Analysis
-
max time kernel
193s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2023 09:09
Static task
static1
Behavioral task
behavioral1
Sample
3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34.exe
Resource
win10v2004-20230220-en
General
-
Target
3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34.exe
-
Size
490KB
-
MD5
640427557f9d7f81d7106f3e74d52be2
-
SHA1
3aa1f5efe2637a3d2d16aac2118b31f13165caa7
-
SHA256
3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34
-
SHA512
e61cc31d6474705a73d8a1bce5662e46ea36043ffccfbaaa35886e94ff41b9337631774b828cce51f833f2e9e801fe8fe8dcf5b91021bb599752f2b0acec6282
-
SSDEEP
12288:bMr2y90VyaSCtFFPQwObak+iV6/Pz7IuNE+ukO5:dy4SHwAV+l4+Y
Malware Config
Extracted
redline
lada
217.196.96.101:4132
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Signatures
-
Processes:
o8282720.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection o8282720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" o8282720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" o8282720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" o8282720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" o8282720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" o8282720.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s8256508.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation s8256508.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 6 IoCs
Processes:
z8491927.exeo8282720.exer7815827.exes8256508.exeoneetx.exeoneetx.exepid process 3396 z8491927.exe 1436 o8282720.exe 2596 r7815827.exe 2948 s8256508.exe 3252 oneetx.exe 3340 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3632 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
o8282720.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features o8282720.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" o8282720.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34.exez8491927.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z8491927.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z8491927.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
o8282720.exer7815827.exepid process 1436 o8282720.exe 1436 o8282720.exe 2596 r7815827.exe 2596 r7815827.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
o8282720.exer7815827.exedescription pid process Token: SeDebugPrivilege 1436 o8282720.exe Token: SeDebugPrivilege 2596 r7815827.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
s8256508.exepid process 2948 s8256508.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34.exez8491927.exes8256508.exeoneetx.exedescription pid process target process PID 2164 wrote to memory of 3396 2164 3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34.exe z8491927.exe PID 2164 wrote to memory of 3396 2164 3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34.exe z8491927.exe PID 2164 wrote to memory of 3396 2164 3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34.exe z8491927.exe PID 3396 wrote to memory of 1436 3396 z8491927.exe o8282720.exe PID 3396 wrote to memory of 1436 3396 z8491927.exe o8282720.exe PID 3396 wrote to memory of 1436 3396 z8491927.exe o8282720.exe PID 3396 wrote to memory of 2596 3396 z8491927.exe r7815827.exe PID 3396 wrote to memory of 2596 3396 z8491927.exe r7815827.exe PID 3396 wrote to memory of 2596 3396 z8491927.exe r7815827.exe PID 2164 wrote to memory of 2948 2164 3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34.exe s8256508.exe PID 2164 wrote to memory of 2948 2164 3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34.exe s8256508.exe PID 2164 wrote to memory of 2948 2164 3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34.exe s8256508.exe PID 2948 wrote to memory of 3252 2948 s8256508.exe oneetx.exe PID 2948 wrote to memory of 3252 2948 s8256508.exe oneetx.exe PID 2948 wrote to memory of 3252 2948 s8256508.exe oneetx.exe PID 3252 wrote to memory of 4568 3252 oneetx.exe schtasks.exe PID 3252 wrote to memory of 4568 3252 oneetx.exe schtasks.exe PID 3252 wrote to memory of 4568 3252 oneetx.exe schtasks.exe PID 3252 wrote to memory of 3632 3252 oneetx.exe rundll32.exe PID 3252 wrote to memory of 3632 3252 oneetx.exe rundll32.exe PID 3252 wrote to memory of 3632 3252 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34.exe"C:\Users\Admin\AppData\Local\Temp\3bf207dfed8e18fe10d53c6b8cda1d2123f33be8945230ec5cdbf94213a90e34.