Analysis
-
max time kernel
186s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
01-05-2023 16:59
Static task
static1
Behavioral task
behavioral1
Sample
711c6ec0df8a75228ea640aa14d259104b78a8e4ca116e178e2609261c145a9d.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
711c6ec0df8a75228ea640aa14d259104b78a8e4ca116e178e2609261c145a9d.exe
Resource
win10v2004-20230221-en
General
-
Target
711c6ec0df8a75228ea640aa14d259104b78a8e4ca116e178e2609261c145a9d.exe
-
Size
1.2MB
-
MD5
d96887d27fddd55b6bc9cca39e8a8c01
-
SHA1
4f8b0b546788d376cfc3722a365b6125583d4de4
-
SHA256
711c6ec0df8a75228ea640aa14d259104b78a8e4ca116e178e2609261c145a9d
-
SHA512
5a42d68742e8f87c4be1a1ceece71426f6cf5b1d8e61edba8d2112e9b10080343ef3ccfa64c7ae1d902fb9800594d1766d7251ebf0e93384f8e25a1ebccea143
-
SSDEEP
24576:5yxy+kRmJNCJPo9H7dvb6KkyY/TpQ3qK0u7lfdLh9DhRAkSUW93/aUE:sxyvMJNCho9H1bp87u6K5JhTzLo
Malware Config
Extracted
redline
gena
185.161.248.73:4164
-
auth_value
d05bf43eef533e262271449829751d07
Extracted
redline
life
185.161.248.73:4164
-
auth_value
8685d11953530b68ad5ec703809d9f91
Signatures
-
Detects Redline Stealer samples 3 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
Processes:
resource yara_rule behavioral2/memory/2468-2334-0x00000000050C0000-0x00000000056D8000-memory.dmp redline_stealer behavioral2/memory/2468-2351-0x0000000005050000-0x00000000050B6000-memory.dmp redline_stealer behavioral2/memory/808-2352-0x0000000005DA0000-0x0000000005F62000-memory.dmp redline_stealer -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s76867837.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation s76867837.exe -
Executes dropped EXE 6 IoCs
Processes:
z32091292.exez57610492.exez25776460.exes76867837.exe1.exet31251887.exepid process 2308 z32091292.exe 3644 z57610492.exe 5012 z25776460.exe 4844 s76867837.exe 2468 1.exe 808 t31251887.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
z25776460.exe711c6ec0df8a75228ea640aa14d259104b78a8e4ca116e178e2609261c145a9d.exez32091292.exez57610492.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z25776460.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z25776460.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 711c6ec0df8a75228ea640aa14d259104b78a8e4ca116e178e2609261c145a9d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 711c6ec0df8a75228ea640aa14d259104b78a8e4ca116e178e2609261c145a9d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z32091292.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z32091292.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z57610492.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z57610492.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 756 4844 WerFault.exe s76867837.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
t31251887.exe1.exepid process 808 t31251887.exe 2468 1.exe 2468 1.exe 808 t31251887.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
s76867837.exet31251887.exe1.exedescription pid process Token: SeDebugPrivilege 4844 s76867837.exe Token: SeDebugPrivilege 808 t31251887.exe Token: SeDebugPrivilege 2468 1.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
711c6ec0df8a75228ea640aa14d259104b78a8e4ca116e178e2609261c145a9d.exez32091292.exez57610492.exez25776460.exes76867837.exedescription pid process target process PID 1384 wrote to memory of 2308 1384 711c6ec0df8a75228ea640aa14d259104b78a8e4ca116e178e2609261c145a9d.exe z32091292.exe PID 1384 wrote to memory of 2308 1384 711c6ec0df8a75228ea640aa14d259104b78a8e4ca116e178e2609261c145a9d.exe z32091292.exe PID 1384 wrote to memory of 2308 1384 711c6ec0df8a75228ea640aa14d259104b78a8e4ca116e178e2609261c145a9d.exe z32091292.exe PID 2308 wrote to memory of 3644 2308 z32091292.exe z57610492.exe PID 2308 wrote to memory of 3644 2308 z32091292.exe z57610492.exe PID 2308 wrote to memory of 3644 2308 z32091292.exe z57610492.exe PID 3644 wrote to memory of 5012 3644 z57610492.exe z25776460.exe PID 3644 wrote to memory of 5012 3644 z57610492.exe z25776460.exe PID 3644 wrote to memory of 5012 3644 z57610492.exe z25776460.exe PID 5012 wrote to memory of 4844 5012 z25776460.exe s76867837.exe PID 5012 wrote to memory of 4844 5012 z25776460.exe s76867837.exe PID 5012 wrote to memory of 4844 5012 z25776460.exe s76867837.exe PID 4844 wrote to memory of 2468 4844 s76867837.exe 1.exe PID 4844 wrote to memory of 2468 4844 s76867837.exe 1.exe PID 4844 wrote to memory of 2468 4844 s76867837.exe 1.exe PID 5012 wrote to memory of 808 5012 z25776460.exe t31251887.exe PID 5012 wrote to memory of 808 5012 z25776460.exe t31251887.exe PID 5012 wrote to memory of 808 5012 z25776460.exe t31251887.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\711c6ec0df8a75228ea640aa14d259104b78a8e4ca116e178e2609261c145a9d.exe"C:\Users\Admin\AppData\Local\Temp\711c6ec0df8a75228ea640aa14d259104b78a8e4ca116e178e2609261c145a9d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z32091292.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z32091292.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z57610492.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z57610492.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z25776460.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z25776460.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s76867837.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s76867837.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 15286⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t31251887.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t31251887.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4844 -ip 48441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z32091292.exeFilesize
1.0MB
MD5b59664c5e03b1201c6a92aea6793aeaa
SHA141f8e54f097319aa70a6b3816e567cda4094621c
SHA2566dd728d2f5532824dd4dd588ed50af9e35052e971013bf9f72d48f4f0a93cc00
SHA51250033c3aa2d2cb0033ea2794de950d5042c7aa5c831b50f8d034ef57691d96c3afa4302d95d57af5dc45c0cdab0ce8fb1ca1453beeaab5bb7931154f8a5a232c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z32091292.exeFilesize
1.0MB
MD5b59664c5e03b1201c6a92aea6793aeaa
SHA141f8e54f097319aa70a6b3816e567cda4094621c
SHA2566dd728d2f5532824dd4dd588ed50af9e35052e971013bf9f72d48f4f0a93cc00
SHA51250033c3aa2d2cb0033ea2794de950d5042c7aa5c831b50f8d034ef57691d96c3afa4302d95d57af5dc45c0cdab0ce8fb1ca1453beeaab5bb7931154f8a5a232c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z57610492.exeFilesize
759KB
MD52743d3e44eaa34ec2084d6660ae330c3
SHA1197eebae2b65bbc6508a91a002d1e7d45a092c26
SHA256d28f85a09497c9e3932b6e937f4d7811a72576ab7c76daf8bafa4617402e7995
SHA51204802f5fd414a437c9576b29da56b06b1fd30f1a65b1ed61cf82ad5943399dbd5600dfce1e7be409dc2cf26dbdd8912e4f2b847142cbda3a72eb44f1babb03fd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z57610492.exeFilesize
759KB
MD52743d3e44eaa34ec2084d6660ae330c3
SHA1197eebae2b65bbc6508a91a002d1e7d45a092c26
SHA256d28f85a09497c9e3932b6e937f4d7811a72576ab7c76daf8bafa4617402e7995
SHA51204802f5fd414a437c9576b29da56b06b1fd30f1a65b1ed61cf82ad5943399dbd5600dfce1e7be409dc2cf26dbdd8912e4f2b847142cbda3a72eb44f1babb03fd
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z25776460.exeFilesize
577KB
MD539b419f7bd9faf4b3de5b86563b96e6b
SHA184d57108e4bd894d220565b2e6498d55622d5d51
SHA2561f941a9e317d5a247657313a4e6b8ff2faa50d0d739f700e75d039a176594368
SHA51203441e3786be527728d079f8f10e58d90406f92914456cf74add89372cf67312fa888348911c9453e1200108f0113d9204e83f65f0c1a9683aba9440a33f32ee
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z25776460.exeFilesize
577KB
MD539b419f7bd9faf4b3de5b86563b96e6b
SHA184d57108e4bd894d220565b2e6498d55622d5d51
SHA2561f941a9e317d5a247657313a4e6b8ff2faa50d0d739f700e75d039a176594368
SHA51203441e3786be527728d079f8f10e58d90406f92914456cf74add89372cf67312fa888348911c9453e1200108f0113d9204e83f65f0c1a9683aba9440a33f32ee
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s76867837.exeFilesize
574KB
MD5d33a622ccec9deacf85544d3bfdd6d51
SHA142c841718d25db700dcc2a39c259a49b2712e94d
SHA256aadff0cf486966cfd1b95bac878bb846dbc8a7dcc241ee5a0f7d5a8d28552b56
SHA5122194978bc3b9ec40b122d887250838ae8fcf0643d1ea3ac43170d80e090727ec0dad92d62ee53b82038792ecd6a61ca78c674872534a479ad07510e3c79d1b3d
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s76867837.exeFilesize
574KB
MD5d33a622ccec9deacf85544d3bfdd6d51
SHA142c841718d25db700dcc2a39c259a49b2712e94d
SHA256aadff0cf486966cfd1b95bac878bb846dbc8a7dcc241ee5a0f7d5a8d28552b56
SHA5122194978bc3b9ec40b122d887250838ae8fcf0643d1ea3ac43170d80e090727ec0dad92d62ee53b82038792ecd6a61ca78c674872534a479ad07510e3c79d1b3d
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t31251887.exeFilesize
169KB
MD5c08c37777f13023b28774720d64b2960
SHA1ca05b214d6f9e13d8461e3fa32b195570aa10ace
SHA256b1ef107d3586167c60e351cb4ca94fb65694fdd7848b44a8ebffe7152fa37cb6
SHA512c208e1802b196d4b1d8d62665b725f25c8183a3934f1a09aa7ef3a266a87d53cefb8972ea900e3bddb5c7ff247b5068835a378286be8b2f5eb53348eae6c2aab
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\t31251887.exeFilesize
169KB
MD5c08c37777f13023b28774720d64b2960
SHA1ca05b214d6f9e13d8461e3fa32b195570aa10ace
SHA256b1ef107d3586167c60e351cb4ca94fb65694fdd7848b44a8ebffe7152fa37cb6
SHA512c208e1802b196d4b1d8d62665b725f25c8183a3934f1a09aa7ef3a266a87d53cefb8972ea900e3bddb5c7ff247b5068835a378286be8b2f5eb53348eae6c2aab
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
C:\Windows\Temp\1.exeFilesize
168KB
MD5f16fb63d4e551d3808e8f01f2671b57e
SHA1781153ad6235a1152da112de1fb39a6f2d063575
SHA2568a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581
SHA512fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf
-
memory/808-2348-0x0000000004A60000-0x0000000004A70000-memory.dmpFilesize
64KB
-
memory/808-2352-0x0000000005DA0000-0x0000000005F62000-memory.dmpFilesize
1.8MB
-
memory/808-2347-0x0000000004A60000-0x0000000004A70000-memory.dmpFilesize
64KB
-
memory/808-2346-0x00000000000E0000-0x000000000010E000-memory.dmpFilesize
184KB
-
memory/808-2353-0x0000000008320000-0x000000000884C000-memory.dmpFilesize
5.2MB
-
memory/2468-2340-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/2468-2351-0x0000000005050000-0x00000000050B6000-memory.dmpFilesize
408KB
-
memory/2468-2349-0x0000000004F60000-0x0000000004FD6000-memory.dmpFilesize
472KB
-
memory/2468-2338-0x0000000004B20000-0x0000000004B5C000-memory.dmpFilesize
240KB
-
memory/2468-2337-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/2468-2336-0x0000000004AC0000-0x0000000004AD2000-memory.dmpFilesize
72KB
-
memory/2468-2335-0x0000000004BB0000-0x0000000004CBA000-memory.dmpFilesize
1.0MB
-
memory/2468-2334-0x00000000050C0000-0x00000000056D8000-memory.dmpFilesize
6.1MB
-
memory/2468-2331-0x0000000000160000-0x000000000018E000-memory.dmpFilesize
184KB
-
memory/2468-2350-0x00000000056E0000-0x0000000005772000-memory.dmpFilesize
584KB
-
memory/2468-2354-0x0000000005E20000-0x0000000005E70000-memory.dmpFilesize
320KB
-
memory/4844-176-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-196-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-202-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-204-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-206-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-208-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-210-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-212-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-214-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-216-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-218-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-220-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-222-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-224-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-226-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-228-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-230-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-2315-0x0000000002720000-0x0000000002730000-memory.dmpFilesize
64KB
-
memory/4844-2317-0x0000000002720000-0x0000000002730000-memory.dmpFilesize
64KB
-
memory/4844-2316-0x0000000002720000-0x0000000002730000-memory.dmpFilesize
64KB
-
memory/4844-2318-0x0000000002720000-0x0000000002730000-memory.dmpFilesize
64KB
-
memory/4844-194-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-200-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-198-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-192-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-2332-0x0000000002720000-0x0000000002730000-memory.dmpFilesize
64KB
-
memory/4844-186-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-188-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-190-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-184-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-182-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-180-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-178-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-173-0x0000000002720000-0x0000000002730000-memory.dmpFilesize
64KB
-
memory/4844-174-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-171-0x0000000002720000-0x0000000002730000-memory.dmpFilesize
64KB
-
memory/4844-169-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-170-0x0000000002720000-0x0000000002730000-memory.dmpFilesize
64KB
-
memory/4844-167-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-164-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-165-0x0000000002C20000-0x0000000002C80000-memory.dmpFilesize
384KB
-
memory/4844-163-0x00000000050D0000-0x0000000005674000-memory.dmpFilesize
5.6MB
-
memory/4844-162-0x0000000000910000-0x000000000096B000-memory.dmpFilesize
364KB