Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 18:31
Static task
static1
Behavioral task
behavioral1
Sample
6b091f4f048b08a113b847933dcf30a1cc8b18bc436a3335a3d17b58d90c7eac.exe
Resource
win10v2004-20230220-en
General
-
Target
6b091f4f048b08a113b847933dcf30a1cc8b18bc436a3335a3d17b58d90c7eac.exe
-
Size
659KB
-
MD5
92a4eb839867e4ba42cd906a3a7e435f
-
SHA1
4d3f289c67a1e92fed6b4b5eb44886d9c5cdab02
-
SHA256
6b091f4f048b08a113b847933dcf30a1cc8b18bc436a3335a3d17b58d90c7eac
-
SHA512
1d734c83ccc724d5af5c82d4faf74a4e199fc617bb3de58e7ef7e9fe2c86755b1a24b74a176c28be4d00434558cfe2b574485dfa22de64e93d6625a1acda7e21
-
SSDEEP
12288:uMrjy905tW72WGCSAtaMCIUwP8V8Mo3QZS+mp68164m5CSI:hyRhIRInP8+Z3T+mTc4/J
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro4579.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro4579.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro4579.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro4579.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro4579.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro4579.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro4579.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/4444-166-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4444-165-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4444-170-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4444-175-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4444-178-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4444-181-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4444-186-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4444-190-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4444-194-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4444-199-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4444-203-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4444-207-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4444-211-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4444-215-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4444-219-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4444-222-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4444-224-0x0000000002630000-0x000000000266F000-memory.dmp family_redline -
Executes dropped EXE 5 IoCs
Processes:
un244552.exepro4579.exepro4579.exequ1095.exesi900520.exepid process 2984 un244552.exe 1564 pro4579.exe 2900 pro4579.exe 4444 qu1095.exe 3676 si900520.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro4579.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro4579.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro4579.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
6b091f4f048b08a113b847933dcf30a1cc8b18bc436a3335a3d17b58d90c7eac.exeun244552.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6b091f4f048b08a113b847933dcf30a1cc8b18bc436a3335a3d17b58d90c7eac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6b091f4f048b08a113b847933dcf30a1cc8b18bc436a3335a3d17b58d90c7eac.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un244552.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un244552.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
pro4579.exedescription pid process target process PID 1564 set thread context of 2900 1564 pro4579.exe pro4579.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1488 sc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1408 4444 WerFault.exe qu1095.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro4579.exequ1095.exesi900520.exepid process 2900 pro4579.exe 2900 pro4579.exe 4444 qu1095.exe 4444 qu1095.exe 3676 si900520.exe 3676 si900520.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
qu1095.exepro4579.exesi900520.exedescription pid process Token: SeDebugPrivilege 4444 qu1095.exe Token: SeDebugPrivilege 2900 pro4579.exe Token: SeDebugPrivilege 3676 si900520.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
6b091f4f048b08a113b847933dcf30a1cc8b18bc436a3335a3d17b58d90c7eac.exeun244552.exepro4579.exedescription pid process target process PID 2840 wrote to memory of 2984 2840 6b091f4f048b08a113b847933dcf30a1cc8b18bc436a3335a3d17b58d90c7eac.exe un244552.exe PID 2840 wrote to memory of 2984 2840 6b091f4f048b08a113b847933dcf30a1cc8b18bc436a3335a3d17b58d90c7eac.exe un244552.exe PID 2840 wrote to memory of 2984 2840 6b091f4f048b08a113b847933dcf30a1cc8b18bc436a3335a3d17b58d90c7eac.exe un244552.exe PID 2984 wrote to memory of 1564 2984 un244552.exe pro4579.exe PID 2984 wrote to memory of 1564 2984 un244552.exe pro4579.exe PID 2984 wrote to memory of 1564 2984 un244552.exe pro4579.exe PID 1564 wrote to memory of 2900 1564 pro4579.exe pro4579.exe PID 1564 wrote to memory of 2900 1564 pro4579.exe pro4579.exe PID 1564 wrote to memory of 2900 1564 pro4579.exe pro4579.exe PID 1564 wrote to memory of 2900 1564 pro4579.exe pro4579.exe PID 1564 wrote to memory of 2900 1564 pro4579.exe pro4579.exe PID 1564 wrote to memory of 2900 1564 pro4579.exe pro4579.exe PID 1564 wrote to memory of 2900 1564 pro4579.exe pro4579.exe PID 1564 wrote to memory of 2900 1564 pro4579.exe pro4579.exe PID 1564 wrote to memory of 2900 1564 pro4579.exe pro4579.exe PID 2984 wrote to memory of 4444 2984 un244552.exe qu1095.exe PID 2984 wrote to memory of 4444 2984 un244552.exe qu1095.exe PID 2984 wrote to memory of 4444 2984 un244552.exe qu1095.exe PID 2840 wrote to memory of 3676 2840 6b091f4f048b08a113b847933dcf30a1cc8b18bc436a3335a3d17b58d90c7eac.exe si900520.exe PID 2840 wrote to memory of 3676 2840 6b091f4f048b08a113b847933dcf30a1cc8b18bc436a3335a3d17b58d90c7eac.exe si900520.exe PID 2840 wrote to memory of 3676 2840 6b091f4f048b08a113b847933dcf30a1cc8b18bc436a3335a3d17b58d90c7eac.exe si900520.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b091f4f048b08a113b847933dcf30a1cc8b18bc436a3335a3d17b58d90c7eac.exe"C:\Users\Admin\AppData\Local\Temp\6b091f4f048b08a113b847933dcf30a1cc8b18bc436a3335a3d17b58d90c7eac.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un244552.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un244552.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4579.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4579.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4579.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4579.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1095.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1095.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4444 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 13284⤵
- Program crash
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si900520.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si900520.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4444 -ip 44441⤵PID:4140
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:1488
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si900520.exeFilesize
175KB
MD5c38dc9d120d33516bd1103a89cbcf198
SHA1bd4f8b71b0504ca8018191235637357af742d48b
SHA2562396dfcd0f30acbdca124ecb8f84bb239ac1f51b628b016fbde163d9146414b8
SHA512b36f58fed246676084374a77127c9d2d34cdae18d4c25374fb2467c6a4d294ad64751cf89dcf6b368ed3fc8f2e23fa98e25d207089d78e59143433180102a269
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si900520.exeFilesize
175KB
MD5c38dc9d120d33516bd1103a89cbcf198
SHA1bd4f8b71b0504ca8018191235637357af742d48b
SHA2562396dfcd0f30acbdca124ecb8f84bb239ac1f51b628b016fbde163d9146414b8
SHA512b36f58fed246676084374a77127c9d2d34cdae18d4c25374fb2467c6a4d294ad64751cf89dcf6b368ed3fc8f2e23fa98e25d207089d78e59143433180102a269
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un244552.exeFilesize
517KB
MD5900a7019d3279c3ffd416bdfc3b7fcb9
SHA1909c9f4da690cac160f8cc8ce519ff37c7726072
SHA2568ec3f22c0e81dea241d9958ef986e2ca36f41cf7bb2edf17541c945ce5603f7e
SHA5125b9bb4c7d421f51e062f5f6fe4d119a9062562b62d4e2dd2b6ea08a93ab238f9820675d0fbdc68a83dee5a29852602f997c040cffb7c496659c6ce4a5f2aa596
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un244552.exeFilesize
517KB
MD5900a7019d3279c3ffd416bdfc3b7fcb9
SHA1909c9f4da690cac160f8cc8ce519ff37c7726072
SHA2568ec3f22c0e81dea241d9958ef986e2ca36f41cf7bb2edf17541c945ce5603f7e
SHA5125b9bb4c7d421f51e062f5f6fe4d119a9062562b62d4e2dd2b6ea08a93ab238f9820675d0fbdc68a83dee5a29852602f997c040cffb7c496659c6ce4a5f2aa596
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4579.exeFilesize
237KB
MD5745b6068d12de1bddda633443dece96d
SHA1588d80ee7914a455a7eb5bfab9d1648e142fd22c
SHA2567c09ae5e31fe5fe8077fb57c3c586cf30c8b3b848454968cba0f07eb925eb497
SHA5120faf401497595b777151f7a9c9d81d9efd0103a8d91c3471b6206a9b51d02ee3a39695032f43cda3b783fc2da4d0bdf0c69cb5959347ede96a17b088f5f37bb9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4579.exeFilesize
237KB
MD5745b6068d12de1bddda633443dece96d
SHA1588d80ee7914a455a7eb5bfab9d1648e142fd22c
SHA2567c09ae5e31fe5fe8077fb57c3c586cf30c8b3b848454968cba0f07eb925eb497
SHA5120faf401497595b777151f7a9c9d81d9efd0103a8d91c3471b6206a9b51d02ee3a39695032f43cda3b783fc2da4d0bdf0c69cb5959347ede96a17b088f5f37bb9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4579.exeFilesize
237KB
MD5745b6068d12de1bddda633443dece96d
SHA1588d80ee7914a455a7eb5bfab9d1648e142fd22c
SHA2567c09ae5e31fe5fe8077fb57c3c586cf30c8b3b848454968cba0f07eb925eb497
SHA5120faf401497595b777151f7a9c9d81d9efd0103a8d91c3471b6206a9b51d02ee3a39695032f43cda3b783fc2da4d0bdf0c69cb5959347ede96a17b088f5f37bb9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1095.exeFilesize
294KB
MD5b6c8bc60026351f2671f7424c058182b
SHA101cb20754798b1e26e5e09962739d67ac57c2907
SHA2561ae2d036f8e5e4ebe4c0a6f046bc6204d40a6a5f8cf582a751fcfc190a464c35
SHA512f4975059643ac066246103f27ca7ee56d18a3a808e4e3bd148fd507ab30ce3710907cf653476d1e02d40639651562321f7690da3bc2241df95a97fbb7267fe98
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1095.exeFilesize
294KB
MD5b6c8bc60026351f2671f7424c058182b
SHA101cb20754798b1e26e5e09962739d67ac57c2907
SHA2561ae2d036f8e5e4ebe4c0a6f046bc6204d40a6a5f8cf582a751fcfc190a464c35
SHA512f4975059643ac066246103f27ca7ee56d18a3a808e4e3bd148fd507ab30ce3710907cf653476d1e02d40639651562321f7690da3bc2241df95a97fbb7267fe98
-
memory/1564-150-0x00000000005C0000-0x00000000005EE000-memory.dmpFilesize
184KB
-
memory/2900-185-0x0000000002510000-0x0000000002522000-memory.dmpFilesize
72KB
-
memory/2900-189-0x0000000002510000-0x0000000002522000-memory.dmpFilesize
72KB
-
memory/2900-159-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2900-160-0x0000000004CE0000-0x0000000004CF0000-memory.dmpFilesize
64KB
-
memory/2900-161-0x0000000004CE0000-0x0000000004CF0000-memory.dmpFilesize
64KB
-
memory/2900-162-0x0000000004CE0000-0x0000000004CF0000-memory.dmpFilesize
64KB
-
memory/2900-204-0x0000000002510000-0x0000000002522000-memory.dmpFilesize
72KB
-
memory/2900-152-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2900-212-0x0000000002510000-0x0000000002522000-memory.dmpFilesize
72KB
-
memory/2900-167-0x0000000002510000-0x0000000002522000-memory.dmpFilesize
72KB
-
memory/2900-200-0x0000000002510000-0x0000000002522000-memory.dmpFilesize
72KB
-
memory/2900-169-0x0000000002510000-0x0000000002522000-memory.dmpFilesize
72KB
-
memory/2900-172-0x0000000002510000-0x0000000002522000-memory.dmpFilesize
72KB
-
memory/2900-151-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2900-148-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2900-1115-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2900-177-0x0000000002510000-0x0000000002522000-memory.dmpFilesize
72KB
-
memory/2900-182-0x0000000002510000-0x0000000002522000-memory.dmpFilesize
72KB
-
memory/2900-1108-0x0000000004CE0000-0x0000000004CF0000-memory.dmpFilesize
64KB
-
memory/2900-1107-0x0000000004CE0000-0x0000000004CF0000-memory.dmpFilesize
64KB
-
memory/2900-208-0x0000000002510000-0x0000000002522000-memory.dmpFilesize
72KB
-
memory/2900-1106-0x0000000004CE0000-0x0000000004CF0000-memory.dmpFilesize
64KB
-
memory/2900-158-0x0000000004CF0000-0x0000000005294000-memory.dmpFilesize
5.6MB
-
memory/2900-220-0x0000000002510000-0x0000000002522000-memory.dmpFilesize
72KB
-
memory/2900-193-0x0000000002510000-0x0000000002522000-memory.dmpFilesize
72KB
-
memory/2900-196-0x0000000002510000-0x0000000002522000-memory.dmpFilesize
72KB
-
memory/2900-216-0x0000000002510000-0x0000000002522000-memory.dmpFilesize
72KB
-
memory/3676-1126-0x00000000001E0000-0x0000000000212000-memory.dmpFilesize
200KB
-
memory/3676-1127-0x0000000004E00000-0x0000000004E10000-memory.dmpFilesize
64KB
-
memory/3676-1128-0x0000000004E00000-0x0000000004E10000-memory.dmpFilesize
64KB
-
memory/4444-164-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/4444-207-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4444-211-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4444-203-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4444-215-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4444-199-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4444-194-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4444-219-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4444-222-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4444-224-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4444-1099-0x00000000052D0000-0x00000000058E8000-memory.dmpFilesize
6.1MB
-
memory/4444-1100-0x00000000058F0000-0x00000000059FA000-memory.dmpFilesize
1.0MB
-
memory/4444-1101-0x0000000004BF0000-0x0000000004C02000-memory.dmpFilesize
72KB
-
memory/4444-1102-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/4444-1103-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/4444-190-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4444-186-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4444-181-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4444-1109-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/4444-1110-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/4444-1111-0x00000000064B0000-0x0000000006542000-memory.dmpFilesize
584KB
-
memory/4444-178-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4444-1116-0x00000000066F0000-0x0000000006766000-memory.dmpFilesize
472KB
-
memory/4444-1117-0x0000000006790000-0x00000000067E0000-memory.dmpFilesize
320KB
-
memory/4444-1118-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/4444-1119-0x0000000006810000-0x00000000069D2000-memory.dmpFilesize
1.8MB
-
memory/4444-1120-0x00000000069E0000-0x0000000006F0C000-memory.dmpFilesize
5.2MB
-
memory/4444-175-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4444-170-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4444-165-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4444-166-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4444-163-0x0000000000680000-0x00000000006CB000-memory.dmpFilesize
300KB