Analysis
-
max time kernel
102s -
max time network
120s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-04-2021 23:01
Static task
static1
Behavioral task
behavioral1
Sample
41c114e52de616504df1cd4137de1ce8.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
41c114e52de616504df1cd4137de1ce8.exe
Resource
win10v20210410
General
-
Target
41c114e52de616504df1cd4137de1ce8.exe
-
Size
187KB
-
MD5
41c114e52de616504df1cd4137de1ce8
-
SHA1
0579cc93cf8e6dd57e878da1f520499e4a77cf5a
-
SHA256
556c6ec49b714eb7bf9b3d816fd18a8962fb6be756224aa4cf8614e5bd7f0738
-
SHA512
4dd0a49f9e5481cb3d3644604e896bc338021968fbae72d426ec67643759b644cba0f4dac81c7c3fef9a05aeca58171f11d790dc5ef76797bbe99a2e57900634
Malware Config
Extracted
redline
20_4_net
Sthellete.xyz:80
Extracted
redline
tor1
45.67.228.131:9603
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3860-170-0x0000000000400000-0x000000000041C000-memory.dmp family_redline behavioral2/memory/3860-174-0x0000000000416232-mapping.dmp family_redline behavioral2/memory/2656-199-0x0000000000416226-mapping.dmp family_redline behavioral2/memory/2656-198-0x0000000000400000-0x000000000041C000-memory.dmp family_redline behavioral2/memory/3572-212-0x00000000004163CA-mapping.dmp family_redline -
Executes dropped EXE 9 IoCs
Processes:
412558.exe6274697.exe257751.exe8818052.exeWindows Host.exe7051520.exe2586827.exe8818052.exe8818052.exepid process 2624 412558.exe 2716 6274697.exe 1940 257751.exe 4004 8818052.exe 184 Windows Host.exe 2516 7051520.exe 1320 2586827.exe 3836 8818052.exe 3572 8818052.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6274697.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\ProgramData\\Windows Host\\Windows Host.exe" 6274697.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
AddInProcess32.exe7051520.exe8818052.exedescription pid process target process PID 1940 set thread context of 3860 1940 AddInProcess32.exe AddInProcess32.exe PID 2516 set thread context of 2656 2516 7051520.exe AddInProcess32.exe PID 4004 set thread context of 3572 4004 8818052.exe 8818052.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
412558.exe2586827.exeAddInProcess32.exe8818052.exe8818052.exeAddInProcess32.exepid process 2624 412558.exe 2624 412558.exe 1320 2586827.exe 2656 AddInProcess32.exe 4004 8818052.exe 4004 8818052.exe 3572 8818052.exe 3860 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
41c114e52de616504df1cd4137de1ce8.exe257751.exe412558.exe7051520.exe2586827.exeAddInProcess32.exeAddInProcess32.exe8818052.exe8818052.exedescription pid process Token: SeDebugPrivilege 512 41c114e52de616504df1cd4137de1ce8.exe Token: SeDebugPrivilege 1940 257751.exe Token: SeDebugPrivilege 2624 412558.exe Token: SeDebugPrivilege 2516 7051520.exe Token: SeDebugPrivilege 1320 2586827.exe Token: SeDebugPrivilege 3860 AddInProcess32.exe Token: SeDebugPrivilege 2656 AddInProcess32.exe Token: SeDebugPrivilege 4004 8818052.exe Token: SeDebugPrivilege 3572 8818052.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
41c114e52de616504df1cd4137de1ce8.exe6274697.exeAddInProcess32.exe7051520.exe8818052.exedescription pid process target process PID 512 wrote to memory of 2624 512 41c114e52de616504df1cd4137de1ce8.exe 412558.exe PID 512 wrote to memory of 2624 512 41c114e52de616504df1cd4137de1ce8.exe 412558.exe PID 512 wrote to memory of 2624 512 41c114e52de616504df1cd4137de1ce8.exe 412558.exe PID 512 wrote to memory of 2716 512 41c114e52de616504df1cd4137de1ce8.exe 6274697.exe PID 512 wrote to memory of 2716 512 41c114e52de616504df1cd4137de1ce8.exe 6274697.exe PID 512 wrote to memory of 2716 512 41c114e52de616504df1cd4137de1ce8.exe 6274697.exe PID 512 wrote to memory of 1940 512 41c114e52de616504df1cd4137de1ce8.exe 257751.exe PID 512 wrote to memory of 1940 512 41c114e52de616504df1cd4137de1ce8.exe 257751.exe PID 512 wrote to memory of 1940 512 41c114e52de616504df1cd4137de1ce8.exe 257751.exe PID 512 wrote to memory of 4004 512 41c114e52de616504df1cd4137de1ce8.exe 8818052.exe PID 512 wrote to memory of 4004 512 41c114e52de616504df1cd4137de1ce8.exe 8818052.exe PID 512 wrote to memory of 4004 512 41c114e52de616504df1cd4137de1ce8.exe 8818052.exe PID 2716 wrote to memory of 184 2716 6274697.exe Windows Host.exe PID 2716 wrote to memory of 184 2716 6274697.exe Windows Host.exe PID 2716 wrote to memory of 184 2716 6274697.exe Windows Host.exe PID 512 wrote to memory of 2516 512 41c114e52de616504df1cd4137de1ce8.exe 7051520.exe PID 512 wrote to memory of 2516 512 41c114e52de616504df1cd4137de1ce8.exe 7051520.exe PID 512 wrote to memory of 2516 512 41c114e52de616504df1cd4137de1ce8.exe 7051520.exe PID 512 wrote to memory of 1320 512 41c114e52de616504df1cd4137de1ce8.exe 2586827.exe PID 512 wrote to memory of 1320 512 41c114e52de616504df1cd4137de1ce8.exe 2586827.exe PID 512 wrote to memory of 1320 512 41c114e52de616504df1cd4137de1ce8.exe 2586827.exe PID 1940 wrote to memory of 3860 1940 AddInProcess32.exe AddInProcess32.exe PID 1940 wrote to memory of 3860 1940 AddInProcess32.exe AddInProcess32.exe PID 1940 wrote to memory of 3860 1940 AddInProcess32.exe AddInProcess32.exe PID 1940 wrote to memory of 3860 1940 AddInProcess32.exe AddInProcess32.exe PID 1940 wrote to memory of 3860 1940 AddInProcess32.exe AddInProcess32.exe PID 1940 wrote to memory of 3860 1940 AddInProcess32.exe AddInProcess32.exe PID 1940 wrote to memory of 3860 1940 AddInProcess32.exe AddInProcess32.exe PID 1940 wrote to memory of 3860 1940 AddInProcess32.exe AddInProcess32.exe PID 2516 wrote to memory of 1940 2516 7051520.exe AddInProcess32.exe PID 2516 wrote to memory of 1940 2516 7051520.exe AddInProcess32.exe PID 2516 wrote to memory of 1940 2516 7051520.exe AddInProcess32.exe PID 2516 wrote to memory of 2656 2516 7051520.exe AddInProcess32.exe PID 2516 wrote to memory of 2656 2516 7051520.exe AddInProcess32.exe PID 2516 wrote to memory of 2656 2516 7051520.exe AddInProcess32.exe PID 2516 wrote to memory of 2656 2516 7051520.exe AddInProcess32.exe PID 2516 wrote to memory of 2656 2516 7051520.exe AddInProcess32.exe PID 2516 wrote to memory of 2656 2516 7051520.exe AddInProcess32.exe PID 2516 wrote to memory of 2656 2516 7051520.exe AddInProcess32.exe PID 2516 wrote to memory of 2656 2516 7051520.exe AddInProcess32.exe PID 4004 wrote to memory of 3836 4004 8818052.exe 8818052.exe PID 4004 wrote to memory of 3836 4004 8818052.exe 8818052.exe PID 4004 wrote to memory of 3836 4004 8818052.exe 8818052.exe PID 4004 wrote to memory of 3572 4004 8818052.exe 8818052.exe PID 4004 wrote to memory of 3572 4004 8818052.exe 8818052.exe PID 4004 wrote to memory of 3572 4004 8818052.exe 8818052.exe PID 4004 wrote to memory of 3572 4004 8818052.exe 8818052.exe PID 4004 wrote to memory of 3572 4004 8818052.exe 8818052.exe PID 4004 wrote to memory of 3572 4004 8818052.exe 8818052.exe PID 4004 wrote to memory of 3572 4004 8818052.exe 8818052.exe PID 4004 wrote to memory of 3572 4004 8818052.exe 8818052.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41c114e52de616504df1cd4137de1ce8.exe"C:\Users\Admin\AppData\Local\Temp\41c114e52de616504df1cd4137de1ce8.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\412558.exe"C:\ProgramData\412558.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\6274697.exe"C:\ProgramData\6274697.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"3⤵
- Executes dropped EXE
-
C:\ProgramData\257751.exe"C:\ProgramData\257751.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\8818052.exe"C:\ProgramData\8818052.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\8818052.exe"{path}"3⤵
- Executes dropped EXE
-
C:\ProgramData\8818052.exe"{path}"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\7051520.exe"C:\ProgramData\7051520.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\2586827.exe"C:\ProgramData\2586827.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\257751.exeMD5
9854ca00ad1b2075d74bf30d2c76977d
SHA1380e032d03252462c997bfe2269653d45d5a4e0d
SHA25620c15773122e08a5b82c0cdc8ec9ce25b67f672b14f2dfa1a2d4125854e79775
SHA5121ece7bf9e43aae4a1aad995660e253ddea691e15dd9d1a585db8b51e06001b094236edf49fb8fa15cc66789107c98f69c4c3e4f1e833fdd2e14660b1719bc475
-
C:\ProgramData\257751.exeMD5
9854ca00ad1b2075d74bf30d2c76977d
SHA1380e032d03252462c997bfe2269653d45d5a4e0d
SHA25620c15773122e08a5b82c0cdc8ec9ce25b67f672b14f2dfa1a2d4125854e79775
SHA5121ece7bf9e43aae4a1aad995660e253ddea691e15dd9d1a585db8b51e06001b094236edf49fb8fa15cc66789107c98f69c4c3e4f1e833fdd2e14660b1719bc475
-
C:\ProgramData\2586827.exeMD5
1dbb51d5ec8804cc1308b77b04a229b8
SHA191f4da1d2df24f674d3d5f69701fe271bf98a336
SHA25656c0531f03a74cc126dce5b73b05492218bb527cfe2a9b9187e123617b89bffe
SHA51263a80b5e5f992dceeccb691f6bd0ab8214f8ae11835e63bc071c4ede39cf01c9ac82b6395dcebd150a6074918e40e5894ea23e78deb7d5ef7929a86b096604ca
-
C:\ProgramData\2586827.exeMD5
1dbb51d5ec8804cc1308b77b04a229b8
SHA191f4da1d2df24f674d3d5f69701fe271bf98a336
SHA25656c0531f03a74cc126dce5b73b05492218bb527cfe2a9b9187e123617b89bffe
SHA51263a80b5e5f992dceeccb691f6bd0ab8214f8ae11835e63bc071c4ede39cf01c9ac82b6395dcebd150a6074918e40e5894ea23e78deb7d5ef7929a86b096604ca
-
C:\ProgramData\412558.exeMD5
9dee976b0c93a6c26b45e98506cedaa1
SHA14bd929747e3d3017db86c4b2b606e4c47e7009d5
SHA25605fd1c0d49f43fd26ac3cbdb5f0486fd0a88381330bd77d9ed935b4e0ab6ccb2
SHA5121c915c861ae67bf493fd53125dbcdf56220474769a23af1c41cb448db84493d77b08adfb34f84f1125585d7e771b24906e9057cc3712114c7c527ee1eb444956
-
C:\ProgramData\412558.exeMD5
9dee976b0c93a6c26b45e98506cedaa1
SHA14bd929747e3d3017db86c4b2b606e4c47e7009d5
SHA25605fd1c0d49f43fd26ac3cbdb5f0486fd0a88381330bd77d9ed935b4e0ab6ccb2
SHA5121c915c861ae67bf493fd53125dbcdf56220474769a23af1c41cb448db84493d77b08adfb34f84f1125585d7e771b24906e9057cc3712114c7c527ee1eb444956
-
C:\ProgramData\6274697.exeMD5
afb7dc87e6208b5747af8e7ab95f28bf
SHA1af2e35b042efcc0c47d31e1747baca34e24a68c1
SHA256a58c95de92eefb42ccff366ae9381c638d425673bd2860256b8263ef7a5609f1
SHA5128448cbcdcc35ee0676a709e01ab0f87c6e11a1718b767f7f220ed559c0f30867b7cb8f82a9d0c3b3279cf00c35619189edac265e724d83811f49e2bea7daa1d0
-
C:\ProgramData\6274697.exeMD5
afb7dc87e6208b5747af8e7ab95f28bf
SHA1af2e35b042efcc0c47d31e1747baca34e24a68c1
SHA256a58c95de92eefb42ccff366ae9381c638d425673bd2860256b8263ef7a5609f1
SHA5128448cbcdcc35ee0676a709e01ab0f87c6e11a1718b767f7f220ed559c0f30867b7cb8f82a9d0c3b3279cf00c35619189edac265e724d83811f49e2bea7daa1d0
-
C:\ProgramData\7051520.exeMD5
ba369b7fb0f0a293fb08d2c1ba3e1594
SHA1814fd4e2db519e07cf4e70d68289164c82fddc56
SHA256ee2c4a9912ea0d6aaa7451da03e30904318cbccfd70f1ec83727cf2ea6b5b6cb
SHA512ac418f360b0b6243aeb61c27d62b395b8cb9c8cd1488c345af62575ad2c3cced8f96d70720c5650acb71ce886a9463894c4d9fed0e9f722da498136e8a72f787
-
C:\ProgramData\7051520.exeMD5
ba369b7fb0f0a293fb08d2c1ba3e1594
SHA1814fd4e2db519e07cf4e70d68289164c82fddc56
SHA256ee2c4a9912ea0d6aaa7451da03e30904318cbccfd70f1ec83727cf2ea6b5b6cb
SHA512ac418f360b0b6243aeb61c27d62b395b8cb9c8cd1488c345af62575ad2c3cced8f96d70720c5650acb71ce886a9463894c4d9fed0e9f722da498136e8a72f787
-
C:\ProgramData\8818052.exeMD5
c2b6d1d75ba91acc3f25c06870b343f1
SHA1da261bb52507fb6a603be05190fac3a2ffec8ea9
SHA256f96bb87342a24dfdcce5db4fb1c06a4d4fcdf727b3e3c649a56bf20c0996cd2f
SHA5123764a2e5bfb9b93969433edaee2164ff112868314a63a2c34fceda89a0472ee03ae1aa37ac9b5ab9b714b326da9811b64ee44df69a852bab2e985e835a97495c
-
C:\ProgramData\8818052.exeMD5
c2b6d1d75ba91acc3f25c06870b343f1
SHA1da261bb52507fb6a603be05190fac3a2ffec8ea9
SHA256f96bb87342a24dfdcce5db4fb1c06a4d4fcdf727b3e3c649a56bf20c0996cd2f
SHA5123764a2e5bfb9b93969433edaee2164ff112868314a63a2c34fceda89a0472ee03ae1aa37ac9b5ab9b714b326da9811b64ee44df69a852bab2e985e835a97495c
-
C:\ProgramData\8818052.exeMD5
c2b6d1d75ba91acc3f25c06870b343f1
SHA1da261bb52507fb6a603be05190fac3a2ffec8ea9
SHA256f96bb87342a24dfdcce5db4fb1c06a4d4fcdf727b3e3c649a56bf20c0996cd2f
SHA5123764a2e5bfb9b93969433edaee2164ff112868314a63a2c34fceda89a0472ee03ae1aa37ac9b5ab9b714b326da9811b64ee44df69a852bab2e985e835a97495c
-
C:\ProgramData\8818052.exeMD5
c2b6d1d75ba91acc3f25c06870b343f1
SHA1da261bb52507fb6a603be05190fac3a2ffec8ea9
SHA256f96bb87342a24dfdcce5db4fb1c06a4d4fcdf727b3e3c649a56bf20c0996cd2f
SHA5123764a2e5bfb9b93969433edaee2164ff112868314a63a2c34fceda89a0472ee03ae1aa37ac9b5ab9b714b326da9811b64ee44df69a852bab2e985e835a97495c
-
C:\ProgramData\Windows Host\Windows Host.exeMD5
afb7dc87e6208b5747af8e7ab95f28bf
SHA1af2e35b042efcc0c47d31e1747baca34e24a68c1
SHA256a58c95de92eefb42ccff366ae9381c638d425673bd2860256b8263ef7a5609f1
SHA5128448cbcdcc35ee0676a709e01ab0f87c6e11a1718b767f7f220ed559c0f30867b7cb8f82a9d0c3b3279cf00c35619189edac265e724d83811f49e2bea7daa1d0
-
C:\ProgramData\Windows Host\Windows Host.exeMD5
afb7dc87e6208b5747af8e7ab95f28bf
SHA1af2e35b042efcc0c47d31e1747baca34e24a68c1
SHA256a58c95de92eefb42ccff366ae9381c638d425673bd2860256b8263ef7a5609f1
SHA5128448cbcdcc35ee0676a709e01ab0f87c6e11a1718b767f7f220ed559c0f30867b7cb8f82a9d0c3b3279cf00c35619189edac265e724d83811f49e2bea7daa1d0
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8818052.exe.logMD5
24c05b1c21d7a1915086cc2084cb0649
SHA1522ca647782d82d7f8a1fa5b44ba65f554ab95a3
SHA2564b4aa87c539b77acbc88241185dd4cd963353d568165f5a5c05c23b0d7598319
SHA512c116038b7b92b06c318679e62eba98cb6d2adda5fd95ac847f0ecb4c0ba999125cc5c81bb60477455afebc56ff3b2d6f2d58954bfafe83737fe80cfa3f6e930b
-
memory/184-152-0x0000000000000000-mapping.dmp
-
memory/184-183-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/512-119-0x0000000000EE0000-0x0000000000EE2000-memory.dmpFilesize
8KB
-
memory/512-117-0x0000000000B00000-0x0000000000B21000-memory.dmpFilesize
132KB
-
memory/512-118-0x0000000000B30000-0x0000000000B31000-memory.dmpFilesize
4KB
-
memory/512-116-0x00000000007F0000-0x00000000007F1000-memory.dmpFilesize
4KB
-
memory/512-114-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/1320-194-0x0000000005150000-0x0000000005151000-memory.dmpFilesize
4KB
-
memory/1320-163-0x0000000000000000-mapping.dmp
-
memory/1320-179-0x0000000002F40000-0x0000000002F41000-memory.dmpFilesize
4KB
-
memory/1320-185-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/1320-168-0x0000000000FB0000-0x0000000000FB1000-memory.dmpFilesize
4KB
-
memory/1320-193-0x0000000005100000-0x000000000513B000-memory.dmpFilesize
236KB
-
memory/1940-137-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/1940-144-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/1940-134-0x0000000000000000-mapping.dmp
-
memory/2516-156-0x0000000000000000-mapping.dmp
-
memory/2516-180-0x0000000005780000-0x0000000005781000-memory.dmpFilesize
4KB
-
memory/2516-160-0x0000000000F50000-0x0000000000F51000-memory.dmpFilesize
4KB
-
memory/2624-173-0x0000000008DA0000-0x0000000008DA1000-memory.dmpFilesize
4KB
-
memory/2624-130-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/2624-145-0x00000000027E0000-0x00000000027E1000-memory.dmpFilesize
4KB
-
memory/2624-140-0x0000000002770000-0x00000000027A2000-memory.dmpFilesize
200KB
-
memory/2624-120-0x0000000000000000-mapping.dmp
-
memory/2624-123-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB
-
memory/2624-171-0x0000000004E00000-0x0000000004E01000-memory.dmpFilesize
4KB
-
memory/2656-207-0x0000000005330000-0x0000000005936000-memory.dmpFilesize
6.0MB
-
memory/2656-198-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2656-199-0x0000000000416226-mapping.dmp
-
memory/2716-139-0x000000000DE80000-0x000000000DE81000-memory.dmpFilesize
4KB
-
memory/2716-141-0x0000000004C20000-0x0000000004C21000-memory.dmpFilesize
4KB
-
memory/2716-125-0x0000000000000000-mapping.dmp
-
memory/2716-142-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB
-
memory/2716-133-0x000000000E2E0000-0x000000000E2E1000-memory.dmpFilesize
4KB
-
memory/2716-128-0x0000000000970000-0x0000000000971000-memory.dmpFilesize
4KB
-
memory/2716-132-0x0000000002BF0000-0x0000000002C02000-memory.dmpFilesize
72KB
-
memory/2716-131-0x0000000002BC0000-0x0000000002BC1000-memory.dmpFilesize
4KB
-
memory/3572-212-0x00000000004163CA-mapping.dmp
-
memory/3572-215-0x0000000005170000-0x0000000005776000-memory.dmpFilesize
6.0MB
-
memory/3860-170-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3860-174-0x0000000000416232-mapping.dmp
-
memory/3860-184-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/3860-189-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/3860-187-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/3860-195-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/3860-196-0x0000000004E10000-0x0000000005416000-memory.dmpFilesize
6.0MB
-
memory/3860-186-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/4004-191-0x0000000000AC0000-0x0000000000AC5000-memory.dmpFilesize
20KB
-
memory/4004-172-0x0000000007FF0000-0x0000000007FF1000-memory.dmpFilesize
4KB
-
memory/4004-192-0x000000000AC00000-0x000000000AC01000-memory.dmpFilesize
4KB
-
memory/4004-176-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4004-149-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/4004-167-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/4004-146-0x0000000000000000-mapping.dmp