Analysis
-
max time kernel
56s -
max time network
70s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
19-03-2023 02:35
Static task
static1
Behavioral task
behavioral1
Sample
ec71239c8c387ae7b5dc7155d239d3014c42380fd5a4956967e9ce62089ac99d.exe
Resource
win10-20230220-en
General
-
Target
ec71239c8c387ae7b5dc7155d239d3014c42380fd5a4956967e9ce62089ac99d.exe
-
Size
851KB
-
MD5
876301ef6c6088bbd50382c67e9d20cc
-
SHA1
a424ec8a5271f614f772e3b93f87fdaf19dda4b2
-
SHA256
ec71239c8c387ae7b5dc7155d239d3014c42380fd5a4956967e9ce62089ac99d
-
SHA512
da4ad5ca5de998fd458610bdff29935cb9421af23da8226c6bdd677786c801ccb6fa83610b25469759b3b3f4258b9923b8df9aeb9f05243c45ea27d536e96972
-
SSDEEP
12288:kMray90u6P7r+jxmjw6r1G3JvR94ouB+bsqMEJAoPsXAT5b6hd62j/R+Syl+YOTP:WyU7lG5cd+bsNEu+Bt6hMmR+u
Malware Config
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Extracted
redline
ruka
193.233.20.28:4125
-
auth_value
5d1d0e51ebe1e3f16cca573ff651c43c
Signatures
-
Processes:
f7029zE.exeh75ZY24.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" f7029zE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" f7029zE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h75ZY24.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h75ZY24.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h75ZY24.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" f7029zE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" f7029zE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" f7029zE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h75ZY24.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h75ZY24.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2592-188-0x0000000004830000-0x0000000004876000-memory.dmp family_redline behavioral1/memory/2592-189-0x0000000004A20000-0x0000000004A64000-memory.dmp family_redline behavioral1/memory/2592-192-0x0000000004A20000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/2592-194-0x0000000004A20000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/2592-197-0x0000000004A20000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/2592-199-0x0000000004A20000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/2592-201-0x0000000004A20000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/2592-203-0x0000000004A20000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/2592-205-0x0000000004A20000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/2592-207-0x0000000004A20000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/2592-209-0x0000000004A20000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/2592-211-0x0000000004A20000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/2592-213-0x0000000004A20000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/2592-215-0x0000000004A20000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/2592-217-0x0000000004A20000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/2592-219-0x0000000004A20000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/2592-221-0x0000000004A20000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/2592-223-0x0000000004A20000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/2592-225-0x0000000004A20000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/2592-227-0x0000000004A20000-0x0000000004A5E000-memory.dmp family_redline behavioral1/memory/2592-1110-0x00000000070C0000-0x00000000070D0000-memory.dmp family_redline -
Executes dropped EXE 6 IoCs
Processes:
niba5070.exeniba4124.exef7029zE.exeh75ZY24.exeimkvy45.exel70BR33.exepid process 4292 niba5070.exe 4988 niba4124.exe 2808 f7029zE.exe 2124 h75ZY24.exe 2592 imkvy45.exe 3912 l70BR33.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
f7029zE.exeh75ZY24.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" f7029zE.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features h75ZY24.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" h75ZY24.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
niba5070.exeniba4124.exeec71239c8c387ae7b5dc7155d239d3014c42380fd5a4956967e9ce62089ac99d.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce niba5070.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" niba5070.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce niba4124.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" niba4124.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ec71239c8c387ae7b5dc7155d239d3014c42380fd5a4956967e9ce62089ac99d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ec71239c8c387ae7b5dc7155d239d3014c42380fd5a4956967e9ce62089ac99d.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
f7029zE.exeh75ZY24.exeimkvy45.exel70BR33.exepid process 2808 f7029zE.exe 2808 f7029zE.exe 2124 h75ZY24.exe 2124 h75ZY24.exe 2592 imkvy45.exe 2592 imkvy45.exe 3912 l70BR33.exe 3912 l70BR33.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
f7029zE.exeh75ZY24.exeimkvy45.exel70BR33.exedescription pid process Token: SeDebugPrivilege 2808 f7029zE.exe Token: SeDebugPrivilege 2124 h75ZY24.exe Token: SeDebugPrivilege 2592 imkvy45.exe Token: SeDebugPrivilege 3912 l70BR33.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
ec71239c8c387ae7b5dc7155d239d3014c42380fd5a4956967e9ce62089ac99d.exeniba5070.exeniba4124.exedescription pid process target process PID 1008 wrote to memory of 4292 1008 ec71239c8c387ae7b5dc7155d239d3014c42380fd5a4956967e9ce62089ac99d.exe niba5070.exe PID 1008 wrote to memory of 4292 1008 ec71239c8c387ae7b5dc7155d239d3014c42380fd5a4956967e9ce62089ac99d.exe niba5070.exe PID 1008 wrote to memory of 4292 1008 ec71239c8c387ae7b5dc7155d239d3014c42380fd5a4956967e9ce62089ac99d.exe niba5070.exe PID 4292 wrote to memory of 4988 4292 niba5070.exe niba4124.exe PID 4292 wrote to memory of 4988 4292 niba5070.exe niba4124.exe PID 4292 wrote to memory of 4988 4292 niba5070.exe niba4124.exe PID 4988 wrote to memory of 2808 4988 niba4124.exe f7029zE.exe PID 4988 wrote to memory of 2808 4988 niba4124.exe f7029zE.exe PID 4988 wrote to memory of 2124 4988 niba4124.exe h75ZY24.exe PID 4988 wrote to memory of 2124 4988 niba4124.exe h75ZY24.exe PID 4988 wrote to memory of 2124 4988 niba4124.exe h75ZY24.exe PID 4292 wrote to memory of 2592 4292 niba5070.exe imkvy45.exe PID 4292 wrote to memory of 2592 4292 niba5070.exe imkvy45.exe PID 4292 wrote to memory of 2592 4292 niba5070.exe imkvy45.exe PID 1008 wrote to memory of 3912 1008 ec71239c8c387ae7b5dc7155d239d3014c42380fd5a4956967e9ce62089ac99d.exe l70BR33.exe PID 1008 wrote to memory of 3912 1008 ec71239c8c387ae7b5dc7155d239d3014c42380fd5a4956967e9ce62089ac99d.exe l70BR33.exe PID 1008 wrote to memory of 3912 1008 ec71239c8c387ae7b5dc7155d239d3014c42380fd5a4956967e9ce62089ac99d.exe l70BR33.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec71239c8c387ae7b5dc7155d239d3014c42380fd5a4956967e9ce62089ac99d.exe"C:\Users\Admin\AppData\Local\Temp\ec71239c8c387ae7b5dc7155d239d3014c42380fd5a4956967e9ce62089ac99d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5070.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5070.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba4124.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba4124.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7029zE.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7029zE.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h75ZY24.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h75ZY24.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\imkvy45.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\imkvy45.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l70BR33.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l70BR33.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l70BR33.exeFilesize
175KB
MD56c4c2a56d5dd785adbe4fe60fa3cc1f2
SHA1f8bd4379310258f8e54c47b56f5eec7394adb9a2
SHA256b182f2d3d49bdda2e29a0ed312deef4bee03983de54080c5e97ad6422de192d2
SHA512f6958cab80e2f7736cea307b51be546e50acd5494b72db0343a09e6ef8c446114f51be6c9826fcb6e9f7190e4ec8415c0a403c3c1706183577c2604b877ff830
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l70BR33.exeFilesize
175KB
MD56c4c2a56d5dd785adbe4fe60fa3cc1f2
SHA1f8bd4379310258f8e54c47b56f5eec7394adb9a2
SHA256b182f2d3d49bdda2e29a0ed312deef4bee03983de54080c5e97ad6422de192d2
SHA512f6958cab80e2f7736cea307b51be546e50acd5494b72db0343a09e6ef8c446114f51be6c9826fcb6e9f7190e4ec8415c0a403c3c1706183577c2604b877ff830
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5070.exeFilesize
708KB
MD51df575f6f82aa1c93b9547c4958368fc
SHA1f4236bc696cfaf8eecfce567322b986aa0d3a440
SHA256c3b82b5d43cad6dae5264baf902311411776bd5ceda932c44ed801e40aeeed9e
SHA512c54ba7a37124ae0d9c0216a5856c67f46387580481fcf66ab9255753fd32c8c4252efcd6831ee091f1a38f791f10293456e9443d2f9d20c21f9c5bbdcd9eaf00
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5070.exeFilesize
708KB
MD51df575f6f82aa1c93b9547c4958368fc
SHA1f4236bc696cfaf8eecfce567322b986aa0d3a440
SHA256c3b82b5d43cad6dae5264baf902311411776bd5ceda932c44ed801e40aeeed9e
SHA512c54ba7a37124ae0d9c0216a5856c67f46387580481fcf66ab9255753fd32c8c4252efcd6831ee091f1a38f791f10293456e9443d2f9d20c21f9c5bbdcd9eaf00
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\imkvy45.exeFilesize
391KB
MD5b21fd6e3e4a9795fc9388db6e045dbe7
SHA1803ae948016a573e3782ceac2a0633a0edfaf048
SHA256e627e48e07779ae36602cc4fa52385b3f6249f472121148685db8c8de2733ba0
SHA512af542b46ec513c0cbae918ddc4f42f62194ca61ea00c2c6dcf1424526297e9e756e101c8e0441210c7e80d0e1058b8523647694216693bbac8097ff7a51d8338
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\imkvy45.exeFilesize
391KB
MD5b21fd6e3e4a9795fc9388db6e045dbe7
SHA1803ae948016a573e3782ceac2a0633a0edfaf048
SHA256e627e48e07779ae36602cc4fa52385b3f6249f472121148685db8c8de2733ba0
SHA512af542b46ec513c0cbae918ddc4f42f62194ca61ea00c2c6dcf1424526297e9e756e101c8e0441210c7e80d0e1058b8523647694216693bbac8097ff7a51d8338
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba4124.exeFilesize
358KB
MD582641505d189923be8681f79d26f0abe
SHA101ca65923255f2e4df0487ee422336f3afde8985
SHA256d01cbd98ae775b04657dffaee89d70eac7c5f7982faca7f5fbcebf0120efda1a
SHA512738e0200222cfe05076a80bebfbd7d6b09e324d185bcefbd86107ce99c1d013d5227049de1e43e9c75ac92247d7b154a4f5f44ed52291b5bbeb569c3f7835bbd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba4124.exeFilesize
358KB
MD582641505d189923be8681f79d26f0abe
SHA101ca65923255f2e4df0487ee422336f3afde8985
SHA256d01cbd98ae775b04657dffaee89d70eac7c5f7982faca7f5fbcebf0120efda1a
SHA512738e0200222cfe05076a80bebfbd7d6b09e324d185bcefbd86107ce99c1d013d5227049de1e43e9c75ac92247d7b154a4f5f44ed52291b5bbeb569c3f7835bbd
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7029zE.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7029zE.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h75ZY24.exeFilesize
371KB
MD5ba514ac8e2be30e99cf7bc07af9163bb
SHA1013b8b31c375648901f7fcb1f8f8a24ee27c7d73
SHA2563e4d59853bee29670b7debbceca4700a154100468aa729ad5eda0c3c83ff1854
SHA5129f4a0641ebc27c0a23d5d6abb3a7cc1050bfa4893bcedbd2b85a6bd4e69dc315bd00915b3e2360968f7f7fe83e35666a75201c02f883131df2a7476840429c50
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h75ZY24.exeFilesize
371KB
MD5ba514ac8e2be30e99cf7bc07af9163bb
SHA1013b8b31c375648901f7fcb1f8f8a24ee27c7d73
SHA2563e4d59853bee29670b7debbceca4700a154100468aa729ad5eda0c3c83ff1854
SHA5129f4a0641ebc27c0a23d5d6abb3a7cc1050bfa4893bcedbd2b85a6bd4e69dc315bd00915b3e2360968f7f7fe83e35666a75201c02f883131df2a7476840429c50
-
memory/2124-144-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/2124-145-0x0000000004710000-0x000000000472A000-memory.dmpFilesize
104KB
-
memory/2124-146-0x00000000074C0000-0x00000000079BE000-memory.dmpFilesize
5.0MB
-
memory/2124-147-0x00000000047A0000-0x00000000047B8000-memory.dmpFilesize
96KB
-
memory/2124-148-0x00000000047A0000-0x00000000047B2000-memory.dmpFilesize
72KB
-
memory/2124-149-0x00000000047A0000-0x00000000047B2000-memory.dmpFilesize
72KB
-
memory/2124-151-0x00000000047A0000-0x00000000047B2000-memory.dmpFilesize
72KB
-
memory/2124-153-0x00000000047A0000-0x00000000047B2000-memory.dmpFilesize
72KB
-
memory/2124-155-0x00000000047A0000-0x00000000047B2000-memory.dmpFilesize
72KB
-
memory/2124-157-0x00000000047A0000-0x00000000047B2000-memory.dmpFilesize
72KB
-
memory/2124-159-0x00000000047A0000-0x00000000047B2000-memory.dmpFilesize
72KB
-
memory/2124-161-0x00000000047A0000-0x00000000047B2000-memory.dmpFilesize
72KB
-
memory/2124-163-0x00000000047A0000-0x00000000047B2000-memory.dmpFilesize
72KB
-
memory/2124-165-0x00000000047A0000-0x00000000047B2000-memory.dmpFilesize
72KB
-
memory/2124-167-0x00000000047A0000-0x00000000047B2000-memory.dmpFilesize
72KB
-
memory/2124-169-0x00000000047A0000-0x00000000047B2000-memory.dmpFilesize
72KB
-
memory/2124-171-0x00000000047A0000-0x00000000047B2000-memory.dmpFilesize
72KB
-
memory/2124-173-0x00000000047A0000-0x00000000047B2000-memory.dmpFilesize
72KB
-
memory/2124-175-0x00000000047A0000-0x00000000047B2000-memory.dmpFilesize
72KB
-
memory/2124-176-0x00000000074B0000-0x00000000074C0000-memory.dmpFilesize
64KB
-
memory/2124-177-0x00000000074B0000-0x00000000074C0000-memory.dmpFilesize
64KB
-
memory/2124-178-0x00000000074B0000-0x00000000074C0000-memory.dmpFilesize
64KB
-
memory/2124-179-0x0000000000400000-0x0000000002B0C000-memory.dmpFilesize
39.0MB
-
memory/2124-181-0x0000000000400000-0x0000000002B0C000-memory.dmpFilesize
39.0MB
-
memory/2124-182-0x00000000074B0000-0x00000000074C0000-memory.dmpFilesize
64KB
-
memory/2124-183-0x00000000074B0000-0x00000000074C0000-memory.dmpFilesize
64KB
-
memory/2592-190-0x0000000002BF0000-0x0000000002C3B000-memory.dmpFilesize
300KB
-
memory/2592-223-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/2592-188-0x0000000004830000-0x0000000004876000-memory.dmpFilesize
280KB
-
memory/2592-192-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/2592-193-0x00000000070C0000-0x00000000070D0000-memory.dmpFilesize
64KB
-
memory/2592-191-0x00000000070C0000-0x00000000070D0000-memory.dmpFilesize
64KB
-
memory/2592-194-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/2592-197-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/2592-195-0x00000000070C0000-0x00000000070D0000-memory.dmpFilesize
64KB
-
memory/2592-199-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/2592-201-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/2592-203-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/2592-205-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/2592-207-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/2592-209-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/2592-211-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/2592-213-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/2592-215-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/2592-217-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/2592-219-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/2592-221-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/2592-189-0x0000000004A20000-0x0000000004A64000-memory.dmpFilesize
272KB
-
memory/2592-225-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/2592-227-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/2592-1100-0x0000000007CE0000-0x00000000082E6000-memory.dmpFilesize
6.0MB
-
memory/2592-1101-0x00000000076D0000-0x00000000077DA000-memory.dmpFilesize
1.0MB
-
memory/2592-1102-0x00000000077F0000-0x0000000007802000-memory.dmpFilesize
72KB
-
memory/2592-1103-0x0000000007810000-0x000000000784E000-memory.dmpFilesize
248KB
-
memory/2592-1104-0x0000000007960000-0x00000000079AB000-memory.dmpFilesize
300KB
-
memory/2592-1105-0x00000000070C0000-0x00000000070D0000-memory.dmpFilesize
64KB
-
memory/2592-1107-0x0000000007AF0000-0x0000000007B82000-memory.dmpFilesize
584KB
-
memory/2592-1108-0x0000000007B90000-0x0000000007BF6000-memory.dmpFilesize
408KB
-
memory/2592-1109-0x00000000089B0000-0x0000000008B72000-memory.dmpFilesize
1.8MB
-
memory/2592-1110-0x00000000070C0000-0x00000000070D0000-memory.dmpFilesize
64KB
-
memory/2592-1112-0x00000000070C0000-0x00000000070D0000-memory.dmpFilesize
64KB
-
memory/2592-1111-0x00000000070C0000-0x00000000070D0000-memory.dmpFilesize
64KB
-
memory/2592-1113-0x0000000008B80000-0x00000000090AC000-memory.dmpFilesize
5.2MB
-
memory/2592-1114-0x00000000091F0000-0x0000000009266000-memory.dmpFilesize
472KB
-
memory/2592-1115-0x0000000009270000-0x00000000092C0000-memory.dmpFilesize
320KB
-
memory/2592-1116-0x00000000070C0000-0x00000000070D0000-memory.dmpFilesize
64KB
-
memory/2808-138-0x0000000000A10000-0x0000000000A1A000-memory.dmpFilesize
40KB
-
memory/3912-1126-0x0000000000120000-0x0000000000152000-memory.dmpFilesize
200KB
-
memory/3912-1127-0x0000000004B60000-0x0000000004BAB000-memory.dmpFilesize
300KB
-
memory/3912-1128-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB