Analysis
-
max time kernel
118s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20230621-en -
resource tags
arch:x64arch:x86image:win10-20230621-enlocale:en-usos:windows10-1703-x64system -
submitted
22-06-2023 10:03
Static task
static1
Behavioral task
behavioral1
Sample
a096b9b34b47b0798f14ce64deeb07b86bc9416ae08504d0c68ec49ae064bce3.exe
Resource
win10-20230621-en
General
-
Target
a096b9b34b47b0798f14ce64deeb07b86bc9416ae08504d0c68ec49ae064bce3.exe
-
Size
678KB
-
MD5
3b2a8a2625640545605f63b988607788
-
SHA1
4001a206aa4e5d5ff63113045e1c7006c9b81a0d
-
SHA256
a096b9b34b47b0798f14ce64deeb07b86bc9416ae08504d0c68ec49ae064bce3
-
SHA512
a1414c08b0b0512d42360c271fc94eb09a69523a1bc0e13d589bd13f0b77703a9a8f41ca525d632a5352a7584f5a75195f4de860a70d874028a1038a7ab5f414
-
SSDEEP
12288:sjztKe5jWeeIO5eYAWJSn/NasPu/WH4w9i+jC+Hup3T4VP8KIxrs+N0Sc1:sjk9eemn/7uuY2RCruIdPc1
Malware Config
Extracted
redline
furga
83.97.73.128:19071
-
auth_value
1b7af6db7a79a3475798fcf494818be7
Extracted
amadey
3.84
77.91.68.63/doma/net/index.php
Signatures
-
Processes:
i9646872.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" i9646872.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" i9646872.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" i9646872.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" i9646872.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" i9646872.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 7 IoCs
Processes:
x5702203.exef8937677.exeg1639597.exerugen.exei9646872.exerugen.exerugen.exepid process 4328 x5702203.exe 2056 f8937677.exe 4692 g1639597.exe 3760 rugen.exe 3544 i9646872.exe 4400 rugen.exe 4368 rugen.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3408 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
i9646872.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" i9646872.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
a096b9b34b47b0798f14ce64deeb07b86bc9416ae08504d0c68ec49ae064bce3.exex5702203.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a096b9b34b47b0798f14ce64deeb07b86bc9416ae08504d0c68ec49ae064bce3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a096b9b34b47b0798f14ce64deeb07b86bc9416ae08504d0c68ec49ae064bce3.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce x5702203.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x5702203.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
f8937677.exei9646872.exepid process 2056 f8937677.exe 2056 f8937677.exe 3544 i9646872.exe 3544 i9646872.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f8937677.exei9646872.exedescription pid process Token: SeDebugPrivilege 2056 f8937677.exe Token: SeDebugPrivilege 3544 i9646872.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
g1639597.exepid process 4692 g1639597.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
a096b9b34b47b0798f14ce64deeb07b86bc9416ae08504d0c68ec49ae064bce3.exex5702203.exeg1639597.exerugen.execmd.exedescription pid process target process PID 2392 wrote to memory of 4328 2392 a096b9b34b47b0798f14ce64deeb07b86bc9416ae08504d0c68ec49ae064bce3.exe x5702203.exe PID 2392 wrote to memory of 4328 2392 a096b9b34b47b0798f14ce64deeb07b86bc9416ae08504d0c68ec49ae064bce3.exe x5702203.exe PID 2392 wrote to memory of 4328 2392 a096b9b34b47b0798f14ce64deeb07b86bc9416ae08504d0c68ec49ae064bce3.exe x5702203.exe PID 4328 wrote to memory of 2056 4328 x5702203.exe f8937677.exe PID 4328 wrote to memory of 2056 4328 x5702203.exe f8937677.exe PID 4328 wrote to memory of 2056 4328 x5702203.exe f8937677.exe PID 4328 wrote to memory of 4692 4328 x5702203.exe g1639597.exe PID 4328 wrote to memory of 4692 4328 x5702203.exe g1639597.exe PID 4328 wrote to memory of 4692 4328 x5702203.exe g1639597.exe PID 4692 wrote to memory of 3760 4692 g1639597.exe rugen.exe PID 4692 wrote to memory of 3760 4692 g1639597.exe rugen.exe PID 4692 wrote to memory of 3760 4692 g1639597.exe rugen.exe PID 2392 wrote to memory of 3544 2392 a096b9b34b47b0798f14ce64deeb07b86bc9416ae08504d0c68ec49ae064bce3.exe i9646872.exe PID 2392 wrote to memory of 3544 2392 a096b9b34b47b0798f14ce64deeb07b86bc9416ae08504d0c68ec49ae064bce3.exe i9646872.exe PID 3760 wrote to memory of 3776 3760 rugen.exe schtasks.exe PID 3760 wrote to memory of 3776 3760 rugen.exe schtasks.exe PID 3760 wrote to memory of 3776 3760 rugen.exe schtasks.exe PID 3760 wrote to memory of 2776 3760 rugen.exe cmd.exe PID 3760 wrote to memory of 2776 3760 rugen.exe cmd.exe PID 3760 wrote to memory of 2776 3760 rugen.exe cmd.exe PID 2776 wrote to memory of 4184 2776 cmd.exe cmd.exe PID 2776 wrote to memory of 4184 2776 cmd.exe cmd.exe PID 2776 wrote to memory of 4184 2776 cmd.exe cmd.exe PID 2776 wrote to memory of 4204 2776 cmd.exe cacls.exe PID 2776 wrote to memory of 4204 2776 cmd.exe cacls.exe PID 2776 wrote to memory of 4204 2776 cmd.exe cacls.exe PID 2776 wrote to memory of 4188 2776 cmd.exe cacls.exe PID 2776 wrote to memory of 4188 2776 cmd.exe cacls.exe PID 2776 wrote to memory of 4188 2776 cmd.exe cacls.exe PID 2776 wrote to memory of 4720 2776 cmd.exe cmd.exe PID 2776 wrote to memory of 4720 2776 cmd.exe cmd.exe PID 2776 wrote to memory of 4720 2776 cmd.exe cmd.exe PID 2776 wrote to memory of 3192 2776 cmd.exe cacls.exe PID 2776 wrote to memory of 3192 2776 cmd.exe cacls.exe PID 2776 wrote to memory of 3192 2776 cmd.exe cacls.exe PID 2776 wrote to memory of 516 2776 cmd.exe cacls.exe PID 2776 wrote to memory of 516 2776 cmd.exe cacls.exe PID 2776 wrote to memory of 516 2776 cmd.exe cacls.exe PID 3760 wrote to memory of 3408 3760 rugen.exe rundll32.exe PID 3760 wrote to memory of 3408 3760 rugen.exe rundll32.exe PID 3760 wrote to memory of 3408 3760 rugen.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a096b9b34b47b0798f14ce64deeb07b86bc9416ae08504d0c68ec49ae064bce3.exe"C:\Users\Admin\AppData\Local\Temp\a096b9b34b47b0798f14ce64deeb07b86bc9416ae08504d0c68ec49ae064bce3.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5702203.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5702203.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f8937677.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f8937677.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1639597.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1639597.exe3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe"C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe" /F5⤵
- Creates scheduled task(s)
PID:3776 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rugen.exe" /P "Admin:N"&&CACLS "rugen.exe" /P "Admin:R" /E&&echo Y|CACLS "..\200f691d32" /P "Admin:N"&&CACLS "..\200f691d32" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4184
-
C:\Windows\SysWOW64\cacls.exeCACLS "rugen.exe" /P "Admin:N"6⤵PID:4204
-
C:\Windows\SysWOW64\cacls.exeCACLS "rugen.exe" /P "Admin:R" /E6⤵PID:4188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4720
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\200f691d32" /P "Admin:N"6⤵PID:3192
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\200f691d32" /P "Admin:R" /E6⤵PID:516
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
- Loads dropped DLL
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9646872.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9646872.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeC:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe1⤵
- Executes dropped EXE
PID:4400
-
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeC:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe1⤵
- Executes dropped EXE
PID:4368
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeFilesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeFilesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeFilesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeFilesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exeFilesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9646872.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i9646872.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5702203.exeFilesize
361KB
MD50c1ecdd732359902716810425a64793b
SHA1955ce700e256e1b1e3c7b3756451c05a9508e4f3
SHA25604202b245cac5f3ff486be49945c50ff90905d1d4bfd381b3063f8c6560aac21
SHA512c8f53bd068844214ea624d39e9db827568bed5229afac4cd7b888952308c407abcaeff70dc6fb16662bb5759ece771f85ede68d39fe73ddfe31de57ebb2c1c52
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5702203.exeFilesize
361KB
MD50c1ecdd732359902716810425a64793b
SHA1955ce700e256e1b1e3c7b3756451c05a9508e4f3
SHA25604202b245cac5f3ff486be49945c50ff90905d1d4bfd381b3063f8c6560aac21
SHA512c8f53bd068844214ea624d39e9db827568bed5229afac4cd7b888952308c407abcaeff70dc6fb16662bb5759ece771f85ede68d39fe73ddfe31de57ebb2c1c52
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f8937677.exeFilesize
389KB
MD57735637062bb091a9f95e743ab885e95
SHA17e007feedbb8835d2b825b5e8b1badc800f493b9
SHA256fb1e443127438c74569b881db802ce8303dcfc3ac01c903c337ef6d0a13d1baf
SHA512fe7b56cb614f7ff0417863efb64c04330f73a68143a42bc2e588849446c81ba946f6a879885d85d29c0d8791df2e4f8aa16b82341416f667634ca3809594aac1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f8937677.exeFilesize
389KB
MD57735637062bb091a9f95e743ab885e95
SHA17e007feedbb8835d2b825b5e8b1badc800f493b9
SHA256fb1e443127438c74569b881db802ce8303dcfc3ac01c903c337ef6d0a13d1baf
SHA512fe7b56cb614f7ff0417863efb64c04330f73a68143a42bc2e588849446c81ba946f6a879885d85d29c0d8791df2e4f8aa16b82341416f667634ca3809594aac1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1639597.exeFilesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1639597.exeFilesize
205KB
MD5835f1373b125353f2b0615a2f105d3dd
SHA11aae6edfedcfe6d6828b98b114c581d9f15db807
SHA25600f972eb3d4d2fac05c10c0e6e212cf096b4142b5b5075b29c6c100d51432cd4
SHA5128826d5ff3ab691094eabf4cec3444752ed46714705dae25bc48b5c9ee36c7c9b9cf8606460e71df519dd26a91798ab8be3415e7465df82d362d602e96ebb25e5
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD583fc14fb36516facb19e0e96286f7f48
SHA140082ca06de4c377585cd164fb521bacadb673da
SHA25608dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e
SHA512ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf
-
memory/2056-148-0x0000000004B20000-0x0000000004B32000-memory.dmpFilesize
72KB
-
memory/2056-151-0x000000000A6A0000-0x000000000A6EB000-memory.dmpFilesize
300KB
-
memory/2056-158-0x000000000B630000-0x000000000BB5C000-memory.dmpFilesize
5.2MB
-
memory/2056-159-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2056-156-0x000000000B3F0000-0x000000000B440000-memory.dmpFilesize
320KB
-
memory/2056-155-0x000000000AE40000-0x000000000AEA6000-memory.dmpFilesize
408KB
-
memory/2056-154-0x000000000A900000-0x000000000ADFE000-memory.dmpFilesize
5.0MB
-
memory/2056-153-0x000000000A860000-0x000000000A8F2000-memory.dmpFilesize
584KB
-
memory/2056-152-0x000000000A7E0000-0x000000000A856000-memory.dmpFilesize
472KB
-
memory/2056-157-0x000000000B460000-0x000000000B622000-memory.dmpFilesize
1.8MB
-
memory/2056-150-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/2056-141-0x00000000001D0000-0x0000000000200000-memory.dmpFilesize
192KB
-
memory/2056-145-0x00000000020D0000-0x00000000020D6000-memory.dmpFilesize
24KB
-
memory/2056-149-0x000000000A5F0000-0x000000000A62E000-memory.dmpFilesize
248KB
-
memory/2056-146-0x0000000009ED0000-0x000000000A4D6000-memory.dmpFilesize
6.0MB
-
memory/2056-147-0x000000000A4E0000-0x000000000A5EA000-memory.dmpFilesize
1.0MB
-
memory/2392-121-0x00000000006F0000-0x0000000000769000-memory.dmpFilesize
484KB
-
memory/2392-177-0x00000000006F0000-0x0000000000769000-memory.dmpFilesize
484KB
-
memory/3544-175-0x0000000000F70000-0x0000000000F7A000-memory.dmpFilesize
40KB