Analysis
-
max time kernel
143s -
max time network
162s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
07-05-2023 09:15
Static task
static1
Behavioral task
behavioral1
Sample
f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8.exe
Resource
win10-20230220-en
General
-
Target
f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8.exe
-
Size
489KB
-
MD5
a46257381e46a504d0b07d133dfaa6a6
-
SHA1
b006a5d920d358dd865c4671f32b59bb3f6ed257
-
SHA256
f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8
-
SHA512
687e4d3c2f919af10f4e9de7458a216a2b6adff78c6759eb2a284ecf21fc504838f8326b52aedf69b65577115c9458e8eb82e69b761e05e5d13d883415ad62a1
-
SSDEEP
12288:XMr2y90IFoTtQW02H1+biZKvI7Ic+iV6cPzDzsGNycFlvAhS:dylF/86OL+6EeycH4hS
Malware Config
Extracted
redline
lada
217.196.96.101:4132
-
auth_value
0b3678897547fedafe314eda5a2015ba
Extracted
amadey
3.70
212.113.119.255/joomla/index.php
Signatures
-
Processes:
o8818025.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" o8818025.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" o8818025.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" o8818025.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" o8818025.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" o8818025.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 7 IoCs
Processes:
z0708210.exeo8818025.exer9860850.exes1625168.exeoneetx.exeoneetx.exeoneetx.exepid process 4036 z0708210.exe 2088 o8818025.exe 980 r9860850.exe 4572 s1625168.exe 2444 oneetx.exe 4160 oneetx.exe 4484 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4404 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
o8818025.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features o8818025.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" o8818025.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8.exez0708210.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z0708210.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z0708210.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
o8818025.exer9860850.exepid process 2088 o8818025.exe 2088 o8818025.exe 980 r9860850.exe 980 r9860850.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
o8818025.exer9860850.exedescription pid process Token: SeDebugPrivilege 2088 o8818025.exe Token: SeDebugPrivilege 980 r9860850.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
s1625168.exepid process 4572 s1625168.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8.exez0708210.exes1625168.exeoneetx.exedescription pid process target process PID 4116 wrote to memory of 4036 4116 f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8.exe z0708210.exe PID 4116 wrote to memory of 4036 4116 f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8.exe z0708210.exe PID 4116 wrote to memory of 4036 4116 f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8.exe z0708210.exe PID 4036 wrote to memory of 2088 4036 z0708210.exe o8818025.exe PID 4036 wrote to memory of 2088 4036 z0708210.exe o8818025.exe PID 4036 wrote to memory of 2088 4036 z0708210.exe o8818025.exe PID 4036 wrote to memory of 980 4036 z0708210.exe r9860850.exe PID 4036 wrote to memory of 980 4036 z0708210.exe r9860850.exe PID 4036 wrote to memory of 980 4036 z0708210.exe r9860850.exe PID 4116 wrote to memory of 4572 4116 f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8.exe s1625168.exe PID 4116 wrote to memory of 4572 4116 f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8.exe s1625168.exe PID 4116 wrote to memory of 4572 4116 f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8.exe s1625168.exe PID 4572 wrote to memory of 2444 4572 s1625168.exe oneetx.exe PID 4572 wrote to memory of 2444 4572 s1625168.exe oneetx.exe PID 4572 wrote to memory of 2444 4572 s1625168.exe oneetx.exe PID 2444 wrote to memory of 4640 2444 oneetx.exe schtasks.exe PID 2444 wrote to memory of 4640 2444 oneetx.exe schtasks.exe PID 2444 wrote to memory of 4640 2444 oneetx.exe schtasks.exe PID 2444 wrote to memory of 4404 2444 oneetx.exe rundll32.exe PID 2444 wrote to memory of 4404 2444 oneetx.exe rundll32.exe PID 2444 wrote to memory of 4404 2444 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8.exe"C:\Users\Admin\AppData\Local\Temp\f8dc56d7c45851399a9a26843decf80bb67790b2f5c8a47d06424336846e56f8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0708210.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0708210.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o8818025.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o8818025.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9860850.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9860850.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1625168.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1625168.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeC:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
231KB
MD5f54ca12b431ac465825c250db49204ab
SHA11674684911a03ae1a1132e57f59862add7225d30
SHA2564e66d91196537685d040521c15b48cc34728da4adb2e67ef4473cc4aa43c2f7c
SHA5128b4bb1c6d21f86cbba0102581c6406d5d25bf38e4c34816f5f1a64afff977ce490292b5d814875b6c15f524287a2780b18cb38860c7e10b4d44c3c80d5eea8a4
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
231KB
MD5f54ca12b431ac465825c250db49204ab
SHA11674684911a03ae1a1132e57f59862add7225d30
SHA2564e66d91196537685d040521c15b48cc34728da4adb2e67ef4473cc4aa43c2f7c
SHA5128b4bb1c6d21f86cbba0102581c6406d5d25bf38e4c34816f5f1a64afff977ce490292b5d814875b6c15f524287a2780b18cb38860c7e10b4d44c3c80d5eea8a4
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
231KB
MD5f54ca12b431ac465825c250db49204ab
SHA11674684911a03ae1a1132e57f59862add7225d30
SHA2564e66d91196537685d040521c15b48cc34728da4adb2e67ef4473cc4aa43c2f7c
SHA5128b4bb1c6d21f86cbba0102581c6406d5d25bf38e4c34816f5f1a64afff977ce490292b5d814875b6c15f524287a2780b18cb38860c7e10b4d44c3c80d5eea8a4
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
231KB
MD5f54ca12b431ac465825c250db49204ab
SHA11674684911a03ae1a1132e57f59862add7225d30
SHA2564e66d91196537685d040521c15b48cc34728da4adb2e67ef4473cc4aa43c2f7c
SHA5128b4bb1c6d21f86cbba0102581c6406d5d25bf38e4c34816f5f1a64afff977ce490292b5d814875b6c15f524287a2780b18cb38860c7e10b4d44c3c80d5eea8a4
-
C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exeFilesize
231KB
MD5f54ca12b431ac465825c250db49204ab
SHA11674684911a03ae1a1132e57f59862add7225d30
SHA2564e66d91196537685d040521c15b48cc34728da4adb2e67ef4473cc4aa43c2f7c
SHA5128b4bb1c6d21f86cbba0102581c6406d5d25bf38e4c34816f5f1a64afff977ce490292b5d814875b6c15f524287a2780b18cb38860c7e10b4d44c3c80d5eea8a4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1625168.exeFilesize
231KB
MD5f54ca12b431ac465825c250db49204ab
SHA11674684911a03ae1a1132e57f59862add7225d30
SHA2564e66d91196537685d040521c15b48cc34728da4adb2e67ef4473cc4aa43c2f7c
SHA5128b4bb1c6d21f86cbba0102581c6406d5d25bf38e4c34816f5f1a64afff977ce490292b5d814875b6c15f524287a2780b18cb38860c7e10b4d44c3c80d5eea8a4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s1625168.exeFilesize
231KB
MD5f54ca12b431ac465825c250db49204ab
SHA11674684911a03ae1a1132e57f59862add7225d30
SHA2564e66d91196537685d040521c15b48cc34728da4adb2e67ef4473cc4aa43c2f7c
SHA5128b4bb1c6d21f86cbba0102581c6406d5d25bf38e4c34816f5f1a64afff977ce490292b5d814875b6c15f524287a2780b18cb38860c7e10b4d44c3c80d5eea8a4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0708210.exeFilesize
307KB
MD50741d9e72f453c9573a55eb6b33d5dc8
SHA1b03cafabf13e3cc13d41b4c6dfd8db2529cc6a37
SHA25628da6a67439ae9e7041c27ce6e23ece3e84322694c639cc4dd45120d21e5c5a1
SHA5126a883526d75f81fc5c2b88fa575e279b64f21bdf89ee03928893de64adf6882e088246c979cee99cded9d366bf4c784ea1d30cd0e1aa3349f7f66d8d2584add7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0708210.exeFilesize
307KB
MD50741d9e72f453c9573a55eb6b33d5dc8
SHA1b03cafabf13e3cc13d41b4c6dfd8db2529cc6a37
SHA25628da6a67439ae9e7041c27ce6e23ece3e84322694c639cc4dd45120d21e5c5a1
SHA5126a883526d75f81fc5c2b88fa575e279b64f21bdf89ee03928893de64adf6882e088246c979cee99cded9d366bf4c784ea1d30cd0e1aa3349f7f66d8d2584add7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o8818025.exeFilesize
177KB
MD568ca93b122dabc11260993bba0e77f4e
SHA159aa638d45b96d05b12187a28085aa34fb9cba51
SHA2569d9e1b16ee3938d13259d348e19cf7bfda0d7ed0ae3b52ef2a28597737aea7a6
SHA5125d202d8d366e4381f7bf7c93480ae5bef7ad0e08a1eeefb8546a5c72a8b3fe2591f31d868a901c45d08304def5464dad253078ca20ddfdb36d6af78781a7a0fd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o8818025.exeFilesize
177KB
MD568ca93b122dabc11260993bba0e77f4e
SHA159aa638d45b96d05b12187a28085aa34fb9cba51
SHA2569d9e1b16ee3938d13259d348e19cf7bfda0d7ed0ae3b52ef2a28597737aea7a6
SHA5125d202d8d366e4381f7bf7c93480ae5bef7ad0e08a1eeefb8546a5c72a8b3fe2591f31d868a901c45d08304def5464dad253078ca20ddfdb36d6af78781a7a0fd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9860850.exeFilesize
168KB
MD5448867b9d9adede1f85f440f40d0d9c0
SHA11cf4ae553e929076e3df1af487cfd6579aa99ee3
SHA25632a2a0fb659d267d12d2d6f4f2add7b835d8e11560e80de685bf34ed5687b4a7
SHA512fab51b8e9834f1ce74c7cd53749b880ed562107061595da52f75207577ea89a91a09a4c3ad4d36f9962c1a67750fc4a10bb9b9780541fdb7e8ad8e59dd2bc0da
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r9860850.exeFilesize
168KB
MD5448867b9d9adede1f85f440f40d0d9c0
SHA11cf4ae553e929076e3df1af487cfd6579aa99ee3
SHA25632a2a0fb659d267d12d2d6f4f2add7b835d8e11560e80de685bf34ed5687b4a7
SHA512fab51b8e9834f1ce74c7cd53749b880ed562107061595da52f75207577ea89a91a09a4c3ad4d36f9962c1a67750fc4a10bb9b9780541fdb7e8ad8e59dd2bc0da
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573df88d68a4f5e066784d462788cf695
SHA1e4bfed336848d0b622fa464d40cf4bd9222aab3f
SHA256f336fa91d52edf1a977a5b8510c1a7b0b22dd6d51576765e10a1fc98fb38109f
SHA51264c7a2828b041fbc2792e8f4e39b9abea9a33356478d307681f1cba278293a0a22569bda5b7718993a5224f514c2af77fe989de14ab2a2ad219b0213fedf3817
-
memory/980-187-0x0000000006120000-0x00000000062E2000-memory.dmpFilesize
1.8MB
-
memory/980-177-0x0000000005200000-0x0000000005806000-memory.dmpFilesize
6.0MB
-
memory/980-189-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/980-188-0x00000000083A0000-0x00000000088CC000-memory.dmpFilesize
5.2MB
-
memory/980-186-0x0000000005E20000-0x0000000005E70000-memory.dmpFilesize
320KB
-
memory/980-185-0x0000000005050000-0x00000000050B6000-memory.dmpFilesize
408KB
-
memory/980-184-0x00000000050F0000-0x0000000005182000-memory.dmpFilesize
584KB
-
memory/980-183-0x0000000004FD0000-0x0000000005046000-memory.dmpFilesize
472KB
-
memory/980-182-0x0000000004E30000-0x0000000004E7B000-memory.dmpFilesize
300KB
-
memory/980-181-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/980-180-0x0000000004CB0000-0x0000000004CEE000-memory.dmpFilesize
248KB
-
memory/980-179-0x0000000004C50000-0x0000000004C62000-memory.dmpFilesize
72KB
-
memory/980-178-0x0000000004D20000-0x0000000004E2A000-memory.dmpFilesize
1.0MB
-
memory/980-175-0x0000000000200000-0x0000000000230000-memory.dmpFilesize
192KB
-
memory/980-176-0x0000000004AB0000-0x0000000004AB6000-memory.dmpFilesize
24KB
-
memory/2088-170-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/2088-163-0x0000000004A50000-0x0000000004A62000-memory.dmpFilesize
72KB
-
memory/2088-149-0x0000000004A50000-0x0000000004A62000-memory.dmpFilesize
72KB
-
memory/2088-165-0x0000000004A50000-0x0000000004A62000-memory.dmpFilesize
72KB
-
memory/2088-169-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/2088-168-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/2088-155-0x0000000004A50000-0x0000000004A62000-memory.dmpFilesize
72KB
-
memory/2088-157-0x0000000004A50000-0x0000000004A62000-memory.dmpFilesize
72KB
-
memory/2088-159-0x0000000004A50000-0x0000000004A62000-memory.dmpFilesize
72KB
-
memory/2088-161-0x0000000004A50000-0x0000000004A62000-memory.dmpFilesize
72KB
-
memory/2088-151-0x0000000004A50000-0x0000000004A62000-memory.dmpFilesize
72KB
-
memory/2088-153-0x0000000004A50000-0x0000000004A62000-memory.dmpFilesize
72KB
-
memory/2088-167-0x0000000004A50000-0x0000000004A62000-memory.dmpFilesize
72KB
-
memory/2088-147-0x0000000004A50000-0x0000000004A62000-memory.dmpFilesize
72KB
-
memory/2088-145-0x0000000004A50000-0x0000000004A62000-memory.dmpFilesize
72KB
-
memory/2088-140-0x0000000004A50000-0x0000000004A62000-memory.dmpFilesize
72KB
-
memory/2088-143-0x0000000004A50000-0x0000000004A62000-memory.dmpFilesize
72KB
-
memory/2088-141-0x0000000004A50000-0x0000000004A62000-memory.dmpFilesize
72KB
-
memory/2088-139-0x0000000004A50000-0x0000000004A68000-memory.dmpFilesize
96KB
-
memory/2088-138-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/2088-136-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/2088-137-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/2088-135-0x0000000004B80000-0x000000000507E000-memory.dmpFilesize
5.0MB
-
memory/2088-134-0x00000000049E0000-0x00000000049FA000-memory.dmpFilesize
104KB