Analysis
-
max time kernel
143s -
max time network
108s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
09-04-2023 20:16
Static task
static1
General
-
Target
f43edcef1a5f1968ba5cc538078da37b7cc913e8992d692aa2d83e2a4af9b175.exe
-
Size
924KB
-
MD5
8ce7b2c4d83e36af9e187fdec3d30d9e
-
SHA1
a37012532eb3a4321f91dca57a13bd12c59664c3
-
SHA256
f43edcef1a5f1968ba5cc538078da37b7cc913e8992d692aa2d83e2a4af9b175
-
SHA512
b8bee748cf749ce969f9192e1ddeec6ac606d0d3f8da106a50c05dcc6d3a0e0d9bfd4d1e0e24fa0cd5dc06c28b8a591628c52e5307db444d239a0e6a02f73e81
-
SSDEEP
24576:VyJ1GDH+kocM06dmmd4C2lIyZwWDxhKp:wJcyk5MXPdX29wWLK
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pr893454.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr893454.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr893454.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr893454.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr893454.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr893454.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/4828-183-0x0000000002200000-0x0000000002246000-memory.dmp family_redline behavioral1/memory/4828-184-0x00000000023C0000-0x0000000002404000-memory.dmp family_redline behavioral1/memory/4828-185-0x00000000023C0000-0x00000000023FF000-memory.dmp family_redline behavioral1/memory/4828-186-0x00000000023C0000-0x00000000023FF000-memory.dmp family_redline behavioral1/memory/4828-188-0x00000000023C0000-0x00000000023FF000-memory.dmp family_redline behavioral1/memory/4828-190-0x00000000023C0000-0x00000000023FF000-memory.dmp family_redline behavioral1/memory/4828-192-0x00000000023C0000-0x00000000023FF000-memory.dmp family_redline behavioral1/memory/4828-194-0x00000000023C0000-0x00000000023FF000-memory.dmp family_redline behavioral1/memory/4828-196-0x00000000023C0000-0x00000000023FF000-memory.dmp family_redline behavioral1/memory/4828-198-0x00000000023C0000-0x00000000023FF000-memory.dmp family_redline behavioral1/memory/4828-200-0x00000000023C0000-0x00000000023FF000-memory.dmp family_redline behavioral1/memory/4828-202-0x00000000023C0000-0x00000000023FF000-memory.dmp family_redline behavioral1/memory/4828-204-0x00000000023C0000-0x00000000023FF000-memory.dmp family_redline behavioral1/memory/4828-206-0x00000000023C0000-0x00000000023FF000-memory.dmp family_redline behavioral1/memory/4828-208-0x00000000023C0000-0x00000000023FF000-memory.dmp family_redline behavioral1/memory/4828-210-0x00000000023C0000-0x00000000023FF000-memory.dmp family_redline behavioral1/memory/4828-212-0x00000000023C0000-0x00000000023FF000-memory.dmp family_redline behavioral1/memory/4828-214-0x00000000023C0000-0x00000000023FF000-memory.dmp family_redline behavioral1/memory/4828-216-0x00000000023C0000-0x00000000023FF000-memory.dmp family_redline behavioral1/memory/4828-218-0x00000000023C0000-0x00000000023FF000-memory.dmp family_redline behavioral1/memory/4828-395-0x0000000004C60000-0x0000000004C70000-memory.dmp family_redline -
Executes dropped EXE 6 IoCs
Processes:
un979877.exeun129812.exepr893454.exequ694301.exerk224550.exesi241991.exepid process 988 un979877.exe 4496 un129812.exe 4992 pr893454.exe 4828 qu694301.exe 1528 rk224550.exe 4816 si241991.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pr893454.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr893454.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr893454.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
f43edcef1a5f1968ba5cc538078da37b7cc913e8992d692aa2d83e2a4af9b175.exeun979877.exeun129812.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f43edcef1a5f1968ba5cc538078da37b7cc913e8992d692aa2d83e2a4af9b175.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f43edcef1a5f1968ba5cc538078da37b7cc913e8992d692aa2d83e2a4af9b175.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un979877.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un979877.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un129812.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un129812.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3856 4816 WerFault.exe si241991.exe 2644 4816 WerFault.exe si241991.exe 3952 4816 WerFault.exe si241991.exe 5008 4816 WerFault.exe si241991.exe 3736 4816 WerFault.exe si241991.exe 3784 4816 WerFault.exe si241991.exe 4676 4816 WerFault.exe si241991.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pr893454.exequ694301.exerk224550.exepid process 4992 pr893454.exe 4992 pr893454.exe 4828 qu694301.exe 4828 qu694301.exe 1528 rk224550.exe 1528 rk224550.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pr893454.exequ694301.exerk224550.exedescription pid process Token: SeDebugPrivilege 4992 pr893454.exe Token: SeDebugPrivilege 4828 qu694301.exe Token: SeDebugPrivilege 1528 rk224550.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
f43edcef1a5f1968ba5cc538078da37b7cc913e8992d692aa2d83e2a4af9b175.exeun979877.exeun129812.exedescription pid process target process PID 3668 wrote to memory of 988 3668 f43edcef1a5f1968ba5cc538078da37b7cc913e8992d692aa2d83e2a4af9b175.exe un979877.exe PID 3668 wrote to memory of 988 3668 f43edcef1a5f1968ba5cc538078da37b7cc913e8992d692aa2d83e2a4af9b175.exe un979877.exe PID 3668 wrote to memory of 988 3668 f43edcef1a5f1968ba5cc538078da37b7cc913e8992d692aa2d83e2a4af9b175.exe un979877.exe PID 988 wrote to memory of 4496 988 un979877.exe un129812.exe PID 988 wrote to memory of 4496 988 un979877.exe un129812.exe PID 988 wrote to memory of 4496 988 un979877.exe un129812.exe PID 4496 wrote to memory of 4992 4496 un129812.exe pr893454.exe PID 4496 wrote to memory of 4992 4496 un129812.exe pr893454.exe PID 4496 wrote to memory of 4992 4496 un129812.exe pr893454.exe PID 4496 wrote to memory of 4828 4496 un129812.exe qu694301.exe PID 4496 wrote to memory of 4828 4496 un129812.exe qu694301.exe PID 4496 wrote to memory of 4828 4496 un129812.exe qu694301.exe PID 988 wrote to memory of 1528 988 un979877.exe rk224550.exe PID 988 wrote to memory of 1528 988 un979877.exe rk224550.exe PID 988 wrote to memory of 1528 988 un979877.exe rk224550.exe PID 3668 wrote to memory of 4816 3668 f43edcef1a5f1968ba5cc538078da37b7cc913e8992d692aa2d83e2a4af9b175.exe si241991.exe PID 3668 wrote to memory of 4816 3668 f43edcef1a5f1968ba5cc538078da37b7cc913e8992d692aa2d83e2a4af9b175.exe si241991.exe PID 3668 wrote to memory of 4816 3668 f43edcef1a5f1968ba5cc538078da37b7cc913e8992d692aa2d83e2a4af9b175.exe si241991.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f43edcef1a5f1968ba5cc538078da37b7cc913e8992d692aa2d83e2a4af9b175.exe"C:\Users\Admin\AppData\Local\Temp\f43edcef1a5f1968ba5cc538078da37b7cc913e8992d692aa2d83e2a4af9b175.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un979877.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un979877.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un129812.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un129812.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr893454.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr893454.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu694301.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu694301.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk224550.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk224550.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si241991.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si241991.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 6163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 8363⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 8163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 8843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 9003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 10723⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si241991.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si241991.exeFilesize
226KB
MD5d8c3f20eef4f33bd865589859629bf41
SHA13590244f8774ff4ac4e3c54cdbb149363fd9dc7d
SHA2562883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f
SHA51252b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un979877.exeFilesize
661KB
MD59872d439a2b6a4e659a78739e564f88c
SHA181f4501d3472860b5e009e96e428538687b2e6c1
SHA25673224c24b29548ff1a47df8108f4393923ef44ca2f260a470de6b07a9f918a6a
SHA5124bfa3294c04d9d4f4479f80429b3aaa8810ae550b0a23df60caa116d0f0768b91ed345d64a8e1030671d79a062db1e3c3efad58057450257e1a2ace590212272
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un979877.exeFilesize
661KB
MD59872d439a2b6a4e659a78739e564f88c
SHA181f4501d3472860b5e009e96e428538687b2e6c1
SHA25673224c24b29548ff1a47df8108f4393923ef44ca2f260a470de6b07a9f918a6a
SHA5124bfa3294c04d9d4f4479f80429b3aaa8810ae550b0a23df60caa116d0f0768b91ed345d64a8e1030671d79a062db1e3c3efad58057450257e1a2ace590212272
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk224550.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk224550.exeFilesize
175KB
MD5bb6d43fa4ebafe62b98ec4dea4ff49d9
SHA1d8188e664ac977f59d3ec26589e3cf67b1fab23b
SHA2561d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89
SHA512679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un129812.exeFilesize
519KB
MD55f47d507b97c890a207470c92f83d8aa
SHA10718951d2ac648caeaae3d8fdce0dd58ff48f53f
SHA25622caa96151d92232a4dcbda34e2ed37f4fb622518a8100d23b33915c9b5a95ad
SHA51201d62dff903fda0f592227ff647c429d7fa849196ac95fe7e6b2e8a6db520cb7a98db6422d93564782fbfdfcf0e442e73d6e87734da5657d56e8e2dfb5836a88
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un129812.exeFilesize
519KB
MD55f47d507b97c890a207470c92f83d8aa
SHA10718951d2ac648caeaae3d8fdce0dd58ff48f53f
SHA25622caa96151d92232a4dcbda34e2ed37f4fb622518a8100d23b33915c9b5a95ad
SHA51201d62dff903fda0f592227ff647c429d7fa849196ac95fe7e6b2e8a6db520cb7a98db6422d93564782fbfdfcf0e442e73d6e87734da5657d56e8e2dfb5836a88
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr893454.exeFilesize
235KB
MD5ec87ae5a8ea77222b1abac50e03474d1
SHA1cae18a97a8ca74144b68a40a8142c47b6a1c15f0
SHA2565031ebfb23c7c359d79e190c2aa61b0306771fd915d0d9a7eba6495be0c7447e
SHA512a5c03380b70f8bf8e729a992dd6afacb04fb928bc16b5a98ba71355879b9af43772873d6001c3dd16251b95a4ba430852639c3fa3aa46db69bd9d56d099db77f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr893454.exeFilesize
235KB
MD5ec87ae5a8ea77222b1abac50e03474d1
SHA1cae18a97a8ca74144b68a40a8142c47b6a1c15f0
SHA2565031ebfb23c7c359d79e190c2aa61b0306771fd915d0d9a7eba6495be0c7447e
SHA512a5c03380b70f8bf8e729a992dd6afacb04fb928bc16b5a98ba71355879b9af43772873d6001c3dd16251b95a4ba430852639c3fa3aa46db69bd9d56d099db77f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu694301.exeFilesize
292KB
MD5e2cdcedc37aa142cc98d88e1fa3a8aef
SHA1fe0ab69fec3694c664f046d6d1976c59e21226e4
SHA25615a89665194c3d0daa580d6e8838df1e0f308df1a01b3466954633945c5f2e23
SHA5120eede9044bf2117556117b07af1d997cf7888e630399ac79de19e1ff0acdeee520be3a9dff97b4d866e4492c2314ac92aa1b303a5815160453dada3d495a1797
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu694301.exeFilesize
292KB
MD5e2cdcedc37aa142cc98d88e1fa3a8aef
SHA1fe0ab69fec3694c664f046d6d1976c59e21226e4
SHA25615a89665194c3d0daa580d6e8838df1e0f308df1a01b3466954633945c5f2e23
SHA5120eede9044bf2117556117b07af1d997cf7888e630399ac79de19e1ff0acdeee520be3a9dff97b4d866e4492c2314ac92aa1b303a5815160453dada3d495a1797
-
memory/1528-1119-0x00000000053C0000-0x00000000053D0000-memory.dmpFilesize
64KB
-
memory/1528-1118-0x0000000005370000-0x00000000053BB000-memory.dmpFilesize
300KB
-
memory/1528-1117-0x0000000000AF0000-0x0000000000B22000-memory.dmpFilesize
200KB
-
memory/4816-1125-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB
-
memory/4828-1099-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/4828-210-0x00000000023C0000-0x00000000023FF000-memory.dmpFilesize
252KB
-
memory/4828-1111-0x0000000006EA0000-0x0000000006EF0000-memory.dmpFilesize
320KB
-
memory/4828-1110-0x0000000006E20000-0x0000000006E96000-memory.dmpFilesize
472KB
-
memory/4828-1109-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/4828-1108-0x00000000067B0000-0x0000000006CDC000-memory.dmpFilesize
5.2MB
-
memory/4828-1107-0x00000000065C0000-0x0000000006782000-memory.dmpFilesize
1.8MB
-
memory/4828-1106-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/4828-1105-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/4828-1104-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/4828-1102-0x0000000005670000-0x00000000056D6000-memory.dmpFilesize
408KB
-
memory/4828-1101-0x00000000055D0000-0x0000000005662000-memory.dmpFilesize
584KB
-
memory/4828-1100-0x0000000005440000-0x000000000548B000-memory.dmpFilesize
300KB
-
memory/4828-1098-0x00000000052F0000-0x000000000532E000-memory.dmpFilesize
248KB
-
memory/4828-1097-0x00000000052D0000-0x00000000052E2000-memory.dmpFilesize
72KB
-
memory/4828-1096-0x0000000005190000-0x000000000529A000-memory.dmpFilesize
1.0MB
-
memory/4828-183-0x0000000002200000-0x0000000002246000-memory.dmpFilesize
280KB
-
memory/4828-184-0x00000000023C0000-0x0000000002404000-memory.dmpFilesize
272KB
-
memory/4828-185-0x00000000023C0000-0x00000000023FF000-memory.dmpFilesize
252KB
-
memory/4828-186-0x00000000023C0000-0x00000000023FF000-memory.dmpFilesize
252KB
-
memory/4828-188-0x00000000023C0000-0x00000000023FF000-memory.dmpFilesize
252KB
-
memory/4828-190-0x00000000023C0000-0x00000000023FF000-memory.dmpFilesize
252KB
-
memory/4828-192-0x00000000023C0000-0x00000000023FF000-memory.dmpFilesize
252KB
-
memory/4828-194-0x00000000023C0000-0x00000000023FF000-memory.dmpFilesize
252KB
-
memory/4828-196-0x00000000023C0000-0x00000000023FF000-memory.dmpFilesize
252KB
-
memory/4828-198-0x00000000023C0000-0x00000000023FF000-memory.dmpFilesize
252KB
-
memory/4828-200-0x00000000023C0000-0x00000000023FF000-memory.dmpFilesize
252KB
-
memory/4828-202-0x00000000023C0000-0x00000000023FF000-memory.dmpFilesize
252KB
-
memory/4828-204-0x00000000023C0000-0x00000000023FF000-memory.dmpFilesize
252KB
-
memory/4828-206-0x00000000023C0000-0x00000000023FF000-memory.dmpFilesize
252KB
-
memory/4828-208-0x00000000023C0000-0x00000000023FF000-memory.dmpFilesize
252KB
-
memory/4828-1095-0x0000000005780000-0x0000000005D86000-memory.dmpFilesize
6.0MB
-
memory/4828-212-0x00000000023C0000-0x00000000023FF000-memory.dmpFilesize
252KB
-
memory/4828-214-0x00000000023C0000-0x00000000023FF000-memory.dmpFilesize
252KB
-
memory/4828-216-0x00000000023C0000-0x00000000023FF000-memory.dmpFilesize
252KB
-
memory/4828-218-0x00000000023C0000-0x00000000023FF000-memory.dmpFilesize
252KB
-
memory/4828-393-0x00000000004C0000-0x000000000050B000-memory.dmpFilesize
300KB
-
memory/4828-395-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/4828-397-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/4828-399-0x0000000004C60000-0x0000000004C70000-memory.dmpFilesize
64KB
-
memory/4992-164-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/4992-143-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/4992-154-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/4992-178-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/4992-150-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/4992-176-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/4992-175-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/4992-174-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/4992-172-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/4992-170-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/4992-141-0x00000000007E0000-0x00000000007FA000-memory.dmpFilesize
104KB
-
memory/4992-152-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/4992-160-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/4992-162-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/4992-156-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/4992-158-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/4992-147-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/4992-148-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/4992-146-0x00000000023B0000-0x00000000023C8000-memory.dmpFilesize
96KB
-
memory/4992-145-0x0000000004BD0000-0x00000000050CE000-memory.dmpFilesize
5.0MB
-
memory/4992-144-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/4992-166-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/4992-142-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/4992-168-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB