Analysis
-
max time kernel
160s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14-10-2023 18:07
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.9d8ef5af655dc5cdc92ca4b6f019db80.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.9d8ef5af655dc5cdc92ca4b6f019db80.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.9d8ef5af655dc5cdc92ca4b6f019db80.exe
-
Size
701KB
-
MD5
9d8ef5af655dc5cdc92ca4b6f019db80
-
SHA1
c2d44fa41f85c77939c87bb0fed6d3dbbd7b3c67
-
SHA256
c947c837debbe5d3285675b550e33f3bdfd0f87aee7d230e1aa514b751956c20
-
SHA512
a49f9499f3502bd31324e86f79ac2c5c1d13c308161aac4f306824e8d8978143e0f47241eed6a22ebc1f798d411d6110be848c3e8ad37015a58a373b4f0f48a1
-
SSDEEP
12288:XMr8y90+BwUc0t9kH03s7znim+7bu/cNTE5izJFXpXm9NAWioputjd13RS:Hy3NsHes71+7i/Yiiz78JnpK513RS
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 21 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bu902103.exe healer C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bu902103.exe healer behavioral2/memory/1364-14-0x00000000008A0000-0x00000000008AA000-memory.dmp healer behavioral2/memory/208-28-0x00000000023D0000-0x00000000023EA000-memory.dmp healer behavioral2/memory/208-30-0x0000000000800000-0x0000000000900000-memory.dmp healer behavioral2/memory/208-35-0x0000000002740000-0x0000000002758000-memory.dmp healer behavioral2/memory/208-38-0x0000000002740000-0x0000000002752000-memory.dmp healer behavioral2/memory/208-39-0x0000000002740000-0x0000000002752000-memory.dmp healer behavioral2/memory/208-41-0x0000000002740000-0x0000000002752000-memory.dmp healer behavioral2/memory/208-43-0x0000000002740000-0x0000000002752000-memory.dmp healer behavioral2/memory/208-45-0x0000000002740000-0x0000000002752000-memory.dmp healer behavioral2/memory/208-47-0x0000000002740000-0x0000000002752000-memory.dmp healer behavioral2/memory/208-49-0x0000000002740000-0x0000000002752000-memory.dmp healer behavioral2/memory/208-51-0x0000000002740000-0x0000000002752000-memory.dmp healer behavioral2/memory/208-53-0x0000000002740000-0x0000000002752000-memory.dmp healer behavioral2/memory/208-55-0x0000000002740000-0x0000000002752000-memory.dmp healer behavioral2/memory/208-57-0x0000000002740000-0x0000000002752000-memory.dmp healer behavioral2/memory/208-59-0x0000000002740000-0x0000000002752000-memory.dmp healer behavioral2/memory/208-61-0x0000000002740000-0x0000000002752000-memory.dmp healer behavioral2/memory/208-63-0x0000000002740000-0x0000000002752000-memory.dmp healer behavioral2/memory/208-65-0x0000000002740000-0x0000000002752000-memory.dmp healer -
Processes:
bu902103.execor7125.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" bu902103.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" cor7125.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" cor7125.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection bu902103.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" bu902103.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" bu902103.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection cor7125.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" cor7125.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" cor7125.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" cor7125.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" bu902103.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" bu902103.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral2/memory/4196-80-0x0000000002540000-0x0000000002586000-memory.dmp family_redline behavioral2/memory/4196-83-0x0000000004AE0000-0x0000000004B24000-memory.dmp family_redline behavioral2/memory/4196-86-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral2/memory/4196-87-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral2/memory/4196-89-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral2/memory/4196-95-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral2/memory/4196-97-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral2/memory/4196-93-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral2/memory/4196-91-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral2/memory/4196-99-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral2/memory/4196-101-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral2/memory/4196-103-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral2/memory/4196-105-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral2/memory/4196-107-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral2/memory/4196-109-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral2/memory/4196-115-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral2/memory/4196-113-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral2/memory/4196-111-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral2/memory/4196-117-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
kina7107.exebu902103.execor7125.exedDP58s46.exepid process 1136 kina7107.exe 1364 bu902103.exe 208 cor7125.exe 4196 dDP58s46.exe -
Processes:
bu902103.execor7125.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" bu902103.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features cor7125.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" cor7125.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
NEAS.9d8ef5af655dc5cdc92ca4b6f019db80.exekina7107.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" NEAS.9d8ef5af655dc5cdc92ca4b6f019db80.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" kina7107.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
bu902103.execor7125.exepid process 1364 bu902103.exe 1364 bu902103.exe 208 cor7125.exe 208 cor7125.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
bu902103.execor7125.exedDP58s46.exedescription pid process Token: SeDebugPrivilege 1364 bu902103.exe Token: SeDebugPrivilege 208 cor7125.exe Token: SeDebugPrivilege 4196 dDP58s46.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
NEAS.9d8ef5af655dc5cdc92ca4b6f019db80.exekina7107.exedescription pid process target process PID 4364 wrote to memory of 1136 4364 NEAS.9d8ef5af655dc5cdc92ca4b6f019db80.exe kina7107.exe PID 4364 wrote to memory of 1136 4364 NEAS.9d8ef5af655dc5cdc92ca4b6f019db80.exe kina7107.exe PID 4364 wrote to memory of 1136 4364 NEAS.9d8ef5af655dc5cdc92ca4b6f019db80.exe kina7107.exe PID 1136 wrote to memory of 1364 1136 kina7107.exe bu902103.exe PID 1136 wrote to memory of 1364 1136 kina7107.exe bu902103.exe PID 1136 wrote to memory of 208 1136 kina7107.exe cor7125.exe PID 1136 wrote to memory of 208 1136 kina7107.exe cor7125.exe PID 1136 wrote to memory of 208 1136 kina7107.exe cor7125.exe PID 4364 wrote to memory of 4196 4364 NEAS.9d8ef5af655dc5cdc92ca4b6f019db80.exe dDP58s46.exe PID 4364 wrote to memory of 4196 4364 NEAS.9d8ef5af655dc5cdc92ca4b6f019db80.exe dDP58s46.exe PID 4364 wrote to memory of 4196 4364 NEAS.9d8ef5af655dc5cdc92ca4b6f019db80.exe dDP58s46.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.9d8ef5af655dc5cdc92ca4b6f019db80.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.9d8ef5af655dc5cdc92ca4b6f019db80.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina7107.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina7107.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bu902103.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bu902103.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cor7125.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cor7125.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dDP58s46.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dDP58s46.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dDP58s46.exeFilesize
349KB
MD5cbdf8313faded8b1096f60ea5f25f188
SHA1f3531915b999483b8d3c5328f57db03cb97c0cc9
SHA256f6bc9074464a1ff7149f30a6826065c8639fa190d223f514271f358af1969208
SHA512d9cbe6ad51e15715d6ca0ed067adb085572802a9179a3af782dfca95a0625fa847a9db026b9e99d2b160290a2733acbda702e0f2e8fe9fe527c602b7336dbfdd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dDP58s46.exeFilesize
349KB
MD5cbdf8313faded8b1096f60ea5f25f188
SHA1f3531915b999483b8d3c5328f57db03cb97c0cc9
SHA256f6bc9074464a1ff7149f30a6826065c8639fa190d223f514271f358af1969208
SHA512d9cbe6ad51e15715d6ca0ed067adb085572802a9179a3af782dfca95a0625fa847a9db026b9e99d2b160290a2733acbda702e0f2e8fe9fe527c602b7336dbfdd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina7107.exeFilesize
347KB
MD586abbd504e918c7c4917059549d52212
SHA18f7fbe880dcdf89094c4f89fd751f09f14265211
SHA2566b9d8aa3f399999df21d0d7ce1045eb4de03fba4f4dd5c681fdd75331de817c7
SHA5124900326170248fb4a6c340ee452688d25aa6684c406297e13a8d172f70e1bac6f5fbd9c2d2111b374b5b8d0be7e98dc563b3f0a1a48bc151df605c3b6e17753a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina7107.exeFilesize
347KB
MD586abbd504e918c7c4917059549d52212
SHA18f7fbe880dcdf89094c4f89fd751f09f14265211
SHA2566b9d8aa3f399999df21d0d7ce1045eb4de03fba4f4dd5c681fdd75331de817c7
SHA5124900326170248fb4a6c340ee452688d25aa6684c406297e13a8d172f70e1bac6f5fbd9c2d2111b374b5b8d0be7e98dc563b3f0a1a48bc151df605c3b6e17753a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bu902103.exeFilesize
11KB
MD5298ef2f35ad3acc67748f59552872720
SHA1541c30f6eece604785df5cc2faa7c55a82598601
SHA25667e53a74b5b03d175617d6985d5a397a34f107b5af7c1e272d75f1a3c974ca40
SHA5122f3c525e5b019690337fe82af5abadf4d00abdfd810955ed9eb6f5f6d82c8b68343ebbeb714a758f01009329a2c9c40eea7d4dbe8716f8140802eb9d7dec789e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bu902103.exeFilesize
11KB
MD5298ef2f35ad3acc67748f59552872720
SHA1541c30f6eece604785df5cc2faa7c55a82598601
SHA25667e53a74b5b03d175617d6985d5a397a34f107b5af7c1e272d75f1a3c974ca40
SHA5122f3c525e5b019690337fe82af5abadf4d00abdfd810955ed9eb6f5f6d82c8b68343ebbeb714a758f01009329a2c9c40eea7d4dbe8716f8140802eb9d7dec789e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cor7125.exeFilesize
292KB
MD52b52ad91022009d48244e018601d13f2
SHA196ed0d10246c53ddb2036fafd947607e52c494d5
SHA256e48a42feb02c7e5204314ad080f80c397982edd769a7a89c5919f670eb93b823
SHA5124960950af609ce3b0dc0a621538f576d449f2b5c84455be7bf3df6e41ffdb4ec95f54d6b349a0c74bf2e31afb64837a153f465bcf0e24e2e121b79e0a7065d14
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cor7125.exeFilesize
292KB
MD52b52ad91022009d48244e018601d13f2
SHA196ed0d10246c53ddb2036fafd947607e52c494d5
SHA256e48a42feb02c7e5204314ad080f80c397982edd769a7a89c5919f670eb93b823
SHA5124960950af609ce3b0dc0a621538f576d449f2b5c84455be7bf3df6e41ffdb4ec95f54d6b349a0c74bf2e31afb64837a153f465bcf0e24e2e121b79e0a7065d14
-
memory/208-36-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/208-43-0x0000000002740000-0x0000000002752000-memory.dmpFilesize
72KB
-
memory/208-26-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/208-27-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/208-28-0x00000000023D0000-0x00000000023EA000-memory.dmpFilesize
104KB
-
memory/208-29-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/208-30-0x0000000000800000-0x0000000000900000-memory.dmpFilesize
1024KB
-
memory/208-31-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/208-32-0x00000000007B0000-0x00000000007DD000-memory.dmpFilesize
180KB
-
memory/208-33-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/208-34-0x0000000004CA0000-0x0000000005244000-memory.dmpFilesize
5.6MB
-
memory/208-35-0x0000000002740000-0x0000000002758000-memory.dmpFilesize
96KB
-
memory/208-24-0x00000000007B0000-0x00000000007DD000-memory.dmpFilesize
180KB
-
memory/208-37-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/208-38-0x0000000002740000-0x0000000002752000-memory.dmpFilesize
72KB
-
memory/208-39-0x0000000002740000-0x0000000002752000-memory.dmpFilesize
72KB
-
memory/208-41-0x0000000002740000-0x0000000002752000-memory.dmpFilesize
72KB
-
memory/208-25-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/208-45-0x0000000002740000-0x0000000002752000-memory.dmpFilesize
72KB
-
memory/208-47-0x0000000002740000-0x0000000002752000-memory.dmpFilesize
72KB
-
memory/208-49-0x0000000002740000-0x0000000002752000-memory.dmpFilesize
72KB
-
memory/208-51-0x0000000002740000-0x0000000002752000-memory.dmpFilesize
72KB
-
memory/208-53-0x0000000002740000-0x0000000002752000-memory.dmpFilesize
72KB
-
memory/208-55-0x0000000002740000-0x0000000002752000-memory.dmpFilesize
72KB
-
memory/208-57-0x0000000002740000-0x0000000002752000-memory.dmpFilesize
72KB
-
memory/208-59-0x0000000002740000-0x0000000002752000-memory.dmpFilesize
72KB
-
memory/208-61-0x0000000002740000-0x0000000002752000-memory.dmpFilesize
72KB
-
memory/208-63-0x0000000002740000-0x0000000002752000-memory.dmpFilesize
72KB
-
memory/208-65-0x0000000002740000-0x0000000002752000-memory.dmpFilesize
72KB
-
memory/208-67-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/208-68-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/208-71-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/208-23-0x0000000000800000-0x0000000000900000-memory.dmpFilesize
1024KB
-
memory/208-72-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/1364-14-0x00000000008A0000-0x00000000008AA000-memory.dmpFilesize
40KB
-
memory/1364-15-0x00007FFF672A0000-0x00007FFF67D61000-memory.dmpFilesize
10.8MB
-
memory/1364-16-0x00007FFF672A0000-0x00007FFF67D61000-memory.dmpFilesize
10.8MB
-
memory/1364-18-0x00007FFF672A0000-0x00007FFF67D61000-memory.dmpFilesize
10.8MB
-
memory/4196-77-0x00000000007D0000-0x00000000008D0000-memory.dmpFilesize
1024KB
-
memory/4196-78-0x0000000000770000-0x00000000007BB000-memory.dmpFilesize
300KB
-
memory/4196-79-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/4196-80-0x0000000002540000-0x0000000002586000-memory.dmpFilesize
280KB
-
memory/4196-82-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/4196-81-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/4196-84-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/4196-83-0x0000000004AE0000-0x0000000004B24000-memory.dmpFilesize
272KB
-
memory/4196-85-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/4196-86-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4196-87-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4196-89-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4196-95-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4196-97-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4196-93-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4196-91-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4196-99-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4196-101-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4196-103-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4196-105-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4196-107-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4196-109-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4196-115-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4196-113-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4196-111-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4196-117-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4196-992-0x0000000000400000-0x00000000004C7000-memory.dmpFilesize
796KB
-
memory/4196-994-0x00000000007D0000-0x00000000008D0000-memory.dmpFilesize
1024KB
-
memory/4196-995-0x00000000745D0000-0x0000000074D80000-memory.dmpFilesize
7.7MB
-
memory/4196-996-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/4196-997-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/4196-998-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/4196-1000-0x0000000005240000-0x0000000005858000-memory.dmpFilesize
6.1MB
-
memory/4196-1001-0x00000000058E0000-0x00000000059EA000-memory.dmpFilesize
1.0MB
-
memory/4196-1003-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/4196-1004-0x0000000005A20000-0x0000000005A32000-memory.dmpFilesize
72KB
-
memory/4196-1005-0x0000000005CC0000-0x0000000005CFC000-memory.dmpFilesize
240KB
-
memory/4196-1007-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/4196-1008-0x0000000005E10000-0x0000000005E5C000-memory.dmpFilesize
304KB