Analysis
-
max time kernel
125s -
max time network
132s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
26-11-2021 08:53
Static task
static1
Behavioral task
behavioral1
Sample
2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984.exe
Resource
win10-en-20211104
General
-
Target
2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984.exe
-
Size
1.6MB
-
MD5
45c7d66ca1987d417e1858b7b353b758
-
SHA1
ed09b156cfd87ec42f620721a35bf27392bb8c1a
-
SHA256
2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984
-
SHA512
43228a7f672b0c8ba0dbea43d15aae761efbb02dd24e2955f8350fd3db92334ff2c9a2d78857266ae92a45e7330b810d514084e2573a731f8e5dbb10edaebedd
Malware Config
Extracted
redline
Firefox
194.127.179.0:42417
Extracted
redline
Error
129.146.249.128:64466
Extracted
raccoon
1.8.3-hotfix
c5dde00a0ce162508bf7358fade224b1c1bd5f5f
-
url4cnc
http://91.219.236.27/zondaf1zuzya
http://5.181.156.92/zondaf1zuzya
http://91.219.236.207/zondaf1zuzya
http://185.225.19.18/zondaf1zuzya
http://91.219.237.227/zondaf1zuzya
http://185.163.47.176/zondaf1zuzya
https://t.me/zondaf1zuzya
Extracted
redline
Reklyn
185.92.74.98:11734
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1832-151-0x0000000003A00000-0x0000000003A2E000-memory.dmp family_redline behavioral1/memory/4260-150-0x0000000003C30000-0x0000000003C98000-memory.dmp family_redline behavioral1/memory/4260-155-0x0000000003E10000-0x0000000003E76000-memory.dmp family_redline behavioral1/memory/1832-154-0x0000000003C10000-0x0000000003C3C000-memory.dmp family_redline behavioral1/memory/2972-200-0x0000000000400000-0x0000000000424000-memory.dmp family_redline behavioral1/memory/2972-201-0x0000000000418F3A-mapping.dmp family_redline -
Executes dropped EXE 8 IoCs
Processes:
1616.exeFinderFile_2021-11-25_16-07.exeNortonSecurity.exeQfseWnwbRox1BnG.exe1616.exe1616.exeQfseWnwbRox1BnG.exeQfseWnwbRox1BnG.exepid process 3988 1616.exe 1832 FinderFile_2021-11-25_16-07.exe 4260 NortonSecurity.exe 4424 QfseWnwbRox1BnG.exe 2656 1616.exe 2704 1616.exe 2176 QfseWnwbRox1BnG.exe 2972 QfseWnwbRox1BnG.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
1616.exeQfseWnwbRox1BnG.exedescription pid process target process PID 3988 set thread context of 2704 3988 1616.exe 1616.exe PID 4424 set thread context of 2972 4424 QfseWnwbRox1BnG.exe QfseWnwbRox1BnG.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
1616.exeNortonSecurity.exeFinderFile_2021-11-25_16-07.exeQfseWnwbRox1BnG.exeQfseWnwbRox1BnG.exepid process 3988 1616.exe 3988 1616.exe 3988 1616.exe 3988 1616.exe 3988 1616.exe 3988 1616.exe 4260 NortonSecurity.exe 1832 FinderFile_2021-11-25_16-07.exe 4424 QfseWnwbRox1BnG.exe 4424 QfseWnwbRox1BnG.exe 2972 QfseWnwbRox1BnG.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
1616.exeFinderFile_2021-11-25_16-07.exeNortonSecurity.exeQfseWnwbRox1BnG.exeQfseWnwbRox1BnG.exedescription pid process Token: SeDebugPrivilege 3988 1616.exe Token: SeDebugPrivilege 1832 FinderFile_2021-11-25_16-07.exe Token: SeDebugPrivilege 4260 NortonSecurity.exe Token: SeDebugPrivilege 4424 QfseWnwbRox1BnG.exe Token: SeDebugPrivilege 2972 QfseWnwbRox1BnG.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984.exe1616.exeQfseWnwbRox1BnG.exedescription pid process target process PID 3592 wrote to memory of 3988 3592 2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984.exe 1616.exe PID 3592 wrote to memory of 3988 3592 2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984.exe 1616.exe PID 3592 wrote to memory of 3988 3592 2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984.exe 1616.exe PID 3592 wrote to memory of 1832 3592 2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984.exe FinderFile_2021-11-25_16-07.exe PID 3592 wrote to memory of 1832 3592 2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984.exe FinderFile_2021-11-25_16-07.exe PID 3592 wrote to memory of 1832 3592 2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984.exe FinderFile_2021-11-25_16-07.exe PID 3592 wrote to memory of 4260 3592 2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984.exe NortonSecurity.exe PID 3592 wrote to memory of 4260 3592 2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984.exe NortonSecurity.exe PID 3592 wrote to memory of 4260 3592 2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984.exe NortonSecurity.exe PID 3592 wrote to memory of 4424 3592 2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984.exe QfseWnwbRox1BnG.exe PID 3592 wrote to memory of 4424 3592 2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984.exe QfseWnwbRox1BnG.exe PID 3592 wrote to memory of 4424 3592 2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984.exe QfseWnwbRox1BnG.exe PID 3988 wrote to memory of 2656 3988 1616.exe 1616.exe PID 3988 wrote to memory of 2656 3988 1616.exe 1616.exe PID 3988 wrote to memory of 2656 3988 1616.exe 1616.exe PID 3988 wrote to memory of 2704 3988 1616.exe 1616.exe PID 3988 wrote to memory of 2704 3988 1616.exe 1616.exe PID 3988 wrote to memory of 2704 3988 1616.exe 1616.exe PID 3988 wrote to memory of 2704 3988 1616.exe 1616.exe PID 3988 wrote to memory of 2704 3988 1616.exe 1616.exe PID 3988 wrote to memory of 2704 3988 1616.exe 1616.exe PID 3988 wrote to memory of 2704 3988 1616.exe 1616.exe PID 3988 wrote to memory of 2704 3988 1616.exe 1616.exe PID 3988 wrote to memory of 2704 3988 1616.exe 1616.exe PID 4424 wrote to memory of 2176 4424 QfseWnwbRox1BnG.exe QfseWnwbRox1BnG.exe PID 4424 wrote to memory of 2176 4424 QfseWnwbRox1BnG.exe QfseWnwbRox1BnG.exe PID 4424 wrote to memory of 2176 4424 QfseWnwbRox1BnG.exe QfseWnwbRox1BnG.exe PID 4424 wrote to memory of 2972 4424 QfseWnwbRox1BnG.exe QfseWnwbRox1BnG.exe PID 4424 wrote to memory of 2972 4424 QfseWnwbRox1BnG.exe QfseWnwbRox1BnG.exe PID 4424 wrote to memory of 2972 4424 QfseWnwbRox1BnG.exe QfseWnwbRox1BnG.exe PID 4424 wrote to memory of 2972 4424 QfseWnwbRox1BnG.exe QfseWnwbRox1BnG.exe PID 4424 wrote to memory of 2972 4424 QfseWnwbRox1BnG.exe QfseWnwbRox1BnG.exe PID 4424 wrote to memory of 2972 4424 QfseWnwbRox1BnG.exe QfseWnwbRox1BnG.exe PID 4424 wrote to memory of 2972 4424 QfseWnwbRox1BnG.exe QfseWnwbRox1BnG.exe PID 4424 wrote to memory of 2972 4424 QfseWnwbRox1BnG.exe QfseWnwbRox1BnG.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984.exe"C:\Users\Admin\AppData\Local\Temp\2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1616.exe"C:\Users\Admin\AppData\Local\Temp\1616.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1616.exeC:\Users\Admin\AppData\Local\Temp\1616.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1616.exeC:\Users\Admin\AppData\Local\Temp\1616.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\FinderFile_2021-11-25_16-07.exe"C:\Users\Admin\AppData\Local\Temp\FinderFile_2021-11-25_16-07.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\NortonSecurity.exe"C:\Users\Admin\AppData\Local\Temp\NortonSecurity.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exe"C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exe"{path}"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exe"{path}"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QfseWnwbRox1BnG.exe.logMD5
90acfd72f14a512712b1a7380c0faf60
SHA140ba4accb8faa75887e84fb8e38d598dc8cf0f12
SHA25620806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86
SHA51229dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9
-
C:\Users\Admin\AppData\Local\Temp\1616.exeMD5
78cb0c6298d5b2b2193578c8cb7bfa36
SHA1540c1fd6c55179d19afbb806a4eb565407b08589
SHA256a9aca7ba092ed61929359feca0276dfaa50568cdffd375f828033160f5e70166
SHA5121a16f77ca94df210c478d45acd604be9442902b7b3477285cb152a4cb9516f1f4ab6dcaeb48a9bd1d2f21967927fa121001020865321d61e1ac79f44e2aa75b9
-
C:\Users\Admin\AppData\Local\Temp\1616.exeMD5
78cb0c6298d5b2b2193578c8cb7bfa36
SHA1540c1fd6c55179d19afbb806a4eb565407b08589
SHA256a9aca7ba092ed61929359feca0276dfaa50568cdffd375f828033160f5e70166
SHA5121a16f77ca94df210c478d45acd604be9442902b7b3477285cb152a4cb9516f1f4ab6dcaeb48a9bd1d2f21967927fa121001020865321d61e1ac79f44e2aa75b9
-
C:\Users\Admin\AppData\Local\Temp\1616.exeMD5
78cb0c6298d5b2b2193578c8cb7bfa36
SHA1540c1fd6c55179d19afbb806a4eb565407b08589
SHA256a9aca7ba092ed61929359feca0276dfaa50568cdffd375f828033160f5e70166
SHA5121a16f77ca94df210c478d45acd604be9442902b7b3477285cb152a4cb9516f1f4ab6dcaeb48a9bd1d2f21967927fa121001020865321d61e1ac79f44e2aa75b9
-
C:\Users\Admin\AppData\Local\Temp\1616.exeMD5
78cb0c6298d5b2b2193578c8cb7bfa36
SHA1540c1fd6c55179d19afbb806a4eb565407b08589
SHA256a9aca7ba092ed61929359feca0276dfaa50568cdffd375f828033160f5e70166
SHA5121a16f77ca94df210c478d45acd604be9442902b7b3477285cb152a4cb9516f1f4ab6dcaeb48a9bd1d2f21967927fa121001020865321d61e1ac79f44e2aa75b9
-
C:\Users\Admin\AppData\Local\Temp\FinderFile_2021-11-25_16-07.exeMD5
c1f611aca5584cc1cb2e3369309a5bbd
SHA1ba6d374028b33c34c680b730fa1a9467e637c691
SHA2568e3db645afe2742f3348020fc0ebc9cfdbd8f877271503a99aa87cb0a70b85f5
SHA51260dd43e16f68837b4cdce87285560c8423639041dd5e51a749534f23961c9dcb0dd06a81d30db02041caf37c7049e1c540083acb21fbf793bb19512ca2041f1c
-
C:\Users\Admin\AppData\Local\Temp\FinderFile_2021-11-25_16-07.exeMD5
c1f611aca5584cc1cb2e3369309a5bbd
SHA1ba6d374028b33c34c680b730fa1a9467e637c691
SHA2568e3db645afe2742f3348020fc0ebc9cfdbd8f877271503a99aa87cb0a70b85f5
SHA51260dd43e16f68837b4cdce87285560c8423639041dd5e51a749534f23961c9dcb0dd06a81d30db02041caf37c7049e1c540083acb21fbf793bb19512ca2041f1c
-
C:\Users\Admin\AppData\Local\Temp\NortonSecurity.exeMD5
81ba77bb6eccd0ec2fc8a1c05545a87f
SHA1c4b1fa59ce0509056630041b804898c11095865c
SHA25602347fa8becd91016d567f3ba5008b6325c14a33c0c80d2505817e1a23af4955
SHA5127105a94f83e28b08cbec78afcfbb5559e09c71836494d2807516ee3b61ad2820d764b52adc872fab26d66100f361dc5db16abb57ec71449e8abd531170305ca0
-
C:\Users\Admin\AppData\Local\Temp\NortonSecurity.exeMD5
81ba77bb6eccd0ec2fc8a1c05545a87f
SHA1c4b1fa59ce0509056630041b804898c11095865c
SHA25602347fa8becd91016d567f3ba5008b6325c14a33c0c80d2505817e1a23af4955
SHA5127105a94f83e28b08cbec78afcfbb5559e09c71836494d2807516ee3b61ad2820d764b52adc872fab26d66100f361dc5db16abb57ec71449e8abd531170305ca0
-
C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exeMD5
fedec493e939b53057ca0525eb308505
SHA1e12dc7d015101a686a3446a7dd7e8db0947d1629
SHA256f089b142b58e29b36a3e01c0629637f17df554c25c40c2ecfa790cf4a9c0953b
SHA51260d65da576f250ccea4be37c0f45f696ca0e1865ad0ebb44ead7cf2e898990093c8205e86d58b7ac0f2ba83956b73fbb541a2df4e71f96236b719ad53c52ff1e
-
C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exeMD5
fedec493e939b53057ca0525eb308505
SHA1e12dc7d015101a686a3446a7dd7e8db0947d1629
SHA256f089b142b58e29b36a3e01c0629637f17df554c25c40c2ecfa790cf4a9c0953b
SHA51260d65da576f250ccea4be37c0f45f696ca0e1865ad0ebb44ead7cf2e898990093c8205e86d58b7ac0f2ba83956b73fbb541a2df4e71f96236b719ad53c52ff1e
-
C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exeMD5
fedec493e939b53057ca0525eb308505
SHA1e12dc7d015101a686a3446a7dd7e8db0947d1629
SHA256f089b142b58e29b36a3e01c0629637f17df554c25c40c2ecfa790cf4a9c0953b
SHA51260d65da576f250ccea4be37c0f45f696ca0e1865ad0ebb44ead7cf2e898990093c8205e86d58b7ac0f2ba83956b73fbb541a2df4e71f96236b719ad53c52ff1e
-
C:\Users\Admin\AppData\Local\Temp\QfseWnwbRox1BnG.exeMD5
fedec493e939b53057ca0525eb308505
SHA1e12dc7d015101a686a3446a7dd7e8db0947d1629
SHA256f089b142b58e29b36a3e01c0629637f17df554c25c40c2ecfa790cf4a9c0953b
SHA51260d65da576f250ccea4be37c0f45f696ca0e1865ad0ebb44ead7cf2e898990093c8205e86d58b7ac0f2ba83956b73fbb541a2df4e71f96236b719ad53c52ff1e
-
memory/1832-160-0x0000000006292000-0x0000000006293000-memory.dmpFilesize
4KB
-
memory/1832-147-0x0000000000400000-0x0000000001C1B000-memory.dmpFilesize
24.1MB
-
memory/1832-151-0x0000000003A00000-0x0000000003A2E000-memory.dmpFilesize
184KB
-
memory/1832-149-0x0000000003810000-0x0000000003849000-memory.dmpFilesize
228KB
-
memory/1832-173-0x0000000006294000-0x0000000006296000-memory.dmpFilesize
8KB
-
memory/1832-162-0x0000000006293000-0x0000000006294000-memory.dmpFilesize
4KB
-
memory/1832-154-0x0000000003C10000-0x0000000003C3C000-memory.dmpFilesize
176KB
-
memory/1832-159-0x0000000006290000-0x0000000006291000-memory.dmpFilesize
4KB
-
memory/1832-122-0x0000000000000000-mapping.dmp
-
memory/1832-145-0x0000000001F89000-0x0000000001FB5000-memory.dmpFilesize
176KB
-
memory/2704-183-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/2704-184-0x000000000043F176-mapping.dmp
-
memory/2704-189-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/2972-210-0x0000000007090000-0x0000000007091000-memory.dmpFilesize
4KB
-
memory/2972-200-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2972-201-0x0000000000418F3A-mapping.dmp
-
memory/2972-211-0x0000000007180000-0x0000000007181000-memory.dmpFilesize
4KB
-
memory/3592-118-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB
-
memory/3988-139-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB
-
memory/3988-174-0x0000000006330000-0x00000000063C1000-memory.dmpFilesize
580KB
-
memory/3988-176-0x00000000064B0000-0x00000000064B1000-memory.dmpFilesize
4KB
-
memory/3988-179-0x00000000067D0000-0x0000000006826000-memory.dmpFilesize
344KB
-
memory/3988-133-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/3988-120-0x0000000000000000-mapping.dmp
-
memory/4260-157-0x0000000006AE0000-0x0000000006AE1000-memory.dmpFilesize
4KB
-
memory/4260-144-0x0000000001F39000-0x0000000001FB9000-memory.dmpFilesize
512KB
-
memory/4260-163-0x00000000064D3000-0x00000000064D4000-memory.dmpFilesize
4KB
-
memory/4260-164-0x00000000070F0000-0x00000000070F1000-memory.dmpFilesize
4KB
-
memory/4260-166-0x0000000007120000-0x0000000007121000-memory.dmpFilesize
4KB
-
memory/4260-168-0x0000000008830000-0x0000000008831000-memory.dmpFilesize
4KB
-
memory/4260-170-0x0000000008940000-0x0000000008941000-memory.dmpFilesize
4KB
-
memory/4260-172-0x00000000064D4000-0x00000000064D6000-memory.dmpFilesize
8KB
-
memory/4260-156-0x00000000064D0000-0x00000000064D1000-memory.dmpFilesize
4KB
-
memory/4260-155-0x0000000003E10000-0x0000000003E76000-memory.dmpFilesize
408KB
-
memory/4260-175-0x0000000008B80000-0x0000000008B81000-memory.dmpFilesize
4KB
-
memory/4260-150-0x0000000003C30000-0x0000000003C98000-memory.dmpFilesize
416KB
-
memory/4260-148-0x0000000000400000-0x0000000001C6E000-memory.dmpFilesize
24.4MB
-
memory/4260-180-0x0000000008C40000-0x0000000008C41000-memory.dmpFilesize
4KB
-
memory/4260-146-0x0000000001E40000-0x0000000001EDC000-memory.dmpFilesize
624KB
-
memory/4260-161-0x00000000064D2000-0x00000000064D3000-memory.dmpFilesize
4KB
-
memory/4260-124-0x0000000000000000-mapping.dmp
-
memory/4260-193-0x000000000A700000-0x000000000A701000-memory.dmpFilesize
4KB
-
memory/4260-192-0x000000000A0D0000-0x000000000A0D1000-memory.dmpFilesize
4KB
-
memory/4260-191-0x0000000009F00000-0x0000000009F01000-memory.dmpFilesize
4KB
-
memory/4424-141-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/4424-142-0x0000000005480000-0x000000000597E000-memory.dmpFilesize
5.0MB
-
memory/4424-197-0x0000000009C40000-0x0000000009CAC000-memory.dmpFilesize
432KB
-
memory/4424-198-0x0000000009E00000-0x0000000009E1F000-memory.dmpFilesize
124KB
-
memory/4424-140-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/4424-138-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/4424-137-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/4424-136-0x0000000005380000-0x0000000005381000-memory.dmpFilesize
4KB
-
memory/4424-132-0x0000000000B10000-0x0000000000B11000-memory.dmpFilesize
4KB
-
memory/4424-128-0x0000000000000000-mapping.dmp
-
memory/4424-143-0x0000000009EF0000-0x0000000009EF5000-memory.dmpFilesize
20KB