Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2022 06:06
Static task
static1
Behavioral task
behavioral1
Sample
c34729173ecc820eb7674431597d78be.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c34729173ecc820eb7674431597d78be.exe
Resource
win10v2004-20220812-en
General
-
Target
c34729173ecc820eb7674431597d78be.exe
-
Size
427KB
-
MD5
c34729173ecc820eb7674431597d78be
-
SHA1
884f343876a8bb0ebac63c28191c22c6f69590f8
-
SHA256
7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0
-
SHA512
f9c93a0c6f55217016fe5ba550e9948662901b9240662708ac93074bf9692427b73ce10864927026b118aeb6622a47cfa04976bbc9b482a31aef21a5c96786a0
-
SSDEEP
3072:yvGyYiSDnt1Et5CmPo8VGAnxoctr6Byd4TUISI:24UCp6n756BmlI
Malware Config
Extracted
redline
Nigh
80.66.87.20:80
-
auth_value
dab8506635d1dc134af4ebaedf4404eb
Signatures
-
Detects Smokeloader packer 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3120-172-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/3120-174-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/3120-175-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5064-154-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 6 IoCs
Processes:
SETUP_~1.EXEHwqujbjwlyvggktrainingadministrator_s.exeSETUP_~1.EXESETUP_~1.EXESETUP_~1.EXEHwqujbjwlyvggktrainingadministrator_s.exepid process 2764 SETUP_~1.EXE 2280 Hwqujbjwlyvggktrainingadministrator_s.exe 4564 SETUP_~1.EXE 3736 SETUP_~1.EXE 5064 SETUP_~1.EXE 3120 Hwqujbjwlyvggktrainingadministrator_s.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SETUP_~1.EXEHwqujbjwlyvggktrainingadministrator_s.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation SETUP_~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation Hwqujbjwlyvggktrainingadministrator_s.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c34729173ecc820eb7674431597d78be.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce c34729173ecc820eb7674431597d78be.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c34729173ecc820eb7674431597d78be.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
SETUP_~1.EXEHwqujbjwlyvggktrainingadministrator_s.exedescription pid process target process PID 2764 set thread context of 5064 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2280 set thread context of 3120 2280 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
Hwqujbjwlyvggktrainingadministrator_s.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Hwqujbjwlyvggktrainingadministrator_s.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Hwqujbjwlyvggktrainingadministrator_s.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Hwqujbjwlyvggktrainingadministrator_s.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeSETUP_~1.EXEpowershell.exeSETUP_~1.EXEHwqujbjwlyvggktrainingadministrator_s.exepid process 1028 powershell.exe 1028 powershell.exe 2764 SETUP_~1.EXE 2764 SETUP_~1.EXE 2764 SETUP_~1.EXE 2764 SETUP_~1.EXE 3668 powershell.exe 3668 powershell.exe 5064 SETUP_~1.EXE 5064 SETUP_~1.EXE 3120 Hwqujbjwlyvggktrainingadministrator_s.exe 3120 Hwqujbjwlyvggktrainingadministrator_s.exe 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 2484 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Hwqujbjwlyvggktrainingadministrator_s.exepid process 3120 Hwqujbjwlyvggktrainingadministrator_s.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
SETUP_~1.EXEpowershell.exeHwqujbjwlyvggktrainingadministrator_s.exepowershell.exeSETUP_~1.EXEdescription pid process Token: SeDebugPrivilege 2764 SETUP_~1.EXE Token: SeDebugPrivilege 1028 powershell.exe Token: SeDebugPrivilege 2280 Hwqujbjwlyvggktrainingadministrator_s.exe Token: SeDebugPrivilege 3668 powershell.exe Token: SeDebugPrivilege 5064 SETUP_~1.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
c34729173ecc820eb7674431597d78be.exeSETUP_~1.EXEHwqujbjwlyvggktrainingadministrator_s.exedescription pid process target process PID 4232 wrote to memory of 2764 4232 c34729173ecc820eb7674431597d78be.exe SETUP_~1.EXE PID 4232 wrote to memory of 2764 4232 c34729173ecc820eb7674431597d78be.exe SETUP_~1.EXE PID 4232 wrote to memory of 2764 4232 c34729173ecc820eb7674431597d78be.exe SETUP_~1.EXE PID 2764 wrote to memory of 1028 2764 SETUP_~1.EXE powershell.exe PID 2764 wrote to memory of 1028 2764 SETUP_~1.EXE powershell.exe PID 2764 wrote to memory of 1028 2764 SETUP_~1.EXE powershell.exe PID 2764 wrote to memory of 2280 2764 SETUP_~1.EXE Hwqujbjwlyvggktrainingadministrator_s.exe PID 2764 wrote to memory of 2280 2764 SETUP_~1.EXE Hwqujbjwlyvggktrainingadministrator_s.exe PID 2764 wrote to memory of 2280 2764 SETUP_~1.EXE Hwqujbjwlyvggktrainingadministrator_s.exe PID 2764 wrote to memory of 4564 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 4564 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 4564 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 3736 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 3736 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 3736 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 5064 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 5064 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 5064 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 5064 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 5064 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 5064 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 5064 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2764 wrote to memory of 5064 2764 SETUP_~1.EXE SETUP_~1.EXE PID 2280 wrote to memory of 3668 2280 Hwqujbjwlyvggktrainingadministrator_s.exe powershell.exe PID 2280 wrote to memory of 3668 2280 Hwqujbjwlyvggktrainingadministrator_s.exe powershell.exe PID 2280 wrote to memory of 3668 2280 Hwqujbjwlyvggktrainingadministrator_s.exe powershell.exe PID 2280 wrote to memory of 3120 2280 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe PID 2280 wrote to memory of 3120 2280 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe PID 2280 wrote to memory of 3120 2280 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe PID 2280 wrote to memory of 3120 2280 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe PID 2280 wrote to memory of 3120 2280 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe PID 2280 wrote to memory of 3120 2280 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c34729173ecc820eb7674431597d78be.exe"C:\Users\Admin\AppData\Local\Temp\c34729173ecc820eb7674431597d78be.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exe"C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exeC:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exe4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SETUP_~1.EXE.logFilesize
1KB
MD5e87e48b105757e1c7563d1c719059733
SHA128a3f2b2e0672da2b531f4757d2b20b53032dafc
SHA2560aaf22dc84cc3fcfe53de7ccfed8e662247dfb7f1a9967032c88790d0c663461
SHA512bf19c5743143aee914a453c41189c722c9b90a5b8bf299cecf3e1f97656d32cd209ecb74da8aebc89bb41c27d189f73aaaabbc64fe383410c95dc76ad4218968
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD54081738559a23d1364562bdc6471012d
SHA1162168f29ae7d05f7c228065587ba65267e941d9
SHA256e71aff35526cca9087dbec53cc08b40275bc9cf25699a67446c202469ffd2e7b
SHA512eac014ea080bc28b762f0e2174da54a0c7550b3e1b90ffbf8e22cab0a1fcd5632e93e3abda6f2f01a43c195bb4963c144a30b03af330786fc9d56ab2c413f089
-
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exeFilesize
6KB
MD5d0b53e53092311bc055630adf3e4ccdc
SHA1bf66777607a1d968e3194fe047f9a0e03f249f28
SHA2560cdff2f53a06a63f46dd3e773c3ae99f1d29826975295407046d2d87f609fc3e
SHA51234ecfda7dcad85b6e29fe4a51d7798517d1c2432879eee547e254d251c7f21a52616af58c1a5ce6d50a6a505cf2d03a8e46a3d3a441ca18df1aa86ed9bc546c6
-
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exeFilesize
6KB
MD5d0b53e53092311bc055630adf3e4ccdc
SHA1bf66777607a1d968e3194fe047f9a0e03f249f28
