Analysis
-
max time kernel
93s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-04-2021 22:37
Static task
static1
Behavioral task
behavioral1
Sample
41c114e52de616504df1cd4137de1ce8.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
41c114e52de616504df1cd4137de1ce8.exe
Resource
win10v20210410
General
-
Target
41c114e52de616504df1cd4137de1ce8.exe
-
Size
187KB
-
MD5
41c114e52de616504df1cd4137de1ce8
-
SHA1
0579cc93cf8e6dd57e878da1f520499e4a77cf5a
-
SHA256
556c6ec49b714eb7bf9b3d816fd18a8962fb6be756224aa4cf8614e5bd7f0738
-
SHA512
4dd0a49f9e5481cb3d3644604e896bc338021968fbae72d426ec67643759b644cba0f4dac81c7c3fef9a05aeca58171f11d790dc5ef76797bbe99a2e57900634
Malware Config
Extracted
redline
20_4_net
Sthellete.xyz:80
Extracted
redline
tor1
45.67.228.131:9603
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2696-174-0x0000000000400000-0x000000000041C000-memory.dmp family_redline behavioral2/memory/2696-176-0x0000000000416232-mapping.dmp family_redline behavioral2/memory/3628-195-0x0000000000416226-mapping.dmp family_redline behavioral2/memory/3628-192-0x0000000000400000-0x000000000041C000-memory.dmp family_redline behavioral2/memory/1308-212-0x00000000004163CA-mapping.dmp family_redline -
Executes dropped EXE 8 IoCs
Processes:
8217349.exe5208876.exe248979.exe1831316.exe8003767.exeWindows Host.exe8159271.exe1831316.exepid process 2920 8217349.exe 4040 5208876.exe 1340 248979.exe 3016 1831316.exe 500 8003767.exe 1300 Windows Host.exe 188 8159271.exe 1308 1831316.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5208876.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\ProgramData\\Windows Host\\Windows Host.exe" 5208876.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
248979.exe8003767.exe1831316.exedescription pid process target process PID 1340 set thread context of 2696 1340 248979.exe AddInProcess32.exe PID 500 set thread context of 3628 500 8003767.exe AddInProcess32.exe PID 3016 set thread context of 1308 3016 1831316.exe 1831316.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
8217349.exe8159271.exeAddInProcess32.exeAddInProcess32.exe1831316.exepid process 2920 8217349.exe 2920 8217349.exe 188 8159271.exe 3628 AddInProcess32.exe 2696 AddInProcess32.exe 1308 1831316.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
41c114e52de616504df1cd4137de1ce8.exe248979.exe8217349.exe8003767.exe8159271.exeAddInProcess32.exeAddInProcess32.exe1831316.exedescription pid process Token: SeDebugPrivilege 2256 41c114e52de616504df1cd4137de1ce8.exe Token: SeDebugPrivilege 1340 248979.exe Token: SeDebugPrivilege 2920 8217349.exe Token: SeDebugPrivilege 500 8003767.exe Token: SeDebugPrivilege 188 8159271.exe Token: SeDebugPrivilege 2696 AddInProcess32.exe Token: SeDebugPrivilege 3628 AddInProcess32.exe Token: SeDebugPrivilege 1308 1831316.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
41c114e52de616504df1cd4137de1ce8.exe5208876.exe248979.exe8003767.exe1831316.exedescription pid process target process PID 2256 wrote to memory of 2920 2256 41c114e52de616504df1cd4137de1ce8.exe 8217349.exe PID 2256 wrote to memory of 2920 2256 41c114e52de616504df1cd4137de1ce8.exe 8217349.exe PID 2256 wrote to memory of 2920 2256 41c114e52de616504df1cd4137de1ce8.exe 8217349.exe PID 2256 wrote to memory of 4040 2256 41c114e52de616504df1cd4137de1ce8.exe 5208876.exe PID 2256 wrote to memory of 4040 2256 41c114e52de616504df1cd4137de1ce8.exe 5208876.exe PID 2256 wrote to memory of 4040 2256 41c114e52de616504df1cd4137de1ce8.exe 5208876.exe PID 2256 wrote to memory of 1340 2256 41c114e52de616504df1cd4137de1ce8.exe 248979.exe PID 2256 wrote to memory of 1340 2256 41c114e52de616504df1cd4137de1ce8.exe 248979.exe PID 2256 wrote to memory of 1340 2256 41c114e52de616504df1cd4137de1ce8.exe 248979.exe PID 2256 wrote to memory of 3016 2256 41c114e52de616504df1cd4137de1ce8.exe 1831316.exe PID 2256 wrote to memory of 3016 2256 41c114e52de616504df1cd4137de1ce8.exe 1831316.exe PID 2256 wrote to memory of 3016 2256 41c114e52de616504df1cd4137de1ce8.exe 1831316.exe PID 4040 wrote to memory of 1300 4040 5208876.exe Windows Host.exe PID 4040 wrote to memory of 1300 4040 5208876.exe Windows Host.exe PID 4040 wrote to memory of 1300 4040 5208876.exe Windows Host.exe PID 2256 wrote to memory of 500 2256 41c114e52de616504df1cd4137de1ce8.exe 8003767.exe PID 2256 wrote to memory of 500 2256 41c114e52de616504df1cd4137de1ce8.exe 8003767.exe PID 2256 wrote to memory of 500 2256 41c114e52de616504df1cd4137de1ce8.exe 8003767.exe PID 2256 wrote to memory of 188 2256 41c114e52de616504df1cd4137de1ce8.exe 8159271.exe PID 2256 wrote to memory of 188 2256 41c114e52de616504df1cd4137de1ce8.exe 8159271.exe PID 2256 wrote to memory of 188 2256 41c114e52de616504df1cd4137de1ce8.exe 8159271.exe PID 1340 wrote to memory of 3628 1340 248979.exe AddInProcess32.exe PID 1340 wrote to memory of 3628 1340 248979.exe AddInProcess32.exe PID 1340 wrote to memory of 3628 1340 248979.exe AddInProcess32.exe PID 1340 wrote to memory of 2696 1340 248979.exe AddInProcess32.exe PID 1340 wrote to memory of 2696 1340 248979.exe AddInProcess32.exe PID 1340 wrote to memory of 2696 1340 248979.exe AddInProcess32.exe PID 1340 wrote to memory of 2696 1340 248979.exe AddInProcess32.exe PID 1340 wrote to memory of 2696 1340 248979.exe AddInProcess32.exe PID 1340 wrote to memory of 2696 1340 248979.exe AddInProcess32.exe PID 1340 wrote to memory of 2696 1340 248979.exe AddInProcess32.exe PID 1340 wrote to memory of 2696 1340 248979.exe AddInProcess32.exe PID 500 wrote to memory of 3628 500 8003767.exe AddInProcess32.exe PID 500 wrote to memory of 3628 500 8003767.exe AddInProcess32.exe PID 500 wrote to memory of 3628 500 8003767.exe AddInProcess32.exe PID 500 wrote to memory of 3628 500 8003767.exe AddInProcess32.exe PID 500 wrote to memory of 3628 500 8003767.exe AddInProcess32.exe PID 500 wrote to memory of 3628 500 8003767.exe AddInProcess32.exe PID 500 wrote to memory of 3628 500 8003767.exe AddInProcess32.exe PID 500 wrote to memory of 3628 500 8003767.exe AddInProcess32.exe PID 3016 wrote to memory of 1308 3016 1831316.exe 1831316.exe PID 3016 wrote to memory of 1308 3016 1831316.exe 1831316.exe PID 3016 wrote to memory of 1308 3016 1831316.exe 1831316.exe PID 3016 wrote to memory of 1308 3016 1831316.exe 1831316.exe PID 3016 wrote to memory of 1308 3016 1831316.exe 1831316.exe PID 3016 wrote to memory of 1308 3016 1831316.exe 1831316.exe PID 3016 wrote to memory of 1308 3016 1831316.exe 1831316.exe PID 3016 wrote to memory of 1308 3016 1831316.exe 1831316.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\41c114e52de616504df1cd4137de1ce8.exe"C:\Users\Admin\AppData\Local\Temp\41c114e52de616504df1cd4137de1ce8.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\8217349.exe"C:\ProgramData\8217349.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\5208876.exe"C:\ProgramData\5208876.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"3⤵
- Executes dropped EXE
-
C:\ProgramData\248979.exe"C:\ProgramData\248979.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\1831316.exe"C:\ProgramData\1831316.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\1831316.exe"{path}"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\8003767.exe"C:\ProgramData\8003767.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\8159271.exe"C:\ProgramData\8159271.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\1831316.exeMD5
c2b6d1d75ba91acc3f25c06870b343f1
SHA1da261bb52507fb6a603be05190fac3a2ffec8ea9
SHA256f96bb87342a24dfdcce5db4fb1c06a4d4fcdf727b3e3c649a56bf20c0996cd2f
SHA5123764a2e5bfb9b93969433edaee2164ff112868314a63a2c34fceda89a0472ee03ae1aa37ac9b5ab9b714b326da9811b64ee44df69a852bab2e985e835a97495c
-
C:\ProgramData\1831316.exeMD5
c2b6d1d75ba91acc3f25c06870b343f1
SHA1da261bb52507fb6a603be05190fac3a2ffec8ea9
SHA256f96bb87342a24dfdcce5db4fb1c06a4d4fcdf727b3e3c649a56bf20c0996cd2f
SHA5123764a2e5bfb9b93969433edaee2164ff112868314a63a2c34fceda89a0472ee03ae1aa37ac9b5ab9b714b326da9811b64ee44df69a852bab2e985e835a97495c
-
C:\ProgramData\1831316.exeMD5
c2b6d1d75ba91acc3f25c06870b343f1
SHA1da261bb52507fb6a603be05190fac3a2ffec8ea9
SHA256f96bb87342a24dfdcce5db4fb1c06a4d4fcdf727b3e3c649a56bf20c0996cd2f
SHA5123764a2e5bfb9b93969433edaee2164ff112868314a63a2c34fceda89a0472ee03ae1aa37ac9b5ab9b714b326da9811b64ee44df69a852bab2e985e835a97495c
-
C:\ProgramData\248979.exeMD5
9854ca00ad1b2075d74bf30d2c76977d
SHA1380e032d03252462c997bfe2269653d45d5a4e0d
SHA25620c15773122e08a5b82c0cdc8ec9ce25b67f672b14f2dfa1a2d4125854e79775
SHA5121ece7bf9e43aae4a1aad995660e253ddea691e15dd9d1a585db8b51e06001b094236edf49fb8fa15cc66789107c98f69c4c3e4f1e833fdd2e14660b1719bc475
-
C:\ProgramData\248979.exeMD5
9854ca00ad1b2075d74bf30d2c76977d
SHA1380e032d03252462c997bfe2269653d45d5a4e0d
SHA25620c15773122e08a5b82c0cdc8ec9ce25b67f672b14f2dfa1a2d4125854e79775
SHA5121ece7bf9e43aae4a1aad995660e253ddea691e15dd9d1a585db8b51e06001b094236edf49fb8fa15cc66789107c98f69c4c3e4f1e833fdd2e14660b1719bc475
-
C:\ProgramData\5208876.exeMD5
afb7dc87e6208b5747af8e7ab95f28bf
SHA1af2e35b042efcc0c47d31e1747baca34e24a68c1
SHA256a58c95de92eefb42ccff366ae9381c638d425673bd2860256b8263ef7a5609f1
SHA5128448cbcdcc35ee0676a709e01ab0f87c6e11a1718b767f7f220ed559c0f30867b7cb8f82a9d0c3b3279cf00c35619189edac265e724d83811f49e2bea7daa1d0
-
C:\ProgramData\5208876.exeMD5
afb7dc87e6208b5747af8e7ab95f28bf
SHA1af2e35b042efcc0c47d31e1747baca34e24a68c1
SHA256a58c95de92eefb42ccff366ae9381c638d425673bd2860256b8263ef7a5609f1
SHA5128448cbcdcc35ee0676a709e01ab0f87c6e11a1718b767f7f220ed559c0f30867b7cb8f82a9d0c3b3279cf00c35619189edac265e724d83811f49e2bea7daa1d0
-
C:\ProgramData\8003767.exeMD5
ba369b7fb0f0a293fb08d2c1ba3e1594
SHA1814fd4e2db519e07cf4e70d68289164c82fddc56
SHA256ee2c4a9912ea0d6aaa7451da03e30904318cbccfd70f1ec83727cf2ea6b5b6cb
SHA512ac418f360b0b6243aeb61c27d62b395b8cb9c8cd1488c345af62575ad2c3cced8f96d70720c5650acb71ce886a9463894c4d9fed0e9f722da498136e8a72f787
-
C:\ProgramData\8003767.exeMD5
ba369b7fb0f0a293fb08d2c1ba3e1594
SHA1814fd4e2db519e07cf4e70d68289164c82fddc56
SHA256ee2c4a9912ea0d6aaa7451da03e30904318cbccfd70f1ec83727cf2ea6b5b6cb
SHA512ac418f360b0b6243aeb61c27d62b395b8cb9c8cd1488c345af62575ad2c3cced8f96d70720c5650acb71ce886a9463894c4d9fed0e9f722da498136e8a72f787
-
C:\ProgramData\8159271.exeMD5
1dbb51d5ec8804cc1308b77b04a229b8
SHA191f4da1d2df24f674d3d5f69701fe271bf98a336
SHA25656c0531f03a74cc126dce5b73b05492218bb527cfe2a9b9187e123617b89bffe
SHA51263a80b5e5f992dceeccb691f6bd0ab8214f8ae11835e63bc071c4ede39cf01c9ac82b6395dcebd150a6074918e40e5894ea23e78deb7d5ef7929a86b096604ca
-
C:\ProgramData\8159271.exeMD5
1dbb51d5ec8804cc1308b77b04a229b8
SHA191f4da1d2df24f674d3d5f69701fe271bf98a336
SHA25656c0531f03a74cc126dce5b73b05492218bb527cfe2a9b9187e123617b89bffe
SHA51263a80b5e5f992dceeccb691f6bd0ab8214f8ae11835e63bc071c4ede39cf01c9ac82b6395dcebd150a6074918e40e5894ea23e78deb7d5ef7929a86b096604ca
-
C:\ProgramData\8217349.exeMD5
9dee976b0c93a6c26b45e98506cedaa1
SHA14bd929747e3d3017db86c4b2b606e4c47e7009d5
SHA25605fd1c0d49f43fd26ac3cbdb5f0486fd0a88381330bd77d9ed935b4e0ab6ccb2
SHA5121c915c861ae67bf493fd53125dbcdf56220474769a23af1c41cb448db84493d77b08adfb34f84f1125585d7e771b24906e9057cc3712114c7c527ee1eb444956
-
C:\ProgramData\8217349.exeMD5
9dee976b0c93a6c26b45e98506cedaa1
SHA14bd929747e3d3017db86c4b2b606e4c47e7009d5
SHA25605fd1c0d49f43fd26ac3cbdb5f0486fd0a88381330bd77d9ed935b4e0ab6ccb2
SHA5121c915c861ae67bf493fd53125dbcdf56220474769a23af1c41cb448db84493d77b08adfb34f84f1125585d7e771b24906e9057cc3712114c7c527ee1eb444956
-
C:\ProgramData\Windows Host\Windows Host.exeMD5
afb7dc87e6208b5747af8e7ab95f28bf
SHA1af2e35b042efcc0c47d31e1747baca34e24a68c1
SHA256a58c95de92eefb42ccff366ae9381c638d425673bd2860256b8263ef7a5609f1
SHA5128448cbcdcc35ee0676a709e01ab0f87c6e11a1718b767f7f220ed559c0f30867b7cb8f82a9d0c3b3279cf00c35619189edac265e724d83811f49e2bea7daa1d0
-
C:\ProgramData\Windows Host\Windows Host.exeMD5
afb7dc87e6208b5747af8e7ab95f28bf
SHA1af2e35b042efcc0c47d31e1747baca34e24a68c1
SHA256a58c95de92eefb42ccff366ae9381c638d425673bd2860256b8263ef7a5609f1
SHA5128448cbcdcc35ee0676a709e01ab0f87c6e11a1718b767f7f220ed559c0f30867b7cb8f82a9d0c3b3279cf00c35619189edac265e724d83811f49e2bea7daa1d0
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1831316.exe.logMD5
24c05b1c21d7a1915086cc2084cb0649
SHA1522ca647782d82d7f8a1fa5b44ba65f554ab95a3
SHA2564b4aa87c539b77acbc88241185dd4cd963353d568165f5a5c05c23b0d7598319
SHA512c116038b7b92b06c318679e62eba98cb6d2adda5fd95ac847f0ecb4c0ba999125cc5c81bb60477455afebc56ff3b2d6f2d58954bfafe83737fe80cfa3f6e930b
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AddInProcess32.exe.logMD5
6fc881dd3bb50496248d57709eb4ef65
SHA1867fd7a0f033c421b5a49b153bbb7f0a2a9f35ad
SHA2566ba63ec508ff5bafd8cbfdf69dae25950fca0cb1294849f416fdfa6760e1bc60
SHA51269f67beb6094ce4c9bf8b9549992c423e0194ac80c8e1742dc57be26e4a885af6cfd7d1d37dd326266918fa71e41ca566e9a6a9c230b4571e17e0d9c7b553d5d
-
memory/188-194-0x000000000AAA0000-0x000000000AADB000-memory.dmpFilesize
236KB
-
memory/188-182-0x0000000002D10000-0x0000000002D11000-memory.dmpFilesize
4KB
-
memory/188-172-0x0000000000B60000-0x0000000000B61000-memory.dmpFilesize
4KB
-
memory/188-196-0x0000000002D20000-0x0000000002D21000-memory.dmpFilesize
4KB
-
memory/188-168-0x0000000000000000-mapping.dmp
-
memory/188-178-0x0000000001420000-0x0000000001421000-memory.dmpFilesize
4KB
-
memory/500-153-0x0000000000000000-mapping.dmp
-
memory/500-185-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB
-
memory/500-157-0x00000000004F0000-0x00000000004F1000-memory.dmpFilesize
4KB
-
memory/1300-152-0x0000000000000000-mapping.dmp
-
memory/1300-187-0x0000000005430000-0x0000000005431000-memory.dmpFilesize
4KB
-
memory/1308-215-0x0000000004FA0000-0x00000000055A6000-memory.dmpFilesize
6.0MB
-
memory/1308-212-0x00000000004163CA-mapping.dmp
-
memory/1340-126-0x0000000000000000-mapping.dmp
-
memory/1340-130-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/1340-142-0x0000000002990000-0x0000000002991000-memory.dmpFilesize
4KB
-
memory/2256-118-0x0000000002BA0000-0x0000000002BA1000-memory.dmpFilesize
4KB
-
memory/2256-119-0x0000000002C30000-0x0000000002C32000-memory.dmpFilesize
8KB
-
memory/2256-114-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/2256-117-0x00000000011C0000-0x00000000011E1000-memory.dmpFilesize
132KB
-
memory/2256-116-0x00000000011B0000-0x00000000011B1000-memory.dmpFilesize
4KB
-
memory/2696-205-0x0000000004EE0000-0x00000000054E6000-memory.dmpFilesize
6.0MB
-
memory/2696-186-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/2696-190-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/2696-183-0x00000000054F0000-0x00000000054F1000-memory.dmpFilesize
4KB
-
memory/2696-193-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/2696-203-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/2696-174-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2696-176-0x0000000000416232-mapping.dmp
-
memory/2920-184-0x0000000009560000-0x0000000009561000-memory.dmpFilesize
4KB
-
memory/2920-120-0x0000000000000000-mapping.dmp
-
memory/2920-136-0x00000000018F0000-0x00000000018F1000-memory.dmpFilesize
4KB
-
memory/2920-129-0x0000000000E50000-0x0000000000E51000-memory.dmpFilesize
4KB
-
memory/2920-177-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/2920-148-0x0000000002FE0000-0x0000000002FE1000-memory.dmpFilesize
4KB
-
memory/2920-143-0x0000000002F90000-0x0000000002FC2000-memory.dmpFilesize
200KB
-
memory/3016-163-0x0000000007C70000-0x0000000007C71000-memory.dmpFilesize
4KB
-
memory/3016-149-0x0000000000C50000-0x0000000000C51000-memory.dmpFilesize
4KB
-
memory/3016-145-0x0000000000000000-mapping.dmp
-
memory/3016-191-0x000000000B740000-0x000000000B741000-memory.dmpFilesize
4KB
-
memory/3016-189-0x0000000002E70000-0x0000000002E75000-memory.dmpFilesize
20KB
-
memory/3016-165-0x0000000008A30000-0x0000000008A31000-memory.dmpFilesize
4KB
-
memory/3016-180-0x0000000005410000-0x0000000005411000-memory.dmpFilesize
4KB
-
memory/3628-206-0x0000000005250000-0x0000000005856000-memory.dmpFilesize
6.0MB
-
memory/3628-192-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3628-195-0x0000000000416226-mapping.dmp
-
memory/4040-138-0x000000000E300000-0x000000000E301000-memory.dmpFilesize
4KB
-
memory/4040-137-0x0000000002BC0000-0x0000000002BD2000-memory.dmpFilesize
72KB
-
memory/4040-135-0x0000000002B90000-0x0000000002B91000-memory.dmpFilesize
4KB
-
memory/4040-139-0x000000000DEE0000-0x000000000DEE1000-memory.dmpFilesize
4KB
-
memory/4040-140-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB
-
memory/4040-133-0x0000000000A40000-0x0000000000A41000-memory.dmpFilesize
4KB
-
memory/4040-123-0x0000000000000000-mapping.dmp
-
memory/4040-141-0x0000000005360000-0x0000000005361000-memory.dmpFilesize
4KB