Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
21-06-2023 06:14
Static task
static1
Behavioral task
behavioral1
Sample
199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7.exe
Resource
win10-20230220-en
General
-
Target
199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7.exe
-
Size
1000KB
-
MD5
83ef65a424e1baf1d7b861acec54ecb4
-
SHA1
9273c6cd941d801626ac0f35ae687cab0055e208
-
SHA256
199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7
-
SHA512
55b9478928ca32d400eab67aec7c1c337a47d188a04fa89c989fc35e5ba107776e29b1d03bceed6ffd193515e6f84430b1256c1b2476799858038df6ca6d4085
-
SSDEEP
12288:xCAtA8KIiEVqjmG09laoIqLtTmAGiDd4CT7s6Z46E2W0aBjbaxZAj0VQTj7nO62z:htAIi0/9EoTJmIDKgWWa5axZfVQTl
Malware Config
Extracted
redline
top
83.97.73.124:53
-
auth_value
053e5ccc53982413753b68419138b23a
Extracted
redline
Lyla1906
94.130.176.65:13400
-
auth_value
5c6d9077ba684b0add99731765896e7e
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
NJNI8BHDOF558LP.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ NJNI8BHDOF558LP.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
NJNI8BHDOF558LP.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion NJNI8BHDOF558LP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion NJNI8BHDOF558LP.exe -
Executes dropped EXE 4 IoCs
Processes:
Q5OM1I3G3K5C7FI.exe59EMD238DBA2HMI.exeNJNI8BHDOF558LP.exePPJI4HIFIFFMIQG.exepid process 4796 Q5OM1I3G3K5C7FI.exe 944 59EMD238DBA2HMI.exe 2588 NJNI8BHDOF558LP.exe 4788 PPJI4HIFIFFMIQG.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\NJNI8BHDOF558LP.exe themida behavioral1/memory/2588-169-0x0000000000870000-0x0000000000EEC000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\NJNI8BHDOF558LP.exe themida -
Unexpected DNS network traffic destination 16 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 83.97.73.124 Destination IP 83.97.73.124 Destination IP 83.97.73.124 Destination IP 83.97.73.124 Destination IP 83.97.73.124 Destination IP 83.97.73.124 Destination IP 83.97.73.124 Destination IP 83.97.73.124 Destination IP 83.97.73.124 Destination IP 83.97.73.124 Destination IP 83.97.73.124 Destination IP 83.97.73.124 Destination IP 83.97.73.124 Destination IP 83.97.73.124 Destination IP 83.97.73.124 Destination IP 83.97.73.124 -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NJNI8BHDOF558LP.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam = "C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA\\dllhost.exe" NJNI8BHDOF558LP.exe -
Processes:
NJNI8BHDOF558LP.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA NJNI8BHDOF558LP.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
NJNI8BHDOF558LP.exepid process 2588 NJNI8BHDOF558LP.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7.exeQ5OM1I3G3K5C7FI.exe59EMD238DBA2HMI.exedescription pid process target process PID 2908 set thread context of 4212 2908 199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7.exe RegSvcs.exe PID 4796 set thread context of 5068 4796 Q5OM1I3G3K5C7FI.exe RegSvcs.exe PID 944 set thread context of 4320 944 59EMD238DBA2HMI.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
PPJI4HIFIFFMIQG.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch PPJI4HIFIFFMIQG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" PPJI4HIFIFFMIQG.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
NJNI8BHDOF558LP.exeRegSvcs.exeRegSvcs.exepid process 2588 NJNI8BHDOF558LP.exe 2588 NJNI8BHDOF558LP.exe 4320 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 4320 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe 5068 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7.exeNJNI8BHDOF558LP.exeQ5OM1I3G3K5C7FI.exe59EMD238DBA2HMI.exeRegSvcs.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2908 199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7.exe Token: SeDebugPrivilege 2588 NJNI8BHDOF558LP.exe Token: SeDebugPrivilege 4796 Q5OM1I3G3K5C7FI.exe Token: SeDebugPrivilege 944 59EMD238DBA2HMI.exe Token: SeDebugPrivilege 4320 RegSvcs.exe Token: SeDebugPrivilege 5068 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
PPJI4HIFIFFMIQG.exepid process 4788 PPJI4HIFIFFMIQG.exe 4788 PPJI4HIFIFFMIQG.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7.exeRegSvcs.exeQ5OM1I3G3K5C7FI.exe59EMD238DBA2HMI.exedescription pid process target process PID 2908 wrote to memory of 4212 2908 199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7.exe RegSvcs.exe PID 2908 wrote to memory of 4212 2908 199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7.exe RegSvcs.exe PID 2908 wrote to memory of 4212 2908 199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7.exe RegSvcs.exe PID 2908 wrote to memory of 4212 2908 199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7.exe RegSvcs.exe PID 2908 wrote to memory of 4212 2908 199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7.exe RegSvcs.exe PID 2908 wrote to memory of 4212 2908 199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7.exe RegSvcs.exe PID 2908 wrote to memory of 4212 2908 199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7.exe RegSvcs.exe PID 2908 wrote to memory of 4212 2908 199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7.exe RegSvcs.exe PID 2908 wrote to memory of 4212 2908 199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7.exe RegSvcs.exe PID 4212 wrote to memory of 4796 4212 RegSvcs.exe Q5OM1I3G3K5C7FI.exe PID 4212 wrote to memory of 4796 4212 RegSvcs.exe Q5OM1I3G3K5C7FI.exe PID 4212 wrote to memory of 4796 4212 RegSvcs.exe Q5OM1I3G3K5C7FI.exe PID 4212 wrote to memory of 944 4212 RegSvcs.exe 59EMD238DBA2HMI.exe PID 4212 wrote to memory of 944 4212 RegSvcs.exe 59EMD238DBA2HMI.exe PID 4212 wrote to memory of 944 4212 RegSvcs.exe 59EMD238DBA2HMI.exe PID 4212 wrote to memory of 2588 4212 RegSvcs.exe NJNI8BHDOF558LP.exe PID 4212 wrote to memory of 2588 4212 RegSvcs.exe NJNI8BHDOF558LP.exe PID 4212 wrote to memory of 2588 4212 RegSvcs.exe NJNI8BHDOF558LP.exe PID 4212 wrote to memory of 4788 4212 RegSvcs.exe PPJI4HIFIFFMIQG.exe PID 4212 wrote to memory of 4788 4212 RegSvcs.exe PPJI4HIFIFFMIQG.exe PID 4796 wrote to memory of 5068 4796 Q5OM1I3G3K5C7FI.exe RegSvcs.exe PID 4796 wrote to memory of 5068 4796 Q5OM1I3G3K5C7FI.exe RegSvcs.exe PID 4796 wrote to memory of 5068 4796 Q5OM1I3G3K5C7FI.exe RegSvcs.exe PID 4796 wrote to memory of 5068 4796 Q5OM1I3G3K5C7FI.exe RegSvcs.exe PID 4796 wrote to memory of 5068 4796 Q5OM1I3G3K5C7FI.exe RegSvcs.exe PID 4796 wrote to memory of 5068 4796 Q5OM1I3G3K5C7FI.exe RegSvcs.exe PID 4796 wrote to memory of 5068 4796 Q5OM1I3G3K5C7FI.exe RegSvcs.exe PID 4796 wrote to memory of 5068 4796 Q5OM1I3G3K5C7FI.exe RegSvcs.exe PID 944 wrote to memory of 4320 944 59EMD238DBA2HMI.exe RegSvcs.exe PID 944 wrote to memory of 4320 944 59EMD238DBA2HMI.exe RegSvcs.exe PID 944 wrote to memory of 4320 944 59EMD238DBA2HMI.exe RegSvcs.exe PID 944 wrote to memory of 4320 944 59EMD238DBA2HMI.exe RegSvcs.exe PID 944 wrote to memory of 4320 944 59EMD238DBA2HMI.exe RegSvcs.exe PID 944 wrote to memory of 4320 944 59EMD238DBA2HMI.exe RegSvcs.exe PID 944 wrote to memory of 4320 944 59EMD238DBA2HMI.exe RegSvcs.exe PID 944 wrote to memory of 4320 944 59EMD238DBA2HMI.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7.exe"C:\Users\Admin\AppData\Local\Temp\199c2d8e24c0cc919d0400773938ed3cca76860e7be93b5d1f2f8ee12004a5f7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\Q5OM1I3G3K5C7FI.exe"C:\Users\Admin\AppData\Local\Temp\Q5OM1I3G3K5C7FI.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\59EMD238DBA2HMI.exe"C:\Users\Admin\AppData\Local\Temp\59EMD238DBA2HMI.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\NJNI8BHDOF558LP.exe"C:\Users\Admin\AppData\Local\Temp\NJNI8BHDOF558LP.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\PPJI4HIFIFFMIQG.exehttps://iplogger.com/12qaJ43⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4788
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\59EMD238DBA2HMI.exeFilesize
556KB
MD52d1dffc690133c02a27ac0e2d7c03039
SHA155424f59ddc9483a15754b92594fc29bdf8736f3
SHA256c5e338b789ded9449a7f28c6e8aabc8420354b0b1b9cbdc9e9a32ea05823d693
SHA5128a79688ab592961bd8e31848c485c4009dcdd7902968ef41fa9b18602a368428aa97a39daf5ad48e2aa6078e31422d7296e142dccbd846f8986013d2f1828a55
-
C:\Users\Admin\AppData\Local\Temp\59EMD238DBA2HMI.exeFilesize
556KB
MD52d1dffc690133c02a27ac0e2d7c03039
SHA155424f59ddc9483a15754b92594fc29bdf8736f3
SHA256c5e338b789ded9449a7f28c6e8aabc8420354b0b1b9cbdc9e9a32ea05823d693
SHA5128a79688ab592961bd8e31848c485c4009dcdd7902968ef41fa9b18602a368428aa97a39daf5ad48e2aa6078e31422d7296e142dccbd846f8986013d2f1828a55
-
C:\Users\Admin\AppData\Local\Temp\NJNI8BHDOF558LP.exeFilesize
2.5MB
MD56375b46cec76be55885593736cd40270
SHA132f7c3c53ab7403ae7e8488f6b93e2fdda39f9ba
SHA256933722fac65bb4de9beeab946469fb6ba42c187a2ada644f781098320b6770b4
SHA512a2a659f3dbcb085037ec1363bc96b2787cdea2929d47075dd2aba1e87e8f1c246ce01dadb24b503dc121864ecaac2f92d18602e0352c434a49c8bdb49f11ccd6
-
C:\Users\Admin\AppData\Local\Temp\NJNI8BHDOF558LP.exeFilesize
2.5MB
MD56375b46cec76be55885593736cd40270
SHA132f7c3c53ab7403ae7e8488f6b93e2fdda39f9ba
SHA256933722fac65bb4de9beeab946469fb6ba42c187a2ada644f781098320b6770b4
SHA512a2a659f3dbcb085037ec1363bc96b2787cdea2929d47075dd2aba1e87e8f1c246ce01dadb24b503dc121864ecaac2f92d18602e0352c434a49c8bdb49f11ccd6
-
C:\Users\Admin\AppData\Local\Temp\PPJI4HIFIFFMIQG.exeFilesize
8KB
MD58719ce641e7c777ac1b0eaec7b5fa7c7
SHA1c04de52cb511480cc7d00d67f1d9e17b02d6406b
SHA2566283ac6ecbf4c4038cf44896dd221c7c11152bac77273709330409032c3e72ea
SHA5127be5bd6d2342dd02818f1979e7e74a6376658711ac82a59b2af1a67207cfd3c7416b657af01216473b15132e4aa5c6675f0eb8ee6343192c7dfc4a5249ccaa97
-
C:\Users\Admin\AppData\Local\Temp\PPJI4HIFIFFMIQG.exeFilesize
8KB
MD58719ce641e7c777ac1b0eaec7b5fa7c7
SHA1c04de52cb511480cc7d00d67f1d9e17b02d6406b
SHA2566283ac6ecbf4c4038cf44896dd221c7c11152bac77273709330409032c3e72ea
SHA5127be5bd6d2342dd02818f1979e7e74a6376658711ac82a59b2af1a67207cfd3c7416b657af01216473b15132e4aa5c6675f0eb8ee6343192c7dfc4a5249ccaa97
-
C:\Users\Admin\AppData\Local\Temp\Q5OM1I3G3K5C7FI.exeFilesize
602KB
MD53f8f5177e8907b126f2575b67aea9db1
SHA130ac43a9c6dd799441519db56a14bf1a0e2b5bab
SHA256712bd451f71fe3a5a3ad3b2d0965b0dd872c5348f8338af96c222add990a5326
SHA5121537bb2ad49921ee5ef54ca940485d1ae9a4ec7308c77f938a47ce7451ce2e8e0638bf73511c092acfb0b1277a2c91ff202278b582d2b5319fa647b7e988f398
-
C:\Users\Admin\AppData\Local\Temp\Q5OM1I3G3K5C7FI.exeFilesize
602KB
MD53f8f5177e8907b126f2575b67aea9db1
SHA130ac43a9c6dd799441519db56a14bf1a0e2b5bab
SHA256712bd451f71fe3a5a3ad3b2d0965b0dd872c5348f8338af96c222add990a5326
SHA5121537bb2ad49921ee5ef54ca940485d1ae9a4ec7308c77f938a47ce7451ce2e8e0638bf73511c092acfb0b1277a2c91ff202278b582d2b5319fa647b7e988f398
-
memory/944-260-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/944-163-0x0000000000710000-0x00000000007A0000-memory.dmpFilesize
576KB
-
memory/2588-180-0x0000000005C30000-0x000000000612E000-memory.dmpFilesize
5.0MB
-
memory/2588-169-0x0000000000870000-0x0000000000EEC000-memory.dmpFilesize
6.5MB
-
memory/2588-167-0x0000000000870000-0x0000000000EEC000-memory.dmpFilesize
6.5MB
-
memory/2588-176-0x0000000001180000-0x0000000001190000-memory.dmpFilesize
64KB
-
memory/2588-181-0x00000000057E0000-0x0000000005872000-memory.dmpFilesize
584KB
-
memory/2588-182-0x00000000057D0000-0x00000000057DA000-memory.dmpFilesize
40KB
-
memory/2588-275-0x0000000000870000-0x0000000000EEC000-memory.dmpFilesize
6.5MB
-
memory/2588-279-0x0000000001180000-0x0000000001190000-memory.dmpFilesize
64KB
-
memory/2908-148-0x0000000004BF0000-0x0000000004C05000-memory.dmpFilesize
84KB
-
memory/2908-132-0x0000000004BF0000-0x0000000004C05000-memory.dmpFilesize
84KB
-
memory/2908-124-0x0000000002680000-0x0000000002690000-memory.dmpFilesize
64KB
-
memory/2908-125-0x0000000004BF0000-0x0000000004C05000-memory.dmpFilesize
84KB
-
memory/2908-128-0x0000000004BF0000-0x0000000004C05000-memory.dmpFilesize
84KB
-
memory/2908-122-0x0000000004CC0000-0x0000000004D5C000-memory.dmpFilesize
624KB
-
memory/2908-121-0x00000000001C0000-0x00000000002C0000-memory.dmpFilesize
1024KB
-
memory/2908-146-0x0000000004BF0000-0x0000000004C05000-memory.dmpFilesize
84KB
-
memory/2908-144-0x0000000004BF0000-0x0000000004C05000-memory.dmpFilesize
84KB
-
memory/2908-142-0x0000000004BF0000-0x0000000004C05000-memory.dmpFilesize
84KB
-
memory/2908-140-0x0000000004BF0000-0x0000000004C05000-memory.dmpFilesize
84KB
-
memory/2908-138-0x0000000004BF0000-0x0000000004C05000-memory.dmpFilesize
84KB
-
memory/2908-136-0x0000000004BF0000-0x0000000004C05000-memory.dmpFilesize
84KB
-
memory/2908-126-0x0000000004BF0000-0x0000000004C05000-memory.dmpFilesize
84KB
-
memory/2908-134-0x0000000004BF0000-0x0000000004C05000-memory.dmpFilesize
84KB
-
memory/2908-123-0x0000000004BF0000-0x0000000004C0C000-memory.dmpFilesize
112KB
-
memory/2908-130-0x0000000004BF0000-0x0000000004C05000-memory.dmpFilesize
84KB
-
memory/4212-152-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/4212-153-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/4212-151-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/4212-190-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/4212-175-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/4212-149-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/4320-277-0x0000000006C10000-0x0000000006DD2000-memory.dmpFilesize
1.8MB
-
memory/4320-278-0x0000000007310000-0x000000000783C000-memory.dmpFilesize
5.2MB
-
memory/4320-272-0x0000000006360000-0x00000000063D6000-memory.dmpFilesize
472KB
-
memory/4320-273-0x0000000006290000-0x00000000062AE000-memory.dmpFilesize
120KB
-
memory/4320-276-0x00000000064F0000-0x0000000006540000-memory.dmpFilesize
320KB
-
memory/4320-271-0x0000000005750000-0x00000000057B6000-memory.dmpFilesize
408KB
-
memory/4320-270-0x0000000005740000-0x0000000005750000-memory.dmpFilesize
64KB
-
memory/4320-269-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/4788-214-0x0000025CE6C30000-0x0000025CE6C40000-memory.dmpFilesize
64KB
-
memory/4788-217-0x0000025CE6C30000-0x0000025CE6C40000-memory.dmpFilesize
64KB
-
memory/4788-191-0x0000025CCC5B0000-0x0000025CCC5B6000-memory.dmpFilesize
24KB
-
memory/4788-213-0x0000025CE6C30000-0x0000025CE6C40000-memory.dmpFilesize
64KB
-
memory/4788-235-0x00000264E91D0000-0x00000264E9976000-memory.dmpFilesize
7.6MB
-
memory/4796-219-0x00000000052C0000-0x00000000052D0000-memory.dmpFilesize
64KB
-
memory/4796-158-0x00000000007E0000-0x000000000087C000-memory.dmpFilesize
624KB
-
memory/5068-233-0x000000000AD50000-0x000000000AE5A000-memory.dmpFilesize
1.0MB
-
memory/5068-232-0x000000000B1C0000-0x000000000B7C6000-memory.dmpFilesize
6.0MB
-
memory/5068-226-0x0000000001970000-0x0000000001976000-memory.dmpFilesize
24KB
-
memory/5068-220-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/5068-236-0x000000000ACE0000-0x000000000AD1E000-memory.dmpFilesize
248KB
-
memory/5068-234-0x000000000AC80000-0x000000000AC92000-memory.dmpFilesize
72KB
-
memory/5068-241-0x000000000AE60000-0x000000000AEAB000-memory.dmpFilesize
300KB
-
memory/5068-237-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB
-
memory/5068-281-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB