Analysis
-
max time kernel
125s -
max time network
125s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
03-11-2020 06:16
Static task
static1
Behavioral task
behavioral1
Sample
b76964a44b67b1f41a7f1feb9bfebe75.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
b76964a44b67b1f41a7f1feb9bfebe75.exe
Resource
win10v20201028
General
-
Target
b76964a44b67b1f41a7f1feb9bfebe75.exe
-
Size
327KB
-
MD5
b76964a44b67b1f41a7f1feb9bfebe75
-
SHA1
2d050b2b99381ede6c179934d3492be20a05f3b5
-
SHA256
566b744e0e0b789f5ba0502144328af1df9483cfbd80a0efc7437aec176c3ac6
-
SHA512
e47061cbb64eb1fcaf97a4783ba95c60248517f7457e049192b67f25e229f50e8d8159f88d02bd4668806eda77d029f7dca3425254a5dc70646a3c9e95365541
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1140-17-0x0000000004180000-0x00000000041A4000-memory.dmp family_redline behavioral2/memory/1140-19-0x00000000069A0000-0x00000000069C2000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 17 checkip.amazonaws.com -
Program crash 39 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2756 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 200 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 1768 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 3784 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 2416 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 360 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 3180 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 1292 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 1856 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 2792 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 2324 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 2452 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 2636 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 3420 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 1288 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 3968 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 3756 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 4080 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 508 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 2428 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 3184 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 3980 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 1296 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 3080 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 428 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 1144 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 3912 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 3676 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 3940 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 2272 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 3956 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 3644 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 2404 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 3804 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 548 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 1268 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 2484 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 2200 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe 2088 1140 WerFault.exe b76964a44b67b1f41a7f1feb9bfebe75.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid process 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 1768 WerFault.exe 1768 WerFault.exe 1768 WerFault.exe 1768 WerFault.exe 1768 WerFault.exe 1768 WerFault.exe 1768 WerFault.exe 1768 WerFault.exe 1768 WerFault.exe 1768 WerFault.exe 1768 WerFault.exe 1768 WerFault.exe 1768 WerFault.exe 1768 WerFault.exe 1768 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 3784 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe 2416 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
Processes:
WerFault.exeWerFault.exeb76964a44b67b1f41a7f1feb9bfebe75.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process Token: SeRestorePrivilege 2756 WerFault.exe Token: SeBackupPrivilege 2756 WerFault.exe Token: SeDebugPrivilege 2756 WerFault.exe Token: SeDebugPrivilege 200 WerFault.exe Token: SeDebugPrivilege 1140 b76964a44b67b1f41a7f1feb9bfebe75.exe Token: SeDebugPrivilege 1768 WerFault.exe Token: SeDebugPrivilege 3784 WerFault.exe Token: SeDebugPrivilege 2416 WerFault.exe Token: SeDebugPrivilege 360 WerFault.exe Token: SeDebugPrivilege 3180 WerFault.exe Token: SeDebugPrivilege 1292 WerFault.exe Token: SeDebugPrivilege 1856 WerFault.exe Token: SeDebugPrivilege 2792 WerFault.exe Token: SeDebugPrivilege 2324 WerFault.exe Token: SeDebugPrivilege 2452 WerFault.exe Token: SeDebugPrivilege 2636 WerFault.exe Token: SeDebugPrivilege 3420 WerFault.exe Token: SeDebugPrivilege 1288 WerFault.exe Token: SeDebugPrivilege 3968 WerFault.exe Token: SeDebugPrivilege 3756 WerFault.exe Token: SeDebugPrivilege 4080 WerFault.exe Token: SeDebugPrivilege 508 WerFault.exe Token: SeDebugPrivilege 2428 WerFault.exe Token: SeDebugPrivilege 3184 WerFault.exe Token: SeDebugPrivilege 3980 WerFault.exe Token: SeDebugPrivilege 1296 WerFault.exe Token: SeDebugPrivilege 3080 WerFault.exe Token: SeDebugPrivilege 428 WerFault.exe Token: SeDebugPrivilege 1144 WerFault.exe Token: SeDebugPrivilege 3912 WerFault.exe Token: SeDebugPrivilege 3676 WerFault.exe Token: SeDebugPrivilege 3940 WerFault.exe Token: SeDebugPrivilege 2272 WerFault.exe Token: SeDebugPrivilege 3956 WerFault.exe Token: SeDebugPrivilege 3644 WerFault.exe Token: SeDebugPrivilege 2404 WerFault.exe Token: SeDebugPrivilege 3804 WerFault.exe Token: SeDebugPrivilege 548 WerFault.exe Token: SeDebugPrivilege 1268 WerFault.exe Token: SeDebugPrivilege 2484 WerFault.exe Token: SeDebugPrivilege 2200 WerFault.exe Token: SeDebugPrivilege 2088 WerFault.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
