Analysis
-
max time kernel
136s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-09-2022 06:26
Static task
static1
Behavioral task
behavioral1
Sample
60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0.exe
Resource
win10v2004-20220901-en
General
-
Target
60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0.exe
-
Size
926KB
-
MD5
661a6a25cbdbec6543e74fae455e349a
-
SHA1
c5486f079370b7a0b2c1dbd170035ce25da8163e
-
SHA256
60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0
-
SHA512
b2514f2f29d73a41a4c26c81c1997dd3cd91258461b71da86e7cfe6f02d416cd13d11747be9b274a612b08544cd4389b7c2f0337a4a2b020d7c5e8babf51bb5b
-
SSDEEP
12288:taxffztFbbNiQoNS+2pvdNbbM3wBirlBQYg3fLLD:taxHzvwQoNS+q/bbswBirPQYgvD
Malware Config
Extracted
redline
mag21
jamesmillion.xyz:47481
-
auth_value
b5ecf039f4b13b472d3c95fc6fe41fc8
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 2 IoCs
Processes:
MinerStub.exeMinerStub.exepid process 4584 MinerStub.exe 3936 MinerStub.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0.exemg.exe.exeMinerStub.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation mg.exe.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation MinerStub.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
Processes:
MinerStub.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook MinerStub.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook MinerStub.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook MinerStub.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook MinerStub.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook MinerStub.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook MinerStub.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MinerStub.exe Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
mg.exe.exedescription pid process target process PID 1128 set thread context of 4440 1128 mg.exe.exe InstallUtil.exe -
Drops file in Program Files directory 1 IoCs
Processes:
mg.exe.exedescription ioc process File created C:\Program Files (x86)\Common Files\MinerStub.exe mg.exe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MinerStub.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier MinerStub.exe Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 MinerStub.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
mg.exe.exepowershell.exeInstallUtil.exeMinerStub.exepid process 1128 mg.exe.exe 1572 powershell.exe 1572 powershell.exe 1572 powershell.exe 4440 InstallUtil.exe 4440 InstallUtil.exe 3936 MinerStub.exe 3936 MinerStub.exe 3936 MinerStub.exe 3936 MinerStub.exe 3936 MinerStub.exe 3936 MinerStub.exe 3936 MinerStub.exe 3936 MinerStub.exe 3936 MinerStub.exe 3936 MinerStub.exe 3936 MinerStub.exe 3936 MinerStub.exe 3936 MinerStub.exe 3936 MinerStub.exe 3936 MinerStub.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0.exepid process 5028 60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0.exemg.exe.exeMinerStub.exepowershell.exeMinerStub.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 5028 60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0.exe Token: SeDebugPrivilege 1128 mg.exe.exe Token: SeDebugPrivilege 4584 MinerStub.exe Token: SeDebugPrivilege 1572 powershell.exe Token: SeDebugPrivilege 3936 MinerStub.exe Token: SeDebugPrivilege 4440 InstallUtil.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0.exemg.exe.exeMinerStub.exedescription pid process target process PID 5028 wrote to memory of 1128 5028 60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0.exe mg.exe.exe PID 5028 wrote to memory of 1128 5028 60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0.exe mg.exe.exe PID 5028 wrote to memory of 1128 5028 60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0.exe mg.exe.exe PID 1128 wrote to memory of 4584 1128 mg.exe.exe MinerStub.exe PID 1128 wrote to memory of 4584 1128 mg.exe.exe MinerStub.exe PID 1128 wrote to memory of 4440 1128 mg.exe.exe InstallUtil.exe PID 1128 wrote to memory of 4440 1128 mg.exe.exe InstallUtil.exe PID 1128 wrote to memory of 4440 1128 mg.exe.exe InstallUtil.exe PID 1128 wrote to memory of 4440 1128 mg.exe.exe InstallUtil.exe PID 1128 wrote to memory of 4440 1128 mg.exe.exe InstallUtil.exe PID 1128 wrote to memory of 4440 1128 mg.exe.exe InstallUtil.exe PID 1128 wrote to memory of 4440 1128 mg.exe.exe InstallUtil.exe PID 1128 wrote to memory of 4440 1128 mg.exe.exe InstallUtil.exe PID 4584 wrote to memory of 1572 4584 MinerStub.exe powershell.exe PID 4584 wrote to memory of 1572 4584 MinerStub.exe powershell.exe -
outlook_office_path 1 IoCs
Processes:
MinerStub.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe -
outlook_win_path 1 IoCs
Processes:
MinerStub.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MinerStub.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0.exe"C:\Users\Admin\AppData\Local\Temp\60c85fce1fbb2d9aaf9737335785e6c0c55b1e42a45394aa7c408b93f2b9bdf0.exe"1⤵
- Checks computer location settings
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mg.exe.exe"C:\Users\Admin\AppData\Local\Temp\mg.exe.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\MinerStub.exe"C:\Program Files (x86)\Common Files\MinerStub.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\MinerStub.exeC:\Users\Admin\AppData\Roaming\MinerStub.exe1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\MinerStub.exeFilesize
469KB
MD55df52a373daa1af07a403e3556ecc43c
SHA11791f75489f917078e3f15172efe1c3b214c5567
SHA2565173f34fd7d1451ef86933d79ea1f9bf7247f32044f30773350cfe3daaa99cf3
SHA512f7229502dea6a01dc5ecabcfd80512f27e1a6f581d5a95eb5ab9b84cfd3eb32bd3f7c0668e1932e397ddf8a8a35920520d5c4b120e8014d737dbe483a514e9af
-
C:\Program Files (x86)\Common Files\MinerStub.exeFilesize
469KB
MD55df52a373daa1af07a403e3556ecc43c
SHA11791f75489f917078e3f15172efe1c3b214c5567
SHA2565173f34fd7d1451ef86933d79ea1f9bf7247f32044f30773350cfe3daaa99cf3
SHA512f7229502dea6a01dc5ecabcfd80512f27e1a6f581d5a95eb5ab9b84cfd3eb32bd3f7c0668e1932e397ddf8a8a35920520d5c4b120e8014d737dbe483a514e9af
-
C:\Users\Admin\AppData\Roaming\MinerStub.exeFilesize
469KB
MD55df52a373daa1af07a403e3556ecc43c
SHA11791f75489f917078e3f15172efe1c3b214c5567
SHA2565173f34fd7d1451ef86933d79ea1f9bf7247f32044f30773350cfe3daaa99cf3
SHA512f7229502dea6a01dc5ecabcfd80512f27e1a6f581d5a95eb5ab9b84cfd3eb32bd3f7c0668e1932e397ddf8a8a35920520d5c4b120e8014d737dbe483a514e9af
-
C:\Users\Admin\AppData\Roaming\MinerStub.exeFilesize
469KB
MD55df52a373daa1af07a403e3556ecc43c
SHA11791f75489f917078e3f15172efe1c3b214c5567
SHA2565173f34fd7d1451ef86933d79ea1f9bf7247f32044f30773350cfe3daaa99cf3
SHA512f7229502dea6a01dc5ecabcfd80512f27e1a6f581d5a95eb5ab9b84cfd3eb32bd3f7c0668e1932e397ddf8a8a35920520d5c4b120e8014d737dbe483a514e9af
-
memory/1128-138-0x0000000000000000-mapping.dmp
-
memory/1572-148-0x00007FFF3AD40000-0x00007FFF3B801000-memory.dmpFilesize
10.8MB
-
memory/1572-146-0x0000000000000000-mapping.dmp
-
memory/1572-153-0x00007FFF3AD40000-0x00007FFF3B801000-memory.dmpFilesize
10.8MB
-
memory/1572-147-0x000001DD2CA60000-0x000001DD2CA82000-memory.dmpFilesize
136KB
-
memory/3936-152-0x00007FFF3AD40000-0x00007FFF3B801000-memory.dmpFilesize
10.8MB
-
memory/3936-154-0x00007FFF3AD40000-0x00007FFF3B801000-memory.dmpFilesize
10.8MB
-
memory/4440-161-0x0000000007720000-0x0000000007796000-memory.dmpFilesize
472KB
-
memory/4440-160-0x00000000054C0000-0x0000000005526000-memory.dmpFilesize
408KB
-
memory/4440-159-0x0000000005130000-0x000000000516C000-memory.dmpFilesize
240KB
-
memory/4440-143-0x0000000000000000-mapping.dmp
-
memory/4440-162-0x00000000064F0000-0x000000000650E000-memory.dmpFilesize
120KB
-
memory/4440-158-0x0000000005200000-0x000000000530A000-memory.dmpFilesize
1.0MB
-
memory/4440-157-0x00000000050D0000-0x00000000050E2000-memory.dmpFilesize
72KB
-
memory/4440-156-0x0000000005670000-0x0000000005C88000-memory.dmpFilesize
6.1MB
-
memory/4440-155-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/4440-163-0x0000000007970000-0x0000000007B32000-memory.dmpFilesize
1.8MB
-
memory/4440-164-0x0000000000FC0000-0x0000000001010000-memory.dmpFilesize
320KB
-
memory/4584-144-0x00007FFF3AD40000-0x00007FFF3B801000-memory.dmpFilesize
10.8MB
-
memory/4584-151-0x00007FFF3AD40000-0x00007FFF3B801000-memory.dmpFilesize
10.8MB
-
memory/4584-145-0x00007FFF3AD40000-0x00007FFF3B801000-memory.dmpFilesize
10.8MB
-
memory/4584-142-0x0000000000F50000-0x0000000000FC8000-memory.dmpFilesize
480KB
-
memory/4584-139-0x0000000000000000-mapping.dmp
-
memory/5028-133-0x0000000005930000-0x0000000005ED4000-memory.dmpFilesize
5.6MB
-
memory/5028-134-0x0000000005260000-0x00000000052FC000-memory.dmpFilesize
624KB
-
memory/5028-132-0x0000000000D00000-0x0000000000DEE000-memory.dmpFilesize
952KB
-
memory/5028-137-0x000000001D210000-0x000000001D73C000-memory.dmpFilesize
5.2MB
-
memory/5028-135-0x0000000006A50000-0x0000000006AE2000-memory.dmpFilesize
584KB
-
memory/5028-136-0x0000000005900000-0x000000000590A000-memory.dmpFilesize
40KB