Analysis
-
max time kernel
119s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28-03-2024 07:28
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.PWSX-gen.23268.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.PWSX-gen.23268.exe
Resource
win10v2004-20240226-en
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.23268.exe
-
Size
740KB
-
MD5
172ee9c18f5ccdc214e7beebcf9d8778
-
SHA1
66ac5a38d22c834aa3672961d46ff111bf67e72c
-
SHA256
63235afcdd767af4bb5bd09488642bbdfb0124e9b4066d00b4815050faae9079
-
SHA512
54a83a65eeeca1821b89d809ea730d640fd9511e2b29f58009eb3d8138968c28f58fbd02e08552c4ca7a0828326a8b9649c2fe146aefd0e7a318d855fde11e18
-
SSDEEP
12288:bSG0YOwqyjo4Gzzsj+YuFVQMJ2FE0KBxHPhzbwxwJlCMo1FPpXPtH:OWO7yn+Yucbex9wqJlz
Malware Config
Extracted
Protocol: smtp- Host:
mail.hoangtruongphat.com - Port:
587 - Username:
cus.overseas@hoangtruongphat.com - Password:
hoangtruongphat818
Extracted
agenttesla
Protocol: smtp- Host:
mail.hoangtruongphat.com - Port:
587 - Username:
cus.overseas@hoangtruongphat.com - Password:
hoangtruongphat818 - Email To:
cus.overseas@hoangtruongphat.com
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org 13 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Win32.PWSX-gen.23268.exedescription pid process target process PID 1540 set thread context of 1956 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe SecuriteInfo.com.Win32.PWSX-gen.23268.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
SecuriteInfo.com.Win32.PWSX-gen.23268.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C SecuriteInfo.com.Win32.PWSX-gen.23268.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 SecuriteInfo.com.Win32.PWSX-gen.23268.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 SecuriteInfo.com.Win32.PWSX-gen.23268.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
SecuriteInfo.com.Win32.PWSX-gen.23268.exepowershell.exepowershell.exeSecuriteInfo.com.Win32.PWSX-gen.23268.exepid process 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe 2984 powershell.exe 3016 powershell.exe 1956 SecuriteInfo.com.Win32.PWSX-gen.23268.exe 1956 SecuriteInfo.com.Win32.PWSX-gen.23268.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
SecuriteInfo.com.Win32.PWSX-gen.23268.exepowershell.exepowershell.exeSecuriteInfo.com.Win32.PWSX-gen.23268.exedescription pid process Token: SeDebugPrivilege 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe Token: SeDebugPrivilege 3016 powershell.exe Token: SeDebugPrivilege 2984 powershell.exe Token: SeDebugPrivilege 1956 SecuriteInfo.com.Win32.PWSX-gen.23268.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
SecuriteInfo.com.Win32.PWSX-gen.23268.exedescription pid process target process PID 1540 wrote to memory of 3016 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe powershell.exe PID 1540 wrote to memory of 3016 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe powershell.exe PID 1540 wrote to memory of 3016 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe powershell.exe PID 1540 wrote to memory of 3016 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe powershell.exe PID 1540 wrote to memory of 2984 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe powershell.exe PID 1540 wrote to memory of 2984 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe powershell.exe PID 1540 wrote to memory of 2984 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe powershell.exe PID 1540 wrote to memory of 2984 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe powershell.exe PID 1540 wrote to memory of 2572 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe schtasks.exe PID 1540 wrote to memory of 2572 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe schtasks.exe PID 1540 wrote to memory of 2572 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe schtasks.exe PID 1540 wrote to memory of 2572 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe schtasks.exe PID 1540 wrote to memory of 2708 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe SecuriteInfo.com.Win32.PWSX-gen.23268.exe PID 1540 wrote to memory of 2708 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe SecuriteInfo.com.Win32.PWSX-gen.23268.exe PID 1540 wrote to memory of 2708 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe SecuriteInfo.com.Win32.PWSX-gen.23268.exe PID 1540 wrote to memory of 2708 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe SecuriteInfo.com.Win32.PWSX-gen.23268.exe PID 1540 wrote to memory of 1956 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe SecuriteInfo.com.Win32.PWSX-gen.23268.exe PID 1540 wrote to memory of 1956 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe SecuriteInfo.com.Win32.PWSX-gen.23268.exe PID 1540 wrote to memory of 1956 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe SecuriteInfo.com.Win32.PWSX-gen.23268.exe PID 1540 wrote to memory of 1956 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe SecuriteInfo.com.Win32.PWSX-gen.23268.exe PID 1540 wrote to memory of 1956 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe SecuriteInfo.com.Win32.PWSX-gen.23268.exe PID 1540 wrote to memory of 1956 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe SecuriteInfo.com.Win32.PWSX-gen.23268.exe PID 1540 wrote to memory of 1956 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe SecuriteInfo.com.Win32.PWSX-gen.23268.exe PID 1540 wrote to memory of 1956 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe SecuriteInfo.com.Win32.PWSX-gen.23268.exe PID 1540 wrote to memory of 1956 1540 SecuriteInfo.com.Win32.PWSX-gen.23268.exe SecuriteInfo.com.Win32.PWSX-gen.23268.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23268.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23268.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23268.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\deZVtbExkPfJNa.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\deZVtbExkPfJNa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp31AB.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23268.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23268.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23268.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.23268.exe"2⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD580bc4e46e9a6009ebbd513dcfc1fea38
SHA12a22288c9825ec9556166a60337b10a0d21d18f6
SHA2562629c80773fc7ca1528dfaac2e0c83bab955a5b5a7907dc03c264e5d2d24c8e4
SHA5125b72866556d227a3383e4fed033599caab14b0b029f5741c42c7dcd37a57d34463d9b98ca9c870841a876b902e34a41b19a977eb1a3cc0cab8b73020baedb173
-
C:\Users\Admin\AppData\Local\Temp\Tar71CB.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\tmp31AB.tmpFilesize
1KB
MD54207a8d599e888117719085e43095b4c
SHA125d8d2e3e515380096aa182f6c29b4109a1471e9
SHA25609b34070309de9b9c0e0a9ca46a93a017a1ca6c05b599e9c16faf5719eb0f4c4
SHA512aa0ac6391298aec589d2c75fae22ffb6e3e528bdfab1c81b13a6034d2ee5b2fa172d055bf83986e78175e196690873fcdfc6e3a2d4ee795cd6a014386fb3748c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FYE2ZHGB3E7C8BLCIO0V.tempFilesize
7KB
MD5bf3b35cd1c822bb8b737211649ade2da
SHA115aab7f98221c20f291a27826aa182da9f8fabc1
SHA256f345e9d278b37376da4ee2197c61d768b06f1a06dc3d8dc279c6ea13bd0e6003
SHA512372488776df1c478fe4b777bf3ccae3fd05ef89e37a281850a7d865841f9f8a569389b37cd98d591b94ddc2f5ce09b908887382fab1d9456ad9d8e5254a4570e
-
memory/1540-5-0x0000000007640000-0x00000000076C4000-memory.dmpFilesize
528KB
-
memory/1540-1-0x0000000074E50000-0x000000007553E000-memory.dmpFilesize
6.9MB
-
memory/1540-4-0x00000000004D0000-0x00000000004DC000-memory.dmpFilesize
48KB
-
memory/1540-3-0x0000000000610000-0x000000000062A000-memory.dmpFilesize
104KB
-
memory/1540-2-0x0000000007210000-0x0000000007250000-memory.dmpFilesize
256KB
-
memory/1540-0-0x0000000000300000-0x00000000003BE000-memory.dmpFilesize
760KB
-
memory/1540-29-0x0000000074E50000-0x000000007553E000-memory.dmpFilesize
6.9MB
-
memory/1956-30-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1956-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1956-117-0x0000000073B50000-0x000000007423E000-memory.dmpFilesize
6.9MB
-
memory/1956-25-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1956-18-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1956-19-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1956-34-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1956-21-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1956-20-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/1956-41-0x0000000073B50000-0x000000007423E000-memory.dmpFilesize
6.9MB
-
memory/2984-38-0x00000000029D0000-0x0000000002A10000-memory.dmpFilesize
256KB
-
memory/2984-37-0x00000000029D0000-0x0000000002A10000-memory.dmpFilesize
256KB
-
memory/2984-28-0x000000006F9A0000-0x000000006FF4B000-memory.dmpFilesize
5.7MB
-
memory/2984-43-0x000000006F9A0000-0x000000006FF4B000-memory.dmpFilesize
5.7MB
-
memory/2984-36-0x000000006F9A0000-0x000000006FF4B000-memory.dmpFilesize
5.7MB
-
memory/2984-33-0x00000000029D0000-0x0000000002A10000-memory.dmpFilesize
256KB
-
memory/3016-27-0x000000006F9A0000-0x000000006FF4B000-memory.dmpFilesize
5.7MB
-
memory/3016-39-0x00000000029C0000-0x0000000002A00000-memory.dmpFilesize
256KB
-
memory/3016-42-0x000000006F9A0000-0x000000006FF4B000-memory.dmpFilesize
5.7MB
-
memory/3016-40-0x00000000029C0000-0x0000000002A00000-memory.dmpFilesize
256KB
-
memory/3016-35-0x000000006F9A0000-0x000000006FF4B000-memory.dmpFilesize
5.7MB
-
memory/3016-31-0x00000000029C0000-0x0000000002A00000-memory.dmpFilesize
256KB