Analysis
-
max time kernel
623s -
max time network
1558s -
platform
windows11_x64 -
resource
win11 -
submitted
22-10-2021 14:39
Static task
static1
Behavioral task
behavioral1
Sample
keygen-step-4.exe
Resource
win7-ja-20211014
Behavioral task
behavioral2
Sample
keygen-step-4.exe
Resource
win7-en-20211014
Behavioral task
behavioral3
Sample
keygen-step-4.exe
Resource
win7-de-20211014
Behavioral task
behavioral4
Sample
keygen-step-4.exe
Resource
win11
Behavioral task
behavioral5
Sample
keygen-step-4.exe
Resource
win10-ja-20211014
Behavioral task
behavioral6
Sample
keygen-step-4.exe
Resource
win10-en-20210920
Behavioral task
behavioral7
Sample
keygen-step-4.exe
Resource
win10-de-20210920
General
-
Target
keygen-step-4.exe
-
Size
4.2MB
-
MD5
00ebc043e56f9f084116b06bdda236af
-
SHA1
5cd4266a7b4500f3c9bfa5174b535d52361167ed
-
SHA256
f6e16a4200c3510b4a0ddc031240495d36e9c1d47160e488606f0978e9bb0422
-
SHA512
03d5c4d62c09b18259d42168284b72eecb874e5ec12063edfb54637a833c376b0ab788fc20474f21969e674f29e135498aa46ddf1b62ef6f06c506037543ee67
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral4/memory/3512-170-0x0000000000000000-mapping.dmp family_redline behavioral4/memory/3512-171-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
KiffAppE2.exePlsWnEU2.exePlsWnEU2.exepid process 1944 KiffAppE2.exe 2848 PlsWnEU2.exe 3512 PlsWnEU2.exe -
Sets service image path in registry 2 TTPs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PlsWnEU2.exedescription pid process target process PID 2848 set thread context of 3512 2848 PlsWnEU2.exe PlsWnEU2.exe -
Drops file in Windows directory 6 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
svchost.exeWaaSMedicAgent.exeWaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
svchost.exesvchost.exeKiffAppE2.exeWaaSMedicAgent.exePlsWnEU2.exedescription pid process Token: SeShutdownPrivilege 4524 svchost.exe Token: SeCreatePagefilePrivilege 4524 svchost.exe Token: SeShutdownPrivilege 4524 svchost.exe Token: SeCreatePagefilePrivilege 4524 svchost.exe Token: SeShutdownPrivilege 4524 svchost.exe Token: SeCreatePagefilePrivilege 4524 svchost.exe Token: SeShutdownPrivilege 2112 svchost.exe Token: SeCreatePagefilePrivilege 2112 svchost.exe Token: SeDebugPrivilege 1944 KiffAppE2.exe Token: SeTakeOwnershipPrivilege 4636 WaaSMedicAgent.exe Token: SeSecurityPrivilege 4636 WaaSMedicAgent.exe Token: SeRestorePrivilege 4636 WaaSMedicAgent.exe Token: SeBackupPrivilege 4636 WaaSMedicAgent.exe Token: SeShutdownPrivilege 4524 svchost.exe Token: SeCreatePagefilePrivilege 4524 svchost.exe Token: SeDebugPrivilege 3512 PlsWnEU2.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
keygen-step-4.exesvchost.exeKiffAppE2.exePlsWnEU2.exedescription pid process target process PID 4232 wrote to memory of 1944 4232 keygen-step-4.exe KiffAppE2.exe PID 4232 wrote to memory of 1944 4232 keygen-step-4.exe KiffAppE2.exe PID 2112 wrote to memory of 3712 2112 svchost.exe MoUsoCoreWorker.exe PID 2112 wrote to memory of 3712 2112 svchost.exe MoUsoCoreWorker.exe PID 1944 wrote to memory of 2848 1944 KiffAppE2.exe PlsWnEU2.exe PID 1944 wrote to memory of 2848 1944 KiffAppE2.exe PlsWnEU2.exe PID 1944 wrote to memory of 2848 1944 KiffAppE2.exe PlsWnEU2.exe PID 2848 wrote to memory of 3512 2848 PlsWnEU2.exe PlsWnEU2.exe PID 2848 wrote to memory of 3512 2848 PlsWnEU2.exe PlsWnEU2.exe PID 2848 wrote to memory of 3512 2848 PlsWnEU2.exe PlsWnEU2.exe PID 2848 wrote to memory of 3512 2848 PlsWnEU2.exe PlsWnEU2.exe PID 2848 wrote to memory of 3512 2848 PlsWnEU2.exe PlsWnEU2.exe PID 2848 wrote to memory of 3512 2848 PlsWnEU2.exe PlsWnEU2.exe PID 2848 wrote to memory of 3512 2848 PlsWnEU2.exe PlsWnEU2.exe PID 2848 wrote to memory of 3512 2848 PlsWnEU2.exe PlsWnEU2.exe PID 2112 wrote to memory of 2152 2112 svchost.exe MoUsoCoreWorker.exe PID 2112 wrote to memory of 2152 2112 svchost.exe MoUsoCoreWorker.exe
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KiffAppE2.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\KiffAppE2.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\PlsWnEU2.exe"C:\Users\Admin\Documents\PlsWnEU2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\PlsWnEU2.exeC:\Users\Admin\Documents\PlsWnEU2.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 65b1aa8d918c8d3f168629fc61765ea5 OzaWr/uu6kO2F/1/svXlhA.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\uus\AMD64\MoUsoCoreWorker.exeC:\Windows\uus\AMD64\MoUsoCoreWorker.exe2⤵
-
C:\Windows\uus\AMD64\MoUsoCoreWorker.exeC:\Windows\uus\AMD64\MoUsoCoreWorker.exe2⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 65b1aa8d918c8d3f168629fc61765ea5 OzaWr/uu6kO2F/1/svXlhA.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PlsWnEU2.exe.logMD5
e07da89fc7e325db9d25e845e27027a8
SHA14b6a03bcdb46f325984cbbb6302ff79f33637e19
SHA25694ab73c00494d10a2159175b81e23047621451e3a566e5a0b1222379db634aaf
SHA5121e33e34595ebb6ce129d0244199d29722c916c036da542c3001f84b10a964b96cec7a9fdd19e120d7840614b307b504be993a4f8538d54382aa4944575476dda
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KiffAppE2.exeMD5
6a9bf2c46a15d1fc9142e16aed31e8dd
SHA1802024dc5b3b37d123dfaa05f2b3c19e82f1f83f
SHA256fa9a091c09bb374ef72215fba163e3dd7b77ee4c9720eea92795786a359b9abb
SHA512c563d2426d4db24c988801fedd252b425b291ad6b90540f1d6e78d9d8276a9726e93d06dc57a7ed183589ce531578e480ac544b331b1cd06946afaaa1cddff85
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\KiffAppE2.exeMD5
6a9bf2c46a15d1fc9142e16aed31e8dd
SHA1802024dc5b3b37d123dfaa05f2b3c19e82f1f83f
SHA256fa9a091c09bb374ef72215fba163e3dd7b77ee4c9720eea92795786a359b9abb
SHA512c563d2426d4db24c988801fedd252b425b291ad6b90540f1d6e78d9d8276a9726e93d06dc57a7ed183589ce531578e480ac544b331b1cd06946afaaa1cddff85
-
C:\Users\Admin\Documents\PlsWnEU2.exeMD5
00160e8ca109521d28a89daa08cc2cae
SHA13569f50e6a2fc500b4a7ee8c0e1a446d9766afa1
SHA256d2e3a00472e772e4509e221ad732f3de0e0fb3fe4f788552e5f5382b1306b11e
SHA5121b1ea39d615774935be107000f4d61b64f3a9760bad70f04dfd580a7e8ab6209ca3b8b55a250d89845fa8206b02c78187ea4613506a2634c56be27f1a4e3b309
-
C:\Users\Admin\Documents\PlsWnEU2.exeMD5
00160e8ca109521d28a89daa08cc2cae
SHA13569f50e6a2fc500b4a7ee8c0e1a446d9766afa1
SHA256d2e3a00472e772e4509e221ad732f3de0e0fb3fe4f788552e5f5382b1306b11e
SHA5121b1ea39d615774935be107000f4d61b64f3a9760bad70f04dfd580a7e8ab6209ca3b8b55a250d89845fa8206b02c78187ea4613506a2634c56be27f1a4e3b309
-
C:\Users\Admin\Documents\PlsWnEU2.exeMD5
00160e8ca109521d28a89daa08cc2cae
SHA13569f50e6a2fc500b4a7ee8c0e1a446d9766afa1
SHA256d2e3a00472e772e4509e221ad732f3de0e0fb3fe4f788552e5f5382b1306b11e
SHA5121b1ea39d615774935be107000f4d61b64f3a9760bad70f04dfd580a7e8ab6209ca3b8b55a250d89845fa8206b02c78187ea4613506a2634c56be27f1a4e3b309
-
memory/1944-167-0x0000000002934000-0x0000000002935000-memory.dmpFilesize
4KB
-
memory/1944-155-0x0000000000620000-0x0000000000621000-memory.dmpFilesize
4KB
-
memory/1944-157-0x0000000002930000-0x0000000002932000-memory.dmpFilesize
8KB
-
memory/1944-151-0x0000000000000000-mapping.dmp
-
memory/1944-165-0x0000000002932000-0x0000000002934000-memory.dmpFilesize
8KB
-
memory/1944-166-0x0000000002935000-0x0000000002937000-memory.dmpFilesize
8KB
-
memory/2152-193-0x0000000000000000-mapping.dmp
-
memory/2848-169-0x0000000005AA0000-0x0000000005AA1000-memory.dmpFilesize
4KB
-
memory/2848-158-0x0000000000000000-mapping.dmp
-
memory/2848-168-0x00000000054E0000-0x00000000054E1000-memory.dmpFilesize
4KB
-
memory/2848-161-0x00000000007D0000-0x00000000007D1000-memory.dmpFilesize
4KB
-
memory/2848-163-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/2848-164-0x0000000002DA0000-0x0000000002DA1000-memory.dmpFilesize
4KB
-
memory/3512-170-0x0000000000000000-mapping.dmp
-
memory/3512-182-0x00000000058D0000-0x00000000058D1000-memory.dmpFilesize
4KB
-
memory/3512-191-0x0000000007D00000-0x0000000007D01000-memory.dmpFilesize
4KB
-
memory/3512-190-0x00000000084C0000-0x00000000084C1000-memory.dmpFilesize
4KB
-
memory/3512-171-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3512-189-0x0000000007DC0000-0x0000000007DC1000-memory.dmpFilesize
4KB
-
memory/3512-175-0x0000000005AF0000-0x0000000005AF1000-memory.dmpFilesize
4KB
-
memory/3512-176-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/3512-177-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/3512-178-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/3512-179-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/3512-180-0x0000000006110000-0x0000000006111000-memory.dmpFilesize
4KB
-
memory/3512-181-0x0000000005860000-0x0000000005861000-memory.dmpFilesize
4KB
-
memory/3512-188-0x00000000073E0000-0x00000000073E1000-memory.dmpFilesize
4KB
-
memory/3512-183-0x00000000054D0000-0x0000000005AE8000-memory.dmpFilesize
6.1MB
-
memory/3512-185-0x0000000006FF0000-0x0000000006FF1000-memory.dmpFilesize
4KB
-
memory/3712-152-0x0000000000000000-mapping.dmp
-
memory/4232-146-0x0000000002FA0000-0x0000000002FA1000-memory.dmpFilesize
4KB
-
memory/4232-147-0x0000000002FA0000-0x0000000002FA1000-memory.dmpFilesize
4KB
-
memory/4524-149-0x0000018DEF0A0000-0x0000018DEF0B0000-memory.dmpFilesize
64KB
-
memory/4524-150-0x0000018DF17B0000-0x0000018DF17B4000-memory.dmpFilesize
16KB
-
memory/4524-148-0x0000018DEF020000-0x0000018DEF030000-memory.dmpFilesize
64KB
-
memory/4524-194-0x0000018DF17D0000-0x0000018DF17D4000-memory.dmpFilesize
16KB
-
memory/4524-195-0x0000018DF16F0000-0x0000018DF16F1000-memory.dmpFilesize
4KB
-
memory/4524-197-0x0000018DF16B0000-0x0000018DF16B1000-memory.dmpFilesize
4KB