Analysis
-
max time kernel
82s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29-09-2021 11:09
Static task
static1
General
-
Target
c5e23e7b15649c2d49b797eba7d7b83c76d661603e1b4bde412185eac2b81982.exe
-
Size
309KB
-
MD5
8baa6c1cadfa0a5b7a956e6c55d3d9d0
-
SHA1
c219a61f1dad6eddc14f3fdb009eae8d76b58c85
-
SHA256
c5e23e7b15649c2d49b797eba7d7b83c76d661603e1b4bde412185eac2b81982
-
SHA512
56f2c867d8534beb520b92ee24debff7db17440e2ce6ac90aecf13607121c1d7ecfd6f97953a3f604d0794e491bda42988a4c76e01f8128756eacca6a3ac8f8c
Malware Config
Extracted
redline
aboba
65.108.1.219:28593
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/992-116-0x0000000000DE0000-0x0000000000DFF000-memory.dmp family_redline behavioral1/memory/992-121-0x0000000002A00000-0x0000000002A1E000-memory.dmp family_redline -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1800 created 2512 1800 WerFault.exe filename.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
filename.exeUpSys.exeUpSys.exeUpSys.exepid process 2512 filename.exe 1304 UpSys.exe 364 UpSys.exe 1280 UpSys.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
filename.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion filename.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion filename.exe -
Drops startup file 1 IoCs
Processes:
filename.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk filename.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\filename.exe themida C:\Users\Admin\AppData\Local\Temp\filename.exe themida behavioral1/memory/2512-137-0x00007FF72D210000-0x00007FF72DE86000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
filename.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA filename.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
filename.exepid process 2512 filename.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1800 2512 WerFault.exe filename.exe -
Modifies data under HKEY_USERS 52 IoCs
Processes:
powershell.exeUpSys.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ UpSys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" UpSys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" UpSys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" UpSys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" UpSys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
c5e23e7b15649c2d49b797eba7d7b83c76d661603e1b4bde412185eac2b81982.exepowershell.exeUpSys.exeUpSys.exepowershell.exeWerFault.exepid process 992 c5e23e7b15649c2d49b797eba7d7b83c76d661603e1b4bde412185eac2b81982.exe 1016 powershell.exe 1016 powershell.exe 1016 powershell.exe 1304 UpSys.exe 1304 UpSys.exe 1304 UpSys.exe 1304 UpSys.exe 364 UpSys.exe 364 UpSys.exe 364 UpSys.exe 364 UpSys.exe 364 UpSys.exe 1572 powershell.exe 1572 powershell.exe 1572 powershell.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe 1800 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
c5e23e7b15649c2d49b797eba7d7b83c76d661603e1b4bde412185eac2b81982.exepowershell.exeUpSys.exeUpSys.exepowershell.exeWerFault.exedescription pid process Token: SeDebugPrivilege 992 c5e23e7b15649c2d49b797eba7d7b83c76d661603e1b4bde412185eac2b81982.exe Token: SeDebugPrivilege 1016 powershell.exe Token: SeBackupPrivilege 1016 powershell.exe Token: SeBackupPrivilege 1016 powershell.exe Token: SeRestorePrivilege 1016 powershell.exe Token: SeSecurityPrivilege 1016 powershell.exe Token: SeBackupPrivilege 1016 powershell.exe Token: SeBackupPrivilege 1016 powershell.exe Token: SeRestorePrivilege 1016 powershell.exe Token: SeSecurityPrivilege 1016 powershell.exe Token: SeDebugPrivilege 1304 UpSys.exe Token: SeAssignPrimaryTokenPrivilege 1304 UpSys.exe Token: SeIncreaseQuotaPrivilege 1304 UpSys.exe Token: 0 1304 UpSys.exe Token: SeDebugPrivilege 364 UpSys.exe Token: SeAssignPrimaryTokenPrivilege 364 UpSys.exe Token: SeIncreaseQuotaPrivilege 364 UpSys.exe Token: SeDebugPrivilege 1572 powershell.exe Token: SeDebugPrivilege 1800 WerFault.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
c5e23e7b15649c2d49b797eba7d7b83c76d661603e1b4bde412185eac2b81982.exefilename.exepowershell.exeUpSys.exedescription pid process target process PID 992 wrote to memory of 2512 992 c5e23e7b15649c2d49b797eba7d7b83c76d661603e1b4bde412185eac2b81982.exe filename.exe PID 992 wrote to memory of 2512 992 c5e23e7b15649c2d49b797eba7d7b83c76d661603e1b4bde412185eac2b81982.exe filename.exe PID 2512 wrote to memory of 1016 2512 filename.exe powershell.exe PID 2512 wrote to memory of 1016 2512 filename.exe powershell.exe PID 1016 wrote to memory of 1304 1016 powershell.exe UpSys.exe PID 1016 wrote to memory of 1304 1016 powershell.exe UpSys.exe PID 1280 wrote to memory of 1572 1280 UpSys.exe powershell.exe PID 1280 wrote to memory of 1572 1280 UpSys.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5e23e7b15649c2d49b797eba7d7b83c76d661603e1b4bde412185eac2b81982.exe"C:\Users\Admin\AppData\Local\Temp\c5e23e7b15649c2d49b797eba7d7b83c76d661603e1b4bde412185eac2b81982.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\filename.exe"C:\Users\Admin\AppData\Local\Temp\filename.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Drops startup file
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\Data); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\Systemd); $(New-Item -Path C:\ProgramData -Name checks.txt -ItemType file -Value 1); $(exit)3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\UpSys.exe"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\UpSys.exe"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\UpSys.exe"C:\ProgramData\UpSys.exe" /TI/ /SW:0 powershell.exe6⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2512 -s 11763⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Systemd\CPU.zipMD5
c83e742c2d59317c991a11f88ac04f79
SHA19fc460bce2135d4f8ca4457404113f24a986972f
SHA256cde604e24c0032a5e7ba07c9301605880ee16a8172075dff373eb7d432508ade
SHA5121b0024cb6e44c7486f7639010a93f3dd67c4f278e785b9c7e1751f1118c694773f23c14e6f65c985f42501556345d7f8a8e7dd5cb523919d31ebf9d516c4ceab
-
C:\ProgramData\UpSys.exeMD5
efe5769e37ba37cf4607cb9918639932
SHA1f24ca204af2237a714e8b41d54043da7bbe5393b
SHA2565f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2
SHA51233794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1
-
C:\ProgramData\UpSys.exeMD5
efe5769e37ba37cf4607cb9918639932
SHA1f24ca204af2237a714e8b41d54043da7bbe5393b
SHA2565f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2
SHA51233794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1
-
C:\ProgramData\UpSys.exeMD5
efe5769e37ba37cf4607cb9918639932
SHA1f24ca204af2237a714e8b41d54043da7bbe5393b
SHA2565f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2
SHA51233794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1
-
C:\ProgramData\UpSys.exeMD5
efe5769e37ba37cf4607cb9918639932
SHA1f24ca204af2237a714e8b41d54043da7bbe5393b
SHA2565f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2
SHA51233794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1
-
C:\Users\Admin\AppData\Local\Temp\filename.exeMD5
ab40d2395f7abeee43552ae6a750044d
SHA16d6a406e51934998567bb3318633a8f281dda509
SHA256bcc26c979a4d7b0afec88bdf7c864e965db3041616acea4cda1874ba476e74e0
SHA512b6efdc8da501db4c355333460baf551bb8f536b777505198ed55bf82c5131972269ecfd5285458e77d4df4d3366771c73687be039620c5258835fc782fe459b6
-
C:\Users\Admin\AppData\Local\Temp\filename.exeMD5
ab40d2395f7abeee43552ae6a750044d
SHA16d6a406e51934998567bb3318633a8f281dda509
SHA256bcc26c979a4d7b0afec88bdf7c864e965db3041616acea4cda1874ba476e74e0
SHA512b6efdc8da501db4c355333460baf551bb8f536b777505198ed55bf82c5131972269ecfd5285458e77d4df4d3366771c73687be039620c5258835fc782fe459b6
-
memory/992-124-0x0000000005AE0000-0x0000000005AE1000-memory.dmpFilesize
4KB
-
memory/992-130-0x0000000007680000-0x0000000007681000-memory.dmpFilesize
4KB
-
memory/992-123-0x0000000005AB0000-0x0000000005AB1000-memory.dmpFilesize
4KB
-
memory/992-114-0x0000000000880000-0x00000000009CA000-memory.dmpFilesize
1.3MB
-
memory/992-125-0x0000000004F84000-0x0000000004F86000-memory.dmpFilesize
8KB
-
memory/992-126-0x0000000005BF0000-0x0000000005BF1000-memory.dmpFilesize
4KB
-
memory/992-127-0x0000000005C70000-0x0000000005C71000-memory.dmpFilesize
4KB
-
memory/992-128-0x0000000006E90000-0x0000000006E91000-memory.dmpFilesize
4KB
-
memory/992-129-0x0000000007060000-0x0000000007061000-memory.dmpFilesize
4KB
-
memory/992-119-0x0000000004F83000-0x0000000004F84000-memory.dmpFilesize
4KB
-
memory/992-131-0x0000000007720000-0x0000000007721000-memory.dmpFilesize
4KB
-
memory/992-132-0x0000000006430000-0x0000000006431000-memory.dmpFilesize
4KB
-
memory/992-133-0x0000000007A00000-0x0000000007A01000-memory.dmpFilesize
4KB
-
memory/992-115-0x0000000000400000-0x000000000087E000-memory.dmpFilesize
4.5MB
-
memory/992-121-0x0000000002A00000-0x0000000002A1E000-memory.dmpFilesize
120KB
-
memory/992-120-0x0000000004F90000-0x0000000004F91000-memory.dmpFilesize
4KB
-
memory/992-116-0x0000000000DE0000-0x0000000000DFF000-memory.dmpFilesize
124KB
-
memory/992-122-0x0000000005490000-0x0000000005491000-memory.dmpFilesize
4KB
-
memory/992-118-0x0000000004F82000-0x0000000004F83000-memory.dmpFilesize
4KB
-
memory/992-117-0x0000000004F80000-0x0000000004F81000-memory.dmpFilesize
4KB
-
memory/1016-138-0x0000000000000000-mapping.dmp
-
memory/1016-147-0x00000269680B0000-0x00000269680B1000-memory.dmpFilesize
4KB
-
memory/1016-143-0x0000026967D80000-0x0000026967D81000-memory.dmpFilesize
4KB
-
memory/1016-160-0x000002694F6D0000-0x000002694F6D2000-memory.dmpFilesize
8KB
-
memory/1016-161-0x000002694F6D3000-0x000002694F6D5000-memory.dmpFilesize
8KB
-
memory/1016-182-0x000002694F6D6000-0x000002694F6D8000-memory.dmpFilesize
8KB
-
memory/1304-153-0x0000000000000000-mapping.dmp
-
memory/1572-183-0x0000000000000000-mapping.dmp
-
memory/1572-205-0x000001B1C0B70000-0x000001B1C0B71000-memory.dmpFilesize
4KB
-
memory/1572-217-0x000001B1C0A60000-0x000001B1C0A62000-memory.dmpFilesize
8KB
-
memory/1572-218-0x000001B1C0A63000-0x000001B1C0A65000-memory.dmpFilesize
8KB
-
memory/2512-137-0x00007FF72D210000-0x00007FF72DE86000-memory.dmpFilesize
12.5MB
-
memory/2512-134-0x0000000000000000-mapping.dmp