Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 19:47
Static task
static1
Behavioral task
behavioral1
Sample
2b0dea2ff2d83c8a0f9a2c72ccca46769955ea60dede40dc96e8e99e7f824de3.exe
Resource
win10-en-20211208
General
-
Target
2b0dea2ff2d83c8a0f9a2c72ccca46769955ea60dede40dc96e8e99e7f824de3.exe
-
Size
316KB
-
MD5
afc1267985c0d23f4b7fb22a4cc98cca
-
SHA1
fa0bb2db621e58372afe3a53af58b059c35f606e
-
SHA256
2b0dea2ff2d83c8a0f9a2c72ccca46769955ea60dede40dc96e8e99e7f824de3
-
SHA512
07a98098a729be1b2640c7a660f8a67481be198eb8106ae051729d4136d304117813ab9070f7140161fe7cb463f3c3b2fdafac908f919e80e5812c04d19bd6ae
Malware Config
Extracted
smokeloader
2020
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
Processes:
pid process 1880 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2000 3768 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
2b0dea2ff2d83c8a0f9a2c72ccca46769955ea60dede40dc96e8e99e7f824de3.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2b0dea2ff2d83c8a0f9a2c72ccca46769955ea60dede40dc96e8e99e7f824de3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2b0dea2ff2d83c8a0f9a2c72ccca46769955ea60dede40dc96e8e99e7f824de3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2b0dea2ff2d83c8a0f9a2c72ccca46769955ea60dede40dc96e8e99e7f824de3.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3CD79FB-7E17-11EC-9231-EAE77BAD686B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\Main Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2b0dea2ff2d83c8a0f9a2c72ccca46769955ea60dede40dc96e8e99e7f824de3.exepid process 2384 2b0dea2ff2d83c8a0f9a2c72ccca46769955ea60dede40dc96e8e99e7f824de3.exe 2384 2b0dea2ff2d83c8a0f9a2c72ccca46769955ea60dede40dc96e8e99e7f824de3.exe 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 1880 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1880 -
Suspicious behavior: MapViewOfSection 47 IoCs
Processes:
2b0dea2ff2d83c8a0f9a2c72ccca46769955ea60dede40dc96e8e99e7f824de3.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2384 2b0dea2ff2d83c8a0f9a2c72ccca46769955ea60dede40dc96e8e99e7f824de3.exe 1880 1880 1880 1880 1880 1880 1472 explorer.exe 1472 explorer.exe 1880 1880 1268 explorer.exe 1268 explorer.exe 1880 1880 596 explorer.exe 596 explorer.exe 1880 1880 944 explorer.exe 944 explorer.exe 1880 1880 2064 explorer.exe 2064 explorer.exe 1880 1880 992 explorer.exe 992 explorer.exe 992 explorer.exe 992 explorer.exe 992 explorer.exe 992 explorer.exe 992 explorer.exe 992 explorer.exe 992 explorer.exe 992 explorer.exe 992 explorer.exe 992 explorer.exe 992 explorer.exe 992 explorer.exe 992 explorer.exe 992 explorer.exe 992 explorer.exe 992 explorer.exe 992 explorer.exe 992 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1032 WMIC.exe Token: SeSecurityPrivilege 1032 WMIC.exe Token: SeTakeOwnershipPrivilege 1032 WMIC.exe Token: SeLoadDriverPrivilege 1032 WMIC.exe Token: SeSystemProfilePrivilege 1032 WMIC.exe Token: SeSystemtimePrivilege 1032 WMIC.exe Token: SeProfSingleProcessPrivilege 1032 WMIC.exe Token: SeIncBasePriorityPrivilege 1032 WMIC.exe Token: SeCreatePagefilePrivilege 1032 WMIC.exe Token: SeBackupPrivilege 1032 WMIC.exe Token: SeRestorePrivilege 1032 WMIC.exe Token: SeShutdownPrivilege 1032 WMIC.exe Token: SeDebugPrivilege 1032 WMIC.exe Token: SeSystemEnvironmentPrivilege 1032 WMIC.exe Token: SeRemoteShutdownPrivilege 1032 WMIC.exe Token: SeUndockPrivilege 1032 WMIC.exe Token: SeManageVolumePrivilege 1032 WMIC.exe Token: 33 1032 WMIC.exe Token: 34 1032 WMIC.exe Token: 35 1032 WMIC.exe Token: 36 1032 WMIC.exe Token: SeIncreaseQuotaPrivilege 1032 WMIC.exe Token: SeSecurityPrivilege 1032 WMIC.exe Token: SeTakeOwnershipPrivilege 1032 WMIC.exe Token: SeLoadDriverPrivilege 1032 WMIC.exe Token: SeSystemProfilePrivilege 1032 WMIC.exe Token: SeSystemtimePrivilege 1032 WMIC.exe Token: SeProfSingleProcessPrivilege 1032 WMIC.exe Token: SeIncBasePriorityPrivilege 1032 WMIC.exe Token: SeCreatePagefilePrivilege 1032 WMIC.exe Token: SeBackupPrivilege 1032 WMIC.exe Token: SeRestorePrivilege 1032 WMIC.exe Token: SeShutdownPrivilege 1032 WMIC.exe Token: SeDebugPrivilege 1032 WMIC.exe Token: SeSystemEnvironmentPrivilege 1032 WMIC.exe Token: SeRemoteShutdownPrivilege 1032 WMIC.exe Token: SeUndockPrivilege 1032 WMIC.exe Token: SeManageVolumePrivilege 1032 WMIC.exe Token: 33 1032 WMIC.exe Token: 34 1032 WMIC.exe Token: 35 1032 WMIC.exe Token: 36 1032 WMIC.exe Token: SeIncreaseQuotaPrivilege 1384 WMIC.exe Token: SeSecurityPrivilege 1384 WMIC.exe Token: SeTakeOwnershipPrivilege 1384 WMIC.exe Token: SeLoadDriverPrivilege 1384 WMIC.exe Token: SeSystemProfilePrivilege 1384 WMIC.exe Token: SeSystemtimePrivilege 1384 WMIC.exe Token: SeProfSingleProcessPrivilege 1384 WMIC.exe Token: SeIncBasePriorityPrivilege 1384 WMIC.exe Token: SeCreatePagefilePrivilege 1384 WMIC.exe Token: SeBackupPrivilege 1384 WMIC.exe Token: SeRestorePrivilege 1384 WMIC.exe Token: SeShutdownPrivilege 1384 WMIC.exe Token: SeDebugPrivilege 1384 WMIC.exe Token: SeSystemEnvironmentPrivilege 1384 WMIC.exe Token: SeRemoteShutdownPrivilege 1384 WMIC.exe Token: SeUndockPrivilege 1384 WMIC.exe Token: SeManageVolumePrivilege 1384 WMIC.exe Token: 33 1384 WMIC.exe Token: 34 1384 WMIC.exe Token: 35 1384 WMIC.exe Token: 36 1384 WMIC.exe Token: SeIncreaseQuotaPrivilege 1384 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2384 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2384 iexplore.exe 2384 iexplore.exe 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exeiexplore.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exedescription pid process target process PID 1880 wrote to memory of 3968 1880 cmd.exe PID 1880 wrote to memory of 3968 1880 cmd.exe PID 3968 wrote to memory of 1032 3968 cmd.exe WMIC.exe PID 3968 wrote to memory of 1032 3968 cmd.exe WMIC.exe PID 3968 wrote to memory of 1384 3968 cmd.exe WMIC.exe PID 3968 wrote to memory of 1384 3968 cmd.exe WMIC.exe PID 3968 wrote to memory of 2324 3968 cmd.exe WMIC.exe PID 3968 wrote to memory of 2324 3968 cmd.exe WMIC.exe PID 3968 wrote to memory of 4060 3968 cmd.exe WMIC.exe PID 3968 wrote to memory of 4060 3968 cmd.exe WMIC.exe PID 2384 wrote to memory of 2972 2384 iexplore.exe IEXPLORE.EXE PID 2384 wrote to memory of 2972 2384 iexplore.exe IEXPLORE.EXE PID 2384 wrote to memory of 2972 2384 iexplore.exe IEXPLORE.EXE PID 1880 wrote to memory of 1428 1880 explorer.exe PID 1880 wrote to memory of 1428 1880 explorer.exe PID 1880 wrote to memory of 1428 1880 explorer.exe PID 1880 wrote to memory of 1428 1880 explorer.exe PID 1880 wrote to memory of 3372 1880 explorer.exe PID 1880 wrote to memory of 3372 1880 explorer.exe PID 1880 wrote to memory of 3372 1880 explorer.exe PID 1880 wrote to memory of 1472 1880 explorer.exe PID 1880 wrote to memory of 1472 1880 explorer.exe PID 1880 wrote to memory of 1472 1880 explorer.exe PID 1880 wrote to memory of 1472 1880 explorer.exe PID 1472 wrote to memory of 2972 1472 explorer.exe IEXPLORE.EXE PID 1472 wrote to memory of 2972 1472 explorer.exe IEXPLORE.EXE PID 1880 wrote to memory of 1268 1880 explorer.exe PID 1880 wrote to memory of 1268 1880 explorer.exe PID 1880 wrote to memory of 1268 1880 explorer.exe PID 1268 wrote to memory of 2384 1268 explorer.exe iexplore.exe PID 1268 wrote to memory of 2384 1268 explorer.exe iexplore.exe PID 1880 wrote to memory of 596 1880 explorer.exe PID 1880 wrote to memory of 596 1880 explorer.exe PID 1880 wrote to memory of 596 1880 explorer.exe PID 1880 wrote to memory of 596 1880 explorer.exe PID 596 wrote to memory of 2972 596 explorer.exe IEXPLORE.EXE PID 596 wrote to memory of 2972 596 explorer.exe IEXPLORE.EXE PID 1880 wrote to memory of 944 1880 explorer.exe PID 1880 wrote to memory of 944 1880 explorer.exe PID 1880 wrote to memory of 944 1880 explorer.exe PID 944 wrote to memory of 2384 944 explorer.exe iexplore.exe PID 944 wrote to memory of 2384 944 explorer.exe iexplore.exe PID 1880 wrote to memory of 2064 1880 explorer.exe PID 1880 wrote to memory of 2064 1880 explorer.exe PID 1880 wrote to memory of 2064 1880 explorer.exe PID 1880 wrote to memory of 2064 1880 explorer.exe PID 2064 wrote to memory of 2972 2064 explorer.exe IEXPLORE.EXE PID 2064 wrote to memory of 2972 2064 explorer.exe IEXPLORE.EXE PID 1880 wrote to memory of 992 1880 explorer.exe PID 1880 wrote to memory of 992 1880 explorer.exe PID 1880 wrote to memory of 992 1880 explorer.exe PID 992 wrote to memory of 2448 992 explorer.exe sihost.exe PID 992 wrote to memory of 2448 992 explorer.exe sihost.exe PID 992 wrote to memory of 2456 992 explorer.exe svchost.exe PID 992 wrote to memory of 2456 992 explorer.exe svchost.exe PID 992 wrote to memory of 2760 992 explorer.exe taskhostw.exe PID 992 wrote to memory of 2760 992 explorer.exe taskhostw.exe PID 992 wrote to memory of 3256 992 explorer.exe ShellExperienceHost.exe PID 992 wrote to memory of 3256 992 explorer.exe ShellExperienceHost.exe PID 992 wrote to memory of 3268 992 explorer.exe SearchUI.exe PID 992 wrote to memory of 3268 992 explorer.exe SearchUI.exe PID 992 wrote to memory of 3512 992 explorer.exe RuntimeBroker.exe PID 992 wrote to memory of 3512 992 explorer.exe RuntimeBroker.exe PID 992 wrote to memory of 3768 992 explorer.exe DllHost.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3768 -s 9082⤵
- Program crash
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\2b0dea2ff2d83c8a0f9a2c72ccca46769955ea60dede40dc96e8e99e7f824de3.exe"C:\Users\Admin\AppData\Local\Temp\2b0dea2ff2d83c8a0f9a2c72ccca46769955ea60dede40dc96e8e99e7f824de3.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/596-321-0x00000000004F0000-0x00000000004F5000-memory.dmpFilesize
20KB
-
memory/596-322-0x00000000004E0000-0x00000000004E9000-memory.dmpFilesize
36KB
-
memory/944-324-0x0000000000C30000-0x0000000000C3C000-memory.dmpFilesize
48KB
-
memory/944-323-0x0000000000C40000-0x0000000000C46000-memory.dmpFilesize
24KB
-
memory/992-328-0x00000000008A0000-0x00000000008AD000-memory.dmpFilesize
52KB
-
memory/992-327-0x00000000008B0000-0x00000000008B7000-memory.dmpFilesize
28KB
-
memory/1268-319-0x0000000000BB0000-0x0000000000BB9000-memory.dmpFilesize
36KB
-
memory/1268-320-0x0000000000BA0000-0x0000000000BAE000-memory.dmpFilesize
56KB
-
memory/1428-315-0x0000000003200000-0x000000000326B000-memory.dmpFilesize
428KB
-
memory/1428-314-0x0000000003270000-0x00000000032E5000-memory.dmpFilesize
468KB
-
memory/1472-317-0x0000000002EF0000-0x0000000002EF7000-memory.dmpFilesize
28KB
-
memory/1472-318-0x0000000000AA0000-0x0000000000AAB000-memory.dmpFilesize
44KB
-
memory/1880-120-0x0000000000650000-0x0000000000666000-memory.dmpFilesize
88KB
-
memory/2000-334-0x0000027CF2A30000-0x0000027CF2A31000-memory.dmpFilesize
4KB
-
memory/2064-325-0x0000000000A20000-0x0000000000A26000-memory.dmpFilesize
24KB
-
memory/2064-326-0x0000000000A10000-0x0000000000A1B000-memory.dmpFilesize
44KB
-
memory/2384-118-0x0000000000460000-0x00000000005AA000-memory.dmpFilesize
1.3MB
-
memory/2384-119-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2384-117-0x0000000000030000-0x0000000000038000-memory.dmpFilesize
32KB
-
memory/2448-329-0x0000020E446A0000-0x0000020E446A1000-memory.dmpFilesize
4KB
-
memory/2456-330-0x000002784E580000-0x000002784E581000-memory.dmpFilesize
4KB
-
memory/2760-331-0x0000024B3EFE0000-0x0000024B3EFE1000-memory.dmpFilesize
4KB
-
memory/2760-333-0x0000024B3F320000-0x0000024B3F321000-memory.dmpFilesize
4KB
-
memory/3372-316-0x0000000000A00000-0x0000000000A0C000-memory.dmpFilesize
48KB
-
memory/3512-332-0x0000027712630000-0x0000027712631000-memory.dmpFilesize
4KB