Analysis
-
max time kernel
57s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 18:36
Static task
static1
Behavioral task
behavioral1
Sample
87aab2f72bf937effb2117d6abc3c7f7d4a974541944e74c2b23d2913de963fa.exe
Resource
win10-20230220-en
General
-
Target
87aab2f72bf937effb2117d6abc3c7f7d4a974541944e74c2b23d2913de963fa.exe
-
Size
660KB
-
MD5
06bf359b7fd60464937518cec4461fa0
-
SHA1
d58143261aa89af3fe02a1dd86c2ce0f67d84b07
-
SHA256
87aab2f72bf937effb2117d6abc3c7f7d4a974541944e74c2b23d2913de963fa
-
SHA512
f4bfa347a76e5599e6553b5c87da8e7bb53c10eeab56dad8caabb3d27bb899589ca70d91f6469da0c0f8909b30b33e22a9e82b7ca6e1a5338ad8ef511f533a96
-
SSDEEP
12288:lMr8y901J+T/OX3hakXR0HQOZz0CUIyG7MTFE3YgZSJ0En0l6SsySo6+xjn:ByIc/OX3hdB4vUnGQFE3YDJ05sSsyfVL
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro2211.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro2211.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro2211.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro2211.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro2211.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro2211.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4720-152-0x0000000002270000-0x00000000022B6000-memory.dmp family_redline behavioral1/memory/4720-155-0x0000000004A40000-0x0000000004A84000-memory.dmp family_redline behavioral1/memory/4720-161-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4720-163-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4720-167-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4720-171-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4720-175-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4720-179-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4720-183-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4720-196-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4720-201-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4720-189-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4720-205-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4720-207-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4720-209-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4720-211-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4720-213-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4720-215-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline behavioral1/memory/4720-217-0x0000000004A40000-0x0000000004A7F000-memory.dmp family_redline -
Executes dropped EXE 5 IoCs
Processes:
un442394.exepro2211.exepro2211.exequ8983.exesi579860.exepid process 2608 un442394.exe 1508 pro2211.exe 4108 pro2211.exe 4720 qu8983.exe 4368 si579860.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro2211.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro2211.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro2211.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
87aab2f72bf937effb2117d6abc3c7f7d4a974541944e74c2b23d2913de963fa.exeun442394.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 87aab2f72bf937effb2117d6abc3c7f7d4a974541944e74c2b23d2913de963fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 87aab2f72bf937effb2117d6abc3c7f7d4a974541944e74c2b23d2913de963fa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un442394.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un442394.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
pro2211.exedescription pid process target process PID 1508 set thread context of 4108 1508 pro2211.exe pro2211.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro2211.exequ8983.exesi579860.exepid process 4108 pro2211.exe 4108 pro2211.exe 4720 qu8983.exe 4720 qu8983.exe 4368 si579860.exe 4368 si579860.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro2211.exequ8983.exesi579860.exedescription pid process Token: SeDebugPrivilege 4108 pro2211.exe Token: SeDebugPrivilege 4720 qu8983.exe Token: SeDebugPrivilege 4368 si579860.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
87aab2f72bf937effb2117d6abc3c7f7d4a974541944e74c2b23d2913de963fa.exeun442394.exepro2211.exedescription pid process target process PID 4128 wrote to memory of 2608 4128 87aab2f72bf937effb2117d6abc3c7f7d4a974541944e74c2b23d2913de963fa.exe un442394.exe PID 4128 wrote to memory of 2608 4128 87aab2f72bf937effb2117d6abc3c7f7d4a974541944e74c2b23d2913de963fa.exe un442394.exe PID 4128 wrote to memory of 2608 4128 87aab2f72bf937effb2117d6abc3c7f7d4a974541944e74c2b23d2913de963fa.exe un442394.exe PID 2608 wrote to memory of 1508 2608 un442394.exe pro2211.exe PID 2608 wrote to memory of 1508 2608 un442394.exe pro2211.exe PID 2608 wrote to memory of 1508 2608 un442394.exe pro2211.exe PID 1508 wrote to memory of 4108 1508 pro2211.exe pro2211.exe PID 1508 wrote to memory of 4108 1508 pro2211.exe pro2211.exe PID 1508 wrote to memory of 4108 1508 pro2211.exe pro2211.exe PID 1508 wrote to memory of 4108 1508 pro2211.exe pro2211.exe PID 1508 wrote to memory of 4108 1508 pro2211.exe pro2211.exe PID 1508 wrote to memory of 4108 1508 pro2211.exe pro2211.exe PID 1508 wrote to memory of 4108 1508 pro2211.exe pro2211.exe PID 1508 wrote to memory of 4108 1508 pro2211.exe pro2211.exe PID 1508 wrote to memory of 4108 1508 pro2211.exe pro2211.exe PID 2608 wrote to memory of 4720 2608 un442394.exe qu8983.exe PID 2608 wrote to memory of 4720 2608 un442394.exe qu8983.exe PID 2608 wrote to memory of 4720 2608 un442394.exe qu8983.exe PID 4128 wrote to memory of 4368 4128 87aab2f72bf937effb2117d6abc3c7f7d4a974541944e74c2b23d2913de963fa.exe si579860.exe PID 4128 wrote to memory of 4368 4128 87aab2f72bf937effb2117d6abc3c7f7d4a974541944e74c2b23d2913de963fa.exe si579860.exe PID 4128 wrote to memory of 4368 4128 87aab2f72bf937effb2117d6abc3c7f7d4a974541944e74c2b23d2913de963fa.exe si579860.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87aab2f72bf937effb2117d6abc3c7f7d4a974541944e74c2b23d2913de963fa.exe"C:\Users\Admin\AppData\Local\Temp\87aab2f72bf937effb2117d6abc3c7f7d4a974541944e74c2b23d2913de963fa.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un442394.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un442394.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2211.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2211.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2211.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2211.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8983.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8983.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si579860.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si579860.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si579860.exeFilesize
175KB
MD55e830ab92524263bfec035f2cddd313b
SHA1c2741fe4f4f00e2b577dd93ab3e38e73172e779a
SHA2565028e2f01baace339c285553c8e79254aafd8081a6def0b4bb708055b80ae087
SHA5120d3e55b3ffc3e1d33bfdca0a2c78dd752fbe4a9351fe667c432cf3113accf6ff2cf7d24ded48048e7c29af74e42ce8448e0c0f3e3b08d02dfe4e52ff5eb1bcd5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si579860.exeFilesize
175KB
MD55e830ab92524263bfec035f2cddd313b
SHA1c2741fe4f4f00e2b577dd93ab3e38e73172e779a
SHA2565028e2f01baace339c285553c8e79254aafd8081a6def0b4bb708055b80ae087
SHA5120d3e55b3ffc3e1d33bfdca0a2c78dd752fbe4a9351fe667c432cf3113accf6ff2cf7d24ded48048e7c29af74e42ce8448e0c0f3e3b08d02dfe4e52ff5eb1bcd5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un442394.exeFilesize
518KB
MD5690d1fe6f1ce81dd8cc3fe1f63bae3aa
SHA1fba4db3160628507a8e5297265bf3cc60819aced
SHA25663457a549dc1589bcb308c949d16c808e960128e9d61a0993051edee32b36ab5
SHA512152d8a803c88a0cae908fef2a720486b59ec373d39f7a5563b18f29e43a592a14b359023a4a0f02e6ab0c7f3649ca10951bb06cd4929241bd055f5f01cb6ffd3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un442394.exeFilesize
518KB
MD5690d1fe6f1ce81dd8cc3fe1f63bae3aa
SHA1fba4db3160628507a8e5297265bf3cc60819aced
SHA25663457a549dc1589bcb308c949d16c808e960128e9d61a0993051edee32b36ab5
SHA512152d8a803c88a0cae908fef2a720486b59ec373d39f7a5563b18f29e43a592a14b359023a4a0f02e6ab0c7f3649ca10951bb06cd4929241bd055f5f01cb6ffd3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2211.exeFilesize
237KB
MD5d02fe2253ceeccdd6fba3c3c0653a7d7
SHA174f58d2bfa64c9eb5cd421a7ec8e35c531208b69
SHA256bf77cc8f729f5083c1eee6f4e50c91f2fe32601bb54e5e839b8941c746847093
SHA512692f7806c894ee0b71dc520ea24d183ed2be47ca437d2d5c144400d88cd05bd2a15e4c96aee4df080bde925e71684a9a3882f5808452a32c940e54d6da3ea6aa
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2211.exeFilesize
237KB
MD5d02fe2253ceeccdd6fba3c3c0653a7d7
SHA174f58d2bfa64c9eb5cd421a7ec8e35c531208b69
SHA256bf77cc8f729f5083c1eee6f4e50c91f2fe32601bb54e5e839b8941c746847093
SHA512692f7806c894ee0b71dc520ea24d183ed2be47ca437d2d5c144400d88cd05bd2a15e4c96aee4df080bde925e71684a9a3882f5808452a32c940e54d6da3ea6aa
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2211.exeFilesize
237KB
MD5d02fe2253ceeccdd6fba3c3c0653a7d7
SHA174f58d2bfa64c9eb5cd421a7ec8e35c531208b69
SHA256bf77cc8f729f5083c1eee6f4e50c91f2fe32601bb54e5e839b8941c746847093
SHA512692f7806c894ee0b71dc520ea24d183ed2be47ca437d2d5c144400d88cd05bd2a15e4c96aee4df080bde925e71684a9a3882f5808452a32c940e54d6da3ea6aa
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8983.exeFilesize
294KB
MD550e1b970c1d22711de70a980a7e6527f
SHA13a3b5c35933742fd37facf401b67599b1ff07ab6
SHA256d969834585f1614d58fb2530da59beef1946782b0ed2f9a800e54eddb6a3a29e
SHA5121cb7e3ce2546d3607f44e91c4b6a28f8a3afedfd9c0dadad6b411e4fe83b0bf40f15ce9c9f17fd8933a57f9569181623bef6ce269bb309fa7aaaab7992a6c65d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8983.exeFilesize
294KB
MD550e1b970c1d22711de70a980a7e6527f
SHA13a3b5c35933742fd37facf401b67599b1ff07ab6
SHA256d969834585f1614d58fb2530da59beef1946782b0ed2f9a800e54eddb6a3a29e
SHA5121cb7e3ce2546d3607f44e91c4b6a28f8a3afedfd9c0dadad6b411e4fe83b0bf40f15ce9c9f17fd8933a57f9569181623bef6ce269bb309fa7aaaab7992a6c65d
-
memory/1508-137-0x00000000004B0000-0x00000000004DE000-memory.dmpFilesize
184KB
-
memory/4108-1112-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4108-1103-0x0000000004A00000-0x0000000004A10000-memory.dmpFilesize
64KB
-
memory/4108-146-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4108-147-0x0000000004A00000-0x0000000004A10000-memory.dmpFilesize
64KB
-
memory/4108-148-0x0000000004A00000-0x0000000004A10000-memory.dmpFilesize
64KB
-
memory/4108-149-0x0000000004A10000-0x0000000004F0E000-memory.dmpFilesize
5.0MB
-
memory/4108-150-0x0000000004A00000-0x0000000004A10000-memory.dmpFilesize
64KB
-
memory/4108-151-0x00000000024B0000-0x00000000024C8000-memory.dmpFilesize
96KB
-
memory/4108-191-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4108-153-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4108-135-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4108-154-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4108-157-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4108-159-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4108-200-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4108-162-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4108-140-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4108-170-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4108-138-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4108-166-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4108-197-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4108-174-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4108-145-0x0000000002240000-0x000000000225A000-memory.dmpFilesize
104KB
-
memory/4108-178-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4108-1102-0x0000000004A00000-0x0000000004A10000-memory.dmpFilesize
64KB
-
memory/4108-182-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4108-204-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4108-185-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4368-1121-0x0000000000650000-0x0000000000682000-memory.dmpFilesize
200KB
-
memory/4368-1122-0x0000000005090000-0x00000000050DB000-memory.dmpFilesize
300KB
-
memory/4368-1123-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/4720-193-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/4720-196-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4720-195-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/4720-201-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4720-188-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/4720-190-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/4720-189-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4720-205-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4720-183-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4720-207-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4720-209-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4720-211-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4720-213-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4720-215-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4720-217-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4720-1092-0x0000000005720000-0x0000000005D26000-memory.dmpFilesize
6.0MB
-
memory/4720-1093-0x0000000005190000-0x000000000529A000-memory.dmpFilesize
1.0MB
-
memory/4720-1094-0x00000000052D0000-0x00000000052E2000-memory.dmpFilesize
72KB
-
memory/4720-1095-0x00000000052F0000-0x000000000532E000-memory.dmpFilesize
248KB
-
memory/4720-1096-0x0000000005440000-0x000000000548B000-memory.dmpFilesize
300KB
-
memory/4720-1097-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/4720-1100-0x00000000055D0000-0x0000000005662000-memory.dmpFilesize
584KB
-
memory/4720-1101-0x0000000005670000-0x00000000056D6000-memory.dmpFilesize
408KB
-
memory/4720-179-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4720-175-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4720-1104-0x0000000006380000-0x0000000006542000-memory.dmpFilesize
1.8MB
-
memory/4720-1105-0x0000000006550000-0x0000000006A7C000-memory.dmpFilesize
5.2MB
-
memory/4720-1106-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/4720-1107-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/4720-1108-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/4720-171-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4720-1113-0x0000000004AB0000-0x0000000004AC0000-memory.dmpFilesize
64KB
-
memory/4720-1114-0x0000000006E00000-0x0000000006E76000-memory.dmpFilesize
472KB
-
memory/4720-1115-0x0000000006E90000-0x0000000006EE0000-memory.dmpFilesize
320KB
-
memory/4720-167-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4720-163-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4720-161-0x0000000004A40000-0x0000000004A7F000-memory.dmpFilesize
252KB
-
memory/4720-155-0x0000000004A40000-0x0000000004A84000-memory.dmpFilesize
272KB
-
memory/4720-152-0x0000000002270000-0x00000000022B6000-memory.dmpFilesize
280KB