Analysis
-
max time kernel
87s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 18:55
Static task
static1
Behavioral task
behavioral1
Sample
d2dbdf8764748a0970fbcd5f2d0732965b386283da16b82fd88cf6246a2037b1.exe
Resource
win10v2004-20230220-en
General
-
Target
d2dbdf8764748a0970fbcd5f2d0732965b386283da16b82fd88cf6246a2037b1.exe
-
Size
660KB
-
MD5
30a973e8bfc1b33d04d5b504896abc88
-
SHA1
5dcd8ad8c980c9ce20ce0ef389975071083fdbd8
-
SHA256
d2dbdf8764748a0970fbcd5f2d0732965b386283da16b82fd88cf6246a2037b1
-
SHA512
22164296a3272cfba03d83ae76b0f3307433f5ae7a9c002f6bf58120115e52144a851044ffcc333c2d182d6258e796fafb684ebb9ac8a8df1b021daee9a997af
-
SSDEEP
12288:oMrwy90vVmfedUZ7Hq6ehmC+cGsW/GjZSRUWqcl6o/7e0:oy4sfeaq6ehmCe1/GIRUysoDe0
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro9227.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro9227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro9227.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro9227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro9227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro9227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro9227.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2020-163-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-166-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-161-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-170-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-175-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-179-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/4592-189-0x0000000004C50000-0x0000000004C60000-memory.dmp family_redline behavioral1/memory/2020-186-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-192-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-196-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-199-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-202-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-206-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-210-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-214-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-219-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-222-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2020-225-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline -
Executes dropped EXE 5 IoCs
Processes:
un347942.exepro9227.exepro9227.exequ3623.exesi980643.exepid process 5116 un347942.exe 4640 pro9227.exe 4592 pro9227.exe 2020 qu3623.exe 4508 si980643.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro9227.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro9227.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro9227.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
d2dbdf8764748a0970fbcd5f2d0732965b386283da16b82fd88cf6246a2037b1.exeun347942.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d2dbdf8764748a0970fbcd5f2d0732965b386283da16b82fd88cf6246a2037b1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d2dbdf8764748a0970fbcd5f2d0732965b386283da16b82fd88cf6246a2037b1.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un347942.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un347942.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
pro9227.exedescription pid process target process PID 4640 set thread context of 4592 4640 pro9227.exe pro9227.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1320 2020 WerFault.exe qu3623.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro9227.exequ3623.exesi980643.exepid process 4592 pro9227.exe 4592 pro9227.exe 2020 qu3623.exe 2020 qu3623.exe 4508 si980643.exe 4508 si980643.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
qu3623.exepro9227.exesi980643.exedescription pid process Token: SeDebugPrivilege 2020 qu3623.exe Token: SeDebugPrivilege 4592 pro9227.exe Token: SeDebugPrivilege 4508 si980643.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
d2dbdf8764748a0970fbcd5f2d0732965b386283da16b82fd88cf6246a2037b1.exeun347942.exepro9227.exedescription pid process target process PID 4464 wrote to memory of 5116 4464 d2dbdf8764748a0970fbcd5f2d0732965b386283da16b82fd88cf6246a2037b1.exe un347942.exe PID 4464 wrote to memory of 5116 4464 d2dbdf8764748a0970fbcd5f2d0732965b386283da16b82fd88cf6246a2037b1.exe un347942.exe PID 4464 wrote to memory of 5116 4464 d2dbdf8764748a0970fbcd5f2d0732965b386283da16b82fd88cf6246a2037b1.exe un347942.exe PID 5116 wrote to memory of 4640 5116 un347942.exe pro9227.exe PID 5116 wrote to memory of 4640 5116 un347942.exe pro9227.exe PID 5116 wrote to memory of 4640 5116 un347942.exe pro9227.exe PID 4640 wrote to memory of 4592 4640 pro9227.exe pro9227.exe PID 4640 wrote to memory of 4592 4640 pro9227.exe pro9227.exe PID 4640 wrote to memory of 4592 4640 pro9227.exe pro9227.exe PID 4640 wrote to memory of 4592 4640 pro9227.exe pro9227.exe PID 4640 wrote to memory of 4592 4640 pro9227.exe pro9227.exe PID 4640 wrote to memory of 4592 4640 pro9227.exe pro9227.exe PID 4640 wrote to memory of 4592 4640 pro9227.exe pro9227.exe PID 4640 wrote to memory of 4592 4640 pro9227.exe pro9227.exe PID 4640 wrote to memory of 4592 4640 pro9227.exe pro9227.exe PID 5116 wrote to memory of 2020 5116 un347942.exe qu3623.exe PID 5116 wrote to memory of 2020 5116 un347942.exe qu3623.exe PID 5116 wrote to memory of 2020 5116 un347942.exe qu3623.exe PID 4464 wrote to memory of 4508 4464 d2dbdf8764748a0970fbcd5f2d0732965b386283da16b82fd88cf6246a2037b1.exe si980643.exe PID 4464 wrote to memory of 4508 4464 d2dbdf8764748a0970fbcd5f2d0732965b386283da16b82fd88cf6246a2037b1.exe si980643.exe PID 4464 wrote to memory of 4508 4464 d2dbdf8764748a0970fbcd5f2d0732965b386283da16b82fd88cf6246a2037b1.exe si980643.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2dbdf8764748a0970fbcd5f2d0732965b386283da16b82fd88cf6246a2037b1.exe"C:\Users\Admin\AppData\Local\Temp\d2dbdf8764748a0970fbcd5f2d0732965b386283da16b82fd88cf6246a2037b1.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un347942.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un347942.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9227.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9227.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9227.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9227.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3623.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3623.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 15444⤵
- Program crash
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si980643.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si980643.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2020 -ip 20201⤵PID:3744
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si980643.exeFilesize
175KB
MD596e34f2defc17937b999d4986498f248
SHA1f0ce2c3f1ae03f91e423b7a5175f7e8892700314
SHA25607cf88c050d7e87f75cb300b33be845aba6493684f3bf2ce4d36b0caa3920696
SHA5129ab0a4da3884cb9321bda4cbc0ff20ed79281ef7d8f56f8c018cdd5b1865b1984196c0c8751493a7d034cb245f6a47ac4f57f551e25789767e6b08e614a3db4e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si980643.exeFilesize
175KB
MD596e34f2defc17937b999d4986498f248
SHA1f0ce2c3f1ae03f91e423b7a5175f7e8892700314
SHA25607cf88c050d7e87f75cb300b33be845aba6493684f3bf2ce4d36b0caa3920696
SHA5129ab0a4da3884cb9321bda4cbc0ff20ed79281ef7d8f56f8c018cdd5b1865b1984196c0c8751493a7d034cb245f6a47ac4f57f551e25789767e6b08e614a3db4e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un347942.exeFilesize
517KB
MD5883174e657e53d16ae9606b4c6055ac7
SHA10924d5ff3b9306a18c7530c3aba9a38897cf73a4
SHA256cab7d7b2e5a2228b60d7dd6e510a7289274dfe28b92deb8f23d087211fb32707
SHA5129a463e5c000d537477dc7d928d1a6468bb7dae498f85cd7cfcd27709a9dd69d1b52274015dc1ab5f61b7674c2a7511e24cd9f2659541ac7d2b4723bc23c4a369
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un347942.exeFilesize
517KB
MD5883174e657e53d16ae9606b4c6055ac7
SHA10924d5ff3b9306a18c7530c3aba9a38897cf73a4
SHA256cab7d7b2e5a2228b60d7dd6e510a7289274dfe28b92deb8f23d087211fb32707
SHA5129a463e5c000d537477dc7d928d1a6468bb7dae498f85cd7cfcd27709a9dd69d1b52274015dc1ab5f61b7674c2a7511e24cd9f2659541ac7d2b4723bc23c4a369
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9227.exeFilesize
237KB
MD5007dd7bbe6ba98befb62b409865088f9
SHA1849c5465f6543cdfd1d7d861db713218a766d576
SHA256b6fb9479ee00af481a5b72f365dcf52a3e6d6ef6e88dbc381ce5f2df1e302a78
SHA5126804ae5cf73bd84ea11d723276564c012aecd870c6f795f258149956ab1c7ff683c9780d97703677dcf399f226ad2fe6ad51b2cbf5527cab13d2f353b836a1c8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9227.exeFilesize
237KB
MD5007dd7bbe6ba98befb62b409865088f9
SHA1849c5465f6543cdfd1d7d861db713218a766d576
SHA256b6fb9479ee00af481a5b72f365dcf52a3e6d6ef6e88dbc381ce5f2df1e302a78
SHA5126804ae5cf73bd84ea11d723276564c012aecd870c6f795f258149956ab1c7ff683c9780d97703677dcf399f226ad2fe6ad51b2cbf5527cab13d2f353b836a1c8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro9227.exeFilesize
237KB
MD5007dd7bbe6ba98befb62b409865088f9
SHA1849c5465f6543cdfd1d7d861db713218a766d576
SHA256b6fb9479ee00af481a5b72f365dcf52a3e6d6ef6e88dbc381ce5f2df1e302a78
SHA5126804ae5cf73bd84ea11d723276564c012aecd870c6f795f258149956ab1c7ff683c9780d97703677dcf399f226ad2fe6ad51b2cbf5527cab13d2f353b836a1c8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3623.exeFilesize
294KB
MD5da8fcb10c11289f694133c4dbbe2efab
SHA1f3ac3d326ff12b5655aa313d4ccc32b53282b646
SHA256a8dac8a26615ccfd2d1e44f8db9e4e823e94ad7a79eceb5ec1222c74be4d6bad
SHA512571721aefcdd16f7a228e73379abcabaae9078132b31b750398dbcd292e29ee4594a62a02e62263810f1017a17382cdbfd4a0f7d536f69af4b5abffec1799200
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3623.exeFilesize
294KB
MD5da8fcb10c11289f694133c4dbbe2efab
SHA1f3ac3d326ff12b5655aa313d4ccc32b53282b646
SHA256a8dac8a26615ccfd2d1e44f8db9e4e823e94ad7a79eceb5ec1222c74be4d6bad
SHA512571721aefcdd16f7a228e73379abcabaae9078132b31b750398dbcd292e29ee4594a62a02e62263810f1017a17382cdbfd4a0f7d536f69af4b5abffec1799200
-
memory/2020-1103-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/2020-210-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-1122-0x00000000080F0000-0x0000000008140000-memory.dmpFilesize
320KB
-
memory/2020-159-0x0000000002150000-0x000000000219B000-memory.dmpFilesize
300KB
-
memory/2020-160-0x0000000004B60000-0x0000000005104000-memory.dmpFilesize
5.6MB
-
memory/2020-1121-0x0000000004550000-0x00000000045C6000-memory.dmpFilesize
472KB
-
memory/2020-1120-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/2020-163-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-166-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-161-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-1115-0x0000000006690000-0x0000000006BBC000-memory.dmpFilesize
5.2MB
-
memory/2020-170-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-1114-0x00000000064B0000-0x0000000006672000-memory.dmpFilesize
1.8MB
-
memory/2020-175-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-1111-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/2020-179-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-181-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/2020-184-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/2020-1110-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/2020-1108-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/2020-1107-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/2020-186-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-1104-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/2020-1102-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/2020-192-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-196-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-1101-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/2020-1100-0x0000000005210000-0x0000000005828000-memory.dmpFilesize
6.1MB
-
memory/2020-199-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-225-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-202-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-222-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-206-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-219-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2020-214-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/4508-1129-0x0000000000030000-0x0000000000062000-memory.dmpFilesize
200KB
-
memory/4508-1131-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4508-1130-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4592-1109-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/4592-178-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4592-223-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4592-203-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4592-198-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4592-194-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4592-176-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/4592-155-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4592-182-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4592-189-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/4592-187-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/4592-215-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4592-188-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4592-207-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4592-1112-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/4592-1113-0x0000000004C50000-0x0000000004C60000-memory.dmpFilesize
64KB
-
memory/4592-172-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4592-169-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4592-1119-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4592-164-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4592-162-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4592-158-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4592-156-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4592-148-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4592-218-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4592-211-0x0000000002540000-0x0000000002552000-memory.dmpFilesize
72KB
-
memory/4640-150-0x0000000000600000-0x000000000062E000-memory.dmpFilesize
184KB