Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 18:47
Static task
static1
Behavioral task
behavioral1
Sample
f19c06dbaf98aa2f2701b5c8ee5be43667600583741c96957741782f31bc841d.exe
Resource
win10v2004-20230220-en
General
-
Target
f19c06dbaf98aa2f2701b5c8ee5be43667600583741c96957741782f31bc841d.exe
-
Size
660KB
-
MD5
f21f51ee32abe19671d4e02e545ce136
-
SHA1
43fae9d27a4b9f7f4e397dcc1fb289718da60f92
-
SHA256
f19c06dbaf98aa2f2701b5c8ee5be43667600583741c96957741782f31bc841d
-
SHA512
92f1f2d83180c5d2dc9e8fd35d6a3222e50e7494c3492ba1d68d13cd21e02626328cb18ba6421a53df85eab1e69236ec2c3278cf9b76d1197978a5986c78736b
-
SSDEEP
12288:ZMriy90QM5I7iVCIOrjvxYxoiUo7molHb/58oOsZSyr4bWl6MH18:TyTM5IuAHvx2oi3cyrnso8
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro0907.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0907.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0907.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro0907.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0907.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0907.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0907.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/3700-173-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3700-175-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3700-180-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3700-184-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3700-188-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3700-192-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3700-195-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3700-199-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3700-203-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3700-208-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3700-212-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3700-214-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3700-216-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3700-218-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3700-221-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3700-224-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/3700-226-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline -
Executes dropped EXE 5 IoCs
Processes:
un963596.exepro0907.exepro0907.exequ4135.exesi372824.exepid process 4900 un963596.exe 2288 pro0907.exe 1932 pro0907.exe 3700 qu4135.exe 2408 si372824.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro0907.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro0907.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0907.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un963596.exef19c06dbaf98aa2f2701b5c8ee5be43667600583741c96957741782f31bc841d.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un963596.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un963596.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f19c06dbaf98aa2f2701b5c8ee5be43667600583741c96957741782f31bc841d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f19c06dbaf98aa2f2701b5c8ee5be43667600583741c96957741782f31bc841d.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
pro0907.exedescription pid process target process PID 2288 set thread context of 1932 2288 pro0907.exe pro0907.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1588 3700 WerFault.exe qu4135.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro0907.exequ4135.exesi372824.exepid process 1932 pro0907.exe 1932 pro0907.exe 3700 qu4135.exe 3700 qu4135.exe 2408 si372824.exe 2408 si372824.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro0907.exequ4135.exesi372824.exedescription pid process Token: SeDebugPrivilege 1932 pro0907.exe Token: SeDebugPrivilege 3700 qu4135.exe Token: SeDebugPrivilege 2408 si372824.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
f19c06dbaf98aa2f2701b5c8ee5be43667600583741c96957741782f31bc841d.exeun963596.exepro0907.exedescription pid process target process PID 1916 wrote to memory of 4900 1916 f19c06dbaf98aa2f2701b5c8ee5be43667600583741c96957741782f31bc841d.exe un963596.exe PID 1916 wrote to memory of 4900 1916 f19c06dbaf98aa2f2701b5c8ee5be43667600583741c96957741782f31bc841d.exe un963596.exe PID 1916 wrote to memory of 4900 1916 f19c06dbaf98aa2f2701b5c8ee5be43667600583741c96957741782f31bc841d.exe un963596.exe PID 4900 wrote to memory of 2288 4900 un963596.exe pro0907.exe PID 4900 wrote to memory of 2288 4900 un963596.exe pro0907.exe PID 4900 wrote to memory of 2288 4900 un963596.exe pro0907.exe PID 2288 wrote to memory of 1932 2288 pro0907.exe pro0907.exe PID 2288 wrote to memory of 1932 2288 pro0907.exe pro0907.exe PID 2288 wrote to memory of 1932 2288 pro0907.exe pro0907.exe PID 2288 wrote to memory of 1932 2288 pro0907.exe pro0907.exe PID 2288 wrote to memory of 1932 2288 pro0907.exe pro0907.exe PID 2288 wrote to memory of 1932 2288 pro0907.exe pro0907.exe PID 2288 wrote to memory of 1932 2288 pro0907.exe pro0907.exe PID 2288 wrote to memory of 1932 2288 pro0907.exe pro0907.exe PID 2288 wrote to memory of 1932 2288 pro0907.exe pro0907.exe PID 4900 wrote to memory of 3700 4900 un963596.exe qu4135.exe PID 4900 wrote to memory of 3700 4900 un963596.exe qu4135.exe PID 4900 wrote to memory of 3700 4900 un963596.exe qu4135.exe PID 1916 wrote to memory of 2408 1916 f19c06dbaf98aa2f2701b5c8ee5be43667600583741c96957741782f31bc841d.exe si372824.exe PID 1916 wrote to memory of 2408 1916 f19c06dbaf98aa2f2701b5c8ee5be43667600583741c96957741782f31bc841d.exe si372824.exe PID 1916 wrote to memory of 2408 1916 f19c06dbaf98aa2f2701b5c8ee5be43667600583741c96957741782f31bc841d.exe si372824.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f19c06dbaf98aa2f2701b5c8ee5be43667600583741c96957741782f31bc841d.exe"C:\Users\Admin\AppData\Local\Temp\f19c06dbaf98aa2f2701b5c8ee5be43667600583741c96957741782f31bc841d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un963596.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un963596.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0907.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0907.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0907.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0907.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4135.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4135.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3700 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 18004⤵
- Program crash
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si372824.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si372824.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3700 -ip 37001⤵PID:3980
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si372824.exeFilesize
175KB
MD5e55fffc071d8f2b1b3ae9beb34c5f96d
SHA140a1217e70bfb489d00e7cb21f63b7297910f0ee
SHA2565b0dfe374db8df276e0a2efbcbdf72530de3a53fb263a0b025f837be7969ee0a
SHA51285390b40cb5badc0afd8038b3e47e0060be8960e078171c79017cc286c93b8e62dd4fe8050e1edc58efd23a6839f6204aa6aa7055ba658b853eebe6ae724b73f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si372824.exeFilesize
175KB
MD5e55fffc071d8f2b1b3ae9beb34c5f96d
SHA140a1217e70bfb489d00e7cb21f63b7297910f0ee
SHA2565b0dfe374db8df276e0a2efbcbdf72530de3a53fb263a0b025f837be7969ee0a
SHA51285390b40cb5badc0afd8038b3e47e0060be8960e078171c79017cc286c93b8e62dd4fe8050e1edc58efd23a6839f6204aa6aa7055ba658b853eebe6ae724b73f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un963596.exeFilesize
517KB
MD51ba9004e29aad71a5be20aa59703a616
SHA17de44b83ceb4184aa4d9e1b76191af48a09719b9
SHA2562b194064612f480f1b82390fcb40683a4ae3c7e6e27ad6951dfde09c2e773a5f
SHA512d7f959dc52f5d82517d0a34b8f01dc8316da44dd8c2b40fcef72eb312899bfc59e7905b022af5c9d437b36b69c07587956e1991348e287fc1661dc6d158c1481
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un963596.exeFilesize
517KB
MD51ba9004e29aad71a5be20aa59703a616
SHA17de44b83ceb4184aa4d9e1b76191af48a09719b9
SHA2562b194064612f480f1b82390fcb40683a4ae3c7e6e27ad6951dfde09c2e773a5f
SHA512d7f959dc52f5d82517d0a34b8f01dc8316da44dd8c2b40fcef72eb312899bfc59e7905b022af5c9d437b36b69c07587956e1991348e287fc1661dc6d158c1481
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0907.exeFilesize
237KB
MD545bf116870a82c229f62fccbd03fb01c
SHA14a7d41f024d463c83b2b43a3a778731fa9e70fa3
SHA256dba4af674a887cdfd63e719c996032a28685be3befbe43cd7900e474bffb218e
SHA512a151ef18dfc2eac6381564db7f4722ce4911d47f8e1d13c9e42092af4e93cff4c7d357e41392ab101f9d04fea39fdad1839682d51f94524cc1cf7f71b9f0b8cc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0907.exeFilesize
237KB
MD545bf116870a82c229f62fccbd03fb01c
SHA14a7d41f024d463c83b2b43a3a778731fa9e70fa3
SHA256dba4af674a887cdfd63e719c996032a28685be3befbe43cd7900e474bffb218e
SHA512a151ef18dfc2eac6381564db7f4722ce4911d47f8e1d13c9e42092af4e93cff4c7d357e41392ab101f9d04fea39fdad1839682d51f94524cc1cf7f71b9f0b8cc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0907.exeFilesize
237KB
MD545bf116870a82c229f62fccbd03fb01c
SHA14a7d41f024d463c83b2b43a3a778731fa9e70fa3
SHA256dba4af674a887cdfd63e719c996032a28685be3befbe43cd7900e474bffb218e
SHA512a151ef18dfc2eac6381564db7f4722ce4911d47f8e1d13c9e42092af4e93cff4c7d357e41392ab101f9d04fea39fdad1839682d51f94524cc1cf7f71b9f0b8cc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4135.exeFilesize
294KB
MD59a71198f051c4bf397ede9e5c4a0916e
SHA1dc3d4a082237747c2c536b8fa0049043d0f15b77
SHA256492637e41052652b9a531c6897b23cb8dcd9325d6a1dd08effce6a51b3638fcf
SHA51252d3035e082c00b0a79a5e36e26d272d4a2d91a3461f4fa8c9b1c2366637c6ab508df6f17e154c954373e9e3f2122fdf5ee8e528e232fcdebf4bfb5bb69ad2cd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4135.exeFilesize
294KB
MD59a71198f051c4bf397ede9e5c4a0916e
SHA1dc3d4a082237747c2c536b8fa0049043d0f15b77
SHA256492637e41052652b9a531c6897b23cb8dcd9325d6a1dd08effce6a51b3638fcf
SHA51252d3035e082c00b0a79a5e36e26d272d4a2d91a3461f4fa8c9b1c2366637c6ab508df6f17e154c954373e9e3f2122fdf5ee8e528e232fcdebf4bfb5bb69ad2cd
-
memory/1932-166-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/1932-187-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/1932-158-0x0000000004A90000-0x0000000005034000-memory.dmpFilesize
5.6MB
-
memory/1932-159-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1932-161-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/1932-162-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1932-160-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1932-163-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/1932-164-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1932-207-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/1932-204-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/1932-170-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/1932-200-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/1932-150-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1932-172-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/1932-211-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/1932-176-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/1932-1116-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1932-179-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/1932-1112-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1932-183-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/1932-1111-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1932-152-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1932-1108-0x0000000004A80000-0x0000000004A90000-memory.dmpFilesize
64KB
-
memory/1932-191-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/1932-196-0x00000000023E0000-0x00000000023F2000-memory.dmpFilesize
72KB
-
memory/1932-148-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2288-151-0x0000000000800000-0x000000000082E000-memory.dmpFilesize
184KB
-
memory/2408-1128-0x00000000007A0000-0x00000000007D2000-memory.dmpFilesize
200KB
-
memory/2408-1129-0x0000000005110000-0x0000000005120000-memory.dmpFilesize
64KB
-
memory/3700-195-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3700-208-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3700-203-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3700-212-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3700-214-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3700-199-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3700-216-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3700-218-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3700-221-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3700-220-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/3700-224-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3700-222-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/3700-226-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3700-1101-0x0000000005290000-0x00000000058A8000-memory.dmpFilesize
6.1MB
-
memory/3700-1102-0x00000000058B0000-0x00000000059BA000-memory.dmpFilesize
1.0MB
-
memory/3700-1103-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/3700-1104-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/3700-1105-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/3700-192-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3700-1109-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/3700-1110-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/3700-188-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3700-184-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3700-180-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3700-1117-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/3700-1118-0x00000000064B0000-0x0000000006672000-memory.dmpFilesize
1.8MB
-
memory/3700-1119-0x0000000006690000-0x0000000006BBC000-memory.dmpFilesize
5.2MB
-
memory/3700-1120-0x0000000006DF0000-0x0000000006E66000-memory.dmpFilesize
472KB
-
memory/3700-1121-0x0000000006E80000-0x0000000006ED0000-memory.dmpFilesize
320KB
-
memory/3700-1122-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/3700-175-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3700-173-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/3700-169-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/3700-167-0x0000000002020000-0x000000000206B000-memory.dmpFilesize
300KB