Analysis
-
max time kernel
125s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
24-11-2022 00:01
Static task
static1
Behavioral task
behavioral1
Sample
f2b85e58fdb90c1d844dbec89ef55b2f881d617a7ab2c9bf7763581c9a4d2be2.exe
Resource
win10-20220812-en
General
-
Target
f2b85e58fdb90c1d844dbec89ef55b2f881d617a7ab2c9bf7763581c9a4d2be2.exe
-
Size
244KB
-
MD5
2e795a9e52afa69f803f2bb1201b8a36
-
SHA1
269af084a0dcb713e70d603bca106023e742cf09
-
SHA256
f2b85e58fdb90c1d844dbec89ef55b2f881d617a7ab2c9bf7763581c9a4d2be2
-
SHA512
a80ab9d7504c3715292db9058c7cf2f22d0f46938d19a3ff49cd7fa1d3a515b5248a6e45e7771fa1a9262c5a8e036f685335e914c22a33642005f5a5af129672
-
SSDEEP
6144:hXOhLM4GbDkfXtdWmqfWmDKSLzjP88N42YL:hXkVGbD2dwfBKb
Malware Config
Extracted
amadey
3.50
193.56.146.174/g84kvj4jck/index.php
185.246.221.126/i4kvjd3xc/index.php
Extracted
redline
@REDLINEVIP Cloud (TG: @FATHEROFCARDERS)
151.80.89.233:13553
-
auth_value
fbee175162920530e6bf470c8003fa1a
Extracted
netwire
alice2019.myftp.biz:3360
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
Fs_Spread_0001
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000206001\Stub1.exe netwire C:\Users\Admin\AppData\Local\Temp\1000206001\Stub1.exe netwire -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000199001\40Kdfdf.exe family_redline C:\Users\Admin\AppData\Local\Temp\1000199001\40Kdfdf.exe family_redline behavioral1/memory/3608-360-0x0000000000740000-0x0000000000768000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 9 IoCs
Processes:
rovwer.exe40Kdfdf.exestub.exegntuud.exeStub1.exegntuud.exerovwer.exegntuud.exerovwer.exepid process 4556 rovwer.exe 3608 40Kdfdf.exe 508 stub.exe 3872 gntuud.exe 3360 Stub1.exe 4472 gntuud.exe 700 rovwer.exe 4940 gntuud.exe 4780 rovwer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
rovwer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\40Kdfdf.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000199001\\40Kdfdf.exe" rovwer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\stub.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000205000\\stub.exe" rovwer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\Stub1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000206001\\Stub1.exe" rovwer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4004 schtasks.exe 5076 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
40Kdfdf.exepid process 3608 40Kdfdf.exe 3608 40Kdfdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
40Kdfdf.exedescription pid process Token: SeDebugPrivilege 3608 40Kdfdf.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
f2b85e58fdb90c1d844dbec89ef55b2f881d617a7ab2c9bf7763581c9a4d2be2.exerovwer.execmd.exestub.exegntuud.exedescription pid process target process PID 1524 wrote to memory of 4556 1524 f2b85e58fdb90c1d844dbec89ef55b2f881d617a7ab2c9bf7763581c9a4d2be2.exe rovwer.exe PID 1524 wrote to memory of 4556 1524 f2b85e58fdb90c1d844dbec89ef55b2f881d617a7ab2c9bf7763581c9a4d2be2.exe rovwer.exe PID 1524 wrote to memory of 4556 1524 f2b85e58fdb90c1d844dbec89ef55b2f881d617a7ab2c9bf7763581c9a4d2be2.exe rovwer.exe PID 4556 wrote to memory of 4004 4556 rovwer.exe schtasks.exe PID 4556 wrote to memory of 4004 4556 rovwer.exe schtasks.exe PID 4556 wrote to memory of 4004 4556 rovwer.exe schtasks.exe PID 4556 wrote to memory of 3916 4556 rovwer.exe cmd.exe PID 4556 wrote to memory of 3916 4556 rovwer.exe cmd.exe PID 4556 wrote to memory of 3916 4556 rovwer.exe cmd.exe PID 3916 wrote to memory of 4260 3916 cmd.exe cmd.exe PID 3916 wrote to memory of 4260 3916 cmd.exe cmd.exe PID 3916 wrote to memory of 4260 3916 cmd.exe cmd.exe PID 3916 wrote to memory of 4144 3916 cmd.exe cacls.exe PID 3916 wrote to memory of 4144 3916 cmd.exe cacls.exe PID 3916 wrote to memory of 4144 3916 cmd.exe cacls.exe PID 3916 wrote to memory of 4528 3916 cmd.exe cacls.exe PID 3916 wrote to memory of 4528 3916 cmd.exe cacls.exe PID 3916 wrote to memory of 4528 3916 cmd.exe cacls.exe PID 3916 wrote to memory of 4944 3916 cmd.exe cmd.exe PID 3916 wrote to memory of 4944 3916 cmd.exe cmd.exe PID 3916 wrote to memory of 4944 3916 cmd.exe cmd.exe PID 3916 wrote to memory of 3192 3916 cmd.exe cacls.exe PID 3916 wrote to memory of 3192 3916 cmd.exe cacls.exe PID 3916 wrote to memory of 3192 3916 cmd.exe cacls.exe PID 4556 wrote to memory of 3608 4556 rovwer.exe 40Kdfdf.exe PID 4556 wrote to memory of 3608 4556 rovwer.exe 40Kdfdf.exe PID 4556 wrote to memory of 3608 4556 rovwer.exe 40Kdfdf.exe PID 3916 wrote to memory of 4492 3916 cmd.exe cacls.exe PID 3916 wrote to memory of 4492 3916 cmd.exe cacls.exe PID 3916 wrote to memory of 4492 3916 cmd.exe cacls.exe PID 4556 wrote to memory of 508 4556 rovwer.exe stub.exe PID 4556 wrote to memory of 508 4556 rovwer.exe stub.exe PID 4556 wrote to memory of 508 4556 rovwer.exe stub.exe PID 508 wrote to memory of 3872 508 stub.exe gntuud.exe PID 508 wrote to memory of 3872 508 stub.exe gntuud.exe PID 508 wrote to memory of 3872 508 stub.exe gntuud.exe PID 3872 wrote to memory of 5076 3872 gntuud.exe schtasks.exe PID 3872 wrote to memory of 5076 3872 gntuud.exe schtasks.exe PID 3872 wrote to memory of 5076 3872 gntuud.exe schtasks.exe PID 4556 wrote to memory of 3360 4556 rovwer.exe Stub1.exe PID 4556 wrote to memory of 3360 4556 rovwer.exe Stub1.exe PID 4556 wrote to memory of 3360 4556 rovwer.exe Stub1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2b85e58fdb90c1d844dbec89ef55b2f881d617a7ab2c9bf7763581c9a4d2be2.exe"C:\Users\Admin\AppData\Local\Temp\f2b85e58fdb90c1d844dbec89ef55b2f881d617a7ab2c9bf7763581c9a4d2be2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe" /F3⤵
- Creates scheduled task(s)
PID:4004 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rovwer.exe" /P "Admin:N"&&CACLS "rovwer.exe" /P "Admin:R" /E&&echo Y|CACLS "..\99e342142d" /P "Admin:N"&&CACLS "..\99e342142d" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:4260
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:N"4⤵PID:4144
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:R" /E4⤵PID:4528
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵PID:4944
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:N"4⤵PID:3192
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:R" /E4⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\1000199001\40Kdfdf.exe"C:\Users\Admin\AppData\Local\Temp\1000199001\40Kdfdf.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3608 -
C:\Users\Admin\AppData\Roaming\1000205000\stub.exe"C:\Users\Admin\AppData\Roaming\1000205000\stub.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Users\Admin\AppData\Local\Temp\613bae0a89\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\613bae0a89\gntuud.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\613bae0a89\gntuud.exe" /F5⤵
- Creates scheduled task(s)
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\1000206001\Stub1.exe"C:\Users\Admin\AppData\Local\Temp\1000206001\Stub1.exe"3⤵
- Executes dropped EXE
PID:3360
-
C:\Users\Admin\AppData\Local\Temp\613bae0a89\gntuud.exeC:\Users\Admin\AppData\Local\Temp\613bae0a89\gntuud.exe1⤵
- Executes dropped EXE
PID:4472
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe1⤵
- Executes dropped EXE
PID:700
-
C:\Users\Admin\AppData\Local\Temp\613bae0a89\gntuud.exeC:\Users\Admin\AppData\Local\Temp\613bae0a89\gntuud.exe1⤵
- Executes dropped EXE
PID:4940
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe1⤵
- Executes dropped EXE
PID:4780
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000199001\40Kdfdf.exeFilesize
137KB
MD587ef06885fd221a86bba9e5b86a7ea7d
SHA16644db86f2d557167f442a5fe72a82de3fe943ba
SHA256ab5026bf6fe5d692faaf86752b4c9fa226ec49ba54cfb625579287b498eab20f
SHA512c65b38856d4995b01454754044ae7373363a02b8e228c249fee3c1c2222f2348473f0bba5a5f2e4a280cd183e57dc13423bb09f86919ccb8968c8229310c5ad0
-
C:\Users\Admin\AppData\Local\Temp\1000199001\40Kdfdf.exeFilesize
137KB
MD587ef06885fd221a86bba9e5b86a7ea7d
SHA16644db86f2d557167f442a5fe72a82de3fe943ba
SHA256ab5026bf6fe5d692faaf86752b4c9fa226ec49ba54cfb625579287b498eab20f
SHA512c65b38856d4995b01454754044ae7373363a02b8e228c249fee3c1c2222f2348473f0bba5a5f2e4a280cd183e57dc13423bb09f86919ccb8968c8229310c5ad0
-
C:\Users\Admin\AppData\Local\Temp\1000206001\Stub1.exeFilesize
160KB
MD55816d94bf51f3d6b6d8fa68809a05a57
SHA12f90c3c153bedd60af34e9748ddce2a67fe103e6
SHA256ec9e73dd34c006df5b695379fd2fefe4a98e3aafa505c03e4c8bff42272b515b
SHA512c6b0053037aaf062b5b862bea2b1a1f8d9eb9583ebf77727f7e9c7c821bd194db9adb21012186f5c46cb399bce10d23a7b53f866f51d2fe1c706ddbd02bdcd70
-
C:\Users\Admin\AppData\Local\Temp\1000206001\Stub1.exeFilesize
160KB
MD55816d94bf51f3d6b6d8fa68809a05a57
SHA12f90c3c153bedd60af34e9748ddce2a67fe103e6
SHA256ec9e73dd34c006df5b695379fd2fefe4a98e3aafa505c03e4c8bff42272b515b
SHA512c6b0053037aaf062b5b862bea2b1a1f8d9eb9583ebf77727f7e9c7c821bd194db9adb21012186f5c46cb399bce10d23a7b53f866f51d2fe1c706ddbd02bdcd70
-
C:\Users\Admin\AppData\Local\Temp\613bae0a89\gntuud.exeFilesize
241KB
MD571f206a09c6a316713fe5710090bb595
SHA13499f16371e584129f2d4d1171b35f1d456e0455
SHA2565a41339569b08e820f423ab113dd2e0f66fa24184b6cd365c40265393800fffc
SHA51255718b1aaaeaf2e769f7520edfaafe9a43a9599556e63b649c838308fd25964a217b09a5d46a7a7c62dd4aa0ffcce58ca5ccaabd9c9212f4b46104d35c4ec544
-
C:\Users\Admin\AppData\Local\Temp\613bae0a89\gntuud.exeFilesize
241KB
MD571f206a09c6a316713fe5710090bb595
SHA13499f16371e584129f2d4d1171b35f1d456e0455
SHA2565a41339569b08e820f423ab113dd2e0f66fa24184b6cd365c40265393800fffc
SHA51255718b1aaaeaf2e769f7520edfaafe9a43a9599556e63b649c838308fd25964a217b09a5d46a7a7c62dd4aa0ffcce58ca5ccaabd9c9212f4b46104d35c4ec544
-
C:\Users\Admin\AppData\Local\Temp\613bae0a89\gntuud.exeFilesize
241KB
MD571f206a09c6a316713fe5710090bb595
SHA13499f16371e584129f2d4d1171b35f1d456e0455
SHA2565a41339569b08e820f423ab113dd2e0f66fa24184b6cd365c40265393800fffc
SHA51255718b1aaaeaf2e769f7520edfaafe9a43a9599556e63b649c838308fd25964a217b09a5d46a7a7c62dd4aa0ffcce58ca5ccaabd9c9212f4b46104d35c4ec544
-
C:\Users\Admin\AppData\Local\Temp\613bae0a89\gntuud.exeFilesize
241KB
MD571f206a09c6a316713fe5710090bb595
SHA13499f16371e584129f2d4d1171b35f1d456e0455
SHA2565a41339569b08e820f423ab113dd2e0f66fa24184b6cd365c40265393800fffc
SHA51255718b1aaaeaf2e769f7520edfaafe9a43a9599556e63b649c838308fd25964a217b09a5d46a7a7c62dd4aa0ffcce58ca5ccaabd9c9212f4b46104d35c4ec544
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
244KB
MD52e795a9e52afa69f803f2bb1201b8a36
SHA1269af084a0dcb713e70d603bca106023e742cf09
SHA256f2b85e58fdb90c1d844dbec89ef55b2f881d617a7ab2c9bf7763581c9a4d2be2
SHA512a80ab9d7504c3715292db9058c7cf2f22d0f46938d19a3ff49cd7fa1d3a515b5248a6e45e7771fa1a9262c5a8e036f685335e914c22a33642005f5a5af129672
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
244KB
MD52e795a9e52afa69f803f2bb1201b8a36
SHA1269af084a0dcb713e70d603bca106023e742cf09
SHA256f2b85e58fdb90c1d844dbec89ef55b2f881d617a7ab2c9bf7763581c9a4d2be2
SHA512a80ab9d7504c3715292db9058c7cf2f22d0f46938d19a3ff49cd7fa1d3a515b5248a6e45e7771fa1a9262c5a8e036f685335e914c22a33642005f5a5af129672
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
244KB
MD52e795a9e52afa69f803f2bb1201b8a36
SHA1269af084a0dcb713e70d603bca106023e742cf09
SHA256f2b85e58fdb90c1d844dbec89ef55b2f881d617a7ab2c9bf7763581c9a4d2be2
SHA512a80ab9d7504c3715292db9058c7cf2f22d0f46938d19a3ff49cd7fa1d3a515b5248a6e45e7771fa1a9262c5a8e036f685335e914c22a33642005f5a5af129672
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
244KB
MD52e795a9e52afa69f803f2bb1201b8a36
SHA1269af084a0dcb713e70d603bca106023e742cf09
SHA256f2b85e58fdb90c1d844dbec89ef55b2f881d617a7ab2c9bf7763581c9a4d2be2
SHA512a80ab9d7504c3715292db9058c7cf2f22d0f46938d19a3ff49cd7fa1d3a515b5248a6e45e7771fa1a9262c5a8e036f685335e914c22a33642005f5a5af129672
-
C:\Users\Admin\AppData\Roaming\1000205000\stub.exeFilesize
241KB
MD571f206a09c6a316713fe5710090bb595
SHA13499f16371e584129f2d4d1171b35f1d456e0455
SHA2565a41339569b08e820f423ab113dd2e0f66fa24184b6cd365c40265393800fffc
SHA51255718b1aaaeaf2e769f7520edfaafe9a43a9599556e63b649c838308fd25964a217b09a5d46a7a7c62dd4aa0ffcce58ca5ccaabd9c9212f4b46104d35c4ec544
-
C:\Users\Admin\AppData\Roaming\1000205000\stub.exeFilesize
241KB
MD571f206a09c6a316713fe5710090bb595
SHA13499f16371e584129f2d4d1171b35f1d456e0455
SHA2565a41339569b08e820f423ab113dd2e0f66fa24184b6cd365c40265393800fffc
SHA51255718b1aaaeaf2e769f7520edfaafe9a43a9599556e63b649c838308fd25964a217b09a5d46a7a7c62dd4aa0ffcce58ca5ccaabd9c9212f4b46104d35c4ec544
-
memory/508-405-0x0000000000000000-mapping.dmp
-
memory/700-669-0x000000000095E000-0x000000000097D000-memory.dmpFilesize
124KB
-
memory/700-670-0x0000000000400000-0x000000000065B000-memory.dmpFilesize
2.4MB
-
memory/1524-133-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-161-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-135-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-136-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-137-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-139-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-140-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-141-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-142-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-143-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-144-0x0000000000770000-0x00000000008BA000-memory.dmpFilesize
1.3MB
-
memory/1524-146-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-145-0x00000000023C0000-0x00000000023FE000-memory.dmpFilesize
248KB
-
memory/1524-147-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-148-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-149-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-150-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-151-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-152-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-153-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-154-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-155-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-156-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-157-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-158-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-159-0x0000000000400000-0x000000000065B000-memory.dmpFilesize
2.4MB
-
memory/1524-160-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-134-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-162-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-163-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-164-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-165-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-166-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-117-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-132-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-131-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-171-0x00000000023C0000-0x00000000023FE000-memory.dmpFilesize
248KB
-
memory/1524-130-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-129-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-174-0x0000000000400000-0x000000000065B000-memory.dmpFilesize
2.4MB
-
memory/1524-128-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-127-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-126-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-125-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-124-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-118-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-123-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-122-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-121-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-120-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-119-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/1524-116-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/3192-293-0x0000000000000000-mapping.dmp
-
memory/3360-527-0x0000000000000000-mapping.dmp
-
memory/3608-389-0x00000000075D0000-0x00000000076DA000-memory.dmpFilesize
1.0MB
-
memory/3608-577-0x0000000005850000-0x00000000058E2000-memory.dmpFilesize
584KB
-
memory/3608-599-0x0000000008DD0000-0x0000000008E20000-memory.dmpFilesize
320KB
-
memory/3608-598-0x0000000008E50000-0x0000000008EC6000-memory.dmpFilesize
472KB
-
memory/3608-397-0x00000000074C0000-0x00000000074D2000-memory.dmpFilesize
72KB
-
memory/3608-399-0x00000000074E0000-0x000000000751E000-memory.dmpFilesize
248KB
-
memory/3608-401-0x0000000007520000-0x000000000756B000-memory.dmpFilesize
300KB
-
memory/3608-360-0x0000000000740000-0x0000000000768000-memory.dmpFilesize
160KB
-
memory/3608-592-0x00000000090D0000-0x00000000095FC000-memory.dmpFilesize
5.2MB
-
memory/3608-591-0x0000000008370000-0x0000000008532000-memory.dmpFilesize
1.8MB
-
memory/3608-582-0x00000000058F0000-0x0000000005956000-memory.dmpFilesize
408KB
-
memory/3608-304-0x0000000000000000-mapping.dmp
-
memory/3608-580-0x00000000086A0000-0x0000000008B9E000-memory.dmpFilesize
5.0MB
-
memory/3608-387-0x0000000005D70000-0x0000000006376000-memory.dmpFilesize
6.0MB
-
memory/3872-452-0x0000000000000000-mapping.dmp
-
memory/3916-224-0x0000000000000000-mapping.dmp
-
memory/4004-222-0x0000000000000000-mapping.dmp
-
memory/4144-249-0x0000000000000000-mapping.dmp
-
memory/4260-240-0x0000000000000000-mapping.dmp
-
memory/4492-314-0x0000000000000000-mapping.dmp
-
memory/4528-273-0x0000000000000000-mapping.dmp
-
memory/4556-212-0x000000000091A000-0x0000000000939000-memory.dmpFilesize
124KB
-
memory/4556-167-0x0000000000000000-mapping.dmp
-
memory/4556-363-0x000000000091A000-0x0000000000939000-memory.dmpFilesize
124KB
-
memory/4556-184-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/4556-183-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/4556-173-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/4556-179-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/4556-186-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/4556-182-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/4556-177-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/4556-181-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/4556-180-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/4556-185-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/4556-364-0x0000000000660000-0x00000000007AA000-memory.dmpFilesize
1.3MB
-
memory/4556-215-0x0000000000400000-0x000000000065B000-memory.dmpFilesize
2.4MB
-
memory/4556-188-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/4556-169-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/4556-365-0x0000000000400000-0x000000000065B000-memory.dmpFilesize
2.4MB
-
memory/4556-187-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/4556-213-0x0000000000660000-0x00000000007AA000-memory.dmpFilesize
1.3MB
-
memory/4556-176-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/4556-175-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/4556-170-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/4556-172-0x0000000077290000-0x000000007741E000-memory.dmpFilesize
1.6MB
-
memory/4780-737-0x0000000000400000-0x000000000065B000-memory.dmpFilesize
2.4MB
-
memory/4780-736-0x000000000094E000-0x000000000096D000-memory.dmpFilesize
124KB
-
memory/4944-290-0x0000000000000000-mapping.dmp
-
memory/5076-499-0x0000000000000000-mapping.dmp