b76964a44b67b1f41a7f1feb9bfebe75.execmd.exedescription pid process target process PID 1140 wrote to memory of 3836 1140 b76964a44b67b1f41a7f1feb9bfebe75.exe cmd.exe PID 1140 wrote to memory of 3836 1140 b76964a44b67b1f41a7f1feb9bfebe75.exe cmd.exe PID 1140 wrote to memory of 3836 1140 b76964a44b67b1f41a7f1feb9bfebe75.exe cmd.exe PID 3836 wrote to memory of 1468 3836 cmd.exe PING.EXE PID 3836 wrote to memory of 1468 3836 cmd.exe PING.EXE PID 3836 wrote to memory of 1468 3836 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\b76964a44b67b1f41a7f1feb9bfebe75.exe"C:\Users\Admin\AppData\Local\Temp\b76964a44b67b1f41a7f1feb9bfebe75.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 5442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 5482⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 12402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 12682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 13162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 13562⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 14282⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 14962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 15642⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 15002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 14602⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 18922⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 19642⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 20442⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 19842⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 21082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 21642⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 21762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 22202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 21242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 22402⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 22482⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 22962⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 23322⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 21482⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 24002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 23762⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 24922⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 19002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 22642⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 22882⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 25202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 21882⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 24082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 23802⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 24362⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 25722⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 26082⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ping 127.0.0.1 -n 3 > nul & del ""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 33⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 22722⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/200-13-0x00000000046A0000-0x00000000046A1000-memory.dmpFilesize
4KB
-
memory/200-16-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/360-44-0x0000000004930000-0x0000000004931000-memory.dmpFilesize
4KB
-
memory/360-37-0x0000000004630000-0x0000000004631000-memory.dmpFilesize
4KB
-
memory/428-229-0x0000000004D70000-0x0000000004D71000-memory.dmpFilesize
4KB
-
memory/428-232-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/508-202-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/508-205-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/548-368-0x0000000004680000-0x0000000004681000-memory.dmpFilesize
4KB
-
memory/548-371-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/1140-139-0x0000000008DA0000-0x0000000008DA1000-memory.dmpFilesize
4KB
-
memory/1140-1-0x0000000002980000-0x0000000002981000-memory.dmpFilesize
4KB
-
memory/1140-19-0x00000000069A0000-0x00000000069C2000-memory.dmpFilesize
136KB
-
memory/1140-20-0x0000000006F50000-0x0000000006F51000-memory.dmpFilesize
4KB
-
memory/1140-21-0x00000000075D0000-0x00000000075D1000-memory.dmpFilesize
4KB
-
memory/1140-22-0x0000000007590000-0x0000000007591000-memory.dmpFilesize
4KB
-
memory/1140-384-0x000000000A280000-0x000000000A281000-memory.dmpFilesize
4KB
-
memory/1140-17-0x0000000004180000-0x00000000041A4000-memory.dmpFilesize
144KB
-
memory/1140-3-0x0000000073270000-0x000000007395E000-memory.dmpFilesize
6.9MB
-
memory/1140-141-0x0000000008EE0000-0x0000000008EE1000-memory.dmpFilesize
4KB
-
memory/1140-2-0x0000000004390000-0x0000000004391000-memory.dmpFilesize
4KB
-
memory/1140-18-0x0000000006A50000-0x0000000006A51000-memory.dmpFilesize
4KB
-
memory/1140-24-0x00000000077A0000-0x00000000077A1000-memory.dmpFilesize
4KB
-
memory/1140-23-0x0000000007620000-0x0000000007621000-memory.dmpFilesize
4KB
-
memory/1140-134-0x00000000087A0000-0x00000000087A1000-memory.dmpFilesize
4KB
-
memory/1140-166-0x0000000009260000-0x0000000009261000-memory.dmpFilesize
4KB
-
memory/1140-129-0x00000000085D0000-0x00000000085D1000-memory.dmpFilesize
4KB
-
memory/1140-140-0x0000000008E50000-0x0000000008E51000-memory.dmpFilesize
4KB
-
memory/1140-0-0x0000000002517000-0x0000000002518000-memory.dmpFilesize
4KB
-
memory/1268-372-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB
-
memory/1268-375-0x00000000051F0000-0x00000000051F1000-memory.dmpFilesize
4KB
-
memory/1288-158-0x0000000004510000-0x0000000004511000-memory.dmpFilesize
4KB
-
memory/1288-165-0x0000000004A00000-0x0000000004A01000-memory.dmpFilesize
4KB
-
memory/1292-124-0x00000000058A0000-0x00000000058A1000-memory.dmpFilesize
4KB
-
memory/1292-121-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/1296-219-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/1296-216-0x0000000004840000-0x0000000004841000-memory.dmpFilesize
4KB
-
memory/1468-386-0x0000000000000000-mapping.dmp
-
memory/1768-28-0x00000000051B0000-0x00000000051B1000-memory.dmpFilesize
4KB
-
memory/1768-25-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/1856-128-0x0000000005A10000-0x0000000005A11000-memory.dmpFilesize
4KB
-
memory/1856-125-0x00000000050E0000-0x00000000050E1000-memory.dmpFilesize
4KB
-
memory/2088-390-0x0000000005130000-0x0000000005131000-memory.dmpFilesize
4KB
-
memory/2088-387-0x0000000004800000-0x0000000004801000-memory.dmpFilesize
4KB
-
memory/2200-380-0x00000000051B0000-0x00000000051B1000-memory.dmpFilesize
4KB
-
memory/2200-383-0x00000000058E0000-0x00000000058E1000-memory.dmpFilesize
4KB
-
memory/2272-257-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/2324-138-0x0000000005690000-0x0000000005691000-memory.dmpFilesize
4KB
-
memory/2324-135-0x0000000004E60000-0x0000000004E61000-memory.dmpFilesize
4KB
-
memory/2404-360-0x0000000004720000-0x0000000004721000-memory.dmpFilesize
4KB
-
memory/2404-363-0x0000000004F60000-0x0000000004F61000-memory.dmpFilesize
4KB
-
memory/2416-33-0x0000000004510000-0x0000000004511000-memory.dmpFilesize
4KB
-
memory/2428-206-0x0000000004F10000-0x0000000004F11000-memory.dmpFilesize
4KB
-
memory/2428-209-0x0000000005840000-0x0000000005841000-memory.dmpFilesize
4KB
-
memory/2452-145-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/2452-142-0x0000000004510000-0x0000000004511000-memory.dmpFilesize
4KB
-
memory/2484-379-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/2484-376-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/2636-149-0x00000000059D0000-0x00000000059D1000-memory.dmpFilesize
4KB
-
memory/2636-146-0x00000000051A0000-0x00000000051A1000-memory.dmpFilesize
4KB
-
memory/2756-9-0x0000000004610000-0x0000000004611000-memory.dmpFilesize
4KB
-
memory/2756-12-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/2756-5-0x0000000004610000-0x0000000004611000-memory.dmpFilesize
4KB
-
memory/2756-4-0x0000000004610000-0x0000000004611000-memory.dmpFilesize
4KB
-
memory/2792-133-0x00000000058C0000-0x00000000058C1000-memory.dmpFilesize
4KB
-
memory/2792-130-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/3080-220-0x0000000004510000-0x0000000004511000-memory.dmpFilesize
4KB
-
memory/3080-227-0x0000000004510000-0x0000000004511000-memory.dmpFilesize
4KB
-
memory/3080-228-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/3180-49-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/3180-45-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3184-211-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/3184-210-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/3420-157-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3420-150-0x0000000004510000-0x0000000004511000-memory.dmpFilesize
4KB
-
memory/3644-266-0x0000000004EC0000-0x0000000004EC1000-memory.dmpFilesize
4KB
-
memory/3676-246-0x0000000004510000-0x0000000004511000-memory.dmpFilesize
4KB
-
memory/3676-249-0x0000000004A50000-0x0000000004A51000-memory.dmpFilesize
4KB
-
memory/3756-182-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3756-187-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3756-175-0x0000000004510000-0x0000000004511000-memory.dmpFilesize
4KB
-
memory/3756-183-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3756-184-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3756-185-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3756-186-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3756-196-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3756-197-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3756-188-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3756-195-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3756-189-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3756-194-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3756-193-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3756-192-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3756-190-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3756-191-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/3784-32-0x0000000005550000-0x0000000005551000-memory.dmpFilesize
4KB
-
memory/3784-29-0x0000000004D20000-0x0000000004D21000-memory.dmpFilesize
4KB
-
memory/3804-367-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/3804-364-0x0000000004720000-0x0000000004721000-memory.dmpFilesize
4KB
-
memory/3836-385-0x0000000000000000-mapping.dmp
-
memory/3912-242-0x0000000004510000-0x0000000004511000-memory.dmpFilesize
4KB
-
memory/3912-245-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/3940-253-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/3956-261-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/3968-174-0x0000000004A00000-0x0000000004A01000-memory.dmpFilesize
4KB
-
memory/3968-167-0x0000000004510000-0x0000000004511000-memory.dmpFilesize
4KB
-
memory/3980-212-0x0000000004C50000-0x0000000004C51000-memory.dmpFilesize
4KB
-
memory/4080-201-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB