Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2022 15:39
Static task
static1
Behavioral task
behavioral1
Sample
8dd5ec6332a698f00b2feb4b74fcf185a6905bce3e18bd998d1ea8ba0e354525.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8dd5ec6332a698f00b2feb4b74fcf185a6905bce3e18bd998d1ea8ba0e354525.exe
Resource
win10v2004-20220812-en
General
-
Target
8dd5ec6332a698f00b2feb4b74fcf185a6905bce3e18bd998d1ea8ba0e354525.exe
-
Size
231KB
-
MD5
eabaf86be2fa999dfada34f3c9e53c99
-
SHA1
6a41e2a4452a19631b9ccac17496df40f867f6ec
-
SHA256
8dd5ec6332a698f00b2feb4b74fcf185a6905bce3e18bd998d1ea8ba0e354525
-
SHA512
c87b2ef8f7a914185f96836c6a5f6c36d3c3ebb771e934f81d4119df8659e3301775ae4bd59215817c11676ddffb221b7793802ebff7f8124f26058a10556f38
-
SSDEEP
3072:TFciL5TkXE5HLjQO69QHD/PjoZBFp50dtJ//894w7RkxmJZs:T/L54XILkbQgZjkrJ/kmGymI
Malware Config
Extracted
redline
11
79.137.202.18:45218
-
auth_value
107e09eee63158d2488feb03dac75204
Signatures
-
Detects Smokeloader packer 3 IoCs
Processes:
resource yara_rule behavioral2/memory/988-133-0x00000000006F0000-0x00000000006F9000-memory.dmp family_smokeloader behavioral2/memory/4360-192-0x00000000012D0000-0x00000000012D8000-memory.dmp family_smokeloader behavioral2/memory/4360-208-0x00000000012D0000-0x00000000012D8000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
hjagregF8EB.exeFBCB.exeFDB0.exepid process 1508 hjagreg 2236 F8EB.exe 4476 FBCB.exe 3996 FDB0.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
FDB0.exedescription pid process target process PID 3996 set thread context of 4512 3996 FDB0.exe vbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1500 3996 WerFault.exe FDB0.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
8dd5ec6332a698f00b2feb4b74fcf185a6905bce3e18bd998d1ea8ba0e354525.exehjagregdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8dd5ec6332a698f00b2feb4b74fcf185a6905bce3e18bd998d1ea8ba0e354525.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8dd5ec6332a698f00b2feb4b74fcf185a6905bce3e18bd998d1ea8ba0e354525.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8dd5ec6332a698f00b2feb4b74fcf185a6905bce3e18bd998d1ea8ba0e354525.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hjagreg Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hjagreg Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hjagreg -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8dd5ec6332a698f00b2feb4b74fcf185a6905bce3e18bd998d1ea8ba0e354525.exepid process 988 8dd5ec6332a698f00b2feb4b74fcf185a6905bce3e18bd998d1ea8ba0e354525.exe 988 8dd5ec6332a698f00b2feb4b74fcf185a6905bce3e18bd998d1ea8ba0e354525.exe 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2864 -
Suspicious behavior: MapViewOfSection 20 IoCs
Processes:
8dd5ec6332a698f00b2feb4b74fcf185a6905bce3e18bd998d1ea8ba0e354525.exehjagregpid process 988 8dd5ec6332a698f00b2feb4b74fcf185a6905bce3e18bd998d1ea8ba0e354525.exe 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 2864 1508 hjagreg 2864 2864 -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
vbc.exedescription pid process Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 Token: SeDebugPrivilege 4512 vbc.exe Token: SeShutdownPrivilege 2864 Token: SeCreatePagefilePrivilege 2864 -
Suspicious use of WriteProcessMemory 58 IoCs
Processes:
FDB0.exeF8EB.exedescription pid process target process PID 2864 wrote to memory of 2236 2864 F8EB.exe PID 2864 wrote to memory of 2236 2864 F8EB.exe PID 2864 wrote to memory of 2236 2864 F8EB.exe PID 2864 wrote to memory of 4476 2864 FBCB.exe PID 2864 wrote to memory of 4476 2864 FBCB.exe PID 2864 wrote to memory of 3996 2864 FDB0.exe PID 2864 wrote to memory of 3996 2864 FDB0.exe PID 2864 wrote to memory of 3996 2864 FDB0.exe PID 2864 wrote to memory of 2252 2864 explorer.exe PID 2864 wrote to memory of 2252 2864 explorer.exe PID 2864 wrote to memory of 2252 2864 explorer.exe PID 2864 wrote to memory of 2252 2864 explorer.exe PID 3996 wrote to memory of 4512 3996 FDB0.exe vbc.exe PID 3996 wrote to memory of 4512 3996 FDB0.exe vbc.exe PID 3996 wrote to memory of 4512 3996 FDB0.exe vbc.exe PID 3996 wrote to memory of 4512 3996 FDB0.exe vbc.exe PID 3996 wrote to memory of 4512 3996 FDB0.exe vbc.exe PID 2864 wrote to memory of 4424 2864 explorer.exe PID 2864 wrote to memory of 4424 2864 explorer.exe PID 2864 wrote to memory of 4424 2864 explorer.exe PID 2864 wrote to memory of 4132 2864 explorer.exe PID 2864 wrote to memory of 4132 2864 explorer.exe PID 2864 wrote to memory of 4132 2864 explorer.exe PID 2864 wrote to memory of 4132 2864 explorer.exe PID 2236 wrote to memory of 4036 2236 F8EB.exe vbc.exe PID 2236 wrote to memory of 4036 2236 F8EB.exe vbc.exe PID 2236 wrote to memory of 4036 2236 F8EB.exe vbc.exe PID 2236 wrote to memory of 2304 2236 F8EB.exe vbc.exe PID 2236 wrote to memory of 2304 2236 F8EB.exe vbc.exe PID 2236 wrote to memory of 2304 2236 F8EB.exe vbc.exe PID 2236 wrote to memory of 3048 2236 F8EB.exe vbc.exe PID 2236 wrote to memory of 3048 2236 F8EB.exe vbc.exe PID 2236 wrote to memory of 3048 2236 F8EB.exe vbc.exe PID 2236 wrote to memory of 1516 2236 F8EB.exe vbc.exe PID 2236 wrote to memory of 1516 2236 F8EB.exe vbc.exe PID 2236 wrote to memory of 1516 2236 F8EB.exe vbc.exe PID 2864 wrote to memory of 1484 2864 explorer.exe PID 2864 wrote to memory of 1484 2864 explorer.exe PID 2864 wrote to memory of 1484 2864 explorer.exe PID 2864 wrote to memory of 3464 2864 explorer.exe PID 2864 wrote to memory of 3464 2864 explorer.exe PID 2864 wrote to memory of 3464 2864 explorer.exe PID 2864 wrote to memory of 3464 2864 explorer.exe PID 2864 wrote to memory of 3052 2864 explorer.exe PID 2864 wrote to memory of 3052 2864 explorer.exe PID 2864 wrote to memory of 3052 2864 explorer.exe PID 2864 wrote to memory of 3052 2864 explorer.exe PID 2864 wrote to memory of 3520 2864 explorer.exe PID 2864 wrote to memory of 3520 2864 explorer.exe PID 2864 wrote to memory of 3520 2864 explorer.exe PID 2864 wrote to memory of 3520 2864 explorer.exe PID 2864 wrote to memory of 1820 2864 explorer.exe PID 2864 wrote to memory of 1820 2864 explorer.exe PID 2864 wrote to memory of 1820 2864 explorer.exe PID 2864 wrote to memory of 4360 2864 explorer.exe PID 2864 wrote to memory of 4360 2864 explorer.exe PID 2864 wrote to memory of 4360 2864 explorer.exe PID 2864 wrote to memory of 4360 2864 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dd5ec6332a698f00b2feb4b74fcf185a6905bce3e18bd998d1ea8ba0e354525.exe"C:\Users\Admin\AppData\Local\Temp\8dd5ec6332a698f00b2feb4b74fcf185a6905bce3e18bd998d1ea8ba0e354525.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\hjagregC:\Users\Admin\AppData\Roaming\hjagreg1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F8EB.exeC:\Users\Admin\AppData\Local\Temp\F8EB.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\FBCB.exeC:\Users\Admin\AppData\Local\Temp\FBCB.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\FDB0.exeC:\Users\Admin\AppData\Local\Temp\FDB0.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 1602⤵
- Program crash
