Analysis
-
max time kernel
142s -
max time network
108s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
10-04-2023 20:12
Static task
static1
General
-
Target
bf1ba9aef4951a8c72db26b0d46bce7a2ac05e1d883d5016795126e88f40f4fc.exe
-
Size
940KB
-
MD5
9ff68422844d814b87ec6c6bdcf463e6
-
SHA1
7a0557d99fb30e7e17fb0e65fa1d87599b9bbc42
-
SHA256
bf1ba9aef4951a8c72db26b0d46bce7a2ac05e1d883d5016795126e88f40f4fc
-
SHA512
82d438b6cc9bddadc4c6e6bd2e28460f5c922788b311b73f7abe3a555bac7f8aae9fede83c81b780cb644a831faa2fc30e8f575270b47ac51aa76cb28a9123b4
-
SSDEEP
12288:FMray90ncPRDoT3uTuM+81SP21D8A6zKrClQIf9QO14EFtZ1zfbNotx9v0ZK6yD:LyvtEeTuZnzXzvlQIfz1lFBBo/yZK/
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
zima
176.113.115.145:4125
-
auth_value
2ef701d510c0d27e8a8e3270281678b1
Signatures
-
Processes:
pr174910.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr174910.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr174910.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr174910.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr174910.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr174910.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/4548-186-0x0000000002560000-0x00000000025A6000-memory.dmp family_redline behavioral1/memory/4548-187-0x0000000004A30000-0x0000000004A74000-memory.dmp family_redline behavioral1/memory/4548-189-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/4548-188-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/4548-191-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/4548-193-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/4548-195-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/4548-197-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/4548-199-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/4548-201-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/4548-203-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/4548-205-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/4548-207-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/4548-209-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/4548-211-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/4548-213-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/4548-215-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/4548-217-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/4548-219-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/4548-221-0x0000000004A30000-0x0000000004A6F000-memory.dmp family_redline behavioral1/memory/4548-502-0x0000000004A90000-0x0000000004AA0000-memory.dmp family_redline -
Executes dropped EXE 6 IoCs
Processes:
un908095.exeun947983.exepr174910.exequ456029.exerk892756.exesi196668.exepid process 2608 un908095.exe 4228 un947983.exe 4432 pr174910.exe 4548 qu456029.exe 1640 rk892756.exe 3888 si196668.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pr174910.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr174910.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr174910.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
un908095.exeun947983.exebf1ba9aef4951a8c72db26b0d46bce7a2ac05e1d883d5016795126e88f40f4fc.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un908095.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un908095.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un947983.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un947983.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bf1ba9aef4951a8c72db26b0d46bce7a2ac05e1d883d5016795126e88f40f4fc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" bf1ba9aef4951a8c72db26b0d46bce7a2ac05e1d883d5016795126e88f40f4fc.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1820 3888 WerFault.exe si196668.exe 4052 3888 WerFault.exe si196668.exe 4676 3888 WerFault.exe si196668.exe 4636 3888 WerFault.exe si196668.exe 4348 3888 WerFault.exe si196668.exe 4384 3888 WerFault.exe si196668.exe 3352 3888 WerFault.exe si196668.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pr174910.exequ456029.exerk892756.exepid process 4432 pr174910.exe 4432 pr174910.exe 4548 qu456029.exe 4548 qu456029.exe 1640 rk892756.exe 1640 rk892756.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pr174910.exequ456029.exerk892756.exedescription pid process Token: SeDebugPrivilege 4432 pr174910.exe Token: SeDebugPrivilege 4548 qu456029.exe Token: SeDebugPrivilege 1640 rk892756.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
bf1ba9aef4951a8c72db26b0d46bce7a2ac05e1d883d5016795126e88f40f4fc.exeun908095.exeun947983.exedescription pid process target process PID 2612 wrote to memory of 2608 2612 bf1ba9aef4951a8c72db26b0d46bce7a2ac05e1d883d5016795126e88f40f4fc.exe un908095.exe PID 2612 wrote to memory of 2608 2612 bf1ba9aef4951a8c72db26b0d46bce7a2ac05e1d883d5016795126e88f40f4fc.exe un908095.exe PID 2612 wrote to memory of 2608 2612 bf1ba9aef4951a8c72db26b0d46bce7a2ac05e1d883d5016795126e88f40f4fc.exe un908095.exe PID 2608 wrote to memory of 4228 2608 un908095.exe un947983.exe PID 2608 wrote to memory of 4228 2608 un908095.exe un947983.exe PID 2608 wrote to memory of 4228 2608 un908095.exe un947983.exe PID 4228 wrote to memory of 4432 4228 un947983.exe pr174910.exe PID 4228 wrote to memory of 4432 4228 un947983.exe pr174910.exe PID 4228 wrote to memory of 4432 4228 un947983.exe pr174910.exe PID 4228 wrote to memory of 4548 4228 un947983.exe qu456029.exe PID 4228 wrote to memory of 4548 4228 un947983.exe qu456029.exe PID 4228 wrote to memory of 4548 4228 un947983.exe qu456029.exe PID 2608 wrote to memory of 1640 2608 un908095.exe rk892756.exe PID 2608 wrote to memory of 1640 2608 un908095.exe rk892756.exe PID 2608 wrote to memory of 1640 2608 un908095.exe rk892756.exe PID 2612 wrote to memory of 3888 2612 bf1ba9aef4951a8c72db26b0d46bce7a2ac05e1d883d5016795126e88f40f4fc.exe si196668.exe PID 2612 wrote to memory of 3888 2612 bf1ba9aef4951a8c72db26b0d46bce7a2ac05e1d883d5016795126e88f40f4fc.exe si196668.exe PID 2612 wrote to memory of 3888 2612 bf1ba9aef4951a8c72db26b0d46bce7a2ac05e1d883d5016795126e88f40f4fc.exe si196668.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf1ba9aef4951a8c72db26b0d46bce7a2ac05e1d883d5016795126e88f40f4fc.exe"C:\Users\Admin\AppData\Local\Temp\bf1ba9aef4951a8c72db26b0d46bce7a2ac05e1d883d5016795126e88f40f4fc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un908095.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un908095.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un947983.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un947983.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr174910.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr174910.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu456029.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu456029.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk892756.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk892756.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si196668.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si196668.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 6203⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 7003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 8363⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 8243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 8843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 9243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 10643⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si196668.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si196668.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un908095.exeFilesize
674KB
MD531ed7af69f0902f7a3f0abafd689044d
SHA123a19110742f8d27e50833901a89f4695ffae3e8
SHA25655fcb81455e235fc23b6dd2695bd3115c40b5c2b3305bec1c39974c517a614ec
SHA5124748b62f03bb0b9734d482cfb35aa6d9c613cf476bec660f2cd6933609b71bb86686a95ebe9c1800f3cafa164195274668516fcca24f0f3e8b417d0ddc31461e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un908095.exeFilesize
674KB
MD531ed7af69f0902f7a3f0abafd689044d
SHA123a19110742f8d27e50833901a89f4695ffae3e8
SHA25655fcb81455e235fc23b6dd2695bd3115c40b5c2b3305bec1c39974c517a614ec
SHA5124748b62f03bb0b9734d482cfb35aa6d9c613cf476bec660f2cd6933609b71bb86686a95ebe9c1800f3cafa164195274668516fcca24f0f3e8b417d0ddc31461e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk892756.exeFilesize
169KB
MD549cf89c8f27381f9cd1fd133d49a106c
SHA17f7be1a57bc64af0025a6f20a9139d379c53b0cd
SHA256c294199ba08e47570a0ef2633fb8957847edd0b6fca5173848bcdb3bd4537c02
SHA512f04f9a15ee26677736f5ddd5431204b5dfd92a4ae47bbf870f5bc486b2677e69c0785ea794e0177d576beb7c296fd19df93faf46e3a8d5104fcdc7b7f565f68d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk892756.exeFilesize
169KB
MD549cf89c8f27381f9cd1fd133d49a106c
SHA17f7be1a57bc64af0025a6f20a9139d379c53b0cd
SHA256c294199ba08e47570a0ef2633fb8957847edd0b6fca5173848bcdb3bd4537c02
SHA512f04f9a15ee26677736f5ddd5431204b5dfd92a4ae47bbf870f5bc486b2677e69c0785ea794e0177d576beb7c296fd19df93faf46e3a8d5104fcdc7b7f565f68d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un947983.exeFilesize
520KB
MD57ec021682bfd4450b93bde083516f849
SHA139c6aa7b8796230eb9c445ffdd34aef4ec41c257
SHA256a4e4a608081e2bde4736bce1aac870be3e6b1aee5f0c71e8089e1b3f89146373
SHA512c0292f4a1a31e45ca70620a4c5fe9b8aaa4d647bdd5238e7ead31fe68b63bc4fd0127465a51a8fe160fd8b67a5d14e63087461e1500dcce28531d7091f0a2ac9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un947983.exeFilesize
520KB
MD57ec021682bfd4450b93bde083516f849
SHA139c6aa7b8796230eb9c445ffdd34aef4ec41c257
SHA256a4e4a608081e2bde4736bce1aac870be3e6b1aee5f0c71e8089e1b3f89146373
SHA512c0292f4a1a31e45ca70620a4c5fe9b8aaa4d647bdd5238e7ead31fe68b63bc4fd0127465a51a8fe160fd8b67a5d14e63087461e1500dcce28531d7091f0a2ac9
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr174910.exeFilesize
239KB
MD5ada8a448f3699aadc882a4281bad1af5
SHA151f32a87c8403ce7f50d71587818a54b02fe9d5c
SHA256173bb606ea32e7b7e276cf7f74a0a6d9a0570b5e9b2a3c5e483d03b87fc1f839
SHA512ad1f4d37c920d37bee47ac7946bb02e37bcea988d17542521f756a73a8a07d32f509a0d303f0847077699f9f09f677591e1f73fdd3514b75d83a1f50727bbdbf
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr174910.exeFilesize
239KB
MD5ada8a448f3699aadc882a4281bad1af5
SHA151f32a87c8403ce7f50d71587818a54b02fe9d5c
SHA256173bb606ea32e7b7e276cf7f74a0a6d9a0570b5e9b2a3c5e483d03b87fc1f839
SHA512ad1f4d37c920d37bee47ac7946bb02e37bcea988d17542521f756a73a8a07d32f509a0d303f0847077699f9f09f677591e1f73fdd3514b75d83a1f50727bbdbf
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu456029.exeFilesize
297KB
MD5fff8194de962fe827af5d4109665dbfc
SHA14939ddb06633a9f871c776b4b28fca307b60adf7
SHA2560d745ea26be29281555a9e0244a0c6d517ac32cf65e23f185b3ca9353632e385
SHA512b2e7806d5eed36e340094e577122886cb1ca2afa0e9cf20f3fcf58c725776693db53e3947bf1c8ade6b1a1f951483b8af3860f703c723b7ae69bfc92cfff75df
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu456029.exeFilesize
297KB
MD5fff8194de962fe827af5d4109665dbfc
SHA14939ddb06633a9f871c776b4b28fca307b60adf7
SHA2560d745ea26be29281555a9e0244a0c6d517ac32cf65e23f185b3ca9353632e385
SHA512b2e7806d5eed36e340094e577122886cb1ca2afa0e9cf20f3fcf58c725776693db53e3947bf1c8ade6b1a1f951483b8af3860f703c723b7ae69bfc92cfff75df
-
memory/1640-1121-0x0000000009FA0000-0x0000000009FEB000-memory.dmpFilesize
300KB
-
memory/1640-1122-0x00000000048F0000-0x0000000004900000-memory.dmpFilesize
64KB
-
memory/1640-1119-0x0000000000070000-0x00000000000A0000-memory.dmpFilesize
192KB
-
memory/1640-1123-0x00000000048F0000-0x0000000004900000-memory.dmpFilesize
64KB
-
memory/1640-1120-0x00000000008B0000-0x00000000008B6000-memory.dmpFilesize
24KB
-
memory/3888-1129-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB
-
memory/4432-152-0x0000000002090000-0x00000000020A2000-memory.dmpFilesize
72KB
-
memory/4432-174-0x0000000002090000-0x00000000020A2000-memory.dmpFilesize
72KB
-
memory/4432-149-0x0000000002090000-0x00000000020A2000-memory.dmpFilesize
72KB
-
memory/4432-154-0x0000000002090000-0x00000000020A2000-memory.dmpFilesize
72KB
-
memory/4432-156-0x0000000002090000-0x00000000020A2000-memory.dmpFilesize
72KB
-
memory/4432-158-0x0000000002090000-0x00000000020A2000-memory.dmpFilesize
72KB
-
memory/4432-160-0x0000000002090000-0x00000000020A2000-memory.dmpFilesize
72KB
-
memory/4432-162-0x0000000002090000-0x00000000020A2000-memory.dmpFilesize
72KB
-
memory/4432-164-0x0000000002090000-0x00000000020A2000-memory.dmpFilesize
72KB
-
memory/4432-166-0x0000000002090000-0x00000000020A2000-memory.dmpFilesize
72KB
-
memory/4432-168-0x0000000002090000-0x00000000020A2000-memory.dmpFilesize
72KB
-
memory/4432-170-0x0000000002090000-0x00000000020A2000-memory.dmpFilesize
72KB
-
memory/4432-172-0x0000000002090000-0x00000000020A2000-memory.dmpFilesize
72KB
-
memory/4432-150-0x0000000002090000-0x00000000020A2000-memory.dmpFilesize
72KB
-
memory/4432-176-0x0000000002090000-0x00000000020A2000-memory.dmpFilesize
72KB
-
memory/4432-177-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/4432-178-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/4432-180-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/4432-148-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/4432-145-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/4432-147-0x0000000002090000-0x00000000020A8000-memory.dmpFilesize
96KB
-
memory/4432-146-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/4432-144-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/4432-143-0x0000000004BB0000-0x00000000050AE000-memory.dmpFilesize
5.0MB
-
memory/4432-142-0x0000000001F90000-0x0000000001FAA000-memory.dmpFilesize
104KB
-
memory/4548-188-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/4548-197-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/4548-199-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/4548-201-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/4548-203-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/4548-205-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/4548-207-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/4548-209-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/4548-211-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/4548-213-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/4548-215-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/4548-217-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/4548-219-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/4548-221-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/4548-499-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4548-500-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4548-502-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4548-1097-0x00000000055E0000-0x0000000005BE6000-memory.dmpFilesize
6.0MB
-
memory/4548-1098-0x0000000005050000-0x000000000515A000-memory.dmpFilesize
1.0MB
-
memory/4548-1099-0x0000000005190000-0x00000000051A2000-memory.dmpFilesize
72KB
-
memory/4548-1100-0x00000000051B0000-0x00000000051EE000-memory.dmpFilesize
248KB
-
memory/4548-1101-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4548-1102-0x0000000005300000-0x000000000534B000-memory.dmpFilesize
300KB
-
memory/4548-1103-0x0000000005490000-0x00000000054F6000-memory.dmpFilesize
408KB
-
memory/4548-1104-0x0000000006170000-0x0000000006202000-memory.dmpFilesize
584KB
-
memory/4548-1106-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4548-1107-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4548-1108-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4548-1109-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/4548-1110-0x0000000007610000-0x00000000077D2000-memory.dmpFilesize
1.8MB
-
memory/4548-195-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/4548-193-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/4548-191-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/4548-189-0x0000000004A30000-0x0000000004A6F000-memory.dmpFilesize
252KB
-
memory/4548-187-0x0000000004A30000-0x0000000004A74000-memory.dmpFilesize
272KB
-
memory/4548-186-0x0000000002560000-0x00000000025A6000-memory.dmpFilesize
280KB
-
memory/4548-185-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/4548-1111-0x00000000077E0000-0x0000000007D0C000-memory.dmpFilesize
5.2MB
-
memory/4548-1112-0x0000000000740000-0x00000000007B6000-memory.dmpFilesize
472KB
-
memory/4548-1113-0x0000000007E20000-0x0000000007E70000-memory.dmpFilesize
320KB