Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29-07-2023 13:31
Static task
static1
Behavioral task
behavioral1
Sample
e00e2ca8f12e507e65af3a_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
e00e2ca8f12e507e65af3a_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
e00e2ca8f12e507e65af3a_JC.exe
-
Size
390KB
-
MD5
16acc22694ecfcc716e627c9ac16e0ee
-
SHA1
36c4ffa86b2c9b84366c070b724fc2e045464861
-
SHA256
e00e2ca8f12e507e65af3a0f955e168a1a3176477281a44f1e84c17ff30b679d
-
SHA512
0496f086ddb81c395cee395decb176379f4299f57fb106fecf261b8d246ecaf31ef08313ab75947bb7b25893177a5ddf52a07816a864825828537fa134fa9024
-
SSDEEP
6144:KAy+bnr+9p0yN90QE9sdj6Ys9YmzXpa60OTyUkJGu1yAJaooiq/jU:8Mrxy90vs1yYCXpV0OTypVaotn
Malware Config
Extracted
amadey
3.86
5.42.92.67/norm/index.php
Extracted
redline
news
77.91.68.68:19071
-
auth_value
99ba2ffe8d72ebe9fdc7e758c94db148
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5887077.exe healer C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5887077.exe healer behavioral2/memory/4364-147-0x00000000005E0000-0x00000000005EA000-memory.dmp healer -
Processes:
p5887077.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" p5887077.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" p5887077.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection p5887077.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" p5887077.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" p5887077.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" p5887077.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
r6432265.exelegola.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation r6432265.exe Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation legola.exe -
Executes dropped EXE 7 IoCs
Processes:
z1008008.exep5887077.exer6432265.exelegola.exet9462999.exelegola.exelegola.exepid process 2520 z1008008.exe 4364 p5887077.exe 3384 r6432265.exe 4788 legola.exe 1156 t9462999.exe 1752 legola.exe 4208 legola.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4256 rundll32.exe -
Processes:
p5887077.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p5887077.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
z1008008.exee00e2ca8f12e507e65af3a_JC.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z1008008.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z1008008.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce e00e2ca8f12e507e65af3a_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e00e2ca8f12e507e65af3a_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
p5887077.exepid process 4364 p5887077.exe 4364 p5887077.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
p5887077.exedescription pid process Token: SeDebugPrivilege 4364 p5887077.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
r6432265.exepid process 3384 r6432265.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
e00e2ca8f12e507e65af3a_JC.exez1008008.exer6432265.exelegola.execmd.exedescription pid process target process PID 2348 wrote to memory of 2520 2348 e00e2ca8f12e507e65af3a_JC.exe z1008008.exe PID 2348 wrote to memory of 2520 2348 e00e2ca8f12e507e65af3a_JC.exe z1008008.exe PID 2348 wrote to memory of 2520 2348 e00e2ca8f12e507e65af3a_JC.exe z1008008.exe PID 2520 wrote to memory of 4364 2520 z1008008.exe p5887077.exe PID 2520 wrote to memory of 4364 2520 z1008008.exe p5887077.exe PID 2520 wrote to memory of 3384 2520 z1008008.exe r6432265.exe PID 2520 wrote to memory of 3384 2520 z1008008.exe r6432265.exe PID 2520 wrote to memory of 3384 2520 z1008008.exe r6432265.exe PID 3384 wrote to memory of 4788 3384 r6432265.exe legola.exe PID 3384 wrote to memory of 4788 3384 r6432265.exe legola.exe PID 3384 wrote to memory of 4788 3384 r6432265.exe legola.exe PID 2348 wrote to memory of 1156 2348 e00e2ca8f12e507e65af3a_JC.exe t9462999.exe PID 2348 wrote to memory of 1156 2348 e00e2ca8f12e507e65af3a_JC.exe t9462999.exe PID 2348 wrote to memory of 1156 2348 e00e2ca8f12e507e65af3a_JC.exe t9462999.exe PID 4788 wrote to memory of 260 4788 legola.exe schtasks.exe PID 4788 wrote to memory of 260 4788 legola.exe schtasks.exe PID 4788 wrote to memory of 260 4788 legola.exe schtasks.exe PID 4788 wrote to memory of 1148 4788 legola.exe cmd.exe PID 4788 wrote to memory of 1148 4788 legola.exe cmd.exe PID 4788 wrote to memory of 1148 4788 legola.exe cmd.exe PID 1148 wrote to memory of 1908 1148 cmd.exe cmd.exe PID 1148 wrote to memory of 1908 1148 cmd.exe cmd.exe PID 1148 wrote to memory of 1908 1148 cmd.exe cmd.exe PID 1148 wrote to memory of 3024 1148 cmd.exe cacls.exe PID 1148 wrote to memory of 3024 1148 cmd.exe cacls.exe PID 1148 wrote to memory of 3024 1148 cmd.exe cacls.exe PID 1148 wrote to memory of 4380 1148 cmd.exe cacls.exe PID 1148 wrote to memory of 4380 1148 cmd.exe cacls.exe PID 1148 wrote to memory of 4380 1148 cmd.exe cacls.exe PID 1148 wrote to memory of 1556 1148 cmd.exe cmd.exe PID 1148 wrote to memory of 1556 1148 cmd.exe cmd.exe PID 1148 wrote to memory of 1556 1148 cmd.exe cmd.exe PID 1148 wrote to memory of 1620 1148 cmd.exe cacls.exe PID 1148 wrote to memory of 1620 1148 cmd.exe cacls.exe PID 1148 wrote to memory of 1620 1148 cmd.exe cacls.exe PID 1148 wrote to memory of 1648 1148 cmd.exe cacls.exe PID 1148 wrote to memory of 1648 1148 cmd.exe cacls.exe PID 1148 wrote to memory of 1648 1148 cmd.exe cacls.exe PID 4788 wrote to memory of 4256 4788 legola.exe rundll32.exe PID 4788 wrote to memory of 4256 4788 legola.exe rundll32.exe PID 4788 wrote to memory of 4256 4788 legola.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e00e2ca8f12e507e65af3a_JC.exe"C:\Users\Admin\AppData\Local\Temp\e00e2ca8f12e507e65af3a_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1008008.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1008008.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5887077.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5887077.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6432265.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6432265.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legola.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legola.exe" /P "Admin:N"&&CACLS "legola.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legola.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legola.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t9462999.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t9462999.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t9462999.exeFilesize
175KB
MD5283f1cc2f90c0e79071d4ebfa17c3f74
SHA10f7e0c1dc18c7139289734cb3a32c5b7a666ec07
SHA2563f0d505f247e591cdef9ec7a743abdb9894a0201b9a4b2da3a490c9fcf72436c
SHA512c3a4e0666f18ea0e2465aa8c685362e9f792da2bb214f2b321106a38dcd3510bb5ea0db524643d4539b6fba664dfe4b73425d10f7b62b1c5832450c4e9d620bc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\t9462999.exeFilesize
175KB
MD5283f1cc2f90c0e79071d4ebfa17c3f74
SHA10f7e0c1dc18c7139289734cb3a32c5b7a666ec07
SHA2563f0d505f247e591cdef9ec7a743abdb9894a0201b9a4b2da3a490c9fcf72436c
SHA512c3a4e0666f18ea0e2465aa8c685362e9f792da2bb214f2b321106a38dcd3510bb5ea0db524643d4539b6fba664dfe4b73425d10f7b62b1c5832450c4e9d620bc
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1008008.exeFilesize
234KB
MD54fae663febf2675bafa60a73a6776f95
SHA130fad6a7872130e377dd225eca0ae64c77cb60c7
SHA256a9b6331d8ce5354cd1a6cf017308faccebdcd61268c29767e22ae16675885f28
SHA51201e47331b4cd5816588a8c6a4b3c1974e19c7651f57f4d7ebf01279504c5d21573fc6898a7610b74710308c2bffe7ccc73abfbd7839f63f2d004d5ed93783a86
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1008008.exeFilesize
234KB
MD54fae663febf2675bafa60a73a6776f95
SHA130fad6a7872130e377dd225eca0ae64c77cb60c7
SHA256a9b6331d8ce5354cd1a6cf017308faccebdcd61268c29767e22ae16675885f28
SHA51201e47331b4cd5816588a8c6a4b3c1974e19c7651f57f4d7ebf01279504c5d21573fc6898a7610b74710308c2bffe7ccc73abfbd7839f63f2d004d5ed93783a86
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5887077.exeFilesize
11KB
MD5f3f7d21db806df8ffa070e03f92944f6
SHA127017a2c245744d64a5ef716da3a85a8799add5f
SHA2564f0a4b96086b2bc45032f0e6b04e6878a70bfa9c9b8eea4298f10cc7a36df6d5
SHA512ed935ace54ad21541655dc45494e0b09bd075c6556a51bbf506d54099d91d36c5948f474b6a25ff84245782348d939a886028ccfcec97f31f41019a302073b16
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\p5887077.exeFilesize
11KB
MD5f3f7d21db806df8ffa070e03f92944f6
SHA127017a2c245744d64a5ef716da3a85a8799add5f
SHA2564f0a4b96086b2bc45032f0e6b04e6878a70bfa9c9b8eea4298f10cc7a36df6d5
SHA512ed935ace54ad21541655dc45494e0b09bd075c6556a51bbf506d54099d91d36c5948f474b6a25ff84245782348d939a886028ccfcec97f31f41019a302073b16
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6432265.exeFilesize
223KB
MD572de20ec881a6f506d05aec57a89e7bd
SHA19dfb3d66102fda6f79c423f7b301a7c583307b97
SHA256e9ab71f5b4788a028676c2084a20260a6fc69b7f7005b399f4086d8719a6d5de
SHA5123a904dd344ad4cb465ebe4a9002dfba6d93396b4ff440d4cfd811b6cf8e4d1cb1a5220a623ae50aafd9c7b93744eab0174798bb27f91b546204f3b6c6430ce37
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r6432265.exeFilesize
223KB
MD572de20ec881a6f506d05aec57a89e7bd
SHA19dfb3d66102fda6f79c423f7b301a7c583307b97
SHA256e9ab71f5b4788a028676c2084a20260a6fc69b7f7005b399f4086d8719a6d5de
SHA5123a904dd344ad4cb465ebe4a9002dfba6d93396b4ff440d4cfd811b6cf8e4d1cb1a5220a623ae50aafd9c7b93744eab0174798bb27f91b546204f3b6c6430ce37
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
223KB
MD572de20ec881a6f506d05aec57a89e7bd
SHA19dfb3d66102fda6f79c423f7b301a7c583307b97
SHA256e9ab71f5b4788a028676c2084a20260a6fc69b7f7005b399f4086d8719a6d5de
SHA5123a904dd344ad4cb465ebe4a9002dfba6d93396b4ff440d4cfd811b6cf8e4d1cb1a5220a623ae50aafd9c7b93744eab0174798bb27f91b546204f3b6c6430ce37
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
223KB
MD572de20ec881a6f506d05aec57a89e7bd
SHA19dfb3d66102fda6f79c423f7b301a7c583307b97
SHA256e9ab71f5b4788a028676c2084a20260a6fc69b7f7005b399f4086d8719a6d5de
SHA5123a904dd344ad4cb465ebe4a9002dfba6d93396b4ff440d4cfd811b6cf8e4d1cb1a5220a623ae50aafd9c7b93744eab0174798bb27f91b546204f3b6c6430ce37
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
223KB
MD572de20ec881a6f506d05aec57a89e7bd
SHA19dfb3d66102fda6f79c423f7b301a7c583307b97
SHA256e9ab71f5b4788a028676c2084a20260a6fc69b7f7005b399f4086d8719a6d5de
SHA5123a904dd344ad4cb465ebe4a9002dfba6d93396b4ff440d4cfd811b6cf8e4d1cb1a5220a623ae50aafd9c7b93744eab0174798bb27f91b546204f3b6c6430ce37
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
223KB
MD572de20ec881a6f506d05aec57a89e7bd
SHA19dfb3d66102fda6f79c423f7b301a7c583307b97
SHA256e9ab71f5b4788a028676c2084a20260a6fc69b7f7005b399f4086d8719a6d5de
SHA5123a904dd344ad4cb465ebe4a9002dfba6d93396b4ff440d4cfd811b6cf8e4d1cb1a5220a623ae50aafd9c7b93744eab0174798bb27f91b546204f3b6c6430ce37
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legola.exeFilesize
223KB
MD572de20ec881a6f506d05aec57a89e7bd
SHA19dfb3d66102fda6f79c423f7b301a7c583307b97
SHA256e9ab71f5b4788a028676c2084a20260a6fc69b7f7005b399f4086d8719a6d5de
SHA5123a904dd344ad4cb465ebe4a9002dfba6d93396b4ff440d4cfd811b6cf8e4d1cb1a5220a623ae50aafd9c7b93744eab0174798bb27f91b546204f3b6c6430ce37
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5358ddcec1819198ecad04ef86899feaa
SHA1478cc105d928665b40aa32a2923c98dbf332b2bd
SHA256d6ee6168d2f6c316601b151aa6a16d8b3fda4bbefd046a93a5c336bd47f75d16
SHA51221c0694342efdec04827d892e51bacc9b4cd21b549e779debdb8d6819afecbebc9e30944338d8c3fd9e43ff9ec97151aab21cc5d60a324b799df416a7fb0b9ae
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5358ddcec1819198ecad04ef86899feaa
SHA1478cc105d928665b40aa32a2923c98dbf332b2bd
SHA256d6ee6168d2f6c316601b151aa6a16d8b3fda4bbefd046a93a5c336bd47f75d16
SHA51221c0694342efdec04827d892e51bacc9b4cd21b549e779debdb8d6819afecbebc9e30944338d8c3fd9e43ff9ec97151aab21cc5d60a324b799df416a7fb0b9ae
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5358ddcec1819198ecad04ef86899feaa
SHA1478cc105d928665b40aa32a2923c98dbf332b2bd
SHA256d6ee6168d2f6c316601b151aa6a16d8b3fda4bbefd046a93a5c336bd47f75d16
SHA51221c0694342efdec04827d892e51bacc9b4cd21b549e779debdb8d6819afecbebc9e30944338d8c3fd9e43ff9ec97151aab21cc5d60a324b799df416a7fb0b9ae
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1156-167-0x0000000072F60000-0x0000000073710000-memory.dmpFilesize
7.7MB
-
memory/1156-171-0x00000000024D0000-0x00000000024E0000-memory.dmpFilesize
64KB
-
memory/1156-172-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1156-173-0x0000000004BC0000-0x0000000004BFC000-memory.dmpFilesize
240KB
-
memory/1156-174-0x0000000072F60000-0x0000000073710000-memory.dmpFilesize
7.7MB
-
memory/1156-175-0x00000000024D0000-0x00000000024E0000-memory.dmpFilesize
64KB
-
memory/1156-170-0x0000000004C30000-0x0000000004D3A000-memory.dmpFilesize
1.0MB
-
memory/1156-169-0x0000000005140000-0x0000000005758000-memory.dmpFilesize
6.1MB
-
memory/1156-168-0x00000000001D0000-0x0000000000200000-memory.dmpFilesize
192KB
-
memory/4364-150-0x00007FFEE9C80000-0x00007FFEEA741000-memory.dmpFilesize
10.8MB
-
memory/4364-148-0x00007FFEE9C80000-0x00007FFEEA741000-memory.dmpFilesize
10.8MB
-
memory/4364-147-0x00000000005E0000-0x00000000005EA000-memory.dmpFilesize
40KB