Analysis
-
max time kernel
138s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 18:38
Static task
static1
Behavioral task
behavioral1
Sample
74005c82485bec5973e298d528d4c30ea701fdee5f8dee59518b1fc836d476ac.exe
Resource
win10v2004-20230221-en
General
-
Target
74005c82485bec5973e298d528d4c30ea701fdee5f8dee59518b1fc836d476ac.exe
-
Size
660KB
-
MD5
089110ebfd272c3899df808a773e02ad
-
SHA1
08f9552eeafa841c8da6f6990992db489fdf52ca
-
SHA256
74005c82485bec5973e298d528d4c30ea701fdee5f8dee59518b1fc836d476ac
-
SHA512
078db4120c53cd4a1a615b388f4d46b4b0c98dbb3f01dbe145a9db74779303e54cea4e822d8a2f9b514fb8bd25a990f25359bc517ee6e5bb355d234a9f6312e9
-
SSDEEP
12288:DMr0y909arYR8oPSTA1S5ZZzQCUlwGanbLrDF3jZST0K15l6o6aVrx:DyJrYRdPSTBUKGanrDF3IT0ksoxH
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro9720.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9720.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/4704-166-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4704-179-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4704-178-0x0000000004D30000-0x0000000004D40000-memory.dmp family_redline behavioral1/memory/4704-184-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4704-191-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4704-195-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4704-187-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4704-172-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4704-163-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4704-198-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4704-201-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4704-204-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4704-209-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4704-213-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4704-217-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4704-222-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4704-224-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/4704-226-0x0000000002640000-0x000000000267F000-memory.dmp family_redline -
Executes dropped EXE 5 IoCs
Processes:
un250556.exepro9720.exepro9720.exequ5077.exesi908202.exepid process 1528 un250556.exe 2156 pro9720.exe 2676 pro9720.exe 4704 qu5077.exe 4612 si908202.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9720.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9720.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9720.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
74005c82485bec5973e298d528d4c30ea701fdee5f8dee59518b1fc836d476ac.exeun250556.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 74005c82485bec5973e298d528d4c30ea701fdee5f8dee59518b1fc836d476ac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 74005c82485bec5973e298d528d4c30ea701fdee5f8dee59518b1fc836d476ac.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un250556.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un250556.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
pro9720.exedescription pid process target process PID 2156 set thread context of 2676 2156 pro9720.exe pro9720.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 3492 sc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4088 4704 WerFault.exe qu5077.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9720.exequ5077.exesi908202.exepid process 2676 pro9720.exe 2676 pro9720.exe 4704 qu5077.exe 4704 qu5077.exe 4612 si908202.exe 4612 si908202.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro9720.exequ5077.exesi908202.exedescription pid process Token: SeDebugPrivilege 2676 pro9720.exe Token: SeDebugPrivilege 4704 qu5077.exe Token: SeDebugPrivilege 4612 si908202.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
74005c82485bec5973e298d528d4c30ea701fdee5f8dee59518b1fc836d476ac.exeun250556.exepro9720.exedescription pid process target process PID 4616 wrote to memory of 1528 4616 74005c82485bec5973e298d528d4c30ea701fdee5f8dee59518b1fc836d476ac.exe un250556.exe PID 4616 wrote to memory of 1528 4616 74005c82485bec5973e298d528d4c30ea701fdee5f8dee59518b1fc836d476ac.exe un250556.exe PID 4616 wrote to memory of 1528 4616 74005c82485bec5973e298d528d4c30ea701fdee5f8dee59518b1fc836d476ac.exe un250556.exe PID 1528 wrote to memory of 2156 1528 un250556.exe pro9720.exe PID 1528 wrote to memory of 2156 1528 un250556.exe pro9720.exe PID 1528 wrote to memory of 2156 1528 un250556.exe pro9720.exe PID 2156 wrote to memory of 2676 2156 pro9720.exe pro9720.exe PID 2156 wrote to memory of 2676 2156 pro9720.exe pro9720.exe PID 2156 wrote to memory of 2676 2156 pro9720.exe pro9720.exe PID 2156 wrote to memory of 2676 2156 pro9720.exe pro9720.exe PID 2156 wrote to memory of 2676 2156 pro9720.exe pro9720.exe PID 2156 wrote to memory of 2676 2156 pro9720.exe pro9720.exe PID 2156 wrote to memory of 2676 2156 pro9720.exe pro9720.exe PID 2156 wrote to memory of 2676 2156 pro9720.exe pro9720.exe PID 2156 wrote to memory of 2676 2156 pro9720.exe pro9720.exe PID 1528 wrote to memory of 4704 1528 un250556.exe qu5077.exe PID 1528 wrote to memory of 4704 1528 un250556.exe qu5077.exe PID 1528 wrote to memory of 4704 1528 un250556.exe qu5077.exe PID 4616 wrote to memory of 4612 4616 74005c82485bec5973e298d528d4c30ea701fdee5f8dee59518b1fc836d476ac.exe si908202.exe PID 4616 wrote to memory of 4612 4616 74005c82485bec5973e298d528d4c30ea701fdee5f8dee59518b1fc836d476ac.exe si908202.exe PID 4616 wrote to memory of 4612 4616 74005c82485bec5973e298d528d4c30ea701fdee5f8dee59518b1fc836d476ac.exe si908202.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74005c82485bec5973e298d528d4c30ea701fdee5f8dee59518b1fc836d476ac.exe"C:\Users\Admin\AppData\Local\Temp\74005c82485bec5973e298d528d4c30ea701fdee5f8dee59518b1fc836d476ac.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un250556.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un250556.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9720.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9720.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9720.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9720.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5077.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5077.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4704 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 15884⤵
- Program crash
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si908202.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si908202.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4704 -ip 47041⤵PID:1112
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:3492
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si908202.exeFilesize
175KB
MD568f2b480a19080ef37250da5731ec7c8
SHA1a39e109362516df28b2c59159c187096758c3f35
SHA2565ad27ba34c7fe6963ea66132e05fb7e0ea5df18f4320744422a4356306fb14e2
SHA512d56456b01dc4a77254138ef5ce32fc2cf222edc789b8444eb6119ece19211c95a573f2f5fe1f23ebbc5b2ca66984004dd3b83de60ee1ff9b460a1fcd9e4f8010
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si908202.exeFilesize
175KB
MD568f2b480a19080ef37250da5731ec7c8
SHA1a39e109362516df28b2c59159c187096758c3f35
SHA2565ad27ba34c7fe6963ea66132e05fb7e0ea5df18f4320744422a4356306fb14e2
SHA512d56456b01dc4a77254138ef5ce32fc2cf222edc789b8444eb6119ece19211c95a573f2f5fe1f23ebbc5b2ca66984004dd3b83de60ee1ff9b460a1fcd9e4f8010
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un250556.exeFilesize
518KB
MD5bd85c650f9633b7fd2c9d50ad286ea15
SHA14093e5c6d60bbbad54095b464e52a2b1907c14c7
SHA25698ecd0e529c1d5410bcc5058354f6c5482b6c0a7e682c7198994ca175fadb85c
SHA5126895ada765145d34f28fe4742d87c09f6f2ca87072ec9f22736c33328c59c707957de55bf9af7cc29fd6295afa791b8ad83a615e022bbb9d306bad34de2a3ac1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un250556.exeFilesize
518KB
MD5bd85c650f9633b7fd2c9d50ad286ea15
SHA14093e5c6d60bbbad54095b464e52a2b1907c14c7
SHA25698ecd0e529c1d5410bcc5058354f6c5482b6c0a7e682c7198994ca175fadb85c
SHA5126895ada765145d34f28fe4742d87c09f6f2ca87072ec9f22736c33328c59c707957de55bf9af7cc29fd6295afa791b8ad83a615e022bbb9d306bad34de2a3ac1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9720.exeFilesize
237KB
MD5a0d0b3ffbe56cb7c71bb1d567d4d0916
SHA17a7bfc5cde8bfc1caee6f6ea0822d509113c3227
SHA2565575f8620020e24ae76774465ec8e3507d9e21941d7c599f30b582ee0af2320f
SHA512014ccfd6c8327dc6e40f959e3205e9699c32916705b08b40c97e1a23b52d857af69e055f8add2af6c907bcd63756fe359bc3859ace469a7c52fe0da31813aed8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9720.exeFilesize
237KB
MD5a0d0b3ffbe56cb7c71bb1d567d4d0916
SHA17a7bfc5cde8bfc1caee6f6ea0822d509113c3227
SHA2565575f8620020e24ae76774465ec8e3507d9e21941d7c599f30b582ee0af2320f
SHA512014ccfd6c8327dc6e40f959e3205e9699c32916705b08b40c97e1a23b52d857af69e055f8add2af6c907bcd63756fe359bc3859ace469a7c52fe0da31813aed8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9720.exeFilesize
237KB
MD5a0d0b3ffbe56cb7c71bb1d567d4d0916
SHA17a7bfc5cde8bfc1caee6f6ea0822d509113c3227
SHA2565575f8620020e24ae76774465ec8e3507d9e21941d7c599f30b582ee0af2320f
SHA512014ccfd6c8327dc6e40f959e3205e9699c32916705b08b40c97e1a23b52d857af69e055f8add2af6c907bcd63756fe359bc3859ace469a7c52fe0da31813aed8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5077.exeFilesize
294KB
MD544a4baf8439a029a9951e889bb501319
SHA15d1b7812b0adf3208a1ac40b3e0e2e26955ce8eb
SHA256dc587e8a172a95ac8ceb272ddd3124c4aa6c55dcb0ffe21de88f986ff34b6279
SHA5126fb632b98a1174ddebf51f18a30189934b345e0b24f5e4e3d6ac7e027cff4d6cb4a0fc7be189635b0507bb3892a9a3d406c465c17df0472da4d29e275d7b020d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu5077.exeFilesize
294KB
MD544a4baf8439a029a9951e889bb501319
SHA15d1b7812b0adf3208a1ac40b3e0e2e26955ce8eb
SHA256dc587e8a172a95ac8ceb272ddd3124c4aa6c55dcb0ffe21de88f986ff34b6279
SHA5126fb632b98a1174ddebf51f18a30189934b345e0b24f5e4e3d6ac7e027cff4d6cb4a0fc7be189635b0507bb3892a9a3d406c465c17df0472da4d29e275d7b020d
-
memory/2156-150-0x0000000000650000-0x000000000067E000-memory.dmpFilesize
184KB
-
memory/2676-218-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/2676-162-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/2676-188-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/2676-164-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/2676-183-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/2676-167-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/2676-210-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/2676-148-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2676-151-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2676-174-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/2676-206-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/2676-180-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/2676-1121-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2676-1114-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/2676-202-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/2676-158-0x0000000004A60000-0x0000000005004000-memory.dmpFilesize
5.6MB
-
memory/2676-192-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/2676-1113-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/2676-1112-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/2676-221-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/2676-152-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2676-168-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/2676-161-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/2676-214-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/2676-160-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2676-159-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/2676-196-0x0000000004950000-0x0000000004962000-memory.dmpFilesize
72KB
-
memory/4612-1130-0x00000000002D0000-0x0000000000302000-memory.dmpFilesize
200KB
-
memory/4612-1131-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/4612-1132-0x0000000004F20000-0x0000000004F30000-memory.dmpFilesize
64KB
-
memory/4704-198-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4704-204-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4704-209-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4704-213-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4704-201-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4704-217-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4704-163-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4704-172-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4704-222-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4704-187-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4704-224-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4704-226-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4704-1101-0x00000000052F0000-0x0000000005908000-memory.dmpFilesize
6.1MB
-
memory/4704-1102-0x0000000005910000-0x0000000005A1A000-memory.dmpFilesize
1.0MB
-
memory/4704-1103-0x0000000004CF0000-0x0000000004D02000-memory.dmpFilesize
72KB
-
memory/4704-1104-0x0000000005A20000-0x0000000005A5C000-memory.dmpFilesize
240KB
-
memory/4704-1105-0x0000000004D30000-0x0000000004D40000-memory.dmpFilesize
64KB
-
memory/4704-1108-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/4704-1109-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/4704-1110-0x0000000006490000-0x0000000006506000-memory.dmpFilesize
472KB
-
memory/4704-1111-0x0000000006520000-0x0000000006570000-memory.dmpFilesize
320KB
-
memory/4704-195-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4704-191-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4704-184-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4704-1115-0x0000000004D30000-0x0000000004D40000-memory.dmpFilesize
64KB
-
memory/4704-1116-0x0000000004D30000-0x0000000004D40000-memory.dmpFilesize
64KB
-
memory/4704-1117-0x0000000004D30000-0x0000000004D40000-memory.dmpFilesize
64KB
-
memory/4704-178-0x0000000004D30000-0x0000000004D40000-memory.dmpFilesize
64KB
-
memory/4704-1122-0x00000000067D0000-0x0000000006992000-memory.dmpFilesize
1.8MB
-
memory/4704-1123-0x00000000069B0000-0x0000000006EDC000-memory.dmpFilesize
5.2MB
-
memory/4704-1124-0x0000000004D30000-0x0000000004D40000-memory.dmpFilesize
64KB
-
memory/4704-179-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB
-
memory/4704-175-0x0000000004D30000-0x0000000004D40000-memory.dmpFilesize
64KB
-
memory/4704-173-0x0000000004D30000-0x0000000004D40000-memory.dmpFilesize
64KB
-
memory/4704-170-0x0000000000650000-0x000000000069B000-memory.dmpFilesize
300KB
-
memory/4704-166-0x0000000002640000-0x000000000267F000-memory.dmpFilesize
252KB