Analysis
-
max time kernel
57s -
max time network
70s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 18:39
Static task
static1
Behavioral task
behavioral1
Sample
90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec.exe
Resource
win10-20230220-en
General
-
Target
90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec.exe
-
Size
660KB
-
MD5
af693cd27a9b597e7280cd8d1125b84e
-
SHA1
b13b326a57bf54ff38ae894d194172ac7df55d3a
-
SHA256
90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec
-
SHA512
392dc2523238b7fab9eb720ff409b550150a110a3dd422be911e62754aca8e5872426ec43c93f5f5ef5561e57cb88138504b2b29fa97e2e32ea697df2eba92cf
-
SSDEEP
12288:XMrsy90fm2v8lQvqJhOpqJ67489149GZSdg8Lgl6xaYp0S:zyUmQZU4pqJct1OdgZs0y
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro0346.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0346.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0346.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0346.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0346.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0346.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/4032-146-0x0000000002360000-0x00000000023A6000-memory.dmp family_redline behavioral1/memory/4032-147-0x00000000023E0000-0x0000000002424000-memory.dmp family_redline behavioral1/memory/4032-151-0x00000000023E0000-0x000000000241F000-memory.dmp family_redline behavioral1/memory/4032-155-0x00000000023E0000-0x000000000241F000-memory.dmp family_redline behavioral1/memory/4032-159-0x00000000023E0000-0x000000000241F000-memory.dmp family_redline behavioral1/memory/4032-164-0x00000000023E0000-0x000000000241F000-memory.dmp family_redline behavioral1/memory/4032-148-0x00000000023E0000-0x000000000241F000-memory.dmp family_redline behavioral1/memory/4032-172-0x00000000023E0000-0x000000000241F000-memory.dmp family_redline behavioral1/memory/4032-176-0x00000000023E0000-0x000000000241F000-memory.dmp family_redline behavioral1/memory/4032-182-0x00000000023E0000-0x000000000241F000-memory.dmp family_redline behavioral1/memory/4032-187-0x00000000023E0000-0x000000000241F000-memory.dmp family_redline behavioral1/memory/4032-191-0x00000000023E0000-0x000000000241F000-memory.dmp family_redline behavioral1/memory/4032-195-0x00000000023E0000-0x000000000241F000-memory.dmp family_redline behavioral1/memory/4032-198-0x00000000023E0000-0x000000000241F000-memory.dmp family_redline behavioral1/memory/4032-202-0x00000000023E0000-0x000000000241F000-memory.dmp family_redline behavioral1/memory/4032-207-0x00000000023E0000-0x000000000241F000-memory.dmp family_redline behavioral1/memory/4032-210-0x00000000023E0000-0x000000000241F000-memory.dmp family_redline behavioral1/memory/4032-212-0x00000000023E0000-0x000000000241F000-memory.dmp family_redline behavioral1/memory/4032-214-0x00000000023E0000-0x000000000241F000-memory.dmp family_redline behavioral1/memory/1560-1099-0x0000000004A30000-0x0000000004A40000-memory.dmp family_redline -
Executes dropped EXE 5 IoCs
Processes:
un559158.exepro0346.exepro0346.exequ4353.exesi352331.exepid process 4292 un559158.exe 4988 pro0346.exe 1560 pro0346.exe 4032 qu4353.exe 4048 si352331.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro0346.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro0346.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0346.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un559158.exe90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un559158.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un559158.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
pro0346.exedescription pid process target process PID 4988 set thread context of 1560 4988 pro0346.exe pro0346.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro0346.exequ4353.exesi352331.exepid process 1560 pro0346.exe 1560 pro0346.exe 4032 qu4353.exe 4032 qu4353.exe 4048 si352331.exe 4048 si352331.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
qu4353.exepro0346.exesi352331.exedescription pid process Token: SeDebugPrivilege 4032 qu4353.exe Token: SeDebugPrivilege 1560 pro0346.exe Token: SeDebugPrivilege 4048 si352331.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec.exeun559158.exepro0346.exedescription pid process target process PID 1008 wrote to memory of 4292 1008 90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec.exe un559158.exe PID 1008 wrote to memory of 4292 1008 90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec.exe un559158.exe PID 1008 wrote to memory of 4292 1008 90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec.exe un559158.exe PID 4292 wrote to memory of 4988 4292 un559158.exe pro0346.exe PID 4292 wrote to memory of 4988 4292 un559158.exe pro0346.exe PID 4292 wrote to memory of 4988 4292 un559158.exe pro0346.exe PID 4988 wrote to memory of 1560 4988 pro0346.exe pro0346.exe PID 4988 wrote to memory of 1560 4988 pro0346.exe pro0346.exe PID 4988 wrote to memory of 1560 4988 pro0346.exe pro0346.exe PID 4988 wrote to memory of 1560 4988 pro0346.exe pro0346.exe PID 4988 wrote to memory of 1560 4988 pro0346.exe pro0346.exe PID 4988 wrote to memory of 1560 4988 pro0346.exe pro0346.exe PID 4988 wrote to memory of 1560 4988 pro0346.exe pro0346.exe PID 4988 wrote to memory of 1560 4988 pro0346.exe pro0346.exe PID 4988 wrote to memory of 1560 4988 pro0346.exe pro0346.exe PID 4292 wrote to memory of 4032 4292 un559158.exe qu4353.exe PID 4292 wrote to memory of 4032 4292 un559158.exe qu4353.exe PID 4292 wrote to memory of 4032 4292 un559158.exe qu4353.exe PID 1008 wrote to memory of 4048 1008 90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec.exe si352331.exe PID 1008 wrote to memory of 4048 1008 90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec.exe si352331.exe PID 1008 wrote to memory of 4048 1008 90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec.exe si352331.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec.exe"C:\Users\Admin\AppData\Local\Temp\90a84d264fc43fa31e07b32a390fe52f46986963083e23dc809a1ac76510a3ec.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un559158.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un559158.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0346.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0346.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0346.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0346.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4353.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4353.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si352331.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si352331.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si352331.exeFilesize
175KB
MD530d5899240fca714b24efdbd88fcc6fa
SHA1ec419485acc64cf73a34f820d76df4c51c32414d
SHA25623d15bc3dfb11cd270d2bb9a64f2aa1e106ddb2c38e21a7fecf24b91f74331a6
SHA512cd2e7a6d78117cf5e3e66506605b7765496ada61e26c159b363c4aa4366e555fe3dfa9c5bdb180d44b5f73693b21acda8e3457fd173b0fd68b9a3175c842c51e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si352331.exeFilesize
175KB
MD530d5899240fca714b24efdbd88fcc6fa
SHA1ec419485acc64cf73a34f820d76df4c51c32414d
SHA25623d15bc3dfb11cd270d2bb9a64f2aa1e106ddb2c38e21a7fecf24b91f74331a6
SHA512cd2e7a6d78117cf5e3e66506605b7765496ada61e26c159b363c4aa4366e555fe3dfa9c5bdb180d44b5f73693b21acda8e3457fd173b0fd68b9a3175c842c51e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un559158.exeFilesize
517KB
MD59eed2786a9090909e3e51c1c51f487ef
SHA1b33fd6abec5e8108e1ab68ec77b719ea25db5a4d
SHA2568b0287f4920e1a964eb2dc06e82480eff045013c55e5eea098ba9849383ae35c
SHA512ac10b6d4a502ebef9085d47d6fc3fd11c785f2367c07e7b5c554709499d685232c93c88c605ab39ae108bda8ff6b20a8409d666bcb734cfc9959d54eb98f0a70
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un559158.exeFilesize
517KB
MD59eed2786a9090909e3e51c1c51f487ef
SHA1b33fd6abec5e8108e1ab68ec77b719ea25db5a4d
SHA2568b0287f4920e1a964eb2dc06e82480eff045013c55e5eea098ba9849383ae35c
SHA512ac10b6d4a502ebef9085d47d6fc3fd11c785f2367c07e7b5c554709499d685232c93c88c605ab39ae108bda8ff6b20a8409d666bcb734cfc9959d54eb98f0a70
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0346.exeFilesize
237KB
MD58554ba518f0ac7c56812c8c6ed688a27
SHA15a1ebda6791b9c1d2b1261db0779115a5c0d8cb9
SHA25620b7e20125e3aaceb60a2530fab66c9c2c155c67bc83c02f90f69f37970d5ee6
SHA512ced9ef73a99f2707abd9f399d2e5c16333781a4237dcd72ef0231b86d6ae7b46719f281d4b00ae19d62903b869584be9aadf7310c80079c86dbdf46a06544dd0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0346.exeFilesize
237KB
MD58554ba518f0ac7c56812c8c6ed688a27
SHA15a1ebda6791b9c1d2b1261db0779115a5c0d8cb9
SHA25620b7e20125e3aaceb60a2530fab66c9c2c155c67bc83c02f90f69f37970d5ee6
SHA512ced9ef73a99f2707abd9f399d2e5c16333781a4237dcd72ef0231b86d6ae7b46719f281d4b00ae19d62903b869584be9aadf7310c80079c86dbdf46a06544dd0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0346.exeFilesize
237KB
MD58554ba518f0ac7c56812c8c6ed688a27
SHA15a1ebda6791b9c1d2b1261db0779115a5c0d8cb9
SHA25620b7e20125e3aaceb60a2530fab66c9c2c155c67bc83c02f90f69f37970d5ee6
SHA512ced9ef73a99f2707abd9f399d2e5c16333781a4237dcd72ef0231b86d6ae7b46719f281d4b00ae19d62903b869584be9aadf7310c80079c86dbdf46a06544dd0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4353.exeFilesize
294KB
MD56cf55843429a2e18929b5ac2645e3a4b
SHA1b3dec7f9c4b62a46ab202a58e11301a79d759d40
SHA2565d366298a658e3211877618b1106f99bbc0f569581b5578692062707f92b76f1
SHA512c75f74634a3ff005adc928179ee161948f432b0a7c8e41ef0071a237f3c54fd2c2b0686e0f2f28b9b5c56259058550731833a72a83c9d77123459796a65f9b9d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4353.exeFilesize
294KB
MD56cf55843429a2e18929b5ac2645e3a4b
SHA1b3dec7f9c4b62a46ab202a58e11301a79d759d40
SHA2565d366298a658e3211877618b1106f99bbc0f569581b5578692062707f92b76f1
SHA512c75f74634a3ff005adc928179ee161948f432b0a7c8e41ef0071a237f3c54fd2c2b0686e0f2f28b9b5c56259058550731833a72a83c9d77123459796a65f9b9d
-
memory/1560-1101-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/1560-209-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/1560-142-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1560-143-0x0000000002200000-0x000000000221A000-memory.dmpFilesize
104KB
-
memory/1560-144-0x0000000004A40000-0x0000000004F3E000-memory.dmpFilesize
5.0MB
-
memory/1560-145-0x0000000004920000-0x0000000004938000-memory.dmpFilesize
96KB
-
memory/1560-135-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1560-1108-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1560-149-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/1560-184-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/1560-150-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/1560-1099-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/1560-154-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/1560-1100-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/1560-158-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/1560-136-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1560-165-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/1560-163-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/1560-162-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/1560-204-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/1560-201-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/1560-167-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/1560-196-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/1560-177-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/1560-192-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/1560-188-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/1560-132-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1560-170-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/1560-181-0x0000000004920000-0x0000000004932000-memory.dmpFilesize
72KB
-
memory/4032-182-0x00000000023E0000-0x000000000241F000-memory.dmpFilesize
252KB
-
memory/4032-1092-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/4032-171-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/4032-187-0x00000000023E0000-0x000000000241F000-memory.dmpFilesize
252KB
-
memory/4032-175-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/4032-191-0x00000000023E0000-0x000000000241F000-memory.dmpFilesize
252KB
-
memory/4032-176-0x00000000023E0000-0x000000000241F000-memory.dmpFilesize
252KB
-
memory/4032-195-0x00000000023E0000-0x000000000241F000-memory.dmpFilesize
252KB
-
memory/4032-172-0x00000000023E0000-0x000000000241F000-memory.dmpFilesize
252KB
-
memory/4032-198-0x00000000023E0000-0x000000000241F000-memory.dmpFilesize
252KB
-
memory/4032-169-0x00000000004C0000-0x000000000050B000-memory.dmpFilesize
300KB
-
memory/4032-148-0x00000000023E0000-0x000000000241F000-memory.dmpFilesize
252KB
-
memory/4032-202-0x00000000023E0000-0x000000000241F000-memory.dmpFilesize
252KB
-
memory/4032-207-0x00000000023E0000-0x000000000241F000-memory.dmpFilesize
252KB
-
memory/4032-210-0x00000000023E0000-0x000000000241F000-memory.dmpFilesize
252KB
-
memory/4032-212-0x00000000023E0000-0x000000000241F000-memory.dmpFilesize
252KB
-
memory/4032-164-0x00000000023E0000-0x000000000241F000-memory.dmpFilesize
252KB
-
memory/4032-214-0x00000000023E0000-0x000000000241F000-memory.dmpFilesize
252KB
-
memory/4032-1089-0x00000000056F0000-0x0000000005CF6000-memory.dmpFilesize
6.0MB
-
memory/4032-1090-0x00000000050E0000-0x00000000051EA000-memory.dmpFilesize
1.0MB
-
memory/4032-1091-0x0000000004B70000-0x0000000004B82000-memory.dmpFilesize
72KB
-
memory/4032-178-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/4032-1093-0x0000000004B90000-0x0000000004BCE000-memory.dmpFilesize
248KB
-
memory/4032-1094-0x0000000005300000-0x000000000534B000-memory.dmpFilesize
300KB
-
memory/4032-1097-0x0000000005490000-0x0000000005522000-memory.dmpFilesize
584KB
-
memory/4032-1098-0x0000000005530000-0x0000000005596000-memory.dmpFilesize
408KB
-
memory/4032-159-0x00000000023E0000-0x000000000241F000-memory.dmpFilesize
252KB
-
memory/4032-155-0x00000000023E0000-0x000000000241F000-memory.dmpFilesize
252KB
-
memory/4032-151-0x00000000023E0000-0x000000000241F000-memory.dmpFilesize
252KB
-
memory/4032-1103-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/4032-1102-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/4032-1104-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/4032-147-0x00000000023E0000-0x0000000002424000-memory.dmpFilesize
272KB
-
memory/4032-1109-0x0000000006340000-0x00000000063B6000-memory.dmpFilesize
472KB
-
memory/4032-1110-0x00000000063C0000-0x0000000006410000-memory.dmpFilesize
320KB
-
memory/4032-1111-0x0000000006440000-0x0000000006602000-memory.dmpFilesize
1.8MB
-
memory/4032-1112-0x0000000006610000-0x0000000006B3C000-memory.dmpFilesize
5.2MB
-
memory/4032-1113-0x0000000004BD0000-0x0000000004BE0000-memory.dmpFilesize
64KB
-
memory/4032-146-0x0000000002360000-0x00000000023A6000-memory.dmpFilesize
280KB
-
memory/4048-1119-0x0000000000320000-0x0000000000352000-memory.dmpFilesize
200KB
-
memory/4048-1120-0x0000000004DE0000-0x0000000004E2B000-memory.dmpFilesize
300KB
-
memory/4048-1121-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/4988-134-0x00000000004B0000-0x00000000004DE000-memory.dmpFilesize
184KB