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8491927.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8491927.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o8282720.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o8282720.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7815827.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7815827.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8256508.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8256508.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
231KB
MD5f5571d5b7ed2fa69d726c30a06b294de
SHA1c4273b77d932bc69300245d26965e9bde5679001
SHA256e676b50f98841d4270c1d2fa0799187fa850757187a837ddc1adbd746d5b2d39
SHA5124c1f85e20ba5dd13b16feb8f958517942af319231a2b2cd9afbddeca9bc62491465d6d5be020bf4e40d2b8fc5dce4556fc1a89c76556e47e8c27ad5e80e37d72
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
231KB
MD5f5571d5b7ed2fa69d726c30a06b294de
SHA1c4273b77d932bc69300245d26965e9bde5679001
SHA256e676b50f98841d4270c1d2fa0799187fa850757187a837ddc1adbd746d5b2d39
SHA5124c1f85e20ba5dd13b16feb8f958517942af319231a2b2cd9afbddeca9bc62491465d6d5be020bf4e40d2b8fc5dce4556fc1a89c76556e47e8c27ad5e80e37d72
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
231KB
MD5f5571d5b7ed2fa69d726c30a06b294de
SHA1c4273b77d932bc69300245d26965e9bde5679001
SHA256e676b50f98841d4270c1d2fa0799187fa850757187a837ddc1adbd746d5b2d39
SHA5124c1f85e20ba5dd13b16feb8f958517942af319231a2b2cd9afbddeca9bc62491465d6d5be020bf4e40d2b8fc5dce4556fc1a89c76556e47e8c27ad5e80e37d72
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
231KB
MD5f5571d5b7ed2fa69d726c30a06b294de
SHA1c4273b77d932bc69300245d26965e9bde5679001
SHA256e676b50f98841d4270c1d2fa0799187fa850757187a837ddc1adbd746d5b2d39
SHA5124c1f85e20ba5dd13b16feb8f958517942af319231a2b2cd9afbddeca9bc62491465d6d5be020bf4e40d2b8fc5dce4556fc1a89c76556e47e8c27ad5e80e37d72
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8256508.exeFilesize
231KB
MD5f5571d5b7ed2fa69d726c30a06b294de
SHA1c4273b77d932bc69300245d26965e9bde5679001
SHA256e676b50f98841d4270c1d2fa0799187fa850757187a837ddc1adbd746d5b2d39
SHA5124c1f85e20ba5dd13b16feb8f958517942af319231a2b2cd9afbddeca9bc62491465d6d5be020bf4e40d2b8fc5dce4556fc1a89c76556e47e8c27ad5e80e37d72
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s8256508.exeFilesize
231KB
MD5f5571d5b7ed2fa69d726c30a06b294de
SHA1c4273b77d932bc69300245d26965e9bde5679001
SHA256e676b50f98841d4270c1d2fa0799187fa850757187a837ddc1adbd746d5b2d39
SHA5124c1f85e20ba5dd13b16feb8f958517942af319231a2b2cd9afbddeca9bc62491465d6d5be020bf4e40d2b8fc5dce4556fc1a89c76556e47e8c27ad5e80e37d72
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8491927.exeFilesize
307KB
MD50825ba6bd5d8b80a04b045814b7a3c1f
SHA1184593f72765502cfc96f8cb52198987e3ed1a36
SHA25655290742f12323d8ccfa2278f2213cdfa21fc212754ebc8073b500fb680b93b5
SHA51284d8e14e3e9136a9e0e0759677e8d48dcbc22c876f0e5b4fd071887f0f840b46fd0b95f45230b8236cbb2830cfea1819ff5d76764819ec2f0cf049442f7e5f7e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8491927.exeFilesize
307KB
MD50825ba6bd5d8b80a04b045814b7a3c1f
SHA1184593f72765502cfc96f8cb52198987e3ed1a36
SHA25655290742f12323d8ccfa2278f2213cdfa21fc212754ebc8073b500fb680b93b5
SHA51284d8e14e3e9136a9e0e0759677e8d48dcbc22c876f0e5b4fd071887f0f840b46fd0b95f45230b8236cbb2830cfea1819ff5d76764819ec2f0cf049442f7e5f7e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o8282720.exeFilesize
177KB
MD55c34ee1302746ea137faefa57b73dcea
SHA1b0a463bb1ae5fe1b900147ef9235dfcab283d4bc
SHA2563fee38540f4b2e2b1cb146a4730ccf91e3f35170cdd3c520ebcc22ba8e668f43
SHA512ba4720d24297e656ec68d1aefc39ccfd542c0e96bb1a222235b6a9108d54c44c632fcaa94c60e2a83bd3500be7ba4b30394bed6123a36064d51c103b72e5f234
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o8282720.exeFilesize
177KB
MD55c34ee1302746ea137faefa57b73dcea
SHA1b0a463bb1ae5fe1b900147ef9235dfcab283d4bc
SHA2563fee38540f4b2e2b1cb146a4730ccf91e3f35170cdd3c520ebcc22ba8e668f43
SHA512ba4720d24297e656ec68d1aefc39ccfd542c0e96bb1a222235b6a9108d54c44c632fcaa94c60e2a83bd3500be7ba4b30394bed6123a36064d51c103b72e5f234
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7815827.exeFilesize
168KB
MD54d9881758dbe75e9c17e13eb7f6980b9
SHA18be68b5cd7a79e91112adfd6f605d19a3dcfa476
SHA256f9117942a334c89be54db10fe9a10aab3c40982a8dfa47031588f17be0b38baa
SHA5123eea9c43d4e85b7b73b08607e0f3500645e172893d3fbe99664da549f2a30f8db41d817e8c146930471cb30c2026b73cccef051e99965a0f5a4da94a87080e98
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r7815827.exeFilesize
168KB
MD54d9881758dbe75e9c17e13eb7f6980b9
SHA18be68b5cd7a79e91112adfd6f605d19a3dcfa476
SHA256f9117942a334c89be54db10fe9a10aab3c40982a8dfa47031588f17be0b38baa
SHA5123eea9c43d4e85b7b73b08607e0f3500645e172893d3fbe99664da549f2a30f8db41d817e8c146930471cb30c2026b73cccef051e99965a0f5a4da94a87080e98
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1436-157-0x0000000002570000-0x0000000002582000-memory.dmpFilesize
72KB
-
memory/1436-155-0x0000000002570000-0x0000000002582000-memory.dmpFilesize
72KB
-
memory/1436-169-0x0000000002570000-0x0000000002582000-memory.dmpFilesize
72KB
-
memory/1436-171-0x0000000002570000-0x0000000002582000-memory.dmpFilesize
72KB
-
memory/1436-173-0x0000000002570000-0x0000000002582000-memory.dmpFilesize
72KB
-
memory/1436-175-0x0000000002570000-0x0000000002582000-memory.dmpFilesize
72KB
-
memory/1436-177-0x0000000002570000-0x0000000002582000-memory.dmpFilesize
72KB
-
memory/1436-179-0x0000000002570000-0x0000000002582000-memory.dmpFilesize
72KB
-
memory/1436-165-0x0000000002570000-0x0000000002582000-memory.dmpFilesize
72KB
-
memory/1436-163-0x0000000002570000-0x0000000002582000-memory.dmpFilesize
72KB
-
memory/1436-147-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/1436-148-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/1436-149-0x0000000004AD0000-0x0000000005074000-memory.dmpFilesize
5.6MB
-
memory/1436-150-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/1436-151-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/1436-152-0x0000000002570000-0x0000000002582000-memory.dmpFilesize
72KB
-
memory/1436-153-0x0000000002570000-0x0000000002582000-memory.dmpFilesize
72KB
-
memory/1436-167-0x0000000002570000-0x0000000002582000-memory.dmpFilesize
72KB
-
memory/1436-159-0x0000000002570000-0x0000000002582000-memory.dmpFilesize
72KB
-
memory/1436-161-0x0000000002570000-0x0000000002582000-memory.dmpFilesize
72KB
-
memory/2596-190-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/2596-195-0x000000000BFE0000-0x000000000C50C000-memory.dmpFilesize
5.2MB
-
memory/2596-196-0x000000000B110000-0x000000000B160000-memory.dmpFilesize
320KB
-
memory/2596-193-0x000000000A390000-0x000000000A3F6000-memory.dmpFilesize
408KB
-
memory/2596-192-0x000000000A430000-0x000000000A4C2000-memory.dmpFilesize
584KB
-
memory/2596-191-0x000000000A310000-0x000000000A386000-memory.dmpFilesize
472KB
-
memory/2596-194-0x000000000B220000-0x000000000B3E2000-memory.dmpFilesize
1.8MB
-
memory/2596-189-0x000000000A000000-0x000000000A03C000-memory.dmpFilesize
240KB
-
memory/2596-188-0x0000000004A30000-0x0000000004A40000-memory.dmpFilesize
64KB
-
memory/2596-187-0x0000000009FA0000-0x0000000009FB2000-memory.dmpFilesize
72KB
-
memory/2596-186-0x000000000A070000-0x000000000A17A000-memory.dmpFilesize
1.0MB
-
memory/2596-185-0x000000000A4F0000-0x000000000AB08000-memory.dmpFilesize
6.1MB
-
memory/2596-184-0x0000000000230000-0x0000000000260000-memory.dmpFilesize
192KB