Analysis
-
max time kernel
151s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19-10-2022 18:09
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
457KB
-
MD5
9ecafa0a55d800f4293093989b90d595
-
SHA1
4b7388775266bf7b9edd19ff456f9dcc5a6bcd06
-
SHA256
914be79c80638787a90cb4d7598ad60a8f39634cb4858489bde36c0e32e235aa
-
SHA512
d43417b47641d815b99687c3418abb0fad2963f7466eac304d596ac61099f09ba1db3fce3a2b7e15a71f29e27476ef579b9e9200778d277acc470c26bc602b49
-
SSDEEP
3072:8ahKyd2n31If5HxTQ3fXaPm1cF8o4Y1Z8JP:8ahOOfTQvXaPm1cFrV4J
Malware Config
Extracted
redline
Nigh
80.66.87.20:80
-
auth_value
dab8506635d1dc134af4ebaedf4404eb
Signatures
-
Detects Smokeloader packer 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3648-172-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/3648-174-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/3648-175-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1180-150-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 6 IoCs
Processes:
ANSWER~1.EXERceqxcitctcydayetuanswerwhat_s.exeANSWER~1.EXERceqxcitctcydayetuanswerwhat_s.exeRceqxcitctcydayetuanswerwhat_s.exeRceqxcitctcydayetuanswerwhat_s.exepid process 1376 ANSWER~1.EXE 3184 Rceqxcitctcydayetuanswerwhat_s.exe 1180 ANSWER~1.EXE 4036 Rceqxcitctcydayetuanswerwhat_s.exe 1756 Rceqxcitctcydayetuanswerwhat_s.exe 3648 Rceqxcitctcydayetuanswerwhat_s.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ANSWER~1.EXERceqxcitctcydayetuanswerwhat_s.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation ANSWER~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Rceqxcitctcydayetuanswerwhat_s.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
file.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
ANSWER~1.EXERceqxcitctcydayetuanswerwhat_s.exedescription pid process target process PID 1376 set thread context of 1180 1376 ANSWER~1.EXE ANSWER~1.EXE PID 3184 set thread context of 3648 3184 Rceqxcitctcydayetuanswerwhat_s.exe Rceqxcitctcydayetuanswerwhat_s.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
Rceqxcitctcydayetuanswerwhat_s.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Rceqxcitctcydayetuanswerwhat_s.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Rceqxcitctcydayetuanswerwhat_s.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Rceqxcitctcydayetuanswerwhat_s.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exeANSWER~1.EXERceqxcitctcydayetuanswerwhat_s.exeRceqxcitctcydayetuanswerwhat_s.exepid process 1660 powershell.exe 1660 powershell.exe 4548 powershell.exe 4548 powershell.exe 1180 ANSWER~1.EXE 1180 ANSWER~1.EXE 3184 Rceqxcitctcydayetuanswerwhat_s.exe 3184 Rceqxcitctcydayetuanswerwhat_s.exe 3184 Rceqxcitctcydayetuanswerwhat_s.exe 3184 Rceqxcitctcydayetuanswerwhat_s.exe 3648 Rceqxcitctcydayetuanswerwhat_s.exe 3648 Rceqxcitctcydayetuanswerwhat_s.exe 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Rceqxcitctcydayetuanswerwhat_s.exepid process 3648 Rceqxcitctcydayetuanswerwhat_s.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
ANSWER~1.EXEpowershell.exeRceqxcitctcydayetuanswerwhat_s.exepowershell.exeANSWER~1.EXEdescription pid process Token: SeDebugPrivilege 1376 ANSWER~1.EXE Token: SeDebugPrivilege 1660 powershell.exe Token: SeDebugPrivilege 3184 Rceqxcitctcydayetuanswerwhat_s.exe Token: SeDebugPrivilege 4548 powershell.exe Token: SeDebugPrivilege 1180 ANSWER~1.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
file.exeANSWER~1.EXERceqxcitctcydayetuanswerwhat_s.exedescription pid process target process PID 2276 wrote to memory of 1376 2276 file.exe ANSWER~1.EXE PID 2276 wrote to memory of 1376 2276 file.exe ANSWER~1.EXE PID 2276 wrote to memory of 1376 2276 file.exe ANSWER~1.EXE PID 1376 wrote to memory of 1660 1376 ANSWER~1.EXE powershell.exe PID 1376 wrote to memory of 1660 1376 ANSWER~1.EXE powershell.exe PID 1376 wrote to memory of 1660 1376 ANSWER~1.EXE powershell.exe PID 1376 wrote to memory of 3184 1376 ANSWER~1.EXE Rceqxcitctcydayetuanswerwhat_s.exe PID 1376 wrote to memory of 3184 1376 ANSWER~1.EXE Rceqxcitctcydayetuanswerwhat_s.exe PID 1376 wrote to memory of 3184 1376 ANSWER~1.EXE Rceqxcitctcydayetuanswerwhat_s.exe PID 1376 wrote to memory of 1180 1376 ANSWER~1.EXE ANSWER~1.EXE PID 1376 wrote to memory of 1180 1376 ANSWER~1.EXE ANSWER~1.EXE PID 1376 wrote to memory of 1180 1376 ANSWER~1.EXE ANSWER~1.EXE PID 1376 wrote to memory of 1180 1376 ANSWER~1.EXE ANSWER~1.EXE PID 1376 wrote to memory of 1180 1376 ANSWER~1.EXE ANSWER~1.EXE PID 1376 wrote to memory of 1180 1376 ANSWER~1.EXE ANSWER~1.EXE PID 1376 wrote to memory of 1180 1376 ANSWER~1.EXE ANSWER~1.EXE PID 1376 wrote to memory of 1180 1376 ANSWER~1.EXE ANSWER~1.EXE PID 3184 wrote to memory of 4548 3184 Rceqxcitctcydayetuanswerwhat_s.exe powershell.exe PID 3184 wrote to memory of 4548 3184 Rceqxcitctcydayetuanswerwhat_s.exe powershell.exe PID 3184 wrote to memory of 4548 3184 Rceqxcitctcydayetuanswerwhat_s.exe powershell.exe PID 3184 wrote to memory of 4036 3184 Rceqxcitctcydayetuanswerwhat_s.exe Rceqxcitctcydayetuanswerwhat_s.exe PID 3184 wrote to memory of 4036 3184 Rceqxcitctcydayetuanswerwhat_s.exe Rceqxcitctcydayetuanswerwhat_s.exe PID 3184 wrote to memory of 4036 3184 Rceqxcitctcydayetuanswerwhat_s.exe Rceqxcitctcydayetuanswerwhat_s.exe PID 3184 wrote to memory of 1756 3184 Rceqxcitctcydayetuanswerwhat_s.exe Rceqxcitctcydayetuanswerwhat_s.exe PID 3184 wrote to memory of 1756 3184 Rceqxcitctcydayetuanswerwhat_s.exe Rceqxcitctcydayetuanswerwhat_s.exe PID 3184 wrote to memory of 1756 3184 Rceqxcitctcydayetuanswerwhat_s.exe Rceqxcitctcydayetuanswerwhat_s.exe PID 3184 wrote to memory of 3648 3184 Rceqxcitctcydayetuanswerwhat_s.exe Rceqxcitctcydayetuanswerwhat_s.exe PID 3184 wrote to memory of 3648 3184 Rceqxcitctcydayetuanswerwhat_s.exe Rceqxcitctcydayetuanswerwhat_s.exe PID 3184 wrote to memory of 3648 3184 Rceqxcitctcydayetuanswerwhat_s.exe Rceqxcitctcydayetuanswerwhat_s.exe PID 3184 wrote to memory of 3648 3184 Rceqxcitctcydayetuanswerwhat_s.exe Rceqxcitctcydayetuanswerwhat_s.exe PID 3184 wrote to memory of 3648 3184 Rceqxcitctcydayetuanswerwhat_s.exe Rceqxcitctcydayetuanswerwhat_s.exe PID 3184 wrote to memory of 3648 3184 Rceqxcitctcydayetuanswerwhat_s.exe Rceqxcitctcydayetuanswerwhat_s.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ANSWER~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ANSWER~1.EXE2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Rceqxcitctcydayetuanswerwhat_s.exe"C:\Users\Admin\AppData\Local\Temp\Rceqxcitctcydayetuanswerwhat_s.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Rceqxcitctcydayetuanswerwhat_s.exeC:\Users\Admin\AppData\Local\Temp\Rceqxcitctcydayetuanswerwhat_s.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rceqxcitctcydayetuanswerwhat_s.exeC:\Users\Admin\AppData\Local\Temp\Rceqxcitctcydayetuanswerwhat_s.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Rceqxcitctcydayetuanswerwhat_s.exeC:\Users\Admin\AppData\Local\Temp\Rceqxcitctcydayetuanswerwhat_s.exe4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ANSWER~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ANSWER~1.EXE3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ANSWER~1.EXE.logFilesize
1KB
MD5e87e48b105757e1c7563d1c719059733
SHA128a3f2b2e0672da2b531f4757d2b20b53032dafc
SHA2560aaf22dc84cc3fcfe53de7ccfed8e662247dfb7f1a9967032c88790d0c663461
SHA512bf19c5743143aee914a453c41189c722c9b90a5b8bf299cecf3e1f97656d32cd209ecb74da8aebc89bb41c27d189f73aaaabbc64fe383410c95dc76ad4218968
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD51745fc08d841be45efd42384c03ba610
SHA13ea83ac2ff0f48724a00efa74d6364e457eef389
SHA25657fc8a8def442762a680be2889a150d7c04d26f9770f2bdb79e959774cdad7cf
SHA512ae4b5ffb93abd21bd30cfb59a0b0e38cd5b99ebfbcca930d86742054700cc5187ecf9e2911710ffd0f44dacef806d29fa70cb0de4e4132b7576ed5d8698640d6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ANSWER~1.EXEFilesize
214.6MB
MD5bb8689d9b974d82e1d538277a9e46ea3
SHA1f2b6671113b9f855574369ead9dbbeb6acfdfefe
SHA2564af7c294e7310214795adee79cf35eb1865ef3219f9b35335d19534941c8783d
SHA512d2164c4e798d5cae0fcb2c7d589b12458a011d0ee26fdbb9e3d9995a5c1eba81a41914f06cb800fc00ed6a4befed89b14e7414ee974a6f22919b8ce58edf0304
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ANSWER~1.EXEFilesize
214.6MB
MD5bb8689d9b974d82e1d538277a9e46ea3
SHA1f2b6671113b9f855574369ead9dbbeb6acfdfefe
SHA2564af7c294e7310214795adee79cf35eb1865ef3219f9b35335d19534941c8783d
SHA512d2164c4e798d5cae0fcb2c7d589b12458a011d0ee26fdbb9e3d9995a5c1eba81a41914f06cb800fc00ed6a4befed89b14e7414ee974a6f22919b8ce58edf0304
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ANSWER~1.EXEFilesize
214.6MB
MD5bb8689d9b974d82e1d538277a9e46ea3
SHA1f2b6671113b9f855574369ead9dbbeb6acfdfefe
SHA2564af7c294e7310214795adee79cf35eb1865ef3219f9b35335d19534941c8783d
SHA512d2164c4e798d5cae0fcb2c7d589b12458a011d0ee26fdbb9e3d9995a5c1eba81a41914f06cb800fc00ed6a4befed89b14e7414ee974a6f22919b8ce58edf0304
-
C:\Users\Admin\AppData\Local\Temp\Rceqxcitctcydayetuanswerwhat_s.exeFilesize
6KB
MD50f6b3e19faa8bf67fa446a0b13066014
SHA17f7ac141c090c22ff2677381990007efc5df70d9
SHA2564d9d51e9218a1823d9d6498ec093bda67beb78c491459b756fb3501079f65534
SHA51264001280784d504ff6fe58d2f603396f2826ae6da5a4f36e2b460c3d5509bc1a04189f960c6d27d429774ef1c467f00a1859fe7d28180b049de86c32c5211cce
-
C:\Users\Admin\AppData\Local\Temp\Rceqxcitctcydayetuanswerwhat_s.exeFilesize
6KB
MD50f6b3e19faa8bf67fa446a0b13066014
SHA17f7ac141c090c22ff2677381990007efc5df70d9
SHA2564d9d51e9218a1823d9d6498ec093bda67beb78c491459b756fb3501079f65534
SHA51264001280784d504ff6fe58d2f603396f2826ae6da5a4f36e2b460c3d5509bc1a04189f960c6d27d429774ef1c467f00a1859fe7d28180b049de86c32c5211cce
-
C:\Users\Admin\AppData\Local\Temp\Rceqxcitctcydayetuanswerwhat_s.exeFilesize
6KB
MD50f6b3e19faa8bf67fa446a0b13066014
SHA17f7ac141c090c22ff2677381990007efc5df70d9
SHA2564d9d51e9218a1823d9d6498ec093bda67beb78c491459b756fb3501079f65534
SHA51264001280784d504ff6fe58d2f603396f2826ae6da5a4f36e2b460c3d5509bc1a04189f960c6d27d429774ef1c467f00a1859fe7d28180b049de86c32c5211cce
-
C:\Users\Admin\AppData\Local\Temp\Rceqxcitctcydayetuanswerwhat_s.exeFilesize
6KB
MD50f6b3e19faa8bf67fa446a0b13066014
SHA17f7ac141c090c22ff2677381990007efc5df70d9
SHA2564d9d51e9218a1823d9d6498ec093bda67beb78c491459b756fb3501079f65534
SHA51264001280784d504ff6fe58d2f603396f2826ae6da5a4f36e2b460c3d5509bc1a04189f960c6d27d429774ef1c467f00a1859fe7d28180b049de86c32c5211cce
-
C:\Users\Admin\AppData\Local\Temp\Rceqxcitctcydayetuanswerwhat_s.exeFilesize
6KB
MD50f6b3e19faa8bf67fa446a0b13066014
SHA17f7ac141c090c22ff2677381990007efc5df70d9
SHA2564d9d51e9218a1823d9d6498ec093bda67beb78c491459b756fb3501079f65534
SHA51264001280784d504ff6fe58d2f603396f2826ae6da5a4f36e2b460c3d5509bc1a04189f960c6d27d429774ef1c467f00a1859fe7d28180b049de86c32c5211cce
-
memory/1180-165-0x00000000072E0000-0x00000000074A2000-memory.dmpFilesize
1.8MB
-
memory/1180-166-0x00000000079E0000-0x0000000007F0C000-memory.dmpFilesize
5.2MB
-
memory/1180-164-0x0000000006A40000-0x0000000006A90000-memory.dmpFilesize
320KB
-
memory/1180-163-0x00000000069C0000-0x0000000006A36000-memory.dmpFilesize
472KB
-
memory/1180-162-0x00000000066C0000-0x0000000006752000-memory.dmpFilesize
584KB
-
memory/1180-149-0x0000000000000000-mapping.dmp
-
memory/1180-161-0x0000000006B60000-0x0000000007104000-memory.dmpFilesize
5.6MB
-
memory/1180-150-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1180-160-0x0000000005220000-0x000000000525C000-memory.dmpFilesize
240KB
-
memory/1180-159-0x00000000051C0000-0x00000000051D2000-memory.dmpFilesize
72KB
-
memory/1180-158-0x0000000005280000-0x000000000538A000-memory.dmpFilesize
1.0MB
-
memory/1180-157-0x0000000005770000-0x0000000005D88000-memory.dmpFilesize
6.1MB
-
memory/1376-135-0x0000000000F60000-0x0000000000F72000-memory.dmpFilesize
72KB
-
memory/1376-136-0x0000000006530000-0x0000000006552000-memory.dmpFilesize
136KB
-
memory/1376-132-0x0000000000000000-mapping.dmp
-
memory/1660-137-0x0000000000000000-mapping.dmp
-
memory/1660-139-0x0000000005BE0000-0x0000000006208000-memory.dmpFilesize
6.2MB
-
memory/1660-140-0x0000000005A70000-0x0000000005AD6000-memory.dmpFilesize
408KB
-
memory/1660-141-0x0000000006280000-0x00000000062E6000-memory.dmpFilesize
408KB
-
memory/1660-142-0x00000000068A0000-0x00000000068BE000-memory.dmpFilesize
120KB
-
memory/1660-143-0x0000000007F00000-0x000000000857A000-memory.dmpFilesize
6.5MB
-
memory/1660-144-0x0000000006DC0000-0x0000000006DDA000-memory.dmpFilesize
104KB
-
memory/1660-138-0x00000000032C0000-0x00000000032F6000-memory.dmpFilesize
216KB
-
memory/1756-169-0x0000000000000000-mapping.dmp
-
memory/3184-145-0x0000000000000000-mapping.dmp
-
memory/3184-148-0x0000000000730000-0x0000000000738000-memory.dmpFilesize
32KB
-
memory/3648-171-0x0000000000000000-mapping.dmp
-
memory/3648-172-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3648-174-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3648-175-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4036-167-0x0000000000000000-mapping.dmp
-
memory/4548-153-0x0000000000000000-mapping.dmp