.dmpFilesize
48KB
-
memory/1564-178-0x0000000000AC0000-0x0000000000AC7000-memory.dmpFilesize
28KB
-
memory/2236-183-0x00000000005B0000-0x00000000005BA000-memory.dmpFilesize
40KB
-
memory/2236-180-0x0000000000000000-mapping.dmp
-
memory/2372-133-0x0000000000000000-mapping.dmp
-
memory/2372-137-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/2372-148-0x0000000074E30000-0x00000000753B4000-memory.dmpFilesize
5.5MB
-
memory/2372-150-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/2372-146-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/2372-145-0x0000000001280000-0x0000000001281000-memory.dmpFilesize
4KB
-
memory/2372-144-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/2372-143-0x0000000000D40000-0x0000000000D85000-memory.dmpFilesize
276KB
-
memory/2372-142-0x0000000072100000-0x0000000072180000-memory.dmpFilesize
512KB
-
memory/2372-140-0x00000000013C0000-0x00000000013C1000-memory.dmpFilesize
4KB
-
memory/2372-149-0x0000000076250000-0x0000000077598000-memory.dmpFilesize
19.3MB
-
memory/2372-139-0x0000000074BC0000-0x0000000074CB1000-memory.dmpFilesize
964KB
-
memory/2372-138-0x00000000754F0000-0x00000000756B2000-memory.dmpFilesize
1.8MB
-
memory/2372-147-0x0000000001320000-0x0000000001321000-memory.dmpFilesize
4KB
-
memory/2372-136-0x00000000013C0000-0x0000000001429000-memory.dmpFilesize
420KB
-
memory/2372-151-0x00000000012C0000-0x00000000012C1000-memory.dmpFilesize
4KB
-
memory/2372-152-0x0000000071270000-0x00000000712BB000-memory.dmpFilesize
300KB
-
memory/3036-153-0x0000000002930000-0x0000000002946000-memory.dmpFilesize
88KB
-
memory/3036-119-0x0000000000A40000-0x0000000000A56000-memory.dmpFilesize
88KB
-
memory/3036-126-0x00000000028C0000-0x00000000028D6000-memory.dmpFilesize
88KB
-
memory/3500-176-0x0000000003130000-0x00000000031A4000-memory.dmpFilesize
464KB
-
memory/3500-177-0x00000000030C0000-0x000000000312B000-memory.dmpFilesize
428KB
-
memory/3500-174-0x0000000000000000-mapping.dmp
-
memory/3552-118-0x0000000000860000-0x0000000000869000-memory.dmpFilesize
36KB
-
memory/3552-117-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB