Analysis
-
max time kernel
93s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 18:29
Static task
static1
Behavioral task
behavioral1
Sample
f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe
Resource
win10v2004-20230220-en
General
-
Target
f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe
-
Size
659KB
-
MD5
96ddac9c45e58245ff6ec923843c5e29
-
SHA1
45f97ddd741dbbe77386649306797c8ae4e43639
-
SHA256
f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40
-
SHA512
5d2af87719df4a73f6375b791ccfe6cdf1af2ae6c747428489e0d665584e2afb2a9babd28bd4715f89cecf1562c9c8807427ccb2f415dbdecf8c21609194da3b
-
SSDEEP
12288:uMrIy90wKI6BZKitBF6wqoJUAKzE8JcUZSqcOIHG6j:CydDKBQLoJlK4Bvqcjpj
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro7061.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro7061.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro7061.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro7061.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro7061.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro7061.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro7061.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/4792-164-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/4792-165-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/4792-169-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/4792-174-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/4792-179-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/4792-184-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/4792-188-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/4792-191-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/4792-196-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/4792-199-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/4792-203-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/4792-207-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/4792-211-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/4792-220-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/4792-217-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/4792-222-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline behavioral1/memory/4792-224-0x0000000004AD0000-0x0000000004B0F000-memory.dmp family_redline -
Executes dropped EXE 5 IoCs
Processes:
un590869.exepro7061.exepro7061.exequ9463.exesi174731.exepid process 2320 un590869.exe 1464 pro7061.exe 2172 pro7061.exe 4792 qu9463.exe 3912 si174731.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro7061.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro7061.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro7061.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
un590869.exef19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un590869.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un590869.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
pro7061.exedescription pid process target process PID 1464 set thread context of 2172 1464 pro7061.exe pro7061.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5032 4792 WerFault.exe qu9463.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro7061.exequ9463.exesi174731.exepid process 2172 pro7061.exe 2172 pro7061.exe 4792 qu9463.exe 4792 qu9463.exe 3912 si174731.exe 3912 si174731.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro7061.exequ9463.exesi174731.exedescription pid process Token: SeDebugPrivilege 2172 pro7061.exe Token: SeDebugPrivilege 4792 qu9463.exe Token: SeDebugPrivilege 3912 si174731.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exeun590869.exepro7061.exedescription pid process target process PID 4412 wrote to memory of 2320 4412 f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe un590869.exe PID 4412 wrote to memory of 2320 4412 f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe un590869.exe PID 4412 wrote to memory of 2320 4412 f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe un590869.exe PID 2320 wrote to memory of 1464 2320 un590869.exe pro7061.exe PID 2320 wrote to memory of 1464 2320 un590869.exe pro7061.exe PID 2320 wrote to memory of 1464 2320 un590869.exe pro7061.exe PID 1464 wrote to memory of 2172 1464 pro7061.exe pro7061.exe PID 1464 wrote to memory of 2172 1464 pro7061.exe pro7061.exe PID 1464 wrote to memory of 2172 1464 pro7061.exe pro7061.exe PID 1464 wrote to memory of 2172 1464 pro7061.exe pro7061.exe PID 1464 wrote to memory of 2172 1464 pro7061.exe pro7061.exe PID 1464 wrote to memory of 2172 1464 pro7061.exe pro7061.exe PID 1464 wrote to memory of 2172 1464 pro7061.exe pro7061.exe PID 1464 wrote to memory of 2172 1464 pro7061.exe pro7061.exe PID 1464 wrote to memory of 2172 1464 pro7061.exe pro7061.exe PID 2320 wrote to memory of 4792 2320 un590869.exe qu9463.exe PID 2320 wrote to memory of 4792 2320 un590869.exe qu9463.exe PID 2320 wrote to memory of 4792 2320 un590869.exe qu9463.exe PID 4412 wrote to memory of 3912 4412 f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe si174731.exe PID 4412 wrote to memory of 3912 4412 f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe si174731.exe PID 4412 wrote to memory of 3912 4412 f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe si174731.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe"C:\Users\Admin\AppData\Local\Temp\f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un590869.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un590869.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7061.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7061.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7061.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7061.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9463.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9463.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 21404⤵
- Program crash
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si174731.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si174731.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4792 -ip 47921⤵PID:4012
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si174731.exeFilesize
175KB
MD537f8bbc2594c2832a722ecd360aedf25
SHA117c9ad18d0796b1254621f84085c37bb80b301d0
SHA256bf4ebd9bcd66e32ba98c9e7ad9f8f9940136aeb8351d02ffb99cd5f835e6f07e
SHA512f8eba90b74fa6598b827c7b71b8ed2d6b30f45d0df60143a0295034ff7deb175d206ac46e9ea3ca1266076bb2aa72d50ec1e2ab58a0ca438efbdcfe1afce0c91
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si174731.exeFilesize
175KB
MD537f8bbc2594c2832a722ecd360aedf25
SHA117c9ad18d0796b1254621f84085c37bb80b301d0
SHA256bf4ebd9bcd66e32ba98c9e7ad9f8f9940136aeb8351d02ffb99cd5f835e6f07e
SHA512f8eba90b74fa6598b827c7b71b8ed2d6b30f45d0df60143a0295034ff7deb175d206ac46e9ea3ca1266076bb2aa72d50ec1e2ab58a0ca438efbdcfe1afce0c91
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un590869.exeFilesize
517KB
MD5c91e242b59e3b5bccb28d954bd72e2f2
SHA13f6c281d027f56f10d2009edc70768e16417c46d
SHA2567df8e381db11a2d8dab012baaa7b4177dceb2b8ad2d5aade898638bcc3088299
SHA512bc07da39d995961440e77d5a65aa7c3b61c0e596fb4d2d6e6826df065c2060f6a925cbea3802382df6b6dc70e3069206ca3338823b84bdba817023ad63e1e74a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un590869.exeFilesize
517KB
MD5c91e242b59e3b5bccb28d954bd72e2f2
SHA13f6c281d027f56f10d2009edc70768e16417c46d
SHA2567df8e381db11a2d8dab012baaa7b4177dceb2b8ad2d5aade898638bcc3088299
SHA512bc07da39d995961440e77d5a65aa7c3b61c0e596fb4d2d6e6826df065c2060f6a925cbea3802382df6b6dc70e3069206ca3338823b84bdba817023ad63e1e74a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7061.exeFilesize
237KB
MD535d88beaac57c45fbc68e465a85de291
SHA14e804a0ce91b497b2fa1095fa2b567e55199e53c
SHA256a0a50306407a72ea2cb745692a58cadabacd7e044d3892c3fb17e23df7a37b96
SHA5120c67da267f0f6236b8a249dba284dbef160f139948de34061e879b2a56503dc97fcd247071c7e217f669aa43be8449b6c0cacd9b6e3725441444311ed5d1067b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7061.exeFilesize
237KB
MD535d88beaac57c45fbc68e465a85de291
SHA14e804a0ce91b497b2fa1095fa2b567e55199e53c
SHA256a0a50306407a72ea2cb745692a58cadabacd7e044d3892c3fb17e23df7a37b96
SHA5120c67da267f0f6236b8a249dba284dbef160f139948de34061e879b2a56503dc97fcd247071c7e217f669aa43be8449b6c0cacd9b6e3725441444311ed5d1067b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7061.exeFilesize
237KB
MD535d88beaac57c45fbc68e465a85de291
SHA14e804a0ce91b497b2fa1095fa2b567e55199e53c
SHA256a0a50306407a72ea2cb745692a58cadabacd7e044d3892c3fb17e23df7a37b96
SHA5120c67da267f0f6236b8a249dba284dbef160f139948de34061e879b2a56503dc97fcd247071c7e217f669aa43be8449b6c0cacd9b6e3725441444311ed5d1067b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9463.exeFilesize
294KB
MD59d4edc090bd8ab45327170e729e2b407
SHA1e5dba4334c707d003fdb0c316ec99152ad97d332
SHA256835d70a185113e83249f91b8d8c4511b53a786c14987e084048ed70603e0c9f9
SHA512794980c96901d9634aa3b77586d2f3a587a01024dca19ceabff4d97a1d1926e0ec9cd82c23aa17e67b5988491991578db35c0cf77ffe0c9643565be61c83b44a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9463.exeFilesize
294KB
MD59d4edc090bd8ab45327170e729e2b407
SHA1e5dba4334c707d003fdb0c316ec99152ad97d332
SHA256835d70a185113e83249f91b8d8c4511b53a786c14987e084048ed70603e0c9f9
SHA512794980c96901d9634aa3b77586d2f3a587a01024dca19ceabff4d97a1d1926e0ec9cd82c23aa17e67b5988491991578db35c0cf77ffe0c9643565be61c83b44a
-
memory/1464-153-0x0000000000600000-0x000000000062E000-memory.dmpFilesize
184KB
-
memory/2172-200-0x0000000004940000-0x0000000004952000-memory.dmpFilesize
72KB
-
memory/2172-214-0x0000000004940000-0x0000000004952000-memory.dmpFilesize
72KB
-
memory/2172-148-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2172-160-0x00000000049F0000-0x0000000004A00000-memory.dmpFilesize
64KB
-
memory/2172-150-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2172-162-0x0000000004A00000-0x0000000004FA4000-memory.dmpFilesize
5.6MB
-
memory/2172-1115-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2172-163-0x0000000004940000-0x0000000004952000-memory.dmpFilesize
72KB
-
memory/2172-166-0x0000000004940000-0x0000000004952000-memory.dmpFilesize
72KB
-
memory/2172-1111-0x00000000049F0000-0x0000000004A00000-memory.dmpFilesize
64KB
-
memory/2172-170-0x0000000004940000-0x0000000004952000-memory.dmpFilesize
72KB
-
memory/2172-1109-0x00000000049F0000-0x0000000004A00000-memory.dmpFilesize
64KB
-
memory/2172-1106-0x00000000049F0000-0x0000000004A00000-memory.dmpFilesize
64KB
-
memory/2172-218-0x0000000004940000-0x0000000004952000-memory.dmpFilesize
72KB
-
memory/2172-175-0x0000000004940000-0x0000000004952000-memory.dmpFilesize
72KB
-
memory/2172-212-0x0000000004940000-0x0000000004952000-memory.dmpFilesize
72KB
-
memory/2172-180-0x0000000004940000-0x0000000004952000-memory.dmpFilesize
72KB
-
memory/2172-183-0x0000000004940000-0x0000000004952000-memory.dmpFilesize
72KB
-
memory/2172-158-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2172-208-0x0000000004940000-0x0000000004952000-memory.dmpFilesize
72KB
-
memory/2172-204-0x0000000004940000-0x0000000004952000-memory.dmpFilesize
72KB
-
memory/2172-187-0x0000000004940000-0x0000000004952000-memory.dmpFilesize
72KB
-
memory/2172-192-0x0000000004940000-0x0000000004952000-memory.dmpFilesize
72KB
-
memory/2172-151-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2172-195-0x0000000004940000-0x0000000004952000-memory.dmpFilesize
72KB
-
memory/3912-1129-0x00000000003A0000-0x00000000003D2000-memory.dmpFilesize
200KB
-
memory/3912-1131-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/3912-1130-0x0000000004CB0000-0x0000000004CC0000-memory.dmpFilesize
64KB
-
memory/4792-1102-0x00000000058C0000-0x00000000058FC000-memory.dmpFilesize
240KB
-
memory/4792-207-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/4792-1103-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/4792-173-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/4792-179-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/4792-174-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/4792-211-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/4792-176-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/4792-220-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/4792-217-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/4792-222-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/4792-224-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/4792-1099-0x0000000005260000-0x0000000005878000-memory.dmpFilesize
6.1MB
-
memory/4792-1100-0x0000000004B80000-0x0000000004C8A000-memory.dmpFilesize
1.0MB
-
memory/4792-1101-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/4792-196-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/4792-184-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/4792-1107-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/4792-203-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/4792-1108-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/4792-169-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/4792-1110-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/4792-165-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/4792-164-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/4792-1116-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/4792-1117-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/4792-1118-0x0000000006340000-0x00000000063B6000-memory.dmpFilesize
472KB
-
memory/4792-1119-0x00000000063E0000-0x0000000006430000-memory.dmpFilesize
320KB
-
memory/4792-1120-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/4792-1121-0x0000000006690000-0x0000000006852000-memory.dmpFilesize
1.8MB
-
memory/4792-1122-0x00000000068B0000-0x0000000006DDC000-memory.dmpFilesize
5.2MB
-
memory/4792-161-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/4792-159-0x0000000002150000-0x000000000219B000-memory.dmpFilesize
300KB
-
memory/4792-188-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/4792-191-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB
-
memory/4792-199-0x0000000004AD0000-0x0000000004B0F000-memory.dmpFilesize
252KB