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3996 -ip 39961⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\F8EB.exeFilesize
67KB
MD5666d8f33d37064fd5d14e2166c9bfa69
SHA13b27df9335a9b2efe9da1057e9f8312a72d1ca9d
SHA2567fddf1b75f50d43214867f367223f2d241d62ae63deea334d051c0ee19d18157
SHA512ac3c993f019bb402db474fda65d587ae7717725eea9b3a869acd3530543b7b94d354f19474f6b1c7fc760b5b22622328def2bef26e3900c186b16e8a3d3b90df
-
C:\Users\Admin\AppData\Local\Temp\F8EB.exeFilesize
67KB
MD5666d8f33d37064fd5d14e2166c9bfa69
SHA13b27df9335a9b2efe9da1057e9f8312a72d1ca9d
SHA2567fddf1b75f50d43214867f367223f2d241d62ae63deea334d051c0ee19d18157
SHA512ac3c993f019bb402db474fda65d587ae7717725eea9b3a869acd3530543b7b94d354f19474f6b1c7fc760b5b22622328def2bef26e3900c186b16e8a3d3b90df
-
C:\Users\Admin\AppData\Local\Temp\FBCB.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\FBCB.exeFilesize
4KB
MD59748489855d9dd82ab09da5e3e55b19e
SHA16ed2bf6a1a53a59cd2137812cb43b5032817f6a1
SHA25605bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b
SHA5127eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be
-
C:\Users\Admin\AppData\Local\Temp\FDB0.exeFilesize
399KB
MD5beec74983cc50c32deb1d2b433670bb7
SHA160a3c9b9c719eee1739e764af50d7337ff5c8da4
SHA256ed5b8959c53b7b4f3f8d2b92dc8fadf95f068ee1b7c1fb15dfbaf5cab84e563f
SHA512edc74a08a047df285e186ea92fb1046c740ed40b766c863e974f8ece284a52d00af094d99c3d3ff8b28f81be82b3b0b87a7fddc2040587ebe68a079e32a23243
-
C:\Users\Admin\AppData\Local\Temp\FDB0.exeFilesize
399KB
MD5beec74983cc50c32deb1d2b433670bb7
SHA160a3c9b9c719eee1739e764af50d7337ff5c8da4
SHA256ed5b8959c53b7b4f3f8d2b92dc8fadf95f068ee1b7c1fb15dfbaf5cab84e563f
SHA512edc74a08a047df285e186ea92fb1046c740ed40b766c863e974f8ece284a52d00af094d99c3d3ff8b28f81be82b3b0b87a7fddc2040587ebe68a079e32a23243
-
C:\Users\Admin\AppData\Roaming\hjagregFilesize
231KB
MD5eabaf86be2fa999dfada34f3c9e53c99
SHA16a41e2a4452a19631b9ccac17496df40f867f6ec
SHA2568dd5ec6332a698f00b2feb4b74fcf185a6905bce3e18bd998d1ea8ba0e354525
SHA512c87b2ef8f7a914185f96836c6a5f6c36d3c3ebb771e934f81d4119df8659e3301775ae4bd59215817c11676ddffb221b7793802ebff7f8124f26058a10556f38
-
C:\Users\Admin\AppData\Roaming\hjagregFilesize
231KB
MD5eabaf86be2fa999dfada34f3c9e53c99
SHA16a41e2a4452a19631b9ccac17496df40f867f6ec
SHA2568dd5ec6332a698f00b2feb4b74fcf185a6905bce3e18bd998d1ea8ba0e354525
SHA512c87b2ef8f7a914185f96836c6a5f6c36d3c3ebb771e934f81d4119df8659e3301775ae4bd59215817c11676ddffb221b7793802ebff7f8124f26058a10556f38
-
memory/988-132-0x000000000071E000-0x000000000072E000-memory.dmpFilesize
64KB
-
memory/988-135-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/988-133-0x00000000006F0000-0x00000000006F9000-memory.dmpFilesize
36KB
-
memory/988-134-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/1484-201-0x0000000000D80000-0x0000000000D86000-memory.dmpFilesize
24KB
-
memory/1484-179-0x0000000000D80000-0x0000000000D86000-memory.dmpFilesize
24KB
-
memory/1484-172-0x0000000000000000-mapping.dmp
-
memory/1484-177-0x0000000000D70000-0x0000000000D7C000-memory.dmpFilesize
48KB
-
memory/1508-190-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/1508-175-0x000000000055D000-0x000000000056D000-memory.dmpFilesize
64KB
-
memory/1508-176-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/1516-171-0x0000000000000000-mapping.dmp
-
memory/1820-189-0x00000000012B0000-0x00000000012BD000-memory.dmpFilesize
52KB
-
memory/1820-187-0x0000000000000000-mapping.dmp
-
memory/1820-188-0x00000000012C0000-0x00000000012C7000-memory.dmpFilesize
28KB
-
memory/1820-207-0x00000000012C0000-0x00000000012C7000-memory.dmpFilesize
28KB
-
memory/2236-157-0x0000000004CD0000-0x0000000004D36000-memory.dmpFilesize
408KB
-
memory/2236-141-0x0000000000380000-0x0000000000396000-memory.dmpFilesize
88KB
-
memory/2236-138-0x0000000000000000-mapping.dmp
-
memory/2252-150-0x0000000000000000-mapping.dmp
-
memory/2252-198-0x0000000001310000-0x0000000001317000-memory.dmpFilesize
28KB
-
memory/2252-159-0x0000000001310000-0x0000000001317000-memory.dmpFilesize
28KB
-
memory/2252-160-0x0000000001300000-0x000000000130B000-memory.dmpFilesize
44KB
-
memory/2304-169-0x0000000000000000-mapping.dmp
-
memory/3048-170-0x0000000000000000-mapping.dmp
-
memory/3052-204-0x0000000000AB0000-0x0000000000AB5000-memory.dmpFilesize
20KB
-
memory/3052-183-0x0000000000AA0000-0x0000000000AA9000-memory.dmpFilesize
36KB
-
memory/3052-182-0x0000000000000000-mapping.dmp
-
memory/3464-178-0x0000000000000000-mapping.dmp
-
memory/3464-202-0x0000000000A80000-0x0000000000AA2000-memory.dmpFilesize
136KB
-
memory/3464-181-0x0000000000A50000-0x0000000000A77000-memory.dmpFilesize
156KB
-
memory/3464-180-0x0000000000A80000-0x0000000000AA2000-memory.dmpFilesize
136KB
-
memory/3520-186-0x0000000000A10000-0x0000000000A1B000-memory.dmpFilesize
44KB
-
memory/3520-206-0x0000000000A20000-0x0000000000A26000-memory.dmpFilesize
24KB
-
memory/3520-184-0x0000000000000000-mapping.dmp
-
memory/3520-185-0x0000000000A20000-0x0000000000A26000-memory.dmpFilesize
24KB
-
memory/3996-147-0x0000000000000000-mapping.dmp
-
memory/4036-168-0x0000000000000000-mapping.dmp
-
memory/4132-165-0x0000000000000000-mapping.dmp
-
memory/4132-174-0x00000000003F0000-0x00000000003F9000-memory.dmpFilesize
36KB
-
memory/4132-173-0x0000000000600000-0x0000000000605000-memory.dmpFilesize
20KB
-
memory/4132-200-0x0000000000600000-0x0000000000605000-memory.dmpFilesize
20KB
-
memory/4360-193-0x00000000012C0000-0x00000000012CB000-memory.dmpFilesize
44KB
-
memory/4360-208-0x00000000012D0000-0x00000000012D8000-memory.dmpFilesize
32KB
-
memory/4360-191-0x0000000000000000-mapping.dmp
-
memory/4360-192-0x00000000012D0000-0x00000000012D8000-memory.dmpFilesize
32KB
-
memory/4424-199-0x0000000000800000-0x0000000000809000-memory.dmpFilesize
36KB
-
memory/4424-162-0x00000000005F0000-0x00000000005FF000-memory.dmpFilesize
60KB
-
memory/4424-161-0x0000000000800000-0x0000000000809000-memory.dmpFilesize
36KB
-
memory/4424-158-0x0000000000000000-mapping.dmp
-
memory/4476-142-0x0000000000000000-mapping.dmp
-
memory/4476-146-0x00007FFDDFAA0000-0x00007FFDE0561000-memory.dmpFilesize
10.8MB
-
memory/4476-145-0x0000000000EB0000-0x0000000000EB8000-memory.dmpFilesize
32KB
-
memory/4512-197-0x0000000005CE0000-0x0000000005D30000-memory.dmpFilesize
320KB
-
memory/4512-167-0x0000000005040000-0x000000000507C000-memory.dmpFilesize
240KB
-
memory/4512-152-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4512-163-0x0000000005560000-0x0000000005B78000-memory.dmpFilesize
6.1MB
-
memory/4512-196-0x0000000006040000-0x00000000060B6000-memory.dmpFilesize
472KB
-
memory/4512-166-0x0000000004FE0000-0x0000000004FF2000-memory.dmpFilesize
72KB
-
memory/4512-203-0x0000000007810000-0x00000000079D2000-memory.dmpFilesize
1.8MB
-
memory/4512-195-0x0000000006130000-0x00000000066D4000-memory.dmpFilesize
5.6MB
-
memory/4512-205-0x0000000007F10000-0x000000000843C000-memory.dmpFilesize
5.2MB
-
memory/4512-194-0x0000000005370000-0x0000000005402000-memory.dmpFilesize
584KB
-
memory/4512-164-0x00000000050A0000-0x00000000051AA000-memory.dmpFilesize
1.0MB
-
memory/4512-151-0x0000000000000000-mapping.dmp