Analysis
-
max time kernel
142s -
max time network
156s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
07-05-2023 08:45
Static task
static1
Behavioral task
behavioral1
Sample
21bd6e2538c2f7360023458cbf971a10e8e7d39509cde2d44835cadfb65d1cd2.exe
Resource
win10-20230220-en
General
-
Target
21bd6e2538c2f7360023458cbf971a10e8e7d39509cde2d44835cadfb65d1cd2.exe
-
Size
490KB
-
MD5
550d95ff1e82a0deae245d31ad3d1224
-
SHA1
b761830bf8fe9c3d074300bbabce1f67f8c4d3ee
-
SHA256
21bd6e2538c2f7360023458cbf971a10e8e7d39509cde2d44835cadfb65d1cd2
-
SHA512
4fb5be1def5cab4eda1cb61fd0534a4563aa097f03fd5de0d439058916cd65638a534ae9c89a73f091f5aea9b748ad9467fb647a3743d8e9794f3ea4163cad2c
-
SSDEEP
12288:yMr3y90kY+BJ6VEl/EoM3N4nelouTd/OSY9U6Srd+o:pyLtsBIelocXY9Ul
Malware Config
Extracted
redline
lada
217.196.96.101:4132
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Signatures
-
Processes:
o9075240.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" o9075240.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" o9075240.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" o9075240.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" o9075240.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" o9075240.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 7 IoCs
Processes:
z4267768.exeo9075240.exer4396537.exes6720038.exeoneetx.exeoneetx.exeoneetx.exepid process 4436 z4267768.exe 4916 o9075240.exe 2968 r4396537.exe 1800 s6720038.exe 4348 oneetx.exe 4316 oneetx.exe 3344 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4724 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
o9075240.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features o9075240.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" o9075240.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
21bd6e2538c2f7360023458cbf971a10e8e7d39509cde2d44835cadfb65d1cd2.exez4267768.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 21bd6e2538c2f7360023458cbf971a10e8e7d39509cde2d44835cadfb65d1cd2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 21bd6e2538c2f7360023458cbf971a10e8e7d39509cde2d44835cadfb65d1cd2.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z4267768.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z4267768.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
o9075240.exer4396537.exepid process 4916 o9075240.exe 4916 o9075240.exe 2968 r4396537.exe 2968 r4396537.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
o9075240.exer4396537.exedescription pid process Token: SeDebugPrivilege 4916 o9075240.exe Token: SeDebugPrivilege 2968 r4396537.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
s6720038.exepid process 1800 s6720038.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
21bd6e2538c2f7360023458cbf971a10e8e7d39509cde2d44835cadfb65d1cd2.exez4267768.exes6720038.exeoneetx.exedescription pid process target process PID 4052 wrote to memory of 4436 4052 21bd6e2538c2f7360023458cbf971a10e8e7d39509cde2d44835cadfb65d1cd2.exe z4267768.exe PID 4052 wrote to memory of 4436 4052 21bd6e2538c2f7360023458cbf971a10e8e7d39509cde2d44835cadfb65d1cd2.exe z4267768.exe PID 4052 wrote to memory of 4436 4052 21bd6e2538c2f7360023458cbf971a10e8e7d39509cde2d44835cadfb65d1cd2.exe z4267768.exe PID 4436 wrote to memory of 4916 4436 z4267768.exe o9075240.exe PID 4436 wrote to memory of 4916 4436 z4267768.exe o9075240.exe PID 4436 wrote to memory of 4916 4436 z4267768.exe o9075240.exe PID 4436 wrote to memory of 2968 4436 z4267768.exe r4396537.exe PID 4436 wrote to memory of 2968 4436 z4267768.exe r4396537.exe PID 4436 wrote to memory of 2968 4436 z4267768.exe r4396537.exe PID 4052 wrote to memory of 1800 4052 21bd6e2538c2f7360023458cbf971a10e8e7d39509cde2d44835cadfb65d1cd2.exe s6720038.exe PID 4052 wrote to memory of 1800 4052 21bd6e2538c2f7360023458cbf971a10e8e7d39509cde2d44835cadfb65d1cd2.exe s6720038.exe PID 4052 wrote to memory of 1800 4052 21bd6e2538c2f7360023458cbf971a10e8e7d39509cde2d44835cadfb65d1cd2.exe s6720038.exe PID 1800 wrote to memory of 4348 1800 s6720038.exe oneetx.exe PID 1800 wrote to memory of 4348 1800 s6720038.exe oneetx.exe PID 1800 wrote to memory of 4348 1800 s6720038.exe oneetx.exe PID 4348 wrote to memory of 4400 4348 oneetx.exe schtasks.exe PID 4348 wrote to memory of 4400 4348 oneetx.exe schtasks.exe PID 4348 wrote to memory of 4400 4348 oneetx.exe schtasks.exe PID 4348 wrote to memory of 4724 4348 oneetx.exe rundll32.exe PID 4348 wrote to memory of 4724 4348 oneetx.exe rundll32.exe PID 4348 wrote to memory of 4724 4348 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21bd6e2538c2f7360023458cbf971a10e8e7d39509cde2d44835cadfb65d1cd2.exe"C:\Users\Admin\AppData\Local\Temp\21bd6e2538c2f7360023458cbf971a10e8e7d39509cde2d44835cadfb65d1cd2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4267768.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4267768.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o9075240.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o9075240.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4396537.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4396537.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s6720038.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s6720038.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
231KB
MD5c7a0433ecdb1bd54e871203cf7bbdded
SHA143e7b8a65336822b2be62b89862690a0c66386be
SHA256cbbce3f26ea098dffbefcf9ea343d43198e252828aba667e1cab2ab46f81b22b
SHA512dab4e19dd2afac4ac9da92b55cc6337fbc06b5b13af86d0e6a860ae161adcbc6d5289895d5759a19d6ecf80f10950b65d58e73645dd2566bdd1dc59f406fe795
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
231KB
MD5c7a0433ecdb1bd54e871203cf7bbdded
SHA143e7b8a65336822b2be62b89862690a0c66386be
SHA256cbbce3f26ea098dffbefcf9ea343d43198e252828aba667e1cab2ab46f81b22b
SHA512dab4e19dd2afac4ac9da92b55cc6337fbc06b5b13af86d0e6a860ae161adcbc6d5289895d5759a19d6ecf80f10950b65d58e73645dd2566bdd1dc59f406fe795
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
231KB
MD5c7a0433ecdb1bd54e871203cf7bbdded
SHA143e7b8a65336822b2be62b89862690a0c66386be
SHA256cbbce3f26ea098dffbefcf9ea343d43198e252828aba667e1cab2ab46f81b22b
SHA512dab4e19dd2afac4ac9da92b55cc6337fbc06b5b13af86d0e6a860ae161adcbc6d5289895d5759a19d6ecf80f10950b65d58e73645dd2566bdd1dc59f406fe795
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
231KB
MD5c7a0433ecdb1bd54e871203cf7bbdded
SHA143e7b8a65336822b2be62b89862690a0c66386be
SHA256cbbce3f26ea098dffbefcf9ea343d43198e252828aba667e1cab2ab46f81b22b
SHA512dab4e19dd2afac4ac9da92b55cc6337fbc06b5b13af86d0e6a860ae161adcbc6d5289895d5759a19d6ecf80f10950b65d58e73645dd2566bdd1dc59f406fe795
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
231KB
MD5c7a0433ecdb1bd54e871203cf7bbdded
SHA143e7b8a65336822b2be62b89862690a0c66386be
SHA256cbbce3f26ea098dffbefcf9ea343d43198e252828aba667e1cab2ab46f81b22b
SHA512dab4e19dd2afac4ac9da92b55cc6337fbc06b5b13af86d0e6a860ae161adcbc6d5289895d5759a19d6ecf80f10950b65d58e73645dd2566bdd1dc59f406fe795
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s6720038.exeFilesize
231KB
MD5c7a0433ecdb1bd54e871203cf7bbdded
SHA143e7b8a65336822b2be62b89862690a0c66386be
SHA256cbbce3f26ea098dffbefcf9ea343d43198e252828aba667e1cab2ab46f81b22b
SHA512dab4e19dd2afac4ac9da92b55cc6337fbc06b5b13af86d0e6a860ae161adcbc6d5289895d5759a19d6ecf80f10950b65d58e73645dd2566bdd1dc59f406fe795
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s6720038.exeFilesize
231KB
MD5c7a0433ecdb1bd54e871203cf7bbdded
SHA143e7b8a65336822b2be62b89862690a0c66386be
SHA256cbbce3f26ea098dffbefcf9ea343d43198e252828aba667e1cab2ab46f81b22b
SHA512dab4e19dd2afac4ac9da92b55cc6337fbc06b5b13af86d0e6a860ae161adcbc6d5289895d5759a19d6ecf80f10950b65d58e73645dd2566bdd1dc59f406fe795
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4267768.exeFilesize
307KB
MD51564fc0a78f3b10966df0737ad5e4de4
SHA16a63a1628286d942b22d7155846c5f2253c20738
SHA2566eab816e3d0770ef478f40b55724b1041ab8926b9781e40d0ee04e3243bfa55b
SHA512ce7bdd3e5a878f6c16ad5a1663c1ef6a43552844a85fa25d324d0d575b5390582484b900a1b69fc38e6aa601d99d829cc76dddf8ebe6823e7cd7486c3d5825dc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4267768.exeFilesize
307KB
MD51564fc0a78f3b10966df0737ad5e4de4
SHA16a63a1628286d942b22d7155846c5f2253c20738
SHA2566eab816e3d0770ef478f40b55724b1041ab8926b9781e40d0ee04e3243bfa55b
SHA512ce7bdd3e5a878f6c16ad5a1663c1ef6a43552844a85fa25d324d0d575b5390582484b900a1b69fc38e6aa601d99d829cc76dddf8ebe6823e7cd7486c3d5825dc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o9075240.exeFilesize
177KB
MD56127a1b9a3502e4407708736bd410e05
SHA18dae5ade6b47910b253d179669e964843c37410a
SHA256e30da49575329782eea3023239bfba26ca6fb27bdb19fc6580693e948b9472dd
SHA51227e37d127141d7528b70eed37b27e72c849a3842cc35b1e7f6973eefec12ffe37b6ebbc10f6fb74d4f9bf54d83eba83d3e57b9ae9f72e927536e8616d223f6f6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o9075240.exeFilesize
177KB
MD56127a1b9a3502e4407708736bd410e05
SHA18dae5ade6b47910b253d179669e964843c37410a
SHA256e30da49575329782eea3023239bfba26ca6fb27bdb19fc6580693e948b9472dd
SHA51227e37d127141d7528b70eed37b27e72c849a3842cc35b1e7f6973eefec12ffe37b6ebbc10f6fb74d4f9bf54d83eba83d3e57b9ae9f72e927536e8616d223f6f6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4396537.exeFilesize
168KB
MD53a7078b0283f7454e60e7cae52f00e51
SHA121bff53d70769404953025160e2ff18d2119e872
SHA2569e11a7636ebbaacbcff0b90e27f9e47054e468397621b5eb2e961ed7cfdeea34
SHA512943feb86f9609fa27b04eff02c15489c62f499a7c422e2df734bcea8548e2ace2fc1d53dc553e96b851be4f8683be7be4528bbfe5a0a7f5dc744e218e9e4c737
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4396537.exeFilesize
168KB
MD53a7078b0283f7454e60e7cae52f00e51
SHA121bff53d70769404953025160e2ff18d2119e872
SHA2569e11a7636ebbaacbcff0b90e27f9e47054e468397621b5eb2e961ed7cfdeea34
SHA512943feb86f9609fa27b04eff02c15489c62f499a7c422e2df734bcea8548e2ace2fc1d53dc553e96b851be4f8683be7be4528bbfe5a0a7f5dc744e218e9e4c737
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
memory/2968-186-0x0000000004FC0000-0x0000000004FD0000-memory.dmpFilesize
64KB
-
memory/2968-176-0x00000000057E0000-0x0000000005DE6000-memory.dmpFilesize
6.0MB
-
memory/2968-188-0x0000000008980000-0x0000000008EAC000-memory.dmpFilesize
5.2MB
-
memory/2968-187-0x0000000006DD0000-0x0000000006F92000-memory.dmpFilesize
1.8MB
-
memory/2968-185-0x0000000005FF0000-0x0000000006040000-memory.dmpFilesize
320KB
-
memory/2968-184-0x00000000056B0000-0x0000000005716000-memory.dmpFilesize
408KB
-
memory/2968-183-0x0000000005610000-0x00000000056A2000-memory.dmpFilesize
584KB
-
memory/2968-182-0x00000000054F0000-0x0000000005566000-memory.dmpFilesize
472KB
-
memory/2968-181-0x0000000004FC0000-0x0000000004FD0000-memory.dmpFilesize
64KB
-
memory/2968-180-0x0000000005210000-0x000000000525B000-memory.dmpFilesize
300KB
-
memory/2968-179-0x00000000051D0000-0x000000000520E000-memory.dmpFilesize
248KB
-
memory/2968-178-0x0000000004F60000-0x0000000004F72000-memory.dmpFilesize
72KB
-
memory/2968-177-0x00000000052E0000-0x00000000053EA000-memory.dmpFilesize
1.0MB
-
memory/2968-174-0x0000000000720000-0x0000000000750000-memory.dmpFilesize
192KB
-
memory/2968-175-0x0000000002A80000-0x0000000002A86000-memory.dmpFilesize
24KB
-
memory/4916-169-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4916-156-0x0000000002700000-0x0000000002712000-memory.dmpFilesize
72KB
-
memory/4916-152-0x0000000002700000-0x0000000002712000-memory.dmpFilesize
72KB
-
memory/4916-154-0x0000000002700000-0x0000000002712000-memory.dmpFilesize
72KB
-
memory/4916-168-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4916-167-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4916-166-0x0000000002700000-0x0000000002712000-memory.dmpFilesize
72KB
-
memory/4916-164-0x0000000002700000-0x0000000002712000-memory.dmpFilesize
72KB
-
memory/4916-162-0x0000000002700000-0x0000000002712000-memory.dmpFilesize
72KB
-
memory/4916-160-0x0000000002700000-0x0000000002712000-memory.dmpFilesize
72KB
-
memory/4916-148-0x0000000002700000-0x0000000002712000-memory.dmpFilesize
72KB
-
memory/4916-150-0x0000000002700000-0x0000000002712000-memory.dmpFilesize
72KB
-
memory/4916-158-0x0000000002700000-0x0000000002712000-memory.dmpFilesize
72KB
-
memory/4916-146-0x0000000002700000-0x0000000002712000-memory.dmpFilesize
72KB
-
memory/4916-144-0x0000000002700000-0x0000000002712000-memory.dmpFilesize
72KB
-
memory/4916-142-0x0000000002700000-0x0000000002712000-memory.dmpFilesize
72KB
-
memory/4916-140-0x0000000002700000-0x0000000002712000-memory.dmpFilesize
72KB
-
memory/4916-139-0x0000000002700000-0x0000000002712000-memory.dmpFilesize
72KB
-
memory/4916-138-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4916-135-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4916-137-0x0000000002700000-0x0000000002718000-memory.dmpFilesize
96KB
-
memory/4916-136-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4916-134-0x0000000004C00000-0x00000000050FE000-memory.dmpFilesize
5.0MB
-
memory/4916-133-0x0000000002170000-0x000000000218A000-memory.dmpFilesize
104KB