Analysis
-
max time kernel
153s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2023 14:10
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.6495d2ca3dd6a4b99c2eea97263d8d90.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.6495d2ca3dd6a4b99c2eea97263d8d90.exe
-
Size
1.0MB
-
MD5
6495d2ca3dd6a4b99c2eea97263d8d90
-
SHA1
392229589db4bd1c21cca7f2f6ff55804cd4b00e
-
SHA256
708ed8e6c65b5c9069f630b7e7f78c01a6ae97ef961f045fce91480f2d4f6c2f
-
SHA512
e5dbcb771c7aa536f960c571a8a10c3cb4ad19c56d34449faa6ad7c3763658fe6c8569333cb24ab9e3e906ec96099267de982d7847959fdd045dd24f1c1d109a
-
SSDEEP
24576:Jy+GZhQfo8aJ7DQbOdrvxXbBYl3rdDF6pxstjxxJz+BLe4pe:8+GvQPbODLqlJWoz+BiK
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
redline
grome
77.91.124.86:19084
Signatures
-
Processes:
AppLaunch.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/624-42-0x0000000000400000-0x000000000043E000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 6 IoCs
Processes:
ln6qN59.exePJ1zl85.exe1Rf27oT4.exe2sA5108.exe3Hb86hv.exe4in290zB.exepid process 1576 ln6qN59.exe 4352 PJ1zl85.exe 388 1Rf27oT4.exe 3872 2sA5108.exe 1184 3Hb86hv.exe 4092 4in290zB.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
NEAS.6495d2ca3dd6a4b99c2eea97263d8d90.exeln6qN59.exePJ1zl85.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" NEAS.6495d2ca3dd6a4b99c2eea97263d8d90.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ln6qN59.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" PJ1zl85.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
1Rf27oT4.exe2sA5108.exe4in290zB.exedescription pid process target process PID 388 set thread context of 2272 388 1Rf27oT4.exe AppLaunch.exe PID 3872 set thread context of 4864 3872 2sA5108.exe AppLaunch.exe PID 4092 set thread context of 624 4092 4in290zB.exe AppLaunch.exe -
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1124 388 WerFault.exe 1Rf27oT4.exe 868 3872 WerFault.exe 2sA5108.exe 3972 4864 WerFault.exe AppLaunch.exe 532 4092 WerFault.exe 4in290zB.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
3Hb86hv.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3Hb86hv.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3Hb86hv.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3Hb86hv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
AppLaunch.exe3Hb86hv.exepid process 2272 AppLaunch.exe 2272 AppLaunch.exe 1184 3Hb86hv.exe 1184 3Hb86hv.exe 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 3436 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3436 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
3Hb86hv.exepid process 1184 3Hb86hv.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 2272 AppLaunch.exe Token: SeShutdownPrivilege 3436 Token: SeCreatePagefilePrivilege 3436 -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 3436 3436 -
Suspicious use of WriteProcessMemory 47 IoCs
Processes:
NEAS.6495d2ca3dd6a4b99c2eea97263d8d90.exeln6qN59.exePJ1zl85.exe1Rf27oT4.exe2sA5108.exe4in290zB.exedescription pid process target process PID 116 wrote to memory of 1576 116 NEAS.6495d2ca3dd6a4b99c2eea97263d8d90.exe ln6qN59.exe PID 116 wrote to memory of 1576 116 NEAS.6495d2ca3dd6a4b99c2eea97263d8d90.exe ln6qN59.exe PID 116 wrote to memory of 1576 116 NEAS.6495d2ca3dd6a4b99c2eea97263d8d90.exe ln6qN59.exe PID 1576 wrote to memory of 4352 1576 ln6qN59.exe PJ1zl85.exe PID 1576 wrote to memory of 4352 1576 ln6qN59.exe PJ1zl85.exe PID 1576 wrote to