Analysis
-
max time kernel
145s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2023 02:55
Static task
static1
Behavioral task
behavioral1
Sample
57f92c61023f11d24f6c0202eaab27346cc82394125bee8cc3bc6f6853701cdb.exe
Resource
win10v2004-20230220-en
General
-
Target
57f92c61023f11d24f6c0202eaab27346cc82394125bee8cc3bc6f6853701cdb.exe
-
Size
851KB
-
MD5
5d707370f7f0ff3f8694c431fbd2bf07
-
SHA1
5a68091f8d4149bec836e93966bdbe1941f51b24
-
SHA256
57f92c61023f11d24f6c0202eaab27346cc82394125bee8cc3bc6f6853701cdb
-
SHA512
492c84ee64f297a40d45d5024ad8e9338895f667d461f23a42fc9a19e4a7e673baef40b52e08d916c6e69c20109fe356dbbd4056279ae1d377a7b5ee21b94a68
-
SSDEEP
12288:uMrBy90383iX72hCcfM4xGcfMZyXJLptHElpXQpz65XyCsE7+SJTuiCfOrwt3J:TyZoShCaYHZqJLpJEbXQFglJ7oiCl3J
Malware Config
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Extracted
redline
ruka
193.233.20.28:4125
-
auth_value
5d1d0e51ebe1e3f16cca573ff651c43c
Signatures
-
Processes:
f7134Vy.exeh74bU03.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection f7134Vy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" f7134Vy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" f7134Vy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" f7134Vy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h74bU03.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h74bU03.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h74bU03.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h74bU03.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" f7134Vy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" f7134Vy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection h74bU03.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h74bU03.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4344-205-0x00000000076D0000-0x000000000770E000-memory.dmp family_redline behavioral1/memory/4344-209-0x00000000076D0000-0x000000000770E000-memory.dmp family_redline behavioral1/memory/4344-208-0x0000000004B40000-0x0000000004B50000-memory.dmp family_redline behavioral1/memory/4344-204-0x00000000076D0000-0x000000000770E000-memory.dmp family_redline behavioral1/memory/4344-212-0x00000000076D0000-0x000000000770E000-memory.dmp family_redline behavioral1/memory/4344-214-0x00000000076D0000-0x000000000770E000-memory.dmp family_redline behavioral1/memory/4344-216-0x00000000076D0000-0x000000000770E000-memory.dmp family_redline behavioral1/memory/4344-218-0x00000000076D0000-0x000000000770E000-memory.dmp family_redline behavioral1/memory/4344-220-0x00000000076D0000-0x000000000770E000-memory.dmp family_redline behavioral1/memory/4344-222-0x00000000076D0000-0x000000000770E000-memory.dmp family_redline behavioral1/memory/4344-224-0x00000000076D0000-0x000000000770E000-memory.dmp family_redline behavioral1/memory/4344-226-0x00000000076D0000-0x000000000770E000-memory.dmp family_redline behavioral1/memory/4344-228-0x00000000076D0000-0x000000000770E000-memory.dmp family_redline behavioral1/memory/4344-230-0x00000000076D0000-0x000000000770E000-memory.dmp family_redline behavioral1/memory/4344-232-0x00000000076D0000-0x000000000770E000-memory.dmp family_redline behavioral1/memory/4344-234-0x00000000076D0000-0x000000000770E000-memory.dmp family_redline behavioral1/memory/4344-236-0x00000000076D0000-0x000000000770E000-memory.dmp family_redline behavioral1/memory/4344-238-0x00000000076D0000-0x000000000770E000-memory.dmp family_redline behavioral1/memory/4344-240-0x00000000076D0000-0x000000000770E000-memory.dmp family_redline -
Executes dropped EXE 6 IoCs
Processes:
niba6463.exeniba6872.exef7134Vy.exeh74bU03.exeihLvY06.exel17GY94.exepid process 2080 niba6463.exe 1284 niba6872.exe 1228 f7134Vy.exe 224 h74bU03.exe 4344 ihLvY06.exe 4648 l17GY94.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
f7134Vy.exeh74bU03.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" f7134Vy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features h74bU03.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" h74bU03.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
niba6463.exeniba6872.exe57f92c61023f11d24f6c0202eaab27346cc82394125bee8cc3bc6f6853701cdb.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" niba6463.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce niba6872.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" niba6872.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 57f92c61023f11d24f6c0202eaab27346cc82394125bee8cc3bc6f6853701cdb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 57f92c61023f11d24f6c0202eaab27346cc82394125bee8cc3bc6f6853701cdb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce niba6463.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4212 4344 WerFault.exe ihLvY06.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
f7134Vy.exeh74bU03.exeihLvY06.exel17GY94.exepid process 1228 f7134Vy.exe 1228 f7134Vy.exe 224 h74bU03.exe 224 h74bU03.exe 4344 ihLvY06.exe 4344 ihLvY06.exe 4648 l17GY94.exe 4648 l17GY94.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
f7134Vy.exeh74bU03.exeihLvY06.exel17GY94.exedescription pid process Token: SeDebugPrivilege 1228 f7134Vy.exe Token: SeDebugPrivilege 224 h74bU03.exe Token: SeDebugPrivilege 4344 ihLvY06.exe Token: SeDebugPrivilege 4648 l17GY94.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
57f92c61023f11d24f6c0202eaab27346cc82394125bee8cc3bc6f6853701cdb.exeniba6463.exeniba6872.exedescription pid process target process PID 3184 wrote to memory of 2080 3184 57f92c61023f11d24f6c0202eaab27346cc82394125bee8cc3bc6f6853701cdb.exe niba6463.exe PID 3184 wrote to memory of 2080 3184 57f92c61023f11d24f6c0202eaab27346cc82394125bee8cc3bc6f6853701cdb.exe niba6463.exe PID 3184 wrote to memory of 2080 3184 57f92c61023f11d24f6c0202eaab27346cc82394125bee8cc3bc6f6853701cdb.exe niba6463.exe PID 2080 wrote to memory of 1284 2080 niba6463.exe niba6872.exe PID 2080 wrote to memory of 1284 2080 niba6463.exe niba6872.exe PID 2080 wrote to memory of 1284 2080 niba6463.exe niba6872.exe PID 1284 wrote to memory of 1228 1284 niba6872.exe f7134Vy.exe PID 1284 wrote to memory of 1228 1284 niba6872.exe f7134Vy.exe PID 1284 wrote to memory of 224 1284 niba6872.exe h74bU03.exe PID 1284 wrote to memory of 224 1284 niba6872.exe h74bU03.exe PID 1284 wrote to memory of 224 1284 niba6872.exe h74bU03.exe PID 2080 wrote to memory of 4344 2080 niba6463.exe ihLvY06.exe PID 2080 wrote to memory of 4344 2080 niba6463.exe ihLvY06.exe PID 2080 wrote to memory of 4344 2080 niba6463.exe ihLvY06.exe PID 3184 wrote to memory of 4648 3184 57f92c61023f11d24f6c0202eaab27346cc82394125bee8cc3bc6f6853701cdb.exe l17GY94.exe PID 3184 wrote to memory of 4648 3184 57f92c61023f11d24f6c0202eaab27346cc82394125bee8cc3bc6f6853701cdb.exe l17GY94.exe PID 3184 wrote to memory of 4648 3184 57f92c61023f11d24f6c0202eaab27346cc82394125bee8cc3bc6f6853701cdb.exe l17GY94.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57f92c61023f11d24f6c0202eaab27346cc82394125bee8cc3bc6f6853701cdb.exe"C:\Users\Admin\AppData\Local\Temp\57f92c61023f11d24f6c0202eaab27346cc82394125bee8cc3bc6f6853701cdb.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba6463.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba6463.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba6872.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba6872.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7134Vy.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7134Vy.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h74bU03.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h74bU03.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ihLvY06.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ihLvY06.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 13604⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l17GY94.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l17GY94.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4344 -ip 43441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l17GY94.exeFilesize
175KB
MD56c4c2a56d5dd785adbe4fe60fa3cc1f2
SHA1f8bd4379310258f8e54c47b56f5eec7394adb9a2
SHA256b182f2d3d49bdda2e29a0ed312deef4bee03983de54080c5e97ad6422de192d2
SHA512f6958cab80e2f7736cea307b51be546e50acd5494b72db0343a09e6ef8c446114f51be6c9826fcb6e9f7190e4ec8415c0a403c3c1706183577c2604b877ff830
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l17GY94.exeFilesize
175KB
MD56c4c2a56d5dd785adbe4fe60fa3cc1f2
SHA1f8bd4379310258f8e54c47b56f5eec7394adb9a2
SHA256b182f2d3d49bdda2e29a0ed312deef4bee03983de54080c5e97ad6422de192d2
SHA512f6958cab80e2f7736cea307b51be546e50acd5494b72db0343a09e6ef8c446114f51be6c9826fcb6e9f7190e4ec8415c0a403c3c1706183577c2604b877ff830
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba6463.exeFilesize
709KB
MD5086ad0e9fef6fb0fad55eaf662fc8b52
SHA10c926345e4a6eea2073849195c29e023cf9657ad
SHA2564617de2d7243a3a80d742869675cb47cc60bc86e1e443e930c4ed6bb6d04a35c
SHA512f45db45a00b5c72530abdbc53e4dce961d50975aedbfa34e094b0b29f4efecc1815c74c70bb4420ea93ee999736b3b1ec993804ab6aade3e3652de47326d93a1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba6463.exeFilesize
709KB
MD5086ad0e9fef6fb0fad55eaf662fc8b52
SHA10c926345e4a6eea2073849195c29e023cf9657ad
SHA2564617de2d7243a3a80d742869675cb47cc60bc86e1e443e930c4ed6bb6d04a35c
SHA512f45db45a00b5c72530abdbc53e4dce961d50975aedbfa34e094b0b29f4efecc1815c74c70bb4420ea93ee999736b3b1ec993804ab6aade3e3652de47326d93a1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ihLvY06.exeFilesize
391KB
MD578e81010b6b343201a97b69e5a04283b
SHA1bde4d7fcfc871873a441b5cb5680b080a6ac6f90
SHA256aade6ee065ab50be86043c9c0321b726e88c7c13043d2ca94b92bd54a46102bf
SHA512236159af96734e3b29901fe02ab4197d1286cfc138593f07a6ed9ee7e82132807b48a7044707f7de661605835407140128ec1a08ad00766bc315674d760b1eeb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ihLvY06.exeFilesize
391KB
MD578e81010b6b343201a97b69e5a04283b
SHA1bde4d7fcfc871873a441b5cb5680b080a6ac6f90
SHA256aade6ee065ab50be86043c9c0321b726e88c7c13043d2ca94b92bd54a46102bf
SHA512236159af96734e3b29901fe02ab4197d1286cfc138593f07a6ed9ee7e82132807b48a7044707f7de661605835407140128ec1a08ad00766bc315674d760b1eeb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba6872.exeFilesize
358KB
MD56cdce90c007d70f2d84b47f3d64b61fc
SHA15fe1de000270ce7f2efdb09931ce599165eacfa4
SHA256cd6a0f9d86363c4cea7f48ed10e7bdcab1261ab803d5af67e3d53117ddbf348d
SHA5129f0ceb1d3bd92dd9dbde56f13a417e4de4c0b07e9cba4dfeadee325f7f358b3ee941cea625d464ba81d7aa2c4efc8b77d9d926eb0192369b798757fe6b44c13c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba6872.exeFilesize
358KB
MD56cdce90c007d70f2d84b47f3d64b61fc
SHA15fe1de000270ce7f2efdb09931ce599165eacfa4
SHA256cd6a0f9d86363c4cea7f48ed10e7bdcab1261ab803d5af67e3d53117ddbf348d
SHA5129f0ceb1d3bd92dd9dbde56f13a417e4de4c0b07e9cba4dfeadee325f7f358b3ee941cea625d464ba81d7aa2c4efc8b77d9d926eb0192369b798757fe6b44c13c
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7134Vy.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f7134Vy.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h74bU03.exeFilesize
371KB
MD5026ad75c622ecf39c841f8e09c2b0e49
SHA15c3bc9f277461165825d2e8cdfd9b2777ec8d733
SHA2564d93e2d167b1fc930d99f7e7b10d6c6454f77d238f9ec53d51627065150f8b08
SHA5122fdd91f02d8fca79e47fabe29c96666a2938ff9208146d27dcfeaa5e83f6b5d93a110d68f3b3a5216fef05435fc58da19332adf2b102bf4fbb55fa765ac3e122
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h74bU03.exeFilesize
371KB
MD5026ad75c622ecf39c841f8e09c2b0e49
SHA15c3bc9f277461165825d2e8cdfd9b2777ec8d733
SHA2564d93e2d167b1fc930d99f7e7b10d6c6454f77d238f9ec53d51627065150f8b08
SHA5122fdd91f02d8fca79e47fabe29c96666a2938ff9208146d27dcfeaa5e83f6b5d93a110d68f3b3a5216fef05435fc58da19332adf2b102bf4fbb55fa765ac3e122
-
memory/224-160-0x0000000002BB0000-0x0000000002BDD000-memory.dmpFilesize
180KB
-
memory/224-161-0x0000000007170000-0x0000000007714000-memory.dmpFilesize
5.6MB
-
memory/224-162-0x0000000004D30000-0x0000000004D42000-memory.dmpFilesize
72KB
-
memory/224-163-0x0000000004D30000-0x0000000004D42000-memory.dmpFilesize
72KB
-
memory/224-165-0x0000000004D30000-0x0000000004D42000-memory.dmpFilesize
72KB
-
memory/224-167-0x0000000004D30000-0x0000000004D42000-memory.dmpFilesize
72KB
-
memory/224-169-0x0000000004D30000-0x0000000004D42000-memory.dmpFilesize
72KB
-
memory/224-171-0x0000000004D30000-0x0000000004D42000-memory.dmpFilesize
72KB
-
memory/224-173-0x0000000004D30000-0x0000000004D42000-memory.dmpFilesize
72KB
-
memory/224-175-0x0000000004D30000-0x0000000004D42000-memory.dmpFilesize
72KB
-
memory/224-177-0x0000000004D30000-0x0000000004D42000-memory.dmpFilesize
72KB
-
memory/224-179-0x0000000004D30000-0x0000000004D42000-memory.dmpFilesize
72KB
-
memory/224-181-0x0000000004D30000-0x0000000004D42000-memory.dmpFilesize
72KB
-
memory/224-183-0x0000000004D30000-0x0000000004D42000-memory.dmpFilesize
72KB
-
memory/224-185-0x0000000004D30000-0x0000000004D42000-memory.dmpFilesize
72KB
-
memory/224-187-0x0000000004D30000-0x0000000004D42000-memory.dmpFilesize
72KB
-
memory/224-189-0x0000000004D30000-0x0000000004D42000-memory.dmpFilesize
72KB
-
memory/224-190-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/224-191-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/224-192-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/224-193-0x0000000000400000-0x0000000002B0C000-memory.dmpFilesize
39.0MB
-
memory/224-196-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/224-197-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/224-198-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/224-195-0x0000000000400000-0x0000000002B0C000-memory.dmpFilesize
39.0MB
-
memory/1228-154-0x0000000000EE0000-0x0000000000EEA000-memory.dmpFilesize
40KB
-
memory/4344-205-0x00000000076D0000-0x000000000770E000-memory.dmpFilesize
248KB
-
memory/4344-206-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/4344-209-0x00000000076D0000-0x000000000770E000-memory.dmpFilesize
248KB
-
memory/4344-210-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/4344-208-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/4344-204-0x00000000076D0000-0x000000000770E000-memory.dmpFilesize
248KB
-
memory/4344-203-0x0000000004780000-0x00000000047CB000-memory.dmpFilesize
300KB
-
memory/4344-212-0x00000000076D0000-0x000000000770E000-memory.dmpFilesize
248KB
-
memory/4344-214-0x00000000076D0000-0x000000000770E000-memory.dmpFilesize
248KB
-
memory/4344-216-0x00000000076D0000-0x000000000770E000-memory.dmpFilesize
248KB
-
memory/4344-218-0x00000000076D0000-0x000000000770E000-memory.dmpFilesize
248KB
-
memory/4344-220-0x00000000076D0000-0x000000000770E000-memory.dmpFilesize
248KB
-
memory/4344-222-0x00000000076D0000-0x000000000770E000-memory.dmpFilesize
248KB
-
memory/4344-224-0x00000000076D0000-0x000000000770E000-memory.dmpFilesize
248KB
-
memory/4344-226-0x00000000076D0000-0x000000000770E000-memory.dmpFilesize
248KB
-
memory/4344-228-0x00000000076D0000-0x000000000770E000-memory.dmpFilesize
248KB
-
memory/4344-230-0x00000000076D0000-0x000000000770E000-memory.dmpFilesize
248KB
-
memory/4344-232-0x00000000076D0000-0x000000000770E000-memory.dmpFilesize
248KB
-
memory/4344-234-0x00000000076D0000-0x000000000770E000-memory.dmpFilesize
248KB
-
memory/4344-236-0x00000000076D0000-0x000000000770E000-memory.dmpFilesize
248KB
-
memory/4344-238-0x00000000076D0000-0x000000000770E000-memory.dmpFilesize
248KB
-
memory/4344-240-0x00000000076D0000-0x000000000770E000-memory.dmpFilesize
248KB
-
memory/4344-1113-0x0000000007860000-0x0000000007E78000-memory.dmpFilesize
6.1MB
-
memory/4344-1114-0x0000000007F00000-0x000000000800A000-memory.dmpFilesize
1.0MB
-
memory/4344-1115-0x0000000008040000-0x0000000008052000-memory.dmpFilesize
72KB
-
memory/4344-1116-0x0000000008060000-0x000000000809C000-memory.dmpFilesize
240KB
-
memory/4344-1117-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/4344-1118-0x0000000008350000-0x00000000083E2000-memory.dmpFilesize
584KB
-
memory/4344-1119-0x00000000083F0000-0x0000000008456000-memory.dmpFilesize
408KB
-
memory/4344-1121-0x0000000008B20000-0x0000000008CE2000-memory.dmpFilesize
1.8MB
-
memory/4344-1122-0x0000000008CF0000-0x000000000921C000-memory.dmpFilesize
5.2MB
-
memory/4344-1123-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/4344-1124-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/4344-1125-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/4344-1126-0x0000000009440000-0x00000000094B6000-memory.dmpFilesize
472KB
-
memory/4344-1127-0x00000000094D0000-0x0000000009520000-memory.dmpFilesize
320KB
-
memory/4648-1133-0x0000000000060000-0x0000000000092000-memory.dmpFilesize
200KB
-
memory/4648-1134-0x00000000048E0000-0x00000000048F0000-memory.dmpFilesize
64KB