Analysis
-
max time kernel
99s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 18:52
Static task
static1
Behavioral task
behavioral1
Sample
04d705e5db50f6b6207f2b80bbd188ac14e860b43b56a15b38547467e1b61192.exe
Resource
win10v2004-20230220-en
General
-
Target
04d705e5db50f6b6207f2b80bbd188ac14e860b43b56a15b38547467e1b61192.exe
-
Size
660KB
-
MD5
f728ee62f2c05c3d75230de1d46fc1e2
-
SHA1
7edea69f547763533bb5dfe39e6b2785da4f53a1
-
SHA256
04d705e5db50f6b6207f2b80bbd188ac14e860b43b56a15b38547467e1b61192
-
SHA512
f8e2aaa7f48a461e8810956fd9ac0b5df5c375f9edd2643da8a2fb776a71c1ec508b5514ffa8bde039abb4162bc79ebba62d01ccc85ccf410278b962b5c47dad
-
SSDEEP
12288:pMr3y90CV9GZkbqGv97p60cLZzQCU69GxYnhROZSS0LzRl6WMQuS:qyd9GZO7ctUCGwRZS0JsWMu
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro6673.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro6673.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro6673.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro6673.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pro6673.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro6673.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro6673.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/4112-163-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4112-165-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4112-170-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4112-174-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4112-178-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4112-181-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4112-186-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4112-189-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4112-195-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4112-201-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4112-205-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4112-210-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4112-214-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4112-217-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4112-222-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4112-224-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/4112-226-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline -
Executes dropped EXE 5 IoCs
Processes:
un556022.exepro6673.exepro6673.exequ8596.exesi116406.exepid process 1400 un556022.exe 2464 pro6673.exe 3936 pro6673.exe 4112 qu8596.exe 3396 si116406.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro6673.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro6673.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro6673.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
04d705e5db50f6b6207f2b80bbd188ac14e860b43b56a15b38547467e1b61192.exeun556022.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 04d705e5db50f6b6207f2b80bbd188ac14e860b43b56a15b38547467e1b61192.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un556022.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un556022.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 04d705e5db50f6b6207f2b80bbd188ac14e860b43b56a15b38547467e1b61192.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
pro6673.exedescription pid process target process PID 2464 set thread context of 3936 2464 pro6673.exe pro6673.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2208 4112 WerFault.exe qu8596.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro6673.exequ8596.exesi116406.exepid process 3936 pro6673.exe 3936 pro6673.exe 4112 qu8596.exe 4112 qu8596.exe 3396 si116406.exe 3396 si116406.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pro6673.exequ8596.exesi116406.exedescription pid process Token: SeDebugPrivilege 3936 pro6673.exe Token: SeDebugPrivilege 4112 qu8596.exe Token: SeDebugPrivilege 3396 si116406.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
04d705e5db50f6b6207f2b80bbd188ac14e860b43b56a15b38547467e1b61192.exeun556022.exepro6673.exedescription pid process target process PID 3660 wrote to memory of 1400 3660 04d705e5db50f6b6207f2b80bbd188ac14e860b43b56a15b38547467e1b61192.exe un556022.exe PID 3660 wrote to memory of 1400 3660 04d705e5db50f6b6207f2b80bbd188ac14e860b43b56a15b38547467e1b61192.exe un556022.exe PID 3660 wrote to memory of 1400 3660 04d705e5db50f6b6207f2b80bbd188ac14e860b43b56a15b38547467e1b61192.exe un556022.exe PID 1400 wrote to memory of 2464 1400 un556022.exe pro6673.exe PID 1400 wrote to memory of 2464 1400 un556022.exe pro6673.exe PID 1400 wrote to memory of 2464 1400 un556022.exe pro6673.exe PID 2464 wrote to memory of 3936 2464 pro6673.exe pro6673.exe PID 2464 wrote to memory of 3936 2464 pro6673.exe pro6673.exe PID 2464 wrote to memory of 3936 2464 pro6673.exe pro6673.exe PID 2464 wrote to memory of 3936 2464 pro6673.exe pro6673.exe PID 2464 wrote to memory of 3936 2464 pro6673.exe pro6673.exe PID 2464 wrote to memory of 3936 2464 pro6673.exe pro6673.exe PID 2464 wrote to memory of 3936 2464 pro6673.exe pro6673.exe PID 2464 wrote to memory of 3936 2464 pro6673.exe pro6673.exe PID 2464 wrote to memory of 3936 2464 pro6673.exe pro6673.exe PID 1400 wrote to memory of 4112 1400 un556022.exe qu8596.exe PID 1400 wrote to memory of 4112 1400 un556022.exe qu8596.exe PID 1400 wrote to memory of 4112 1400 un556022.exe qu8596.exe PID 3660 wrote to memory of 3396 3660 04d705e5db50f6b6207f2b80bbd188ac14e860b43b56a15b38547467e1b61192.exe si116406.exe PID 3660 wrote to memory of 3396 3660 04d705e5db50f6b6207f2b80bbd188ac14e860b43b56a15b38547467e1b61192.exe si116406.exe PID 3660 wrote to memory of 3396 3660 04d705e5db50f6b6207f2b80bbd188ac14e860b43b56a15b38547467e1b61192.exe si116406.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04d705e5db50f6b6207f2b80bbd188ac14e860b43b56a15b38547467e1b61192.exe"C:\Users\Admin\AppData\Local\Temp\04d705e5db50f6b6207f2b80bbd188ac14e860b43b56a15b38547467e1b61192.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un556022.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un556022.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6673.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6673.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6673.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6673.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8596.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8596.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 18764⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si116406.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si116406.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4112 -ip 41121⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si116406.exeFilesize
175KB
MD5a5cd41a516bf0d0e1822e8abfa644e6e
SHA193346eca9469505d667c6d9e633f6a724f7bbdb9
SHA2564cb6d31ba8e9b2019348d2cd5d8b275010d90d0d7cc7d652f637679937c162ee
SHA512e847a3e5423c87dde9e02b557f62f2fcd04d88659518f9bf96cc84faa0b6d51b31fab39550f201767e349b82ee792f07725bcedb96cab75800781316fe32999a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si116406.exeFilesize
175KB
MD5a5cd41a516bf0d0e1822e8abfa644e6e
SHA193346eca9469505d667c6d9e633f6a724f7bbdb9
SHA2564cb6d31ba8e9b2019348d2cd5d8b275010d90d0d7cc7d652f637679937c162ee
SHA512e847a3e5423c87dde9e02b557f62f2fcd04d88659518f9bf96cc84faa0b6d51b31fab39550f201767e349b82ee792f07725bcedb96cab75800781316fe32999a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un556022.exeFilesize
518KB
MD5dccf9bf5fce1071130274a2227a662b1
SHA107efd5c508d28404bbf0ef6017413e66d7fe18c5
SHA256d2635198ad29de5c8934b4043d1d15f6a9ebbea3eceb5860f9cb8a46e50c24c6
SHA5124d3ea6d9bd3c27c6d8f93a1b4ca6160b106ea910379427e8d5eef8d1196d5d7c18642521c40cea268b46034b90df5aea6a1034d3745211a36aee4720108e68f8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un556022.exeFilesize
518KB
MD5dccf9bf5fce1071130274a2227a662b1
SHA107efd5c508d28404bbf0ef6017413e66d7fe18c5
SHA256d2635198ad29de5c8934b4043d1d15f6a9ebbea3eceb5860f9cb8a46e50c24c6
SHA5124d3ea6d9bd3c27c6d8f93a1b4ca6160b106ea910379427e8d5eef8d1196d5d7c18642521c40cea268b46034b90df5aea6a1034d3745211a36aee4720108e68f8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6673.exeFilesize
237KB
MD5d28347e9c711d5106d56a4cc9576ca1a
SHA1a8c60d753fd0ee8435e346bd0611c500924f6464
SHA25659fa28bd06ac27cd2011b52ce27e0dd26032f2bd36522ca2432cba7429b8c8c9
SHA51201abe4e17d6e7bc8d5fb04617f66036be68cf9da399b6cc5cef8e67d378ce2819976e37e2781ec379b348f7810ba2d6e7605c5656ee0f96a331a511f7919838e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6673.exeFilesize
237KB
MD5d28347e9c711d5106d56a4cc9576ca1a
SHA1a8c60d753fd0ee8435e346bd0611c500924f6464
SHA25659fa28bd06ac27cd2011b52ce27e0dd26032f2bd36522ca2432cba7429b8c8c9
SHA51201abe4e17d6e7bc8d5fb04617f66036be68cf9da399b6cc5cef8e67d378ce2819976e37e2781ec379b348f7810ba2d6e7605c5656ee0f96a331a511f7919838e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6673.exeFilesize
237KB
MD5d28347e9c711d5106d56a4cc9576ca1a
SHA1a8c60d753fd0ee8435e346bd0611c500924f6464
SHA25659fa28bd06ac27cd2011b52ce27e0dd26032f2bd36522ca2432cba7429b8c8c9
SHA51201abe4e17d6e7bc8d5fb04617f66036be68cf9da399b6cc5cef8e67d378ce2819976e37e2781ec379b348f7810ba2d6e7605c5656ee0f96a331a511f7919838e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8596.exeFilesize
294KB
MD50eed4077646acd435d485414fe71f90a
SHA1a537df547c9336fb4cd51f578c7b58b23a6a71bd
SHA2564c39a4d0a51cc848de2e32780f12cff6b6b16c6b54020f4876d9171cc6c19efb
SHA5123208b02744bfabee374d608df07a204e386edae34fd08b027d06f7bb42ed9b9d2f5c8f0e095fe158058c6d171ab21658d0fea2380f296a8d233b6be9833166af
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8596.exeFilesize
294KB
MD50eed4077646acd435d485414fe71f90a
SHA1a537df547c9336fb4cd51f578c7b58b23a6a71bd
SHA2564c39a4d0a51cc848de2e32780f12cff6b6b16c6b54020f4876d9171cc6c19efb
SHA5123208b02744bfabee374d608df07a204e386edae34fd08b027d06f7bb42ed9b9d2f5c8f0e095fe158058c6d171ab21658d0fea2380f296a8d233b6be9833166af
-
memory/2464-150-0x0000000000560000-0x000000000058E000-memory.dmpFilesize
184KB
-
memory/3396-1132-0x00000000056A0000-0x00000000056B0000-memory.dmpFilesize
64KB
-
memory/3396-1131-0x0000000000AA0000-0x0000000000AD2000-memory.dmpFilesize
200KB
-
memory/3936-1109-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/3936-206-0x0000000005040000-0x0000000005052000-memory.dmpFilesize
72KB
-
memory/3936-161-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/3936-162-0x0000000004A40000-0x0000000004FE4000-memory.dmpFilesize
5.6MB
-
memory/3936-164-0x0000000005040000-0x0000000005052000-memory.dmpFilesize
72KB
-
memory/3936-148-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3936-166-0x0000000005040000-0x0000000005052000-memory.dmpFilesize
72KB
-
memory/3936-151-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3936-169-0x0000000005040000-0x0000000005052000-memory.dmpFilesize
72KB
-
memory/3936-152-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3936-173-0x0000000005040000-0x0000000005052000-memory.dmpFilesize
72KB
-
memory/3936-154-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3936-1120-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3936-177-0x0000000005040000-0x0000000005052000-memory.dmpFilesize
72KB
-
memory/3936-182-0x0000000005040000-0x0000000005052000-memory.dmpFilesize
72KB
-
memory/3936-1111-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/3936-160-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/3936-1110-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/3936-159-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/3936-190-0x0000000005040000-0x0000000005052000-memory.dmpFilesize
72KB
-
memory/3936-185-0x0000000005040000-0x0000000005052000-memory.dmpFilesize
72KB
-
memory/3936-1108-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3936-221-0x0000000005040000-0x0000000005052000-memory.dmpFilesize
72KB
-
memory/3936-196-0x0000000005040000-0x0000000005052000-memory.dmpFilesize
72KB
-
memory/3936-218-0x0000000005040000-0x0000000005052000-memory.dmpFilesize
72KB
-
memory/3936-213-0x0000000005040000-0x0000000005052000-memory.dmpFilesize
72KB
-
memory/3936-209-0x0000000005040000-0x0000000005052000-memory.dmpFilesize
72KB
-
memory/3936-202-0x0000000005040000-0x0000000005052000-memory.dmpFilesize
72KB
-
memory/4112-186-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4112-195-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4112-210-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4112-201-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4112-214-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4112-200-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4112-197-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4112-217-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4112-222-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4112-224-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4112-194-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4112-226-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4112-1101-0x00000000051B0000-0x00000000057C8000-memory.dmpFilesize
6.1MB
-
memory/4112-1102-0x00000000057D0000-0x00000000058DA000-memory.dmpFilesize
1.0MB
-
memory/4112-1103-0x0000000004BB0000-0x0000000004BC2000-memory.dmpFilesize
72KB
-
memory/4112-1104-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4112-1105-0x00000000058E0000-0x000000000591C000-memory.dmpFilesize
240KB
-
memory/4112-205-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4112-191-0x0000000002150000-0x000000000219B000-memory.dmpFilesize
300KB
-
memory/4112-189-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4112-181-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4112-1112-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/4112-1113-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/4112-1114-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4112-1115-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4112-1116-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4112-178-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4112-1121-0x0000000007620000-0x0000000007696000-memory.dmpFilesize
472KB
-
memory/4112-1122-0x00000000076B0000-0x0000000007700000-memory.dmpFilesize
320KB
-
memory/4112-1123-0x0000000004BF0000-0x0000000004C00000-memory.dmpFilesize
64KB
-
memory/4112-1124-0x0000000007810000-0x00000000079D2000-memory.dmpFilesize
1.8MB
-
memory/4112-1125-0x0000000007A20000-0x0000000007F4C000-memory.dmpFilesize
5.2MB
-
memory/4112-174-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4112-170-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4112-165-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/4112-163-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB