Analysis
-
max time kernel
153s -
max time network
103s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
10-10-2021 21:56
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetect.malware1.32537.18714.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
SecuriteInfo.com.W32.AIDetect.malware1.32537.18714.exe
Resource
win10v20210408
General
-
Target
SecuriteInfo.com.W32.AIDetect.malware1.32537.18714.exe
-
Size
336KB
-
MD5
435d4757bcfe29c1f1ea289a2566a3ed
-
SHA1
105406f798f7b8a0b8532a64ad9061e5ae447cdc
-
SHA256
56ae4932aafb8ed85c51038e2f003e829addf08a197890c8989bf0bdc51e7f49
-
SHA512
8b91b78ad5893a0f2a0a0f4f2c99e061a659c5a534daa1e5d23c1f0af861d38cd05e6c9e0e50474106d8fb61e6e10a14025dd3f4d540ef1e67bd9a6edb1622bb
Malware Config
Extracted
smokeloader
2020
http://gmpeople.com/upload/
http://mile48.com/upload/
http://lecanardstsornin.com/upload/
http://m3600.com/upload/
http://camasirx.com/upload/
Extracted
redline
new
45.9.20.107:46187
Extracted
redline
New1
45.140.146.88:57313
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1852-76-0x00000000032D0000-0x00000000032EF000-memory.dmp family_redline behavioral1/memory/1852-77-0x0000000005910000-0x000000000592D000-memory.dmp family_redline behavioral1/memory/764-89-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral1/memory/764-90-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral1/memory/764-91-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral1/memory/764-92-0x000000000041B23A-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
EC90.exeF5E4.exeF5E4.exepid process 1852 EC90.exe 1960 F5E4.exe 764 F5E4.exe -
Deletes itself 1 IoCs
Processes:
pid process 1220 -
Loads dropped DLL 1 IoCs
Processes:
F5E4.exepid process 1960 F5E4.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/1960-82-0x0000000001170000-0x0000000001191000-memory.dmp agile_net -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
F5E4.exedescription pid process target process PID 1960 set thread context of 764 1960 F5E4.exe F5E4.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
SecuriteInfo.com.W32.AIDetect.malware1.32537.18714.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI SecuriteInfo.com.W32.AIDetect.malware1.32537.18714.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI SecuriteInfo.com.W32.AIDetect.malware1.32537.18714.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI SecuriteInfo.com.W32.AIDetect.malware1.32537.18714.exe -
Processes:
F5E4.exeF5E4.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 F5E4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C F5E4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 F5E4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 F5E4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 F5E4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
SecuriteInfo.com.W32.AIDetect.malware1.32537.18714.exepid process 1652 SecuriteInfo.com.W32.AIDetect.malware1.32537.18714.exe 1652 SecuriteInfo.com.W32.AIDetect.malware1.32537.18714.exe 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 1220 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1220 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetect.malware1.32537.18714.exepid process 1652 SecuriteInfo.com.W32.AIDetect.malware1.32537.18714.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
F5E4.exeEC90.exedescription pid process Token: SeShutdownPrivilege 1220 Token: SeShutdownPrivilege 1220 Token: SeDebugPrivilege 1960 F5E4.exe Token: SeDebugPrivilege 1852 EC90.exe Token: SeShutdownPrivilege 1220 Token: SeShutdownPrivilege 1220 Token: SeShutdownPrivilege 1220 Token: SeShutdownPrivilege 1220 -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
pid process 1220 1220 1220 1220 -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
pid process 1220 1220 1220 1220 -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