memory of 4352 1576 ln6qN59.exe PJ1zl85.exe PID 4352 wrote to memory of 388 4352 PJ1zl85.exe 1Rf27oT4.exe PID 4352 wrote to memory of 388 4352 PJ1zl85.exe 1Rf27oT4.exe PID 4352 wrote to memory of 388 4352 PJ1zl85.exe 1Rf27oT4.exe PID 388 wrote to memory of 2272 388 1Rf27oT4.exe AppLaunch.exe PID 388 wrote to memory of 2272 388 1Rf27oT4.exe AppLaunch.exe PID 388 wrote to memory of 2272 388 1Rf27oT4.exe AppLaunch.exe PID 388 wrote to memory of 2272 388 1Rf27oT4.exe AppLaunch.exe PID 388 wrote to memory of 2272 388 1Rf27oT4.exe AppLaunch.exe PID 388 wrote to memory of 2272 388 1Rf27oT4.exe AppLaunch.exe PID 388 wrote to memory of 2272 388 1Rf27oT4.exe AppLaunch.exe PID 388 wrote to memory of 2272 388 1Rf27oT4.exe AppLaunch.exe PID 4352 wrote to memory of 3872 4352 PJ1zl85.exe 2sA5108.exe PID 4352 wrote to memory of 3872 4352 PJ1zl85.exe 2sA5108.exe PID 4352 wrote to memory of 3872 4352 PJ1zl85.exe 2sA5108.exe PID 3872 wrote to memory of 4864 3872 2sA5108.exe AppLaunch.exe PID 3872 wrote to memory of 4864 3872 2sA5108.exe AppLaunch.exe PID 3872 wrote to memory of 4864 3872 2sA5108.exe AppLaunch.exe PID 3872 wrote to memory of 4864 3872 2sA5108.exe AppLaunch.exe PID 3872 wrote to memory of 4864 3872 2sA5108.exe AppLaunch.exe PID 3872 wrote to memory of 4864 3872 2sA5108.exe AppLaunch.exe PID 3872 wrote to memory of 4864 3872 2sA5108.exe AppLaunch.exe PID 3872 wrote to memory of 4864 3872 2sA5108.exe AppLaunch.exe PID 3872 wrote to memory of 4864 3872 2sA5108.exe AppLaunch.exe PID 3872 wrote to memory of 4864 3872 2sA5108.exe AppLaunch.exe PID 1576 wrote to memory of 1184 1576 ln6qN59.exe 3Hb86hv.exe PID 1576 wrote to memory of 1184 1576 ln6qN59.exe 3Hb86hv.exe PID 1576 wrote to memory of 1184 1576 ln6qN59.exe 3Hb86hv.exe PID 116 wrote to memory of 4092 116 NEAS.6495d2ca3dd6a4b99c2eea97263d8d90.exe 4in290zB.exe PID 116 wrote to memory of 4092 116 NEAS.6495d2ca3dd6a4b99c2eea97263d8d90.exe 4in290zB.exe PID 116 wrote to memory of 4092 116 NEAS.6495d2ca3dd6a4b99c2eea97263d8d90.exe 4in290zB.exe PID 4092 wrote to memory of 548 4092 4in290zB.exe AppLaunch.exe PID 4092 wrote to memory of 548 4092 4in290zB.exe AppLaunch.exe PID 4092 wrote to memory of 548 4092 4in290zB.exe AppLaunch.exe PID 4092 wrote to memory of 624 4092 4in290zB.exe AppLaunch.exe PID 4092 wrote to memory of 624 4092 4in290zB.exe AppLaunch.exe PID 4092 wrote to memory of 624 4092 4in290zB.exe AppLaunch.exe PID 4092 wrote to memory of 624 4092 4in290zB.exe AppLaunch.exe PID 4092 wrote to memory of 624 4092 4in290zB.exe AppLaunch.exe PID 4092 wrote to memory of 624 4092 4in290zB.exe AppLaunch.exe PID 4092 wrote to memory of 624 4092 4in290zB.exe AppLaunch.exe PID 4092 wrote to memory of 624 4092 4in290zB.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.6495d2ca3dd6a4b99c2eea97263d8d90.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.6495d2ca3dd6a4b99c2eea97263d8d90.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ln6qN59.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ln6qN59.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PJ1zl85.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PJ1zl85.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Rf27oT4.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Rf27oT4.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 5845⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sA5108.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sA5108.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 5406⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 5765⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Hb86hv.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Hb86hv.exe3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4in290zB.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4in290zB.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 1883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 388 -ip 3881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3872 -ip 38721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4864 -ip 48641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4092 -ip 40921⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4in290zB.exeFilesize
1.1MB
MD5dfa9e951c06740a60e559a0e10606060
SHA1bafb6217120091409c0e150740f435e2caa1051a
SHA256b287dced5d97f2f8cf9b3fe6f5885addc12b485aafe5553d403cfa1aa1b6f88f
SHA51242bf91eb9a252218cbad960495b9e7f4904b64f864c8bb6001da36061a3299960dac11caa2952b78190b381625af5d0f99c39f299f86c75fdab9b69a0fb79e56
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4in290zB.exeFilesize
1.1MB
MD5dfa9e951c06740a60e559a0e10606060
SHA1bafb6217120091409c0e150740f435e2caa1051a
SHA256b287dced5d97f2f8cf9b3fe6f5885addc12b485aafe5553d403cfa1aa1b6f88f
SHA51242bf91eb9a252218cbad960495b9e7f4904b64f864c8bb6001da36061a3299960dac11caa2952b78190b381625af5d0f99c39f299f86c75fdab9b69a0fb79e56
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ln6qN59.exeFilesize
651KB
MD56c4bc27494056e2ac4ca83786d39203a
SHA1c89205b63ff60dacd24ae81cd5bff589d98ef8fe
SHA25637d24a4a667f291db2cbb0e245e4537e1fbd8b43fddba62277f1102cd25e2d46
SHA512488779a7f5b635dfdb5cf1060f9b808c093271540a6473ed9ce0455a8bc5fe1228c471301da2653d1e3ba6e44d8d3dff3c7abecffd5c7502ac9ef66b814d3ce7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ln6qN59.exeFilesize
651KB
MD56c4bc27494056e2ac4ca83786d39203a
SHA1c89205b63ff60dacd24ae81cd5bff589d98ef8fe
SHA25637d24a4a667f291db2cbb0e245e4537e1fbd8b43fddba62277f1102cd25e2d46
SHA512488779a7f5b635dfdb5cf1060f9b808c093271540a6473ed9ce0455a8bc5fe1228c471301da2653d1e3ba6e44d8d3dff3c7abecffd5c7502ac9ef66b814d3ce7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Hb86hv.exeFilesize
30KB
MD5b6257189df7ce7aebadc6f9657692223
SHA1a26d1eb14d93d5e3c75d3689449028a53b0cb9b2
SHA25661de299d1322d7553edf53a4413b68cf91d7098093b7a47453be4dfb9b33a15b
SHA512672cf5df37e60eede6da861ea4b5028bf0889d38ce31dc18414907291ce3474a01009398f46d8cd39fc4bc5aee711e049aebe86e476bb9e3a7cf3a35b178d6ff
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Hb86hv.exeFilesize
30KB
MD5b6257189df7ce7aebadc6f9657692223
SHA1a26d1eb14d93d5e3c75d3689449028a53b0cb9b2
SHA25661de299d1322d7553edf53a4413b68cf91d7098093b7a47453be4dfb9b33a15b
SHA512672cf5df37e60eede6da861ea4b5028bf0889d38ce31dc18414907291ce3474a01009398f46d8cd39fc4bc5aee711e049aebe86e476bb9e3a7cf3a35b178d6ff
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PJ1zl85.exeFilesize
527KB
MD5df473a99abfc95b8cf11b0b980877837
SHA1dabf0a56dc26d488ca8ec729aaa27df150b20bfe
SHA2565450f333f3b256c0abb4732c5ef2f79bd12fe1710f180418fb7a9becd61cdb95
SHA512451bde8efe72998ee69de9498200b70ec3de68d6cceb2170ff9cdcd3e73f650d38d9199a3d77ea525ff7f8c9f163b256eb36c50f7869097efcdbfd55c8e68401
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\PJ1zl85.exeFilesize
527KB
MD5df473a99abfc95b8cf11b0b980877837
SHA1dabf0a56dc26d488ca8ec729aaa27df150b20bfe
SHA2565450f333f3b256c0abb4732c5ef2f79bd12fe1710f180418fb7a9becd61cdb95
SHA512451bde8efe72998ee69de9498200b70ec3de68d6cceb2170ff9cdcd3e73f650d38d9199a3d77ea525ff7f8c9f163b256eb36c50f7869097efcdbfd55c8e68401
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Rf27oT4.exeFilesize
890KB
MD545f457d53d9bf053d442f263c5c9b7e4
SHA124104051bc81466c1ec05b152d995bf4ce43281b
SHA25671e29b5ae4f5beaf774028a8df0d8c86b7574507cc80960b6e3c18e09d3c5b98
SHA51226e94b032ba4b9c90eaa9a61827d120528a72306c99f6d9bedb33fcdf934725dfaa53209d0955eb43163a7889482cae4c5fe7fe782ade411a5dada85a10ebf6a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Rf27oT4.exeFilesize
890KB
MD545f457d53d9bf053d442f263c5c9b7e4
SHA124104051bc81466c1ec05b152d995bf4ce43281b
SHA25671e29b5ae4f5beaf774028a8df0d8c86b7574507cc80960b6e3c18e09d3c5b98
SHA51226e94b032ba4b9c90eaa9a61827d120528a72306c99f6d9bedb33fcdf934725dfaa53209d0955eb43163a7889482cae4c5fe7fe782ade411a5dada85a10ebf6a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sA5108.exeFilesize
1.1MB
MD56ab3c1a031542e8860903d0c6c23594f
SHA1fa0829b2c5793e3566d45f22795f9cfba1eec86f
SHA25607668deb6dc55ce5149f0ec65efb1c4c45860ade3859347dabb3f27d7a53cdbf
SHA51225f01d51544938ea3efdad5c51396b65cb6872c55b3d8312513e809dffa997a0377771b04d706d59e5169f141c4b99fcd9897faa03f0dbf7f4ca1d4078fea76d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2sA5108.exeFilesize
1.1MB
MD56ab3c1a031542e8860903d0c6c23594f
SHA1fa0829b2c5793e3566d45f22795f9cfba1eec86f
SHA25607668deb6dc55ce5149f0ec65efb1c4c45860ade3859347dabb3f27d7a53cdbf
SHA51225f01d51544938ea3efdad5c51396b65cb6872c55b3d8312513e809dffa997a0377771b04d706d59e5169f141c4b99fcd9897faa03f0dbf7f4ca1d4078fea76d
-
memory/624-48-0x0000000007910000-0x000000000791A000-memory.dmpFilesize
40KB
-
memory/624-51-0x0000000008A10000-0x0000000009028000-memory.dmpFilesize
6.1MB
-
memory/624-57-0x00000000078E0000-0x00000000078F0000-memory.dmpFilesize
64KB
-
memory/624-56-0x0000000074BD0000-0x0000000075380000-memory.dmpFilesize
7.7MB
-
memory/624-55-0x0000000007D60000-0x0000000007DAC000-memory.dmpFilesize
304KB
-
memory/624-54-0x0000000007D20000-0x0000000007D5C000-memory.dmpFilesize
240KB
-
memory/624-53-0x0000000007CC0000-0x0000000007CD2000-memory.dmpFilesize
72KB
-
memory/624-52-0x00000000083F0000-0x00000000084FA000-memory.dmpFilesize
1.0MB
-
memory/624-47-0x00000000078E0000-0x00000000078F0000-memory.dmpFilesize
64KB
-
memory/624-42-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/624-46-0x0000000007930000-0x00000000079C2000-memory.dmpFilesize
584KB
-
memory/624-45-0x0000000074BD0000-0x0000000075380000-memory.dmpFilesize
7.7MB
-
memory/624-44-0x0000000007E40000-0x00000000083E4000-memory.dmpFilesize
5.6MB
-
memory/1184-36-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1184-33-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2272-43-0x0000000074BD0000-0x0000000075380000-memory.dmpFilesize
7.7MB
-
memory/2272-22-0x0000000074BD0000-0x0000000075380000-memory.dmpFilesize
7.7MB
-
memory/2272-21-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2272-50-0x0000000074BD0000-0x0000000075380000-memory.dmpFilesize
7.7MB
-
memory/3436-35-0x00000000022D0000-0x00000000022E6000-memory.dmpFilesize
88KB
-
memory/4864-30-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4864-26-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4864-27-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4864-28-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB