Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
08-08-2023 15:09
Static task
static1
Behavioral task
behavioral1
Sample
95e8fa87e2f2588ceb158323700e33970570ef19b443e2924dbee7c207931130exe_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
95e8fa87e2f2588ceb158323700e33970570ef19b443e2924dbee7c207931130exe_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
95e8fa87e2f2588ceb158323700e33970570ef19b443e2924dbee7c207931130exe_JC.exe
-
Size
517KB
-
MD5
419d14175c8905cfa737630b4deb96f4
-
SHA1
83efd9b8305b7c9a246c2735ba22c1011b67a718
-
SHA256
95e8fa87e2f2588ceb158323700e33970570ef19b443e2924dbee7c207931130
-
SHA512
c5e9546c3c6edb8cbf019c0da7e0379719d8ac806dccf681359439130d5cef247284fb6cd5317f17c039cc9b65ac0b32d652caaa1972d6c69a0185df62fc2605
-
SSDEEP
12288:hMray90Zbnj9cGAZfDL5q5He1HEOiddlTl7AIuaqYwmf:fyU5A1A5He1HEOihTl7PqYwm
Malware Config
Extracted
amadey
3.86
5.42.92.67/norm/index.php
Extracted
redline
papik
77.91.124.156:19071
-
auth_value
325a615d8be5db8e2f7a4c2448fdac3a
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0046193.exe healer C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0046193.exe healer behavioral2/memory/4540-154-0x0000000000DD0000-0x0000000000DDA000-memory.dmp healer -
Processes:
p0046193.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" p0046193.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" p0046193.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection p0046193.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" p0046193.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" p0046193.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" p0046193.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 9 IoCs
Processes:
z5757947.exez4773661.exep0046193.exer4381890.exelegola.exes3004138.exelegola.exelegola.exelegola.exepid process 3092 z5757947.exe 3044 z4773661.exe 4540 p0046193.exe 1552 r4381890.exe 2408 legola.exe 2488 s3004138.exe 1372 legola.exe 4672 legola.exe 4200 legola.exe -
Processes:
p0046193.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p0046193.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
95e8fa87e2f2588ceb158323700e33970570ef19b443e2924dbee7c207931130exe_JC.exez5757947.exez4773661.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 95e8fa87e2f2588ceb158323700e33970570ef19b443e2924dbee7c207931130exe_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z5757947.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z4773661.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
p0046193.exepid process 4540 p0046193.exe 4540 p0046193.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
p0046193.exedescription pid process Token: SeDebugPrivilege 4540 p0046193.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
r4381890.exepid process 1552 r4381890.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
95e8fa87e2f2588ceb158323700e33970570ef19b443e2924dbee7c207931130exe_JC.exez5757947.exez4773661.exer4381890.exelegola.execmd.exedescription pid process target process PID 3288 wrote to memory of 3092 3288 95e8fa87e2f2588ceb158323700e33970570ef19b443e2924dbee7c207931130exe_JC.exe z5757947.exe PID 3288 wrote to memory of 3092 3288 95e8fa87e2f2588ceb158323700e33970570ef19b443e2924dbee7c207931130exe_JC.exe z5757947.exe PID 3288 wrote to memory of 3092 3288 95e8fa87e2f2588ceb158323700e33970570ef19b443e2924dbee7c207931130exe_JC.exe z5757947.exe PID 3092 wrote to memory of 3044 3092 z5757947.exe z4773661.exe PID 3092 wrote to memory of 3044 3092 z5757947.exe z4773661.exe PID 3092 wrote to memory of 3044 3092 z5757947.exe z4773661.exe PID 3044 wrote to memory of 4540 3044 z4773661.exe p0046193.exe PID 3044 wrote to memory of 4540 3044 z4773661.exe p0046193.exe PID 3044 wrote to memory of 1552 3044 z4773661.exe r4381890.exe PID 3044 wrote to memory of 1552 3044 z4773661.exe r4381890.exe PID 3044 wrote to memory of 1552 3044 z4773661.exe r4381890.exe PID 1552 wrote to memory of 2408 1552 r4381890.exe legola.exe PID 1552 wrote to memory of 2408 1552 r4381890.exe legola.exe PID 1552 wrote to memory of 2408 1552 r4381890.exe legola.exe PID 3092 wrote to memory of 2488 3092 z5757947.exe s3004138.exe PID 3092 wrote to memory of 2488 3092 z5757947.exe s3004138.exe PID 3092 wrote to memory of 2488 3092 z5757947.exe s3004138.exe PID 2408 wrote to memory of 2300 2408 legola.exe schtasks.exe PID 2408 wrote to memory of 2300 2408 legola.exe schtasks.exe PID 2408 wrote to memory of 2300 2408 legola.exe schtasks.exe PID 2408 wrote to memory of 748 2408 legola.exe cmd.exe PID 2408 wrote to memory of 748 2408 legola.exe cmd.exe PID 2408 wrote to memory of 748 2408 legola.exe cmd.exe PID 748 wrote to memory of 4532 748 cmd.exe cmd.exe PID 748 wrote to memory of 4532 748 cmd.exe cmd.exe PID 748 wrote to memory of 4532 748 cmd.exe cmd.exe PID 748 wrote to memory of 3076 748 cmd.exe cacls.exe PID 748 wrote to memory of 3076 748 cmd.exe cacls.exe PID 748 wrote to memory of 3076 748 cmd.exe cacls.exe PID 748 wrote to memory of 2868 748 cmd.exe cacls.exe PID 748 wrote to memory of 2868 748 cmd.exe cacls.exe PID 748 wrote to memory of 2868 748 cmd.exe cacls.exe PID 748 wrote to memory of 4940 748 cmd.exe cmd.exe PID 748 wrote to memory of 4940 748 cmd.exe cmd.exe PID 748 wrote to memory of 4940 748 cmd.exe cmd.exe PID 748 wrote to memory of 4840 748 cmd.exe cacls.exe PID 748 wrote to memory of 4840 748 cmd.exe cacls.exe PID 748 wrote to memory of 4840 748 cmd.exe cacls.exe PID 748 wrote to memory of 1488 748 cmd.exe cacls.exe PID 748 wrote to memory of 1488 748 cmd.exe cacls.exe PID 748 wrote to memory of 1488 748 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\95e8fa87e2f2588ceb158323700e33970570ef19b443e2924dbee7c207931130exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\95e8fa87e2f2588ceb158323700e33970570ef19b443e2924dbee7c207931130exe_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5757947.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5757947.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4773661.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4773661.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0046193.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0046193.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r4381890.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r4381890.exe4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legola.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legola.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:R" /E7⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s3004138.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s3004138.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5757947.exeFilesize
390KB
MD53de1324e5b0ab0be02e10cb82b8e0640
SHA11caf315469f4e8b9cbe31e3ae578cab9c809f62c
SHA25650468e54685281ecec8212962193bae3465a748474702d59f39430b6e21e36b3
SHA512877f3dc090024c9b7adb2db4c51bb988196868b4a386a3a551dc136b8d8c16134a18ff12296b65d1d35207ed262e276ddb6780beefba7e8bb2f22a4fd7f23a3a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5757947.exeFilesize
390KB
MD53de1324e5b0ab0be02e10cb82b8e0640
SHA11caf315469f4e8b9cbe31e3ae578cab9c809f62c
SHA25650468e54685281ecec8212962193bae3465a748474702d59f39430b6e21e36b3
SHA512877f3dc090024c9b7adb2db4c51bb988196868b4a386a3a551dc136b8d8c16134a18ff12296b65d1d35207ed262e276ddb6780beefba7e8bb2f22a4fd7f23a3a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s3004138.exeFilesize
173KB
MD58c537347e8a23f5ca7c40dd31430a4a2
SHA1a40ae8bf7d8a5fd7f781ccab6deac3a583e0a1ed
SHA256621bd6792e5b20e88284c0040cb61d3d66dbe1ad0fa9bd1050fa71b982a95adb
SHA512ddc0082b358dc238dd9caa5c34b9ee5c5530cfe37929bd3d28cd33a43f2b60f6cb1c01802ad619caa0289daa4ea714a322aaf6455f5186081df0cea04d9ec1b0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s3004138.exeFilesize
173KB
MD58c537347e8a23f5ca7c40dd31430a4a2
SHA1a40ae8bf7d8a5fd7f781ccab6deac3a583e0a1ed
SHA256621bd6792e5b20e88284c0040cb61d3d66dbe1ad0fa9bd1050fa71b982a95adb
SHA512ddc0082b358dc238dd9caa5c34b9ee5c5530cfe37929bd3d28cd33a43f2b60f6cb1c01802ad619caa0289daa4ea714a322aaf6455f5186081df0cea04d9ec1b0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4773661.exeFilesize
234KB
MD5804a008bfe18b3504c29633df19255a9
SHA18ac03f7091578fde9a58af7c384bd88cf5d842ea
SHA256961bf358a81791007754ee92bc667cace46030dcff81feedc09cb4f95329f32c
SHA51298330a461905ba30f2a848884fe3fd7a45ff93c56cf64d4af7181b48c2fd453dab1eb95e6f170a049083169ddac023b656dd1d0f343490d34ae00d25fff79bcc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4773661.exeFilesize
234KB
MD5804a008bfe18b3504c29633df19255a9
SHA18ac03f7091578fde9a58af7c384bd88cf5d842ea
SHA256961bf358a81791007754ee92bc667cace46030dcff81feedc09cb4f95329f32c
SHA51298330a461905ba30f2a848884fe3fd7a45ff93c56cf64d4af7181b48c2fd453dab1eb95e6f170a049083169ddac023b656dd1d0f343490d34ae00d25fff79bcc
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0046193.exeFilesize
11KB
MD5225f76a6934bb90e542b61588977a84f
SHA1bbb5cc365df0deea93ff6ff2cbafa3f2c7dc6eb9
SHA256c98f0d1c4a7d88abce48355f9b9b10c40247af2b8bf5df2cd5754ebe19dfe2c3
SHA512ca1057fac93b52b2c67be53defa90c60fde43c6efa09743820aac16a53d5aa0c13dbf8fabf20f994b8b60a1b258802e50ce24ba2c812b3156122d48f1d1dd081
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p0046193.exeFilesize
11KB
MD5225f76a6934bb90e542b61588977a84f
SHA1bbb5cc365df0deea93ff6ff2cbafa3f2c7dc6eb9
SHA256c98f0d1c4a7d88abce48355f9b9b10c40247af2b8bf5df2cd5754ebe19dfe2c3
SHA512ca1057fac93b52b2c67be53defa90c60fde43c6efa09743820aac16a53d5aa0c13dbf8fabf20f994b8b60a1b258802e50ce24ba2c812b3156122d48f1d1dd081
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r4381890.exeFilesize
225KB
MD5e9033df6ef9024a9c3322f0fdfa8ad8c
SHA114894f3c45abd06ce9202ac35dab5d4ba0ca9210
SHA256cafca92faed1e73e9bce0210c45f5b39a95cd2ae2101110ba9955e6b2e56c9d2
SHA512a870530e3bbe6305d919f41089c33f1e54b43880e7d7dff3bbfd09405816f423c87e0b2d59600496c1f90537783b08ada51f8a204dee3a5ea5ba965f15a350ab
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r4381890.exeFilesize
225KB
MD5e9033df6ef9024a9c3322f0fdfa8ad8c
SHA114894f3c45abd06ce9202ac35dab5d4ba0ca9210
SHA256cafca92faed1e73e9bce0210c45f5b39a95cd2ae2101110ba9955e6b2e56c9d2
SHA512a870530e3bbe6305d919f41089c33f1e54b43880e7d7dff3bbfd09405816f423c87e0b2d59600496c1f90537783b08ada51f8a204dee3a5ea5ba965f15a350ab
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD5e9033df6ef9024a9c3322f0fdfa8ad8c
SHA114894f3c45abd06ce9202ac35dab5d4ba0ca9210
SHA256cafca92faed1e73e9bce0210c45f5b39a95cd2ae2101110ba9955e6b2e56c9d2
SHA512a870530e3bbe6305d919f41089c33f1e54b43880e7d7dff3bbfd09405816f423c87e0b2d59600496c1f90537783b08ada51f8a204dee3a5ea5ba965f15a350ab
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD5e9033df6ef9024a9c3322f0fdfa8ad8c
SHA114894f3c45abd06ce9202ac35dab5d4ba0ca9210
SHA256cafca92faed1e73e9bce0210c45f5b39a95cd2ae2101110ba9955e6b2e56c9d2
SHA512a870530e3bbe6305d919f41089c33f1e54b43880e7d7dff3bbfd09405816f423c87e0b2d59600496c1f90537783b08ada51f8a204dee3a5ea5ba965f15a350ab
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD5e9033df6ef9024a9c3322f0fdfa8ad8c
SHA114894f3c45abd06ce9202ac35dab5d4ba0ca9210
SHA256cafca92faed1e73e9bce0210c45f5b39a95cd2ae2101110ba9955e6b2e56c9d2
SHA512a870530e3bbe6305d919f41089c33f1e54b43880e7d7dff3bbfd09405816f423c87e0b2d59600496c1f90537783b08ada51f8a204dee3a5ea5ba965f15a350ab
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD5e9033df6ef9024a9c3322f0fdfa8ad8c
SHA114894f3c45abd06ce9202ac35dab5d4ba0ca9210
SHA256cafca92faed1e73e9bce0210c45f5b39a95cd2ae2101110ba9955e6b2e56c9d2
SHA512a870530e3bbe6305d919f41089c33f1e54b43880e7d7dff3bbfd09405816f423c87e0b2d59600496c1f90537783b08ada51f8a204dee3a5ea5ba965f15a350ab
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD5e9033df6ef9024a9c3322f0fdfa8ad8c
SHA114894f3c45abd06ce9202ac35dab5d4ba0ca9210
SHA256cafca92faed1e73e9bce0210c45f5b39a95cd2ae2101110ba9955e6b2e56c9d2
SHA512a870530e3bbe6305d919f41089c33f1e54b43880e7d7dff3bbfd09405816f423c87e0b2d59600496c1f90537783b08ada51f8a204dee3a5ea5ba965f15a350ab
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
225KB
MD5e9033df6ef9024a9c3322f0fdfa8ad8c
SHA114894f3c45abd06ce9202ac35dab5d4ba0ca9210
SHA256cafca92faed1e73e9bce0210c45f5b39a95cd2ae2101110ba9955e6b2e56c9d2
SHA512a870530e3bbe6305d919f41089c33f1e54b43880e7d7dff3bbfd09405816f423c87e0b2d59600496c1f90537783b08ada51f8a204dee3a5ea5ba965f15a350ab
-
memory/2488-178-0x0000000005700000-0x0000000005712000-memory.dmpFilesize
72KB
-
memory/2488-175-0x0000000073330000-0x0000000073AE0000-memory.dmpFilesize
7.7MB
-
memory/2488-176-0x0000000005CD0000-0x00000000062E8000-memory.dmpFilesize
6.1MB
-
memory/2488-177-0x00000000057C0000-0x00000000058CA000-memory.dmpFilesize
1.0MB
-
memory/2488-179-0x00000000055A0000-0x00000000055B0000-memory.dmpFilesize
64KB
-
memory/2488-174-0x0000000000C30000-0x0000000000C60000-memory.dmpFilesize
192KB
-
memory/2488-180-0x0000000005760000-0x000000000579C000-memory.dmpFilesize
240KB
-
memory/2488-182-0x0000000073330000-0x0000000073AE0000-memory.dmpFilesize
7.7MB
-
memory/2488-183-0x00000000055A0000-0x00000000055B0000-memory.dmpFilesize
64KB
-
memory/4540-157-0x00007FFACC370000-0x00007FFACCE31000-memory.dmpFilesize
10.8MB
-
memory/4540-155-0x00007FFACC370000-0x00007FFACCE31000-memory.dmpFilesize
10.8MB
-
memory/4540-154-0x0000000000DD0000-0x0000000000DDA000-memory.dmpFilesize
40KB