Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11-04-2023 12:21
Static task
static1
Behavioral task
behavioral1
Sample
bd1b362e5decd812b883a62629913188a790f3f49b55b52aa9108b63e35e89e8.exe
Resource
win10v2004-20230220-en
General
-
Target
bd1b362e5decd812b883a62629913188a790f3f49b55b52aa9108b63e35e89e8.exe
-
Size
992KB
-
MD5
833a4c872473812bc08ed60beb3df591
-
SHA1
72b6da8b6157fade901cd889f1ef9313718d0448
-
SHA256
bd1b362e5decd812b883a62629913188a790f3f49b55b52aa9108b63e35e89e8
-
SHA512
1f805cbb051957835f9e9f71f831b35b8c434d91eee0fc8e5b1d5cb06acb6ac4f7fbb23020d03f9fe67d55a4508da9e98587454b87d1bbb962f092388761a1de
-
SSDEEP
24576:LyTkW0dAmUbWmMGNefADDCg+MKFqTmeqH2:+THw4bWLGNeYDDC5qqh
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Processes:
az748484.exebu357818.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" az748484.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" az748484.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" az748484.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" bu357818.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" bu357818.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" bu357818.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection az748484.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" az748484.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" az748484.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection bu357818.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" bu357818.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" bu357818.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/1388-210-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1388-211-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1388-213-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1388-215-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1388-217-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1388-219-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1388-221-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1388-223-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1388-225-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1388-227-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1388-232-0x0000000004BB0000-0x0000000004BC0000-memory.dmp family_redline behavioral1/memory/1388-231-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1388-237-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1388-235-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1388-239-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1388-241-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1388-243-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline behavioral1/memory/1388-245-0x0000000004A90000-0x0000000004ACF000-memory.dmp family_redline -
Executes dropped EXE 6 IoCs
Processes:
kina9550.exekina2917.exekina0189.exeaz748484.exebu357818.execor2248.exepid process 3268 kina9550.exe 4404 kina2917.exe 2192 kina0189.exe 2032 az748484.exe 452 bu357818.exe 1388 cor2248.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
bu357818.exeaz748484.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" bu357818.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" az748484.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features bu357818.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
bd1b362e5decd812b883a62629913188a790f3f49b55b52aa9108b63e35e89e8.exekina9550.exekina2917.exekina0189.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" bd1b362e5decd812b883a62629913188a790f3f49b55b52aa9108b63e35e89e8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina9550.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" kina9550.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina2917.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" kina2917.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina0189.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" kina0189.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bd1b362e5decd812b883a62629913188a790f3f49b55b52aa9108b63e35e89e8.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2960 sc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4348 452 WerFault.exe bu357818.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
az748484.exebu357818.execor2248.exepid process 2032 az748484.exe 2032 az748484.exe 452 bu357818.exe 452 bu357818.exe 1388 cor2248.exe 1388 cor2248.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
az748484.exebu357818.execor2248.exedescription pid process Token: SeDebugPrivilege 2032 az748484.exe Token: SeDebugPrivilege 452 bu357818.exe Token: SeDebugPrivilege 1388 cor2248.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
bd1b362e5decd812b883a62629913188a790f3f49b55b52aa9108b63e35e89e8.exekina9550.exekina2917.exekina0189.exedescription pid process target process PID 4256 wrote to memory of 3268 4256 bd1b362e5decd812b883a62629913188a790f3f49b55b52aa9108b63e35e89e8.exe kina9550.exe PID 4256 wrote to memory of 3268 4256 bd1b362e5decd812b883a62629913188a790f3f49b55b52aa9108b63e35e89e8.exe kina9550.exe PID 4256 wrote to memory of 3268 4256 bd1b362e5decd812b883a62629913188a790f3f49b55b52aa9108b63e35e89e8.exe kina9550.exe PID 3268 wrote to memory of 4404 3268 kina9550.exe kina2917.exe PID 3268 wrote to memory of 4404 3268 kina9550.exe kina2917.exe PID 3268 wrote to memory of 4404 3268 kina9550.exe kina2917.exe PID 4404 wrote to memory of 2192 4404 kina2917.exe kina0189.exe PID 4404 wrote to memory of 2192 4404 kina2917.exe kina0189.exe PID 4404 wrote to memory of 2192 4404 kina2917.exe kina0189.exe PID 2192 wrote to memory of 2032 2192 kina0189.exe az748484.exe PID 2192 wrote to memory of 2032 2192 kina0189.exe az748484.exe PID 2192 wrote to memory of 452 2192 kina0189.exe bu357818.exe PID 2192 wrote to memory of 452 2192 kina0189.exe bu357818.exe PID 2192 wrote to memory of 452 2192 kina0189.exe bu357818.exe PID 4404 wrote to memory of 1388 4404 kina2917.exe cor2248.exe PID 4404 wrote to memory of 1388 4404 kina2917.exe cor2248.exe PID 4404 wrote to memory of 1388 4404 kina2917.exe cor2248.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd1b362e5decd812b883a62629913188a790f3f49b55b52aa9108b63e35e89e8.exe"C:\Users\Admin\AppData\Local\Temp\bd1b362e5decd812b883a62629913188a790f3f49b55b52aa9108b63e35e89e8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina9550.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina9550.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina2917.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina2917.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina0189.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina0189.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az748484.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az748484.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu357818.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu357818.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 10806⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor2248.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor2248.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 452 -ip 4521⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina9550.exeFilesize
838KB
MD5a22d1fda1dad896ac9243df1ab680cd3
SHA1abe577b76fb3709aa8241ff04e00eb76922cb1a0
SHA256025dfbca56abdf2bf328662e7881f12678c50bb2e1553fab925f4685ccb17a80
SHA512d9c66001b3fadded4bdb7c0507a876b993bab010bbb246dfa4941dd8f26e5ffb999520d18829322231008a178c82f6a2c697f88e6c4d135c242d28b8c362a3db
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina9550.exeFilesize
838KB
MD5a22d1fda1dad896ac9243df1ab680cd3
SHA1abe577b76fb3709aa8241ff04e00eb76922cb1a0
SHA256025dfbca56abdf2bf328662e7881f12678c50bb2e1553fab925f4685ccb17a80
SHA512d9c66001b3fadded4bdb7c0507a876b993bab010bbb246dfa4941dd8f26e5ffb999520d18829322231008a178c82f6a2c697f88e6c4d135c242d28b8c362a3db
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina2917.exeFilesize
655KB
MD537f0167852264c1511621eb54db0f6b4
SHA1e645ae33355d62a58b5448f93b28df81e5fc67ca
SHA256b33323005bff22cee34575b38acc78754964c953744fcaa37d4478adbabe2e16
SHA512abb06b311703799bc0af6fd96ff2ceacdec632c8ec71013c1237d3923369d34ac0750d681e4385a820a13752719f06393d51d32c5027c6eff5236109cac4fd37
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina2917.exeFilesize
655KB
MD537f0167852264c1511621eb54db0f6b4
SHA1e645ae33355d62a58b5448f93b28df81e5fc67ca
SHA256b33323005bff22cee34575b38acc78754964c953744fcaa37d4478adbabe2e16
SHA512abb06b311703799bc0af6fd96ff2ceacdec632c8ec71013c1237d3923369d34ac0750d681e4385a820a13752719f06393d51d32c5027c6eff5236109cac4fd37
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor2248.exeFilesize
299KB
MD5723e9f4b056a4a5782f8ad497390982d
SHA1618cd240d19d5b0734ea402e433dcf407a9f3d06
SHA256a89bea871be42ef886b080eb5fc15a057eec37c565f053b70b8faada2ed07031
SHA5122c4f7cd2808e98e2afe73719584d6fc6fdd6dec9bed83b45c6508a542022d18434651205bcc6d45fef4d5b17cab8df14c50f939c89aa8591cd06a26656290530
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor2248.exeFilesize
299KB
MD5723e9f4b056a4a5782f8ad497390982d
SHA1618cd240d19d5b0734ea402e433dcf407a9f3d06
SHA256a89bea871be42ef886b080eb5fc15a057eec37c565f053b70b8faada2ed07031
SHA5122c4f7cd2808e98e2afe73719584d6fc6fdd6dec9bed83b45c6508a542022d18434651205bcc6d45fef4d5b17cab8df14c50f939c89aa8591cd06a26656290530
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina0189.exeFilesize
324KB
MD5b5f4b87972296848bd65f9c364809b0f
SHA13986873665fb639a0e37ecb64fa88c203e3df1a9
SHA256663b87593d3d6fbb453811131c0a1c580c2138a8e7b780bc2865ac23cb34b8d8
SHA5120033a0cecb01ac136677dbdf9bbc2fa4efa1b5bb70fcf8739fd69f6b8e18c7c512d4811738b9fdd30c5767610a889165db7cf7354bf8ac642bf1fef2d34a0c18
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina0189.exeFilesize
324KB
MD5b5f4b87972296848bd65f9c364809b0f
SHA13986873665fb639a0e37ecb64fa88c203e3df1a9
SHA256663b87593d3d6fbb453811131c0a1c580c2138a8e7b780bc2865ac23cb34b8d8
SHA5120033a0cecb01ac136677dbdf9bbc2fa4efa1b5bb70fcf8739fd69f6b8e18c7c512d4811738b9fdd30c5767610a889165db7cf7354bf8ac642bf1fef2d34a0c18
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az748484.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az748484.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu357818.exeFilesize
239KB
MD505db56d99dcc72a1fbcc068a92fe7f86
SHA14c314b1ad046899de6489f241331b412403ed8d9
SHA2561e4842185a45adb75c106b3b72d38e76257304957cb994b0487f2870e7710539
SHA51280f6498a813bca48885d98ef9b5518035cfeb632bd853b872b69384fce07a3d0cec3d27abd5b5a84a3b077bc076d1edb0d5839f4c2c28fd636239fe42cf07d5e
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu357818.exeFilesize
239KB
MD505db56d99dcc72a1fbcc068a92fe7f86
SHA14c314b1ad046899de6489f241331b412403ed8d9
SHA2561e4842185a45adb75c106b3b72d38e76257304957cb994b0487f2870e7710539
SHA51280f6498a813bca48885d98ef9b5518035cfeb632bd853b872b69384fce07a3d0cec3d27abd5b5a84a3b077bc076d1edb0d5839f4c2c28fd636239fe42cf07d5e
-
memory/452-176-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/452-169-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/452-170-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/452-171-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/452-172-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/452-174-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/452-168-0x0000000004BE0000-0x0000000005184000-memory.dmpFilesize
5.6MB
-
memory/452-178-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/452-180-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/452-182-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/452-184-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/452-186-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/452-188-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/452-190-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/452-192-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/452-194-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/452-196-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/452-198-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/452-199-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/452-200-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/452-201-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/452-202-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/452-204-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/452-167-0x0000000000650000-0x000000000067D000-memory.dmpFilesize
180KB
-
memory/1388-221-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1388-241-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1388-211-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1388-213-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1388-215-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1388-217-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1388-219-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1388-1136-0x0000000006730000-0x0000000006C5C000-memory.dmpFilesize
5.2MB
-
memory/1388-223-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1388-225-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1388-227-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1388-228-0x0000000000620000-0x000000000066B000-memory.dmpFilesize
300KB
-
memory/1388-229-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1388-234-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1388-232-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1388-231-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1388-237-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1388-235-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1388-239-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1388-210-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1388-243-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1388-245-0x0000000004A90000-0x0000000004ACF000-memory.dmpFilesize
252KB
-
memory/1388-1120-0x0000000005170000-0x0000000005788000-memory.dmpFilesize
6.1MB
-
memory/1388-1121-0x0000000005790000-0x000000000589A000-memory.dmpFilesize
1.0MB
-
memory/1388-1122-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/1388-1123-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1388-1124-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/1388-1126-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1388-1127-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1388-1128-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1388-1129-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/1388-1130-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/1388-1132-0x0000000006270000-0x0000000006302000-memory.dmpFilesize
584KB
-
memory/1388-1133-0x0000000006350000-0x00000000063C6000-memory.dmpFilesize
472KB
-
memory/1388-1134-0x00000000063E0000-0x0000000006430000-memory.dmpFilesize
320KB
-
memory/1388-1135-0x0000000006550000-0x0000000006712000-memory.dmpFilesize
1.8MB
-
memory/2032-161-0x0000000000CA0000-0x0000000000CAA000-memory.dmpFilesize
40KB