F5E4.exedescription pid process target process PID 1220 wrote to memory of 1852 1220 EC90.exe PID 1220 wrote to memory of 1852 1220 EC90.exe PID 1220 wrote to memory of 1852 1220 EC90.exe PID 1220 wrote to memory of 1852 1220 EC90.exe PID 1220 wrote to memory of 1960 1220 F5E4.exe PID 1220 wrote to memory of 1960 1220 F5E4.exe PID 1220 wrote to memory of 1960 1220 F5E4.exe PID 1220 wrote to memory of 1960 1220 F5E4.exe PID 1960 wrote to memory of 764 1960 F5E4.exe F5E4.exe PID 1960 wrote to memory of 764 1960 F5E4.exe F5E4.exe PID 1960 wrote to memory of 764 1960 F5E4.exe F5E4.exe PID 1960 wrote to memory of 764 1960 F5E4.exe F5E4.exe PID 1960 wrote to memory of 764 1960 F5E4.exe F5E4.exe PID 1960 wrote to memory of 764 1960 F5E4.exe F5E4.exe PID 1960 wrote to memory of 764 1960 F5E4.exe F5E4.exe PID 1960 wrote to memory of 764 1960 F5E4.exe F5E4.exe PID 1960 wrote to memory of 764 1960 F5E4.exe F5E4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.32537.18714.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.32537.18714.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\EC90.exeC:\Users\Admin\AppData\Local\Temp\EC90.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\F5E4.exeC:\Users\Admin\AppData\Local\Temp\F5E4.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F5E4.exe"C:\Users\Admin\AppData\Local\Temp\F5E4.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\EC90.exeMD5
cb62283bfe3b9bbc745172bc4c1b3a15
SHA19ac479f4453f6c447c2dbc61c59751548d799721
SHA256626d2d7793e94e5492e0c16aa9a2f24e1785b5b280d5ae28efef2ede9220653a
SHA512cd830492fa4bb096a67564ca455053243cf3666e014b7c61c99305da26e272ce3766f724610fb8107499de8351615318447a4cdccfedf30142fd6186100dab53
-
C:\Users\Admin\AppData\Local\Temp\F5E4.exeMD5
acd58a65e9d362fc8eeac3c4c4e2be11
SHA1956980abda3bfbad427a24d702c09222e13ab53b
SHA256d45c78005f74a5b25a2c9631bb13b069433701d3e65b5d648ee1839252264898
SHA5124023f10131faf541e593c667b86106ad710123ed90db68537a70318449ccc2282d08d01d5807e5671eaa921dd7f53a679d564bf738ca1d938235bdedfc30e645
-
C:\Users\Admin\AppData\Local\Temp\F5E4.exeMD5
acd58a65e9d362fc8eeac3c4c4e2be11
SHA1956980abda3bfbad427a24d702c09222e13ab53b
SHA256d45c78005f74a5b25a2c9631bb13b069433701d3e65b5d648ee1839252264898
SHA5124023f10131faf541e593c667b86106ad710123ed90db68537a70318449ccc2282d08d01d5807e5671eaa921dd7f53a679d564bf738ca1d938235bdedfc30e645
-
C:\Users\Admin\AppData\Local\Temp\F5E4.exeMD5
acd58a65e9d362fc8eeac3c4c4e2be11
SHA1956980abda3bfbad427a24d702c09222e13ab53b
SHA256d45c78005f74a5b25a2c9631bb13b069433701d3e65b5d648ee1839252264898
SHA5124023f10131faf541e593c667b86106ad710123ed90db68537a70318449ccc2282d08d01d5807e5671eaa921dd7f53a679d564bf738ca1d938235bdedfc30e645
-
\Users\Admin\AppData\Local\Temp\F5E4.exeMD5
acd58a65e9d362fc8eeac3c4c4e2be11
SHA1956980abda3bfbad427a24d702c09222e13ab53b
SHA256d45c78005f74a5b25a2c9631bb13b069433701d3e65b5d648ee1839252264898
SHA5124023f10131faf541e593c667b86106ad710123ed90db68537a70318449ccc2282d08d01d5807e5671eaa921dd7f53a679d564bf738ca1d938235bdedfc30e645
-
memory/764-87-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/764-92-0x000000000041B23A-mapping.dmp
-
memory/764-91-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/764-90-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/764-89-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/764-88-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1220-64-0x0000000002BE0000-0x0000000002BF5000-memory.dmpFilesize
84KB
-
memory/1652-63-0x0000000000400000-0x00000000016C7000-memory.dmpFilesize
18.8MB
-
memory/1652-62-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1652-60-0x000000000178B000-0x000000000179C000-memory.dmpFilesize
68KB
-
memory/1652-61-0x00000000754F1000-0x00000000754F3000-memory.dmpFilesize
8KB
-
memory/1852-77-0x0000000005910000-0x000000000592D000-memory.dmpFilesize
116KB
-
memory/1852-75-0x0000000005AA1000-0x0000000005AA2000-memory.dmpFilesize
4KB
-
memory/1852-79-0x0000000005AA3000-0x0000000005AA4000-memory.dmpFilesize
4KB
-
memory/1852-65-0x0000000000000000-mapping.dmp
-
memory/1852-80-0x0000000005AA4000-0x0000000005AA6000-memory.dmpFilesize
8KB
-
memory/1852-78-0x0000000005AA2000-0x0000000005AA3000-memory.dmpFilesize
4KB
-
memory/1852-67-0x00000000002EB000-0x000000000030E000-memory.dmpFilesize
140KB
-
memory/1852-68-0x00000000001C0000-0x00000000001F0000-memory.dmpFilesize
192KB
-
memory/1852-74-0x0000000000400000-0x00000000016DA000-memory.dmpFilesize
18.9MB
-
memory/1852-76-0x00000000032D0000-0x00000000032EF000-memory.dmpFilesize
124KB
-
memory/1960-82-0x0000000001170000-0x0000000001191000-memory.dmpFilesize
132KB
-
memory/1960-85-0x00000000011E0000-0x00000000011E1000-memory.dmpFilesize
4KB
-
memory/1960-72-0x00000000013E0000-0x00000000013E1000-memory.dmpFilesize
4KB
-
memory/1960-69-0x0000000000000000-mapping.dmp
-
memory/1960-84-0x00000000012D0000-0x00000000012DB000-memory.dmpFilesize
44KB
-
memory/1960-83-0x0000000004C81000-0x0000000004C82000-memory.dmpFilesize
4KB
-
memory/1960-81-0x0000000004C80000-0x0000000004C81000-memory.dmpFilesize
4KB