Analysis
-
max time kernel
51s -
max time network
177s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
03-04-2023 22:18
Static task
static1
Behavioral task
behavioral1
Sample
f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe
Resource
win10-20230220-en
General
-
Target
f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe
-
Size
659KB
-
MD5
96ddac9c45e58245ff6ec923843c5e29
-
SHA1
45f97ddd741dbbe77386649306797c8ae4e43639
-
SHA256
f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40
-
SHA512
5d2af87719df4a73f6375b791ccfe6cdf1af2ae6c747428489e0d665584e2afb2a9babd28bd4715f89cecf1562c9c8807427ccb2f415dbdecf8c21609194da3b
-
SSDEEP
12288:uMrIy90wKI6BZKitBF6wqoJUAKzE8JcUZSqcOIHG6j:CydDKBQLoJlK4Bvqcjpj
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Processes:
pro7061.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro7061.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro7061.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro7061.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro7061.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro7061.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral2/memory/4944-146-0x0000000002330000-0x0000000002376000-memory.dmp family_redline behavioral2/memory/4944-148-0x00000000025D0000-0x0000000002614000-memory.dmp family_redline behavioral2/memory/4944-157-0x00000000025D0000-0x000000000260F000-memory.dmp family_redline behavioral2/memory/4944-158-0x00000000025D0000-0x000000000260F000-memory.dmp family_redline behavioral2/memory/4944-163-0x00000000025D0000-0x000000000260F000-memory.dmp family_redline behavioral2/memory/4944-167-0x00000000025D0000-0x000000000260F000-memory.dmp family_redline behavioral2/memory/4944-171-0x00000000025D0000-0x000000000260F000-memory.dmp family_redline behavioral2/memory/4944-175-0x00000000025D0000-0x000000000260F000-memory.dmp family_redline behavioral2/memory/4944-180-0x00000000025D0000-0x000000000260F000-memory.dmp family_redline behavioral2/memory/4944-184-0x00000000025D0000-0x000000000260F000-memory.dmp family_redline behavioral2/memory/4944-187-0x00000000025D0000-0x000000000260F000-memory.dmp family_redline behavioral2/memory/4944-191-0x00000000025D0000-0x000000000260F000-memory.dmp family_redline behavioral2/memory/4944-196-0x00000000025D0000-0x000000000260F000-memory.dmp family_redline behavioral2/memory/4944-200-0x00000000025D0000-0x000000000260F000-memory.dmp family_redline behavioral2/memory/4944-204-0x00000000025D0000-0x000000000260F000-memory.dmp family_redline behavioral2/memory/4944-208-0x00000000025D0000-0x000000000260F000-memory.dmp family_redline behavioral2/memory/4944-211-0x00000000025D0000-0x000000000260F000-memory.dmp family_redline behavioral2/memory/4944-213-0x00000000025D0000-0x000000000260F000-memory.dmp family_redline behavioral2/memory/4944-215-0x00000000025D0000-0x000000000260F000-memory.dmp family_redline -
Executes dropped EXE 5 IoCs
Processes:
un590869.exepro7061.exepro7061.exequ9463.exesi174731.exepid process 2124 un590869.exe 4016 pro7061.exe 4792 pro7061.exe 4944 qu9463.exe 4596 si174731.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
pro7061.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pro7061.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pro7061.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exeun590869.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un590869.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un590869.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
pro7061.exedescription pid process target process PID 4016 set thread context of 4792 4016 pro7061.exe pro7061.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
pro7061.exequ9463.exesi174731.exepid process 4792 pro7061.exe 4792 pro7061.exe 4944 qu9463.exe 4944 qu9463.exe 4596 si174731.exe 4596 si174731.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
qu9463.exepro7061.exesi174731.exedescription pid process Token: SeDebugPrivilege 4944 qu9463.exe Token: SeDebugPrivilege 4792 pro7061.exe Token: SeDebugPrivilege 4596 si174731.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exeun590869.exepro7061.exedescription pid process target process PID 5040 wrote to memory of 2124 5040 f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe un590869.exe PID 5040 wrote to memory of 2124 5040 f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe un590869.exe PID 5040 wrote to memory of 2124 5040 f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe un590869.exe PID 2124 wrote to memory of 4016 2124 un590869.exe pro7061.exe PID 2124 wrote to memory of 4016 2124 un590869.exe pro7061.exe PID 2124 wrote to memory of 4016 2124 un590869.exe pro7061.exe PID 4016 wrote to memory of 4792 4016 pro7061.exe pro7061.exe PID 4016 wrote to memory of 4792 4016 pro7061.exe pro7061.exe PID 4016 wrote to memory of 4792 4016 pro7061.exe pro7061.exe PID 4016 wrote to memory of 4792 4016 pro7061.exe pro7061.exe PID 4016 wrote to memory of 4792 4016 pro7061.exe pro7061.exe PID 4016 wrote to memory of 4792 4016 pro7061.exe pro7061.exe PID 4016 wrote to memory of 4792 4016 pro7061.exe pro7061.exe PID 4016 wrote to memory of 4792 4016 pro7061.exe pro7061.exe PID 4016 wrote to memory of 4792 4016 pro7061.exe pro7061.exe PID 2124 wrote to memory of 4944 2124 un590869.exe qu9463.exe PID 2124 wrote to memory of 4944 2124 un590869.exe qu9463.exe PID 2124 wrote to memory of 4944 2124 un590869.exe qu9463.exe PID 5040 wrote to memory of 4596 5040 f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe si174731.exe PID 5040 wrote to memory of 4596 5040 f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe si174731.exe PID 5040 wrote to memory of 4596 5040 f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe si174731.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe"C:\Users\Admin\AppData\Local\Temp\f19035fa5d260c741a27e4293db95e197d629d8cab2143241af5ea75074ada40.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un590869.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un590869.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7061.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7061.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7061.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7061.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9463.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9463.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si174731.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si174731.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si174731.exeFilesize
175KB
MD537f8bbc2594c2832a722ecd360aedf25
SHA117c9ad18d0796b1254621f84085c37bb80b301d0
SHA256bf4ebd9bcd66e32ba98c9e7ad9f8f9940136aeb8351d02ffb99cd5f835e6f07e
SHA512f8eba90b74fa6598b827c7b71b8ed2d6b30f45d0df60143a0295034ff7deb175d206ac46e9ea3ca1266076bb2aa72d50ec1e2ab58a0ca438efbdcfe1afce0c91
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si174731.exeFilesize
175KB
MD537f8bbc2594c2832a722ecd360aedf25
SHA117c9ad18d0796b1254621f84085c37bb80b301d0
SHA256bf4ebd9bcd66e32ba98c9e7ad9f8f9940136aeb8351d02ffb99cd5f835e6f07e
SHA512f8eba90b74fa6598b827c7b71b8ed2d6b30f45d0df60143a0295034ff7deb175d206ac46e9ea3ca1266076bb2aa72d50ec1e2ab58a0ca438efbdcfe1afce0c91
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un590869.exeFilesize
517KB
MD5c91e242b59e3b5bccb28d954bd72e2f2
SHA13f6c281d027f56f10d2009edc70768e16417c46d
SHA2567df8e381db11a2d8dab012baaa7b4177dceb2b8ad2d5aade898638bcc3088299
SHA512bc07da39d995961440e77d5a65aa7c3b61c0e596fb4d2d6e6826df065c2060f6a925cbea3802382df6b6dc70e3069206ca3338823b84bdba817023ad63e1e74a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un590869.exeFilesize
517KB
MD5c91e242b59e3b5bccb28d954bd72e2f2
SHA13f6c281d027f56f10d2009edc70768e16417c46d
SHA2567df8e381db11a2d8dab012baaa7b4177dceb2b8ad2d5aade898638bcc3088299
SHA512bc07da39d995961440e77d5a65aa7c3b61c0e596fb4d2d6e6826df065c2060f6a925cbea3802382df6b6dc70e3069206ca3338823b84bdba817023ad63e1e74a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7061.exeFilesize
237KB
MD535d88beaac57c45fbc68e465a85de291
SHA14e804a0ce91b497b2fa1095fa2b567e55199e53c
SHA256a0a50306407a72ea2cb745692a58cadabacd7e044d3892c3fb17e23df7a37b96
SHA5120c67da267f0f6236b8a249dba284dbef160f139948de34061e879b2a56503dc97fcd247071c7e217f669aa43be8449b6c0cacd9b6e3725441444311ed5d1067b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7061.exeFilesize
237KB
MD535d88beaac57c45fbc68e465a85de291
SHA14e804a0ce91b497b2fa1095fa2b567e55199e53c
SHA256a0a50306407a72ea2cb745692a58cadabacd7e044d3892c3fb17e23df7a37b96
SHA5120c67da267f0f6236b8a249dba284dbef160f139948de34061e879b2a56503dc97fcd247071c7e217f669aa43be8449b6c0cacd9b6e3725441444311ed5d1067b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7061.exeFilesize
237KB
MD535d88beaac57c45fbc68e465a85de291
SHA14e804a0ce91b497b2fa1095fa2b567e55199e53c
SHA256a0a50306407a72ea2cb745692a58cadabacd7e044d3892c3fb17e23df7a37b96
SHA5120c67da267f0f6236b8a249dba284dbef160f139948de34061e879b2a56503dc97fcd247071c7e217f669aa43be8449b6c0cacd9b6e3725441444311ed5d1067b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9463.exeFilesize
294KB
MD59d4edc090bd8ab45327170e729e2b407
SHA1e5dba4334c707d003fdb0c316ec99152ad97d332
SHA256835d70a185113e83249f91b8d8c4511b53a786c14987e084048ed70603e0c9f9
SHA512794980c96901d9634aa3b77586d2f3a587a01024dca19ceabff4d97a1d1926e0ec9cd82c23aa17e67b5988491991578db35c0cf77ffe0c9643565be61c83b44a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9463.exeFilesize
294KB
MD59d4edc090bd8ab45327170e729e2b407
SHA1e5dba4334c707d003fdb0c316ec99152ad97d332
SHA256835d70a185113e83249f91b8d8c4511b53a786c14987e084048ed70603e0c9f9
SHA512794980c96901d9634aa3b77586d2f3a587a01024dca19ceabff4d97a1d1926e0ec9cd82c23aa17e67b5988491991578db35c0cf77ffe0c9643565be61c83b44a
-
memory/4016-136-0x00000000001D0000-0x00000000001FE000-memory.dmpFilesize
184KB
-
memory/4596-1120-0x0000000004A40000-0x0000000004A8B000-memory.dmpFilesize
300KB
-
memory/4596-1121-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/4596-1119-0x0000000000140000-0x0000000000172000-memory.dmpFilesize
200KB
-
memory/4596-1122-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/4792-186-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4792-194-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4792-134-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4792-150-0x0000000002500000-0x0000000002510000-memory.dmpFilesize
64KB
-
memory/4792-151-0x0000000002500000-0x0000000002510000-memory.dmpFilesize
64KB
-
memory/4792-152-0x0000000002500000-0x0000000002510000-memory.dmpFilesize
64KB
-
memory/4792-137-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4792-138-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4792-144-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4792-145-0x0000000002250000-0x000000000226A000-memory.dmpFilesize
104KB
-
memory/4792-156-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4792-159-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4792-1106-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4792-162-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4792-1100-0x0000000002500000-0x0000000002510000-memory.dmpFilesize
64KB
-
memory/4792-1099-0x0000000002500000-0x0000000002510000-memory.dmpFilesize
64KB
-
memory/4792-166-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4792-149-0x00000000024B0000-0x00000000024C8000-memory.dmpFilesize
96KB
-
memory/4792-1098-0x0000000002500000-0x0000000002510000-memory.dmpFilesize
64KB
-
memory/4792-174-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4792-170-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4792-178-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4792-205-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4792-182-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4792-210-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4792-147-0x00000000049D0000-0x0000000004ECE000-memory.dmpFilesize
5.0MB
-
memory/4792-189-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4792-201-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4792-198-0x00000000024B0000-0x00000000024C2000-memory.dmpFilesize
72KB
-
memory/4944-171-0x00000000025D0000-0x000000000260F000-memory.dmpFilesize
252KB
-
memory/4944-1095-0x0000000005440000-0x000000000548B000-memory.dmpFilesize
300KB
-
memory/4944-191-0x00000000025D0000-0x000000000260F000-memory.dmpFilesize
252KB
-
memory/4944-187-0x00000000025D0000-0x000000000260F000-memory.dmpFilesize
252KB
-
memory/4944-200-0x00000000025D0000-0x000000000260F000-memory.dmpFilesize
252KB
-
memory/4944-204-0x00000000025D0000-0x000000000260F000-memory.dmpFilesize
252KB
-
memory/4944-208-0x00000000025D0000-0x000000000260F000-memory.dmpFilesize
252KB
-
memory/4944-184-0x00000000025D0000-0x000000000260F000-memory.dmpFilesize
252KB
-
memory/4944-180-0x00000000025D0000-0x000000000260F000-memory.dmpFilesize
252KB
-
memory/4944-211-0x00000000025D0000-0x000000000260F000-memory.dmpFilesize
252KB
-
memory/4944-213-0x00000000025D0000-0x000000000260F000-memory.dmpFilesize
252KB
-
memory/4944-215-0x00000000025D0000-0x000000000260F000-memory.dmpFilesize
252KB
-
memory/4944-1090-0x0000000005750000-0x0000000005D56000-memory.dmpFilesize
6.0MB
-
memory/4944-1091-0x0000000005190000-0x000000000529A000-memory.dmpFilesize
1.0MB
-
memory/4944-1092-0x00000000052D0000-0x00000000052E2000-memory.dmpFilesize
72KB
-
memory/4944-1093-0x00000000052F0000-0x000000000532E000-memory.dmpFilesize
248KB
-
memory/4944-1094-0x00000000022F0000-0x0000000002300000-memory.dmpFilesize
64KB
-
memory/4944-196-0x00000000025D0000-0x000000000260F000-memory.dmpFilesize
252KB
-
memory/4944-175-0x00000000025D0000-0x000000000260F000-memory.dmpFilesize
252KB
-
memory/4944-167-0x00000000025D0000-0x000000000260F000-memory.dmpFilesize
252KB
-
memory/4944-163-0x00000000025D0000-0x000000000260F000-memory.dmpFilesize
252KB
-
memory/4944-1101-0x00000000022F0000-0x0000000002300000-memory.dmpFilesize
64KB
-
memory/4944-1102-0x00000000022F0000-0x0000000002300000-memory.dmpFilesize
64KB
-
memory/4944-158-0x00000000025D0000-0x000000000260F000-memory.dmpFilesize
252KB
-
memory/4944-1107-0x00000000055D0000-0x0000000005636000-memory.dmpFilesize
408KB
-
memory/4944-1108-0x0000000006180000-0x0000000006212000-memory.dmpFilesize
584KB
-
memory/4944-1109-0x0000000006490000-0x0000000006652000-memory.dmpFilesize
1.8MB
-
memory/4944-1110-0x0000000006660000-0x0000000006B8C000-memory.dmpFilesize
5.2MB
-
memory/4944-1111-0x0000000007F90000-0x0000000008006000-memory.dmpFilesize
472KB
-
memory/4944-1112-0x0000000008010000-0x0000000008060000-memory.dmpFilesize
320KB
-
memory/4944-146-0x0000000002330000-0x0000000002376000-memory.dmpFilesize
280KB
-
memory/4944-157-0x00000000025D0000-0x000000000260F000-memory.dmpFilesize
252KB
-
memory/4944-155-0x00000000022F0000-0x0000000002300000-memory.dmpFilesize
64KB
-
memory/4944-154-0x00000000022F0000-0x0000000002300000-memory.dmpFilesize
64KB
-
memory/4944-153-0x00000000005E0000-0x000000000062B000-memory.dmpFilesize
300KB
-
memory/4944-148-0x00000000025D0000-0x0000000002614000-memory.dmpFilesize
272KB