Analysis
-
max time kernel
106s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
08-03-2023 21:56
Static task
static1
Behavioral task
behavioral1
Sample
80fdacf20dafe660e7ea195411ad2595860259cd140f93e1376d04932d9a9765.exe
Resource
win10-20230220-en
General
-
Target
80fdacf20dafe660e7ea195411ad2595860259cd140f93e1376d04932d9a9765.exe
-
Size
658KB
-
MD5
8e4c66d81a454312a6411e4fff8c8567
-
SHA1
c91131f05e9a5722fc16c9bb180a0d2f73fb46d1
-
SHA256
80fdacf20dafe660e7ea195411ad2595860259cd140f93e1376d04932d9a9765
-
SHA512
abb481e1d5a7cf169807a3a2cc28c125311e2fafa386adcd63870d59f99b42a92d67faa8be30a7ab4e76b98e034b3a3914694f716bbe29b5ea04688ae11ff2cc
-
SSDEEP
12288:5LtVnUthEmzYlx1K98K6kjuv1fGESzVl75ZM+DvoP1ZId:5TUt0xo6L1a7LXDgt6d
Malware Config
Extracted
redline
garry
193.56.146.11:4173
-
auth_value
210ba56bf751fefe327f26e00f0be5a9
Extracted
amadey
3.68
193.56.146.218/images/IMG_489440/index.php
Signatures
-
Processes:
a897ftxo.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a897ftxo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a897ftxo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a897ftxo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a897ftxo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a897ftxo.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 7 IoCs
Processes:
m652x759.exea897ftxo.exefAano057.exek277sOkl.exeredlines.exeredlines.exeredlines.exepid process 3216 m652x759.exe 3376 a897ftxo.exe 2964 fAano057.exe 4508 k277sOkl.exe 760 redlines.exe 4068 redlines.exe 3444 redlines.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4004 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
a897ftxo.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a897ftxo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features a897ftxo.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
80fdacf20dafe660e7ea195411ad2595860259cd140f93e1376d04932d9a9765.exem652x759.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 80fdacf20dafe660e7ea195411ad2595860259cd140f93e1376d04932d9a9765.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 80fdacf20dafe660e7ea195411ad2595860259cd140f93e1376d04932d9a9765.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce m652x759.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" m652x759.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
a897ftxo.exefAano057.exepid process 3376 a897ftxo.exe 3376 a897ftxo.exe 2964 fAano057.exe 2964 fAano057.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a897ftxo.exefAano057.exedescription pid process Token: SeDebugPrivilege 3376 a897ftxo.exe Token: SeDebugPrivilege 2964 fAano057.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
80fdacf20dafe660e7ea195411ad2595860259cd140f93e1376d04932d9a9765.exem652x759.exek277sOkl.exeredlines.execmd.exedescription pid process target process PID 2532 wrote to memory of 3216 2532 80fdacf20dafe660e7ea195411ad2595860259cd140f93e1376d04932d9a9765.exe m652x759.exe PID 2532 wrote to memory of 3216 2532 80fdacf20dafe660e7ea195411ad2595860259cd140f93e1376d04932d9a9765.exe m652x759.exe PID 2532 wrote to memory of 3216 2532 80fdacf20dafe660e7ea195411ad2595860259cd140f93e1376d04932d9a9765.exe m652x759.exe PID 3216 wrote to memory of 3376 3216 m652x759.exe a897ftxo.exe PID 3216 wrote to memory of 3376 3216 m652x759.exe a897ftxo.exe PID 3216 wrote to memory of 3376 3216 m652x759.exe a897ftxo.exe PID 3216 wrote to memory of 2964 3216 m652x759.exe fAano057.exe PID 3216 wrote to memory of 2964 3216 m652x759.exe fAano057.exe PID 3216 wrote to memory of 2964 3216 m652x759.exe fAano057.exe PID 2532 wrote to memory of 4508 2532 80fdacf20dafe660e7ea195411ad2595860259cd140f93e1376d04932d9a9765.exe k277sOkl.exe PID 2532 wrote to memory of 4508 2532 80fdacf20dafe660e7ea195411ad2595860259cd140f93e1376d04932d9a9765.exe k277sOkl.exe PID 2532 wrote to memory of 4508 2532 80fdacf20dafe660e7ea195411ad2595860259cd140f93e1376d04932d9a9765.exe k277sOkl.exe PID 4508 wrote to memory of 760 4508 k277sOkl.exe redlines.exe PID 4508 wrote to memory of 760 4508 k277sOkl.exe redlines.exe PID 4508 wrote to memory of 760 4508 k277sOkl.exe redlines.exe PID 760 wrote to memory of 4856 760 redlines.exe schtasks.exe PID 760 wrote to memory of 4856 760 redlines.exe schtasks.exe PID 760 wrote to memory of 4856 760 redlines.exe schtasks.exe PID 760 wrote to memory of 4732 760 redlines.exe cmd.exe PID 760 wrote to memory of 4732 760 redlines.exe cmd.exe PID 760 wrote to memory of 4732 760 redlines.exe cmd.exe PID 4732 wrote to memory of 4692 4732 cmd.exe cmd.exe PID 4732 wrote to memory of 4692 4732 cmd.exe cmd.exe PID 4732 wrote to memory of 4692 4732 cmd.exe cmd.exe PID 4732 wrote to memory of 4648 4732 cmd.exe cacls.exe PID 4732 wrote to memory of 4648 4732 cmd.exe cacls.exe PID 4732 wrote to memory of 4648 4732 cmd.exe cacls.exe PID 4732 wrote to memory of 4864 4732 cmd.exe cacls.exe PID 4732 wrote to memory of 4864 4732 cmd.exe cacls.exe PID 4732 wrote to memory of 4864 4732 cmd.exe cacls.exe PID 4732 wrote to memory of 3436 4732 cmd.exe cmd.exe PID 4732 wrote to memory of 3436 4732 cmd.exe cmd.exe PID 4732 wrote to memory of 3436 4732 cmd.exe cmd.exe PID 4732 wrote to memory of 3488 4732 cmd.exe cacls.exe PID 4732 wrote to memory of 3488 4732 cmd.exe cacls.exe PID 4732 wrote to memory of 3488 4732 cmd.exe cacls.exe PID 4732 wrote to memory of 4384 4732 cmd.exe cacls.exe PID 4732 wrote to memory of 4384 4732 cmd.exe cacls.exe PID 4732 wrote to memory of 4384 4732 cmd.exe cacls.exe PID 760 wrote to memory of 4004 760 redlines.exe rundll32.exe PID 760 wrote to memory of 4004 760 redlines.exe rundll32.exe PID 760 wrote to memory of 4004 760 redlines.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\80fdacf20dafe660e7ea195411ad2595860259cd140f93e1376d04932d9a9765.exe"C:\Users\Admin\AppData\Local\Temp\80fdacf20dafe660e7ea195411ad2595860259cd140f93e1376d04932d9a9765.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m652x759.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m652x759.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a897ftxo.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a897ftxo.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fAano057.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fAano057.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\k277sOkl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\k277sOkl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\46aee2aca4\redlines.exe"C:\Users\Admin\AppData\Local\Temp\46aee2aca4\redlines.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN redlines.exe /TR "C:\Users\Admin\AppData\Local\Temp\46aee2aca4\redlines.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "redlines.exe" /P "Admin:N"&&CACLS "redlines.exe" /P "Admin:R" /E&&echo Y|CACLS "..\46aee2aca4" /P "Admin:N"&&CACLS "..\46aee2aca4" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "redlines.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "redlines.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\46aee2aca4" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\46aee2aca4" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\46aee2aca4\redlines.exeC:\Users\Admin\AppData\Local\Temp\46aee2aca4\redlines.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\46aee2aca4\redlines.exeC:\Users\Admin\AppData\Local\Temp\46aee2aca4\redlines.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\46aee2aca4\redlines.exeFilesize
235KB
MD52cf60f8337d5b2ac1ecd5a702fe8119f
SHA1491f843831a2ae68847cb612be7f5886eac354d6
SHA2562a3dbe07f949ead607ad6aa3ab4cf7e544c1d7482e6a72ce109dff5a81f38336
SHA512fba0b731d36e4ce708f46629c18d04ee9a940037abaa57f7667ccbe226a01956c5ff99b029c46feaafea326a7e5aa606c0bb73cd3ed25f8fbae8410209322ac7
-
C:\Users\Admin\AppData\Local\Temp\46aee2aca4\redlines.exeFilesize
235KB
MD52cf60f8337d5b2ac1ecd5a702fe8119f
SHA1491f843831a2ae68847cb612be7f5886eac354d6
SHA2562a3dbe07f949ead607ad6aa3ab4cf7e544c1d7482e6a72ce109dff5a81f38336
SHA512fba0b731d36e4ce708f46629c18d04ee9a940037abaa57f7667ccbe226a01956c5ff99b029c46feaafea326a7e5aa606c0bb73cd3ed25f8fbae8410209322ac7
-
C:\Users\Admin\AppData\Local\Temp\46aee2aca4\redlines.exeFilesize
235KB
MD52cf60f8337d5b2ac1ecd5a702fe8119f
SHA1491f843831a2ae68847cb612be7f5886eac354d6
SHA2562a3dbe07f949ead607ad6aa3ab4cf7e544c1d7482e6a72ce109dff5a81f38336
SHA512fba0b731d36e4ce708f46629c18d04ee9a940037abaa57f7667ccbe226a01956c5ff99b029c46feaafea326a7e5aa606c0bb73cd3ed25f8fbae8410209322ac7
-
C:\Users\Admin\AppData\Local\Temp\46aee2aca4\redlines.exeFilesize
235KB
MD52cf60f8337d5b2ac1ecd5a702fe8119f
SHA1491f843831a2ae68847cb612be7f5886eac354d6
SHA2562a3dbe07f949ead607ad6aa3ab4cf7e544c1d7482e6a72ce109dff5a81f38336
SHA512fba0b731d36e4ce708f46629c18d04ee9a940037abaa57f7667ccbe226a01956c5ff99b029c46feaafea326a7e5aa606c0bb73cd3ed25f8fbae8410209322ac7
-
C:\Users\Admin\AppData\Local\Temp\46aee2aca4\redlines.exeFilesize
235KB
MD52cf60f8337d5b2ac1ecd5a702fe8119f
SHA1491f843831a2ae68847cb612be7f5886eac354d6
SHA2562a3dbe07f949ead607ad6aa3ab4cf7e544c1d7482e6a72ce109dff5a81f38336
SHA512fba0b731d36e4ce708f46629c18d04ee9a940037abaa57f7667ccbe226a01956c5ff99b029c46feaafea326a7e5aa606c0bb73cd3ed25f8fbae8410209322ac7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\k277sOkl.exeFilesize
235KB
MD52cf60f8337d5b2ac1ecd5a702fe8119f
SHA1491f843831a2ae68847cb612be7f5886eac354d6
SHA2562a3dbe07f949ead607ad6aa3ab4cf7e544c1d7482e6a72ce109dff5a81f38336
SHA512fba0b731d36e4ce708f46629c18d04ee9a940037abaa57f7667ccbe226a01956c5ff99b029c46feaafea326a7e5aa606c0bb73cd3ed25f8fbae8410209322ac7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\k277sOkl.exeFilesize
235KB
MD52cf60f8337d5b2ac1ecd5a702fe8119f
SHA1491f843831a2ae68847cb612be7f5886eac354d6
SHA2562a3dbe07f949ead607ad6aa3ab4cf7e544c1d7482e6a72ce109dff5a81f38336
SHA512fba0b731d36e4ce708f46629c18d04ee9a940037abaa57f7667ccbe226a01956c5ff99b029c46feaafea326a7e5aa606c0bb73cd3ed25f8fbae8410209322ac7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m652x759.exeFilesize
382KB
MD565fb93ce39b827d09f8090aea0d8e9d3
SHA1dd4eb0405f6d2d4dff4bbde92bcd600972dda160
SHA25693386cf794aa821ea9970aeef3af62ff94c5c7aacd52df6178415e09ddad91c3
SHA5127fc2dc83b8c619acbb08dc48540a147642c393679a74bffeb11077d82746c5640d2876b3e7fc9b40c0294d4ae78daf811d7d5aa033d15d4e5d14d5de78a5cdc3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m652x759.exeFilesize
382KB
MD565fb93ce39b827d09f8090aea0d8e9d3
SHA1dd4eb0405f6d2d4dff4bbde92bcd600972dda160
SHA25693386cf794aa821ea9970aeef3af62ff94c5c7aacd52df6178415e09ddad91c3
SHA5127fc2dc83b8c619acbb08dc48540a147642c393679a74bffeb11077d82746c5640d2876b3e7fc9b40c0294d4ae78daf811d7d5aa033d15d4e5d14d5de78a5cdc3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a897ftxo.exeFilesize
322KB
MD58141937b23cd1895e561d8e90fdeeff3
SHA16f810e9e480564f5837461f8ccdd07c951a1bece
SHA256ddda10348c77cf0a1539c3a42ce4f71e2c1895ab9b77348256e0a1f01c0936b6
SHA51240957cd33c4be1dab98ac0c40424c868aa3be6f6265fa28df050e5a4844ac6324acb93770bc6cb7cafedabc93fab9b9179a6e6525f6b3dd6fa9e31b4d5da5bec
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a897ftxo.exeFilesize
322KB
MD58141937b23cd1895e561d8e90fdeeff3
SHA16f810e9e480564f5837461f8ccdd07c951a1bece
SHA256ddda10348c77cf0a1539c3a42ce4f71e2c1895ab9b77348256e0a1f01c0936b6
SHA51240957cd33c4be1dab98ac0c40424c868aa3be6f6265fa28df050e5a4844ac6324acb93770bc6cb7cafedabc93fab9b9179a6e6525f6b3dd6fa9e31b4d5da5bec
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fAano057.exeFilesize
175KB
MD5f321ec1070df38bc3d9516ced9c63e82
SHA1ed54b270a786bbd3f9d055e0ae5eaf8e2752fde5
SHA25617696f99326cbeb44f8bd3bae2f91a7fbafa32ef54cf6631f0751cf6227c61a7
SHA5128bd8939185690415cb2305b4ae05e7d0c97db2260cb6bb0197460ff8bede41e0c3dd8c25b96af21503acc82fe24ebfd4e70aac966488de6111b20def9c30d2ab
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\fAano057.exeFilesize
175KB
MD5f321ec1070df38bc3d9516ced9c63e82
SHA1ed54b270a786bbd3f9d055e0ae5eaf8e2752fde5
SHA25617696f99326cbeb44f8bd3bae2f91a7fbafa32ef54cf6631f0751cf6227c61a7
SHA5128bd8939185690415cb2305b4ae05e7d0c97db2260cb6bb0197460ff8bede41e0c3dd8c25b96af21503acc82fe24ebfd4e70aac966488de6111b20def9c30d2ab
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
89KB
MD557cf7ce2696f4ac87b27879886a089bf
SHA1897fc8605b17f47fd51272a8a5f5605d939c744f
SHA256388abaad8701de54dcc5e0d8380630e1b6f0b323f1a9cf4377e38399753842b3
SHA512fd5a09e5908817a612eb59bf424272a749ff6ccccbd66f1900d29c58564befef981bd8bf7049d6d6690ffb8553bf9647f7051a9fb4b57ea1d68e256a769b6a86
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
89KB
MD557cf7ce2696f4ac87b27879886a089bf
SHA1897fc8605b17f47fd51272a8a5f5605d939c744f
SHA256388abaad8701de54dcc5e0d8380630e1b6f0b323f1a9cf4377e38399753842b3
SHA512fd5a09e5908817a612eb59bf424272a749ff6ccccbd66f1900d29c58564befef981bd8bf7049d6d6690ffb8553bf9647f7051a9fb4b57ea1d68e256a769b6a86
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
89KB
MD557cf7ce2696f4ac87b27879886a089bf
SHA1897fc8605b17f47fd51272a8a5f5605d939c744f
SHA256388abaad8701de54dcc5e0d8380630e1b6f0b323f1a9cf4377e38399753842b3
SHA512fd5a09e5908817a612eb59bf424272a749ff6ccccbd66f1900d29c58564befef981bd8bf7049d6d6690ffb8553bf9647f7051a9fb4b57ea1d68e256a769b6a86
-
memory/2532-174-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2532-139-0x0000000004310000-0x000000000439F000-memory.dmpFilesize
572KB
-
memory/2532-205-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2964-194-0x00000000064F0000-0x0000000006540000-memory.dmpFilesize
320KB
-
memory/2964-191-0x0000000006580000-0x0000000006742000-memory.dmpFilesize
1.8MB
-
memory/2964-189-0x00000000052B0000-0x0000000005316000-memory.dmpFilesize
408KB
-
memory/2964-188-0x0000000005210000-0x00000000052A2000-memory.dmpFilesize
584KB
-
memory/2964-187-0x0000000005200000-0x0000000005210000-memory.dmpFilesize
64KB
-
memory/2964-186-0x0000000005010000-0x000000000505B000-memory.dmpFilesize
300KB
-
memory/2964-192-0x0000000006C80000-0x00000000071AC000-memory.dmpFilesize
5.2MB
-
memory/2964-185-0x0000000004E90000-0x0000000004ECE000-memory.dmpFilesize
248KB
-
memory/2964-184-0x0000000004E30000-0x0000000004E42000-memory.dmpFilesize
72KB
-
memory/2964-193-0x0000000006470000-0x00000000064E6000-memory.dmpFilesize
472KB
-
memory/2964-183-0x0000000004F00000-0x000000000500A000-memory.dmpFilesize
1.0MB
-
memory/2964-181-0x00000000005D0000-0x0000000000602000-memory.dmpFilesize
200KB
-
memory/2964-182-0x00000000053A0000-0x00000000059A6000-memory.dmpFilesize
6.0MB
-
memory/3376-167-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/3376-177-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/3376-175-0x0000000000400000-0x00000000004D4000-memory.dmpFilesize
848KB
-
memory/3376-173-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/3376-172-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/3376-153-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/3376-155-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/3376-157-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/3376-159-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/3376-161-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/3376-163-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/3376-165-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/3376-169-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/3376-171-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/3376-147-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/3376-149-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/3376-151-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/3376-145-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/3376-144-0x00000000025D0000-0x00000000025E2000-memory.dmpFilesize
72KB
-
memory/3376-143-0x00000000025D0000-0x00000000025E8000-memory.dmpFilesize
96KB
-
memory/3376-142-0x0000000004AB0000-0x0000000004FAE000-memory.dmpFilesize
5.0MB
-
memory/3376-141-0x0000000002040000-0x000000000205A000-memory.dmpFilesize
104KB
-
memory/3376-140-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB