Analysis
-
max time kernel
200s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16-05-2022 13:53
Static task
static1
Behavioral task
behavioral1
Sample
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe
Resource
win7-20220414-en
General
-
Target
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe
-
Size
383KB
-
MD5
56d9df4afbbaee34afb646e85fb4419d
-
SHA1
0ad215a57d93b70fa3a137060f5f5a3369d4f542
-
SHA256
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
-
SHA512
1178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
Malware Config
Extracted
amadey
3.08
179.43.154.147/d2VxjasuwS/index.php
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 6 668 rundll32.exe -
Executes dropped EXE 5 IoCs
Processes:
ftewk.exeProcessChecke.exeftewk.exeSETUP_~1.EXEftewk.exepid process 1248 ftewk.exe 1768 ProcessChecke.exe 1424 ftewk.exe 940 SETUP_~1.EXE 1348 ftewk.exe -
Loads dropped DLL 7 IoCs
Processes:
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exeftewk.exerundll32.exepid process 1556 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe 1556 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe 1248 ftewk.exe 668 rundll32.exe 668 rundll32.exe 668 rundll32.exe 668 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
ftewk.exeProcessChecke.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ftewk.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce ProcessChecke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ProcessChecke.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 7 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 1536 timeout.exe 1256 timeout.exe 1320 timeout.exe 888 timeout.exe 1304 timeout.exe 1456 timeout.exe 1424 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 668 rundll32.exe 668 rundll32.exe 668 rundll32.exe 668 rundll32.exe -
Suspicious use of WriteProcessMemory 58 IoCs
Processes:
87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exeftewk.execmd.exetaskeng.exeProcessChecke.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1556 wrote to memory of 1248 1556 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe ftewk.exe PID 1556 wrote to memory of 1248 1556 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe ftewk.exe PID 1556 wrote to memory of 1248 1556 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe ftewk.exe PID 1556 wrote to memory of 1248 1556 87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe ftewk.exe PID 1248 wrote to memory of 932 1248 ftewk.exe cmd.exe PID 1248 wrote to memory of 932 1248 ftewk.exe cmd.exe PID 1248 wrote to memory of 932 1248 ftewk.exe cmd.exe PID 1248 wrote to memory of 932 1248 ftewk.exe cmd.exe PID 1248 wrote to memory of 1044 1248 ftewk.exe schtasks.exe PID 1248 wrote to memory of 1044 1248 ftewk.exe schtasks.exe PID 1248 wrote to memory of 1044 1248 ftewk.exe schtasks.exe PID 1248 wrote to memory of 1044 1248 ftewk.exe schtasks.exe PID 932 wrote to memory of 1708 932 cmd.exe reg.exe PID 932 wrote to memory of 1708 932 cmd.exe reg.exe PID 932 wrote to memory of 1708 932 cmd.exe reg.exe PID 932 wrote to memory of 1708 932 cmd.exe reg.exe PID 1248 wrote to memory of 1768 1248 ftewk.exe ProcessChecke.exe PID 1248 wrote to memory of 1768 1248 ftewk.exe ProcessChecke.exe PID 1248 wrote to memory of 1768 1248 ftewk.exe ProcessChecke.exe PID 1248 wrote to memory of 1768 1248 ftewk.exe ProcessChecke.exe PID 548 wrote to memory of 1424 548 taskeng.exe ftewk.exe PID 548 wrote to memory of 1424 548 taskeng.exe ftewk.exe PID 548 wrote to memory of 1424 548 taskeng.exe ftewk.exe PID 548 wrote to memory of 1424 548 taskeng.exe ftewk.exe PID 1248 wrote to memory of 668 1248 ftewk.exe rundll32.exe PID 1248 wrote to memory of 668 1248 ftewk.exe rundll32.exe PID 1248 wrote to memory of 668 1248 ftewk.exe rundll32.exe PID 1248 wrote to memory of 668 1248 ftewk.exe rundll32.exe PID 1248 wrote to memory of 668 1248 ftewk.exe rundll32.exe PID 1248 wrote to memory of 668 1248 ftewk.exe rundll32.exe PID 1248 wrote to memory of 668 1248 ftewk.exe rundll32.exe PID 1768 wrote to memory of 940 1768 ProcessChecke.exe SETUP_~1.EXE PID 1768 wrote to memory of 940 1768 ProcessChecke.exe SETUP_~1.EXE PID 1768 wrote to memory of 940 1768 ProcessChecke.exe SETUP_~1.EXE PID 1768 wrote to memory of 940 1768 ProcessChecke.exe SETUP_~1.EXE PID 1768 wrote to memory of 940 1768 ProcessChecke.exe SETUP_~1.EXE PID 1768 wrote to memory of 940 1768 ProcessChecke.exe SETUP_~1.EXE PID 1768 wrote to memory of 940 1768 ProcessChecke.exe SETUP_~1.EXE PID 1588 wrote to memory of 1536 1588 cmd.exe timeout.exe PID 1588 wrote to memory of 1536 1588 cmd.exe timeout.exe PID 1588 wrote to memory of 1536 1588 cmd.exe timeout.exe PID 1588 wrote to memory of 1536 1588 cmd.exe timeout.exe PID 1936 wrote to memory of 1256 1936 cmd.exe timeout.exe PID 1936 wrote to memory of 1256 1936 cmd.exe timeout.exe PID 1936 wrote to memory of 1256 1936 cmd.exe timeout.exe PID 1936 wrote to memory of 1256 1936 cmd.exe timeout.exe PID 2032 wrote to memory of 1320 2032 cmd.exe timeout.exe PID 2032 wrote to memory of 1320 2032 cmd.exe timeout.exe PID 2032 wrote to memory of 1320 2032 cmd.exe timeout.exe PID 2032 wrote to memory of 1320 2032 cmd.exe timeout.exe PID 548 wrote to memory of 1348 548 taskeng.exe ftewk.exe PID 548 wrote to memory of 1348 548 taskeng.exe ftewk.exe PID 548 wrote to memory of 1348 548 taskeng.exe ftewk.exe PID 548 wrote to memory of 1348 548 taskeng.exe ftewk.exe PID 584 wrote to memory of 888 584 cmd.exe timeout.exe PID 584 wrote to memory of 888 584 cmd.exe timeout.exe PID 584 wrote to memory of 888 584 cmd.exe timeout.exe PID 584 wrote to memory of 888 584 cmd.exe timeout.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe"C:\Users\Admin\AppData\Local\Temp\87995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe"C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\3⤵
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\4⤵PID:1708
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN ftewk.exe /TR "C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe" /F3⤵
- Creates scheduled task(s)
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\1000165001\ProcessChecke.exe"C:\Users\Admin\AppData\Local\Temp\1000165001\ProcessChecke.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE4⤵
- Executes dropped EXE
PID:940 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 15⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\timeout.exetimeout /t 16⤵
- Delays execution with timeout.exe
PID:1536 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 15⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\timeout.exetimeout /t 16⤵
- Delays execution with timeout.exe
PID:1256 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 15⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\timeout.exetimeout /t 16⤵
- Delays execution with timeout.exe
PID:1320 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 15⤵
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\SysWOW64\timeout.exetimeout /t 16⤵
- Delays execution with timeout.exe
PID:888 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 15⤵PID:284
-
C:\Windows\SysWOW64\timeout.exetimeout /t 16⤵
- Delays execution with timeout.exe
PID:1304 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 15⤵PID:1508
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 15⤵PID:564
-
C:\Windows\SysWOW64\timeout.exetimeout /t 16⤵
- Delays execution with timeout.exe
PID:1424 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
PID:668
-
C:\Windows\system32\taskeng.exetaskeng.exe {1B94EE37-C934-4469-A7A6-005F412D5FDA} S-1-5-21-1083475884-596052423-1669053738-1000:WYZSGDWS\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeC:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe2⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeC:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exe2⤵
- Executes dropped EXE
PID:1348
-
C:\Windows\SysWOW64\timeout.exetimeout /t 11⤵
- Delays execution with timeout.exe
PID:1456
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000165001\ProcessChecke.exeFilesize
653KB
MD5996965601a53e187e80c41751f27636d
SHA10874ade44f2fae85e9b20f297b22bf7816b0f835
SHA25628a92195b78c6bd55062acb3a53139bf1d763ae043c616c57c97ff625b80f4f8
SHA512d0d4b1847418ec1742710b13d44b41df899562526a2b3970ec43b6e21b419a7edb5da07b1f586936a9890c340e28a9fcc9eca19a12df6a59183e7a017bc81947
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
C:\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
47.9MB
MD59deea3ca6aa5f9a047d2bf7820397357
SHA1d8860cd96f044d9cfb2c7ecc6a84f3d064cf35fc
SHA256e645dc7a8d3b41302c9c088f88c60d25e39132cd015700c58e23caca1b9d2722
SHA512d581f291643fc192768adedb15c0b25ee7b8debd29cf83ac5ac305a5cef1dda6ec63a53d22712fcdc11e9360da0a0fcdf5159952f585e6ffa6f25aaf3fe10169
-
C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dllFilesize
126KB
MD5b74b2173abbc5a72d47143c1ba62c97c
SHA1b8d17f4f90fbc3b1347c12caf844354b65184735
SHA2568dce72063ff6c2ec939aafe4dc0e247cec27fae82cde7886fda902cc8cd0aa75
SHA512ab73dcb86ae46e7d13d64151e5da9fd4548eccbc9b80ebf32c7de6152f25cbeba64dc3993f4431cb85aa3813cd406d18ea625ec2d92142f0eb295e2ad6ebf6ac
-
\Users\Admin\AppData\Local\Temp\1000165001\ProcessChecke.exeFilesize
653KB
MD5996965601a53e187e80c41751f27636d
SHA10874ade44f2fae85e9b20f297b22bf7816b0f835
SHA25628a92195b78c6bd55062acb3a53139bf1d763ae043c616c57c97ff625b80f4f8
SHA512d0d4b1847418ec1742710b13d44b41df899562526a2b3970ec43b6e21b419a7edb5da07b1f586936a9890c340e28a9fcc9eca19a12df6a59183e7a017bc81947
-
\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
\Users\Admin\AppData\Local\Temp\9d5cca72fb\ftewk.exeFilesize
383KB
MD556d9df4afbbaee34afb646e85fb4419d
SHA10ad215a57d93b70fa3a137060f5f5a3369d4f542
SHA25687995a05b25f0dfbc564f2392434c6f66792cdf5690703bffa5797e1c3d5719c
SHA5121178e68a8ebf530fa71bfe4b63543ea486555b3badfcc144d48920eafbf1f89bfd4a73ea5b04e09f8f9858e6748ae3e25db0c03332939be51131794313e59d31
-
\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dllFilesize
126KB
MD5b74b2173abbc5a72d47143c1ba62c97c
SHA1b8d17f4f90fbc3b1347c12caf844354b65184735
SHA2568dce72063ff6c2ec939aafe4dc0e247cec27fae82cde7886fda902cc8cd0aa75
SHA512ab73dcb86ae46e7d13d64151e5da9fd4548eccbc9b80ebf32c7de6152f25cbeba64dc3993f4431cb85aa3813cd406d18ea625ec2d92142f0eb295e2ad6ebf6ac
-
\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dllFilesize
126KB
MD5b74b2173abbc5a72d47143c1ba62c97c
SHA1b8d17f4f90fbc3b1347c12caf844354b65184735
SHA2568dce72063ff6c2ec939aafe4dc0e247cec27fae82cde7886fda902cc8cd0aa75
SHA512ab73dcb86ae46e7d13d64151e5da9fd4548eccbc9b80ebf32c7de6152f25cbeba64dc3993f4431cb85aa3813cd406d18ea625ec2d92142f0eb295e2ad6ebf6ac
-
\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dllFilesize
126KB
MD5b74b2173abbc5a72d47143c1ba62c97c
SHA1b8d17f4f90fbc3b1347c12caf844354b65184735
SHA2568dce72063ff6c2ec939aafe4dc0e247cec27fae82cde7886fda902cc8cd0aa75
SHA512ab73dcb86ae46e7d13d64151e5da9fd4548eccbc9b80ebf32c7de6152f25cbeba64dc3993f4431cb85aa3813cd406d18ea625ec2d92142f0eb295e2ad6ebf6ac
-
\Users\Admin\AppData\Roaming\465dbc52837d81\cred.dllFilesize
126KB
MD5b74b2173abbc5a72d47143c1ba62c97c
SHA1b8d17f4f90fbc3b1347c12caf844354b65184735
SHA2568dce72063ff6c2ec939aafe4dc0e247cec27fae82cde7886fda902cc8cd0aa75
SHA512ab73dcb86ae46e7d13d64151e5da9fd4548eccbc9b80ebf32c7de6152f25cbeba64dc3993f4431cb85aa3813cd406d18ea625ec2d92142f0eb295e2ad6ebf6ac
-
memory/668-81-0x0000000000270000-0x0000000000294000-memory.dmpFilesize
144KB
-
memory/668-74-0x0000000000000000-mapping.dmp
-
memory/888-92-0x0000000000000000-mapping.dmp
-
memory/932-65-0x0000000000000000-mapping.dmp
-
memory/940-85-0x0000000000000000-mapping.dmp
-
memory/1044-66-0x0000000000000000-mapping.dmp
-
memory/1248-63-0x00000000005CE000-0x00000000005EC000-memory.dmpFilesize
120KB
-
memory/1248-64-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1248-60-0x0000000000000000-mapping.dmp
-
memory/1256-88-0x0000000000000000-mapping.dmp
-
memory/1304-93-0x0000000000000000-mapping.dmp
-
memory/1320-89-0x0000000000000000-mapping.dmp
-
memory/1348-96-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1348-95-0x000000000064E000-0x000000000066C000-memory.dmpFilesize
120KB
-
memory/1348-90-0x0000000000000000-mapping.dmp
-
memory/1424-72-0x0000000000000000-mapping.dmp
-
memory/1424-98-0x0000000000000000-mapping.dmp
-
memory/1424-83-0x000000000057E000-0x000000000059C000-memory.dmpFilesize
120KB
-
memory/1424-84-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1456-97-0x0000000000000000-mapping.dmp
-
memory/1536-87-0x0000000000000000-mapping.dmp
-
memory/1556-57-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/1556-56-0x0000000000290000-0x00000000002C8000-memory.dmpFilesize
224KB
-
memory/1556-54-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/1556-55-0x000000000030E000-0x000000000032C000-memory.dmpFilesize
120KB
-
memory/1708-67-0x0000000000000000-mapping.dmp
-
memory/1768-69-0x0000000000000000-mapping.dmp