Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
21-07-2021 22:04
Static task
static1
Behavioral task
behavioral1
Sample
194D0361BDC50ABB8479B29934FCEDDE.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
194D0361BDC50ABB8479B29934FCEDDE.exe
Resource
win10v20210408
General
-
Target
194D0361BDC50ABB8479B29934FCEDDE.exe
-
Size
220KB
-
MD5
194d0361bdc50abb8479b29934fcedde
-
SHA1
5b8023acb941df513bd28c48e46b2fa4e8a7b7a5
-
SHA256
29016d532a8c967c49aa06b8688541b08d984f0fe807f380742d187595681830
-
SHA512
93705ce8e8afbb00bf88a1ef1409667652956d56738c52095973890b34ba6c02a4f5962079a2c68bb9950ab378987d9dfa907a121c06f75c5824b85ad62aade8
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1172-84-0x00000000003D0000-0x0000000000402000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
4979675.exe8966467.exe5205775.exeWinHoster.exepid process 1068 4979675.exe 968 8966467.exe 1172 5205775.exe 916 WinHoster.exe -
Loads dropped DLL 1 IoCs
Processes:
8966467.exepid process 968 8966467.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
8966467.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 8966467.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1964 1068 WerFault.exe 4979675.exe -
Processes:
194D0361BDC50ABB8479B29934FCEDDE.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 194D0361BDC50ABB8479B29934FCEDDE.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 194D0361BDC50ABB8479B29934FCEDDE.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 194D0361BDC50ABB8479B29934FCEDDE.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 194D0361BDC50ABB8479B29934FCEDDE.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
4979675.exeWerFault.exe5205775.exepid process 1068 4979675.exe 1964 WerFault.exe 1964 WerFault.exe 1964 WerFault.exe 1964 WerFault.exe 1964 WerFault.exe 1964 WerFault.exe 1172 5205775.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1964 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
194D0361BDC50ABB8479B29934FCEDDE.exe4979675.exe5205775.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1888 194D0361BDC50ABB8479B29934FCEDDE.exe Token: SeDebugPrivilege 1068 4979675.exe Token: SeDebugPrivilege 1172 5205775.exe Token: SeDebugPrivilege 1964 WerFault.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
194D0361BDC50ABB8479B29934FCEDDE.exe8966467.exe4979675.exedescription pid process target process PID 1888 wrote to memory of 1068 1888 194D0361BDC50ABB8479B29934FCEDDE.exe 4979675.exe PID 1888 wrote to memory of 1068 1888 194D0361BDC50ABB8479B29934FCEDDE.exe 4979675.exe PID 1888 wrote to memory of 1068 1888 194D0361BDC50ABB8479B29934FCEDDE.exe 4979675.exe PID 1888 wrote to memory of 968 1888 194D0361BDC50ABB8479B29934FCEDDE.exe 8966467.exe PID 1888 wrote to memory of 968 1888 194D0361BDC50ABB8479B29934FCEDDE.exe 8966467.exe PID 1888 wrote to memory of 968 1888 194D0361BDC50ABB8479B29934FCEDDE.exe 8966467.exe PID 1888 wrote to memory of 968 1888 194D0361BDC50ABB8479B29934FCEDDE.exe 8966467.exe PID 1888 wrote to memory of 1172 1888 194D0361BDC50ABB8479B29934FCEDDE.exe 5205775.exe PID 1888 wrote to memory of 1172 1888 194D0361BDC50ABB8479B29934FCEDDE.exe 5205775.exe PID 1888 wrote to memory of 1172 1888 194D0361BDC50ABB8479B29934FCEDDE.exe 5205775.exe PID 1888 wrote to memory of 1172 1888 194D0361BDC50ABB8479B29934FCEDDE.exe 5205775.exe PID 968 wrote to memory of 916 968 8966467.exe WinHoster.exe PID 968 wrote to memory of 916 968 8966467.exe WinHoster.exe PID 968 wrote to memory of 916 968 8966467.exe WinHoster.exe PID 968 wrote to memory of 916 968 8966467.exe WinHoster.exe PID 1068 wrote to memory of 1964 1068 4979675.exe WerFault.exe PID 1068 wrote to memory of 1964 1068 4979675.exe WerFault.exe PID 1068 wrote to memory of 1964 1068 4979675.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\194D0361BDC50ABB8479B29934FCEDDE.exe"C:\Users\Admin\AppData\Local\Temp\194D0361BDC50ABB8479B29934FCEDDE.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\4979675.exe"C:\Users\Admin\AppData\Roaming\4979675.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1068 -s 19843⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\8966467.exe"C:\Users\Admin\AppData\Roaming\8966467.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\5205775.exe"C:\Users\Admin\AppData\Roaming\5205775.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\4979675.exeMD5
9e19fdd75ef29ee192b244933d7bf7d5
SHA1d3bce87a288abf410afc1aff18de6c300fa15c49
SHA2567def442e8216e47cb8fd87b26f1e4fea0b8646f88dc0d08acc94dd9f1e11cdec
SHA5124bde30274686f8a130c55086c256ce4c09504799d67bb61439c029f803ead32950028aae9fb9d7b59a42bc1ed01833e1a53dce00dd335bef5d4fb3f347e3a24f
-
C:\Users\Admin\AppData\Roaming\4979675.exeMD5
9e19fdd75ef29ee192b244933d7bf7d5
SHA1d3bce87a288abf410afc1aff18de6c300fa15c49
SHA2567def442e8216e47cb8fd87b26f1e4fea0b8646f88dc0d08acc94dd9f1e11cdec
SHA5124bde30274686f8a130c55086c256ce4c09504799d67bb61439c029f803ead32950028aae9fb9d7b59a42bc1ed01833e1a53dce00dd335bef5d4fb3f347e3a24f
-
C:\Users\Admin\AppData\Roaming\5205775.exeMD5
52be91bb8576b57551f38cf98bd984cc
SHA1d4b25085ae85e7b4edc2db2f77e4108fd7345fc1
SHA2562eff8b37b39a5384bf9a3732bd7395af3430bd36eafdad4ba5cec6f707cdd680
SHA512f648be8d881ba47b87544327843add140cc4142ab7fac89cd87d3c79bed23524d7b40e35fd0c65a8c50a62c4e4f32d9a1681b3e043ea882bbfc46425891011b1
-
C:\Users\Admin\AppData\Roaming\5205775.exeMD5
52be91bb8576b57551f38cf98bd984cc
SHA1d4b25085ae85e7b4edc2db2f77e4108fd7345fc1
SHA2562eff8b37b39a5384bf9a3732bd7395af3430bd36eafdad4ba5cec6f707cdd680
SHA512f648be8d881ba47b87544327843add140cc4142ab7fac89cd87d3c79bed23524d7b40e35fd0c65a8c50a62c4e4f32d9a1681b3e043ea882bbfc46425891011b1
-
C:\Users\Admin\AppData\Roaming\8966467.exeMD5
0fe3680e0ce50557f4c272bb4872ec74
SHA15f2bbfa2ea1293524b72a2dbfe3954b6ba8f9f66
SHA256f9d67121048756158858a6c926af3db190e88df9eb052e99d8d6d93d7fcf1fd7
SHA512ffe63264322f1e9cad904d4d09069ca5d48e322a2a66e29fcdc6f53f4cd77000389e99f76ae6f86edc974a62f49243169c973be2f52cc33cdbe9a96d7dc5bcf7
-
C:\Users\Admin\AppData\Roaming\8966467.exeMD5
0fe3680e0ce50557f4c272bb4872ec74
SHA15f2bbfa2ea1293524b72a2dbfe3954b6ba8f9f66
SHA256f9d67121048756158858a6c926af3db190e88df9eb052e99d8d6d93d7fcf1fd7
SHA512ffe63264322f1e9cad904d4d09069ca5d48e322a2a66e29fcdc6f53f4cd77000389e99f76ae6f86edc974a62f49243169c973be2f52cc33cdbe9a96d7dc5bcf7
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exeMD5
0fe3680e0ce50557f4c272bb4872ec74
SHA15f2bbfa2ea1293524b72a2dbfe3954b6ba8f9f66
SHA256f9d67121048756158858a6c926af3db190e88df9eb052e99d8d6d93d7fcf1fd7
SHA512ffe63264322f1e9cad904d4d09069ca5d48e322a2a66e29fcdc6f53f4cd77000389e99f76ae6f86edc974a62f49243169c973be2f52cc33cdbe9a96d7dc5bcf7
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exeMD5
0fe3680e0ce50557f4c272bb4872ec74
SHA15f2bbfa2ea1293524b72a2dbfe3954b6ba8f9f66
SHA256f9d67121048756158858a6c926af3db190e88df9eb052e99d8d6d93d7fcf1fd7
SHA512ffe63264322f1e9cad904d4d09069ca5d48e322a2a66e29fcdc6f53f4cd77000389e99f76ae6f86edc974a62f49243169c973be2f52cc33cdbe9a96d7dc5bcf7
-
\Users\Admin\AppData\Roaming\WinHost\WinHoster.exeMD5
0fe3680e0ce50557f4c272bb4872ec74
SHA15f2bbfa2ea1293524b72a2dbfe3954b6ba8f9f66
SHA256f9d67121048756158858a6c926af3db190e88df9eb052e99d8d6d93d7fcf1fd7
SHA512ffe63264322f1e9cad904d4d09069ca5d48e322a2a66e29fcdc6f53f4cd77000389e99f76ae6f86edc974a62f49243169c973be2f52cc33cdbe9a96d7dc5bcf7
-
memory/916-98-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/916-92-0x00000000012F0000-0x00000000012F1000-memory.dmpFilesize
4KB
-
memory/916-89-0x0000000000000000-mapping.dmp
-
memory/968-86-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB
-
memory/968-83-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/968-70-0x0000000000000000-mapping.dmp
-
memory/968-85-0x0000000000360000-0x000000000036B000-memory.dmpFilesize
44KB
-
memory/968-78-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/1068-87-0x000000001AE90000-0x000000001AE92000-memory.dmpFilesize
8KB
-
memory/1068-71-0x0000000000350000-0x0000000000351000-memory.dmpFilesize
4KB
-
memory/1068-82-0x0000000000410000-0x0000000000411000-memory.dmpFilesize
4KB
-
memory/1068-65-0x0000000000000000-mapping.dmp
-
memory/1068-68-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/1068-79-0x0000000000360000-0x00000000003B0000-memory.dmpFilesize
320KB
-
memory/1172-74-0x0000000000000000-mapping.dmp
-
memory/1172-84-0x00000000003D0000-0x0000000000402000-memory.dmpFilesize
200KB
-
memory/1172-77-0x0000000001260000-0x0000000001261000-memory.dmpFilesize
4KB
-
memory/1172-97-0x0000000000520000-0x0000000000521000-memory.dmpFilesize
4KB
-
memory/1888-59-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/1888-64-0x000000001A6A0000-0x000000001A6A2000-memory.dmpFilesize
8KB
-
memory/1888-63-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/1888-62-0x0000000000290000-0x00000000002B3000-memory.dmpFilesize
140KB
-
memory/1888-61-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1964-99-0x0000000000000000-mapping.dmp
-
memory/1964-100-0x000007FEFB571000-0x000007FEFB573000-memory.dmpFilesize
8KB
-
memory/1964-101-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB