Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 16:48
Static task
static1
Behavioral task
behavioral1
Sample
8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe
Resource
win10-20220414-en
General
-
Target
8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe
-
Size
1.4MB
-
MD5
9909c471f3ce6914389f62d58fa6aa43
-
SHA1
309be41081b2b05ec1d2e936f5cc2880d4c28391
-
SHA256
8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3
-
SHA512
3d4791869810665bef2782025c4330b71d5fb41b8110857c2bcb2b2832ae93bdf2b3f49edee27d4501145ba6139296ec053071db22fe75f45f6209bab618c7ef
Malware Config
Extracted
smokeloader
2020
http://motionberry999xerz.ru/
http://happyday9risce.com/
http://kokihap7siexz3.com/
https://motionberry999xerz.ru/
https://happyday9risce.com/
https://kokihap7siexz3.com/
Extracted
redline
test1
23.88.112.179:19536
-
auth_value
68c6114f4d4c471ad88677f54e75676f
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3528-147-0x00000000055F0000-0x0000000005610000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
100D.exehwbfatjhwbfatjhwbfatjpid process 2576 100D.exe 2264 hwbfatj 860 hwbfatj 2196 hwbfatj -
Deletes itself 1 IoCs
Processes:
pid process 3040 -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
100D.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lrjaaawiu = "\"C:\\Users\\Admin\\AppData\\Roaming\\Cdyynpvt\\Lrjaaawiu.exe\"" 100D.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe100D.exehwbfatjdescription pid process target process PID 3696 set thread context of 3036 3696 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe PID 2576 set thread context of 3528 2576 100D.exe InstallUtil.exe PID 2264 set thread context of 2196 2264 hwbfatj hwbfatj -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
hwbfatj8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwbfatj Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwbfatj Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hwbfatj -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1284 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exepid process 3696 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe 3696 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe 3036 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe 3036 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3040 -
Suspicious behavior: MapViewOfSection 18 IoCs
Processes:
8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exehwbfatjpid process 3036 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 3040 2196 hwbfatj -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe100D.exeInstallUtil.exehwbfatjdescription pid process Token: SeDebugPrivilege 3696 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeDebugPrivilege 2576 100D.exe Token: SeDebugPrivilege 3528 InstallUtil.exe Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeShutdownPrivilege 3040 Token: SeCreatePagefilePrivilege 3040 Token: SeDebugPrivilege 2264 hwbfatj -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe100D.execmd.exehwbfatjdescription pid process target process PID 3696 wrote to memory of 3036 3696 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe PID 3696 wrote to memory of 3036 3696 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe PID 3696 wrote to memory of 3036 3696 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe PID 3696 wrote to memory of 3036 3696 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe PID 3696 wrote to memory of 3036 3696 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe PID 3696 wrote to memory of 3036 3696 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe 8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe PID 3040 wrote to memory of 2576 3040 100D.exe PID 3040 wrote to memory of 2576 3040 100D.exe PID 3040 wrote to memory of 2576 3040 100D.exe PID 3040 wrote to memory of 1420 3040 explorer.exe PID 3040 wrote to memory of 1420 3040 explorer.exe PID 3040 wrote to memory of 1420 3040 explorer.exe PID 3040 wrote to memory of 1420 3040 explorer.exe PID 3040 wrote to memory of 1208 3040 explorer.exe PID 3040 wrote to memory of 1208 3040 explorer.exe PID 3040 wrote to memory of 1208 3040 explorer.exe PID 3040 wrote to memory of 1212 3040 explorer.exe PID 3040 wrote to memory of 1212 3040 explorer.exe PID 3040 wrote to memory of 1212 3040 explorer.exe PID 3040 wrote to memory of 1212 3040 explorer.exe PID 3040 wrote to memory of 1660 3040 explorer.exe PID 3040 wrote to memory of 1660 3040 explorer.exe PID 3040 wrote to memory of 1660 3040 explorer.exe PID 3040 wrote to memory of 2416 3040 explorer.exe PID 3040 wrote to memory of 2416 3040 explorer.exe PID 3040 wrote to memory of 2416 3040 explorer.exe PID 3040 wrote to memory of 2416 3040 explorer.exe PID 3040 wrote to memory of 2668 3040 explorer.exe PID 3040 wrote to memory of 2668 3040 explorer.exe PID 3040 wrote to memory of 2668 3040 explorer.exe PID 3040 wrote to memory of 2668 3040 explorer.exe PID 3040 wrote to memory of 1560 3040 explorer.exe PID 3040 wrote to memory of 1560 3040 explorer.exe PID 3040 wrote to memory of 1560 3040 explorer.exe PID 3040 wrote to memory of 900 3040 explorer.exe PID 3040 wrote to memory of 900 3040 explorer.exe PID 3040 wrote to memory of 900 3040 explorer.exe PID 3040 wrote to memory of 900 3040 explorer.exe PID 2576 wrote to memory of 3136 2576 100D.exe cmd.exe PID 2576 wrote to memory of 3136 2576 100D.exe cmd.exe PID 2576 wrote to memory of 3136 2576 100D.exe cmd.exe PID 3136 wrote to memory of 1284 3136 cmd.exe timeout.exe PID 3136 wrote to memory of 1284 3136 cmd.exe timeout.exe PID 3136 wrote to memory of 1284 3136 cmd.exe timeout.exe PID 2576 wrote to memory of 4044 2576 100D.exe InstallUtil.exe PID 2576 wrote to memory of 4044 2576 100D.exe InstallUtil.exe PID 2576 wrote to memory of 4044 2576 100D.exe InstallUtil.exe PID 2576 wrote to memory of 3528 2576 100D.exe InstallUtil.exe PID 2576 wrote to memory of 3528 2576 100D.exe InstallUtil.exe PID 2576 wrote to memory of 3528 2576 100D.exe InstallUtil.exe PID 2576 wrote to memory of 3528 2576 100D.exe InstallUtil.exe PID 2576 wrote to memory of 3528 2576 100D.exe InstallUtil.exe PID 2576 wrote to memory of 3528 2576 100D.exe InstallUtil.exe PID 2576 wrote to memory of 3528 2576 100D.exe InstallUtil.exe PID 2576 wrote to memory of 3528 2576 100D.exe InstallUtil.exe PID 2264 wrote to memory of 860 2264 hwbfatj hwbfatj PID 2264 wrote to memory of 860 2264 hwbfatj hwbfatj PID 2264 wrote to memory of 860 2264 hwbfatj hwbfatj PID 2264 wrote to memory of 2196 2264 hwbfatj hwbfatj PID 2264 wrote to memory of 2196 2264 hwbfatj hwbfatj PID 2264 wrote to memory of 2196 2264 hwbfatj hwbfatj PID 2264 wrote to memory of 2196 2264 hwbfatj hwbfatj PID 2264 wrote to memory of 2196 2264 hwbfatj hwbfatj PID 2264 wrote to memory of 2196 2264 hwbfatj hwbfatj -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe"C:\Users\Admin\AppData\Local\Temp\8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exeC:\Users\Admin\AppData\Local\Temp\8502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3.exe2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\100D.exeC:\Users\Admin\AppData\Local\Temp\100D.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 202⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 203⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Roaming\hwbfatjC:\Users\Admin\AppData\Roaming\hwbfatj1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\hwbfatjC:\Users\Admin\AppData\Roaming\hwbfatj2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\hwbfatjC:\Users\Admin\AppData\Roaming\hwbfatj2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\100D.exeFilesize
1.2MB
MD5c52e23f559f027c6af598ff0a4c3497d
SHA10e6de0682ae5d89a6530a6c6e03054f5aaeb0662
SHA256409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021
SHA512802159c0fa6034dfc4278ee470aef46a52947006b007ae6a90391377d6c9b3774c999c30ab8d62a10869bf4d459736da4b70ce97d7771bf849effff7714e6428
-
C:\Users\Admin\AppData\Local\Temp\100D.exeFilesize
1.2MB
MD5c52e23f559f027c6af598ff0a4c3497d
SHA10e6de0682ae5d89a6530a6c6e03054f5aaeb0662
SHA256409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021
SHA512802159c0fa6034dfc4278ee470aef46a52947006b007ae6a90391377d6c9b3774c999c30ab8d62a10869bf4d459736da4b70ce97d7771bf849effff7714e6428
-
C:\Users\Admin\AppData\Roaming\hwbfatjFilesize
1.4MB
MD59909c471f3ce6914389f62d58fa6aa43
SHA1309be41081b2b05ec1d2e936f5cc2880d4c28391
SHA2568502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3
SHA5123d4791869810665bef2782025c4330b71d5fb41b8110857c2bcb2b2832ae93bdf2b3f49edee27d4501145ba6139296ec053071db22fe75f45f6209bab618c7ef
-
C:\Users\Admin\AppData\Roaming\hwbfatjFilesize
1.4MB
MD59909c471f3ce6914389f62d58fa6aa43
SHA1309be41081b2b05ec1d2e936f5cc2880d4c28391
SHA2568502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3
SHA5123d4791869810665bef2782025c4330b71d5fb41b8110857c2bcb2b2832ae93bdf2b3f49edee27d4501145ba6139296ec053071db22fe75f45f6209bab618c7ef
-
C:\Users\Admin\AppData\Roaming\hwbfatjFilesize
1.4MB
MD59909c471f3ce6914389f62d58fa6aa43
SHA1309be41081b2b05ec1d2e936f5cc2880d4c28391
SHA2568502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3
SHA5123d4791869810665bef2782025c4330b71d5fb41b8110857c2bcb2b2832ae93bdf2b3f49edee27d4501145ba6139296ec053071db22fe75f45f6209bab618c7ef
-
C:\Users\Admin\AppData\Roaming\hwbfatjFilesize
1.4MB
MD59909c471f3ce6914389f62d58fa6aa43
SHA1309be41081b2b05ec1d2e936f5cc2880d4c28391
SHA2568502f7db79a06b2327d4894e79d7936cad1d42b45589f1938cbac8506a4624e3
SHA5123d4791869810665bef2782025c4330b71d5fb41b8110857c2bcb2b2832ae93bdf2b3f49edee27d4501145ba6139296ec053071db22fe75f45f6209bab618c7ef
-
memory/900-141-0x0000000000000000-mapping.dmp
-
memory/1208-135-0x0000000000000000-mapping.dmp
-
memory/1212-136-0x0000000000000000-mapping.dmp
-
memory/1284-143-0x0000000000000000-mapping.dmp
-
memory/1420-133-0x0000000000000000-mapping.dmp
-
memory/1560-140-0x0000000000000000-mapping.dmp
-
memory/1660-137-0x0000000000000000-mapping.dmp
-
memory/2196-164-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2196-162-0x0000000000402E3F-mapping.dmp
-
memory/2416-138-0x0000000000000000-mapping.dmp
-
memory/2576-144-0x00000000053A0000-0x00000000053DA000-memory.dmpFilesize
232KB
-
memory/2576-134-0x0000000008960000-0x0000000008A90000-memory.dmpFilesize
1.2MB
-
memory/2576-132-0x0000000000A30000-0x0000000000B74000-memory.dmpFilesize
1.3MB
-
memory/2576-129-0x0000000000000000-mapping.dmp
-
memory/2668-139-0x0000000000000000-mapping.dmp
-
memory/3036-125-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3036-127-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3036-126-0x0000000000402E3F-mapping.dmp
-
memory/3040-165-0x0000000000D00000-0x0000000000D16000-memory.dmpFilesize
88KB
-
memory/3040-128-0x0000000000CA0000-0x0000000000CB6000-memory.dmpFilesize
88KB
-
memory/3136-142-0x0000000000000000-mapping.dmp
-
memory/3528-150-0x0000000007DD0000-0x0000000007EDA000-memory.dmpFilesize
1.0MB
-
memory/3528-155-0x0000000008040000-0x00000000080B6000-memory.dmpFilesize
472KB
-
memory/3528-148-0x00000000082D0000-0x00000000088D6000-memory.dmpFilesize
6.0MB
-
memory/3528-149-0x0000000005800000-0x0000000005812000-memory.dmpFilesize
72KB
-
memory/3528-146-0x000000000041232E-mapping.dmp
-
memory/3528-151-0x0000000007D00000-0x0000000007D3E000-memory.dmpFilesize
248KB
-
memory/3528-152-0x0000000007D40000-0x0000000007D8B000-memory.dmpFilesize
300KB
-
memory/3528-145-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/3528-159-0x000000000AC80000-0x000000000B1AC000-memory.dmpFilesize
5.2MB
-
memory/3528-147-0x00000000055F0000-0x0000000005610000-memory.dmpFilesize
128KB
-
memory/3528-156-0x0000000008120000-0x000000000813E000-memory.dmpFilesize
120KB
-
memory/3528-157-0x00000000097B0000-0x0000000009800000-memory.dmpFilesize
320KB
-
memory/3528-158-0x000000000A580000-0x000000000A742000-memory.dmpFilesize
1.8MB
-
memory/3696-122-0x00000000275A0000-0x0000000027632000-memory.dmpFilesize
584KB
-
memory/3696-121-0x00000000054D0000-0x0000000005536000-memory.dmpFilesize
408KB
-
memory/3696-120-0x00000000088E0000-0x0000000008A2C000-memory.dmpFilesize
1.3MB
-
memory/3696-123-0x0000000027B40000-0x000000002803E000-memory.dmpFilesize
5.0MB
-
memory/3696-119-0x0000000000A60000-0x0000000000BC0000-memory.dmpFilesize
1.4MB
-
memory/3696-124-0x0000000006790000-0x00000000067C0000-memory.dmpFilesize
192KB