SHA2560cdff2f53a06a63f46dd3e773c3ae99f1d29826975295407046d2d87f609fc3e
SHA51234ecfda7dcad85b6e29fe4a51d7798517d1c2432879eee547e254d251c7f21a52616af58c1a5ce6d50a6a505cf2d03a8e46a3d3a441ca18df1aa86ed9bc546c6
-
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exeFilesize
6KB
MD5d0b53e53092311bc055630adf3e4ccdc
SHA1bf66777607a1d968e3194fe047f9a0e03f249f28
SHA2560cdff2f53a06a63f46dd3e773c3ae99f1d29826975295407046d2d87f609fc3e
SHA51234ecfda7dcad85b6e29fe4a51d7798517d1c2432879eee547e254d251c7f21a52616af58c1a5ce6d50a6a505cf2d03a8e46a3d3a441ca18df1aa86ed9bc546c6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD54786de75433835fdc9d3d08edf8116ca
SHA12c6843f4b1992eeb9215c4d582a94c4ceb7284f9
SHA256d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb
SHA512e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD54786de75433835fdc9d3d08edf8116ca
SHA12c6843f4b1992eeb9215c4d582a94c4ceb7284f9
SHA256d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb
SHA512e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD54786de75433835fdc9d3d08edf8116ca
SHA12c6843f4b1992eeb9215c4d582a94c4ceb7284f9
SHA256d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb
SHA512e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD54786de75433835fdc9d3d08edf8116ca
SHA12c6843f4b1992eeb9215c4d582a94c4ceb7284f9
SHA256d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb
SHA512e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD54786de75433835fdc9d3d08edf8116ca
SHA12c6843f4b1992eeb9215c4d582a94c4ceb7284f9
SHA256d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb
SHA512e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9
-
memory/1028-140-0x00000000054A0000-0x0000000005506000-memory.dmpFilesize
408KB
-
memory/1028-144-0x0000000006650000-0x000000000666A000-memory.dmpFilesize
104KB
-
memory/1028-143-0x0000000007810000-0x0000000007E8A000-memory.dmpFilesize
6.5MB
-
memory/1028-142-0x00000000061D0000-0x00000000061EE000-memory.dmpFilesize
120KB
-
memory/1028-141-0x0000000005510000-0x0000000005576000-memory.dmpFilesize
408KB
-
memory/1028-137-0x0000000000000000-mapping.dmp
-
memory/1028-139-0x0000000005660000-0x0000000005C88000-memory.dmpFilesize
6.2MB
-
memory/1028-138-0x00000000010E0000-0x0000000001116000-memory.dmpFilesize
216KB
-
memory/2280-145-0x0000000000000000-mapping.dmp
-
memory/2280-148-0x00000000001E0000-0x00000000001E8000-memory.dmpFilesize
32KB
-
memory/2764-135-0x0000000000F40000-0x0000000000F52000-memory.dmpFilesize
72KB
-
memory/2764-136-0x0000000006630000-0x0000000006652000-memory.dmpFilesize
136KB
-
memory/2764-132-0x0000000000000000-mapping.dmp
-
memory/3120-174-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3120-175-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3120-172-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3120-171-0x0000000000000000-mapping.dmp
-
memory/3668-161-0x0000000000000000-mapping.dmp
-
memory/3736-151-0x0000000000000000-mapping.dmp
-
memory/4564-149-0x0000000000000000-mapping.dmp
-
memory/5064-154-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/5064-165-0x0000000006AE0000-0x0000000007084000-memory.dmpFilesize
5.6MB
-
memory/5064-166-0x0000000006640000-0x00000000066D2000-memory.dmpFilesize
584KB
-
memory/5064-167-0x0000000007260000-0x0000000007422000-memory.dmpFilesize
1.8MB
-
memory/5064-168-0x0000000007960000-0x0000000007E8C000-memory.dmpFilesize
5.2MB
-
memory/5064-169-0x0000000007630000-0x00000000076A6000-memory.dmpFilesize
472KB
-
memory/5064-170-0x00000000076B0000-0x0000000007700000-memory.dmpFilesize
320KB
-
memory/5064-160-0x0000000005190000-0x00000000051CC000-memory.dmpFilesize
240KB
-
memory/5064-159-0x0000000005130000-0x0000000005142000-memory.dmpFilesize
72KB
-
memory/5064-158-0x0000000005200000-0x000000000530A000-memory.dmpFilesize
1.0MB
-
memory/5064-157-0x00000000056F0000-0x0000000005D08000-memory.dmpFilesize
6.1MB
-
memory/5064-153-0x0000000000000000-mapping.dmp