Analysis
-
max time kernel
145s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 22:33
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
General
-
Target
file.exe
-
Size
226KB
-
MD5
12c05a7b1c02b9bd7ad1304033c4aa53
-
SHA1
9c572b4011cd59574e70c2be69af7ea7cc744a1e
-
SHA256
9ef87b2bc8bfae10e017c5ff603cf1600b1a0830cbbedf1f20fba6be41e2cffe
-
SHA512
407e627b0de3762dfcd013ea1ce4d1c35eae0276c2bde35882e6c9f0e979fb6f55cdd656b5c23a75db9a15dac24f0bb03b3f71ec2a4af2b33bb0b5113598811d
-
SSDEEP
3072:aPw5antDujKZzS5hz87d90R6DlT0PuCCQhmKu6Cc3qstuX/XYf23rMwE49P7O:rA9uKZGW6yp0P8ktwstUPYu3r8w
Malware Config
Extracted
amadey
3.50
31.41.244.17/hfk3vK9/index.php
Extracted
redline
NewYear2023
185.106.92.111:2510
-
auth_value
99e9bde3b38509ea98c3316cc27e6106
Extracted
laplas
clipper.guru
-
api_key
ace492e9661223449782fcc8096dc6ef6289032d08d03a7b0a92179622c35bdb
Signatures
-
Detect Amadey credential stealer module 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll amadey_cred_module \Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll amadey_cred_module \Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll amadey_cred_module \Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll amadey_cred_module behavioral1/memory/1648-86-0x00000000001E0000-0x0000000000204000-memory.dmp amadey_cred_module \Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll amadey_cred_module -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/296-107-0x00000000020A0000-0x00000000020DE000-memory.dmp family_redline behavioral1/memory/296-108-0x0000000002330000-0x000000000236C000-memory.dmp family_redline -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 6 1648 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
gntuud.exelinda5.exegntuud.exeanon.exegala.exepid process 1212 gntuud.exe 2000 linda5.exe 1704 gntuud.exe 296 anon.exe 1672 gala.exe -
Loads dropped DLL 12 IoCs
Processes:
file.exegntuud.exerundll32.exemsiexec.exepid process 1112 file.exe 1112 file.exe 1212 gntuud.exe 1648 rundll32.exe 1648 rundll32.exe 1648 rundll32.exe 1648 rundll32.exe 112 msiexec.exe 1212 gntuud.exe 1212 gntuud.exe 1212 gntuud.exe 1212 gntuud.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
gntuud.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\linda5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000003001\\linda5.exe" gntuud.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 1648 rundll32.exe 1648 rundll32.exe 1648 rundll32.exe 1648 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
anon.exedescription pid process Token: SeDebugPrivilege 296 anon.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
file.exegntuud.exetaskeng.exelinda5.exedescription pid process target process PID 1112 wrote to memory of 1212 1112 file.exe gntuud.exe PID 1112 wrote to memory of 1212 1112 file.exe gntuud.exe PID 1112 wrote to memory of 1212 1112 file.exe gntuud.exe PID 1112 wrote to memory of 1212 1112 file.exe gntuud.exe PID 1212 wrote to memory of 636 1212 gntuud.exe schtasks.exe PID 1212 wrote to memory of 636 1212 gntuud.exe schtasks.exe PID 1212 wrote to memory of 636 1212 gntuud.exe schtasks.exe PID 1212 wrote to memory of 636 1212 gntuud.exe schtasks.exe PID 1212 wrote to memory of 2000 1212 gntuud.exe linda5.exe PID 1212 wrote to memory of 2000 1212 gntuud.exe linda5.exe PID 1212 wrote to memory of 2000 1212 gntuud.exe linda5.exe PID 1212 wrote to memory of 2000 1212 gntuud.exe linda5.exe PID 1616 wrote to memory of 1704 1616 taskeng.exe gntuud.exe PID 1616 wrote to memory of 1704 1616 taskeng.exe gntuud.exe PID 1616 wrote to memory of 1704 1616 taskeng.exe gntuud.exe PID 1616 wrote to memory of 1704 1616 taskeng.exe gntuud.exe PID 1212 wrote to memory of 1648 1212 gntuud.exe rundll32.exe PID 1212 wrote to memory of 1648 1212 gntuud.exe rundll32.exe PID 1212 wrote to memory of 1648 1212 gntuud.exe rundll32.exe PID 1212 wrote to memory of 1648 1212 gntuud.exe rundll32.exe PID 1212 wrote to memory of 1648 1212 gntuud.exe rundll32.exe PID 1212 wrote to memory of 1648 1212 gntuud.exe rundll32.exe PID 1212 wrote to memory of 1648 1212 gntuud.exe rundll32.exe PID 2000 wrote to memory of 112 2000 linda5.exe msiexec.exe PID 2000 wrote to memory of 112 2000 linda5.exe msiexec.exe PID 2000 wrote to memory of 112 2000 linda5.exe msiexec.exe PID 2000 wrote to memory of 112 2000 linda5.exe msiexec.exe PID 2000 wrote to memory of 112 2000 linda5.exe msiexec.exe PID 2000 wrote to memory of 112 2000 linda5.exe msiexec.exe PID 2000 wrote to memory of 112 2000 linda5.exe msiexec.exe PID 1212 wrote to memory of 296 1212 gntuud.exe anon.exe PID 1212 wrote to memory of 296 1212 gntuud.exe anon.exe PID 1212 wrote to memory of 296 1212 gntuud.exe anon.exe PID 1212 wrote to memory of 296 1212 gntuud.exe anon.exe PID 1212 wrote to memory of 1672 1212 gntuud.exe gala.exe PID 1212 wrote to memory of 1672 1212 gntuud.exe gala.exe PID 1212 wrote to memory of 1672 1212 gntuud.exe gala.exe PID 1212 wrote to memory of 1672 1212 gntuud.exe gala.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000003001\linda5.exe"C:\Users\Admin\AppData\Local\Temp\1000003001\linda5.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" -Y .\WMLHQpOP.GD4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\1000005001\anon.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\anon.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000004001\gala.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\gala.exe"3⤵
- Executes dropped EXE
-
C:\Windows\system32\taskeng.exetaskeng.exe {59AE4BBD-F34A-42F7-8E88-976DAF5CAF41} S-1-5-21-3406023954-474543476-3319432036-1000:VUIIVLGQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeC:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000003001\linda5.exeFilesize
1.5MB
MD5729ee19ff1d07963af76c1e290d77b15
SHA100a8e6bf6915b34e18c56c3e6e9a29102a2b7a6a
SHA25674b3d905ebd25524fea43911c5ea3f6abf477baac2ad9f4f4905b11e925632a1
SHA5127c451c8aa5ab5ba1543f8ab73cd1c297995c14d95747d4c9185c8c6dc5712319382e3bb52083f829420c6aaf6e059731bc5a3807e998d41daf39ea6036bf0ee7
-
C:\Users\Admin\AppData\Local\Temp\1000003001\linda5.exeFilesize
1.5MB
MD5729ee19ff1d07963af76c1e290d77b15
SHA100a8e6bf6915b34e18c56c3e6e9a29102a2b7a6a
SHA25674b3d905ebd25524fea43911c5ea3f6abf477baac2ad9f4f4905b11e925632a1
SHA5127c451c8aa5ab5ba1543f8ab73cd1c297995c14d95747d4c9185c8c6dc5712319382e3bb52083f829420c6aaf6e059731bc5a3807e998d41daf39ea6036bf0ee7
-
C:\Users\Admin\AppData\Local\Temp\1000004001\gala.exeFilesize
4.6MB
MD5f6829a19455a7b24a79e0b984d2a42d9
SHA1c71d657301d721b42c52c0252aa5fe0dbfb04f9f
SHA2567dc8f90673b102c2945e36747763ccccd243519500eca01fd1cfdbbfcb61d61b
SHA512e3d8db3d3938366e9fe8c1645647dbf29bfb5c9a6210f54bdfca05b9782f005b9b40df2a7980f160143c48139a638c5a4ff6b091d0d846a839d363eba94bce4c
-
C:\Users\Admin\AppData\Local\Temp\1000004001\gala.exeFilesize
4.6MB
MD5f6829a19455a7b24a79e0b984d2a42d9
SHA1c71d657301d721b42c52c0252aa5fe0dbfb04f9f
SHA2567dc8f90673b102c2945e36747763ccccd243519500eca01fd1cfdbbfcb61d61b
SHA512e3d8db3d3938366e9fe8c1645647dbf29bfb5c9a6210f54bdfca05b9782f005b9b40df2a7980f160143c48139a638c5a4ff6b091d0d846a839d363eba94bce4c
-
C:\Users\Admin\AppData\Local\Temp\1000005001\anon.exeFilesize
297KB
MD53091f1775af3bb34121b2caddb4eb353
SHA11661bf18cf8d266b2c3f1ac50c282dc945e568c8
SHA2562282a4fcfa986d6781501636dfd04375c471e05fdfcb65732b088211bd9fff72
SHA51270f1406e446944459f8488db52e7589d399cfb65460028f89a7ad58d1ddc93d68ffdb942f929c1674df26adaf6478caed1c7fef2798ae490b6bfefa7ddb0b348
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
226KB
MD512c05a7b1c02b9bd7ad1304033c4aa53
SHA19c572b4011cd59574e70c2be69af7ea7cc744a1e
SHA2569ef87b2bc8bfae10e017c5ff603cf1600b1a0830cbbedf1f20fba6be41e2cffe
SHA512407e627b0de3762dfcd013ea1ce4d1c35eae0276c2bde35882e6c9f0e979fb6f55cdd656b5c23a75db9a15dac24f0bb03b3f71ec2a4af2b33bb0b5113598811d
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
226KB
MD512c05a7b1c02b9bd7ad1304033c4aa53
SHA19c572b4011cd59574e70c2be69af7ea7cc744a1e
SHA2569ef87b2bc8bfae10e017c5ff603cf1600b1a0830cbbedf1f20fba6be41e2cffe
SHA512407e627b0de3762dfcd013ea1ce4d1c35eae0276c2bde35882e6c9f0e979fb6f55cdd656b5c23a75db9a15dac24f0bb03b3f71ec2a4af2b33bb0b5113598811d
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
226KB
MD512c05a7b1c02b9bd7ad1304033c4aa53
SHA19c572b4011cd59574e70c2be69af7ea7cc744a1e
SHA2569ef87b2bc8bfae10e017c5ff603cf1600b1a0830cbbedf1f20fba6be41e2cffe
SHA512407e627b0de3762dfcd013ea1ce4d1c35eae0276c2bde35882e6c9f0e979fb6f55cdd656b5c23a75db9a15dac24f0bb03b3f71ec2a4af2b33bb0b5113598811d
-
C:\Users\Admin\AppData\Local\Temp\WMLHQpOP.GDFilesize
1.8MB
MD5942723194669b920653e223cce23c667
SHA1f9792616cdb48c272f83f94c383ede45030c5eac
SHA256debd0b3b1e89683a28e1c97eb45b2a4bf4044dd5b6fa855215f4b3582b6caa20
SHA512619245acdd16b21dfc2ac2e08f197df39a1e28b18d9c97b93a9a65bc5ee5d0cfce9b19c9cc5f8cf4fa702882c8e707c45661393f38ea5f258a348e47ae9b0938
-
C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dllFilesize
126KB
MD5adbaf286228c46522e50371c4be31a03
SHA1a29d644c4663b2e2b2bd92046ba0df629537c297
SHA256d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0
SHA51274a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d
-
\Users\Admin\AppData\Local\Temp\1000003001\linda5.exeFilesize
1.5MB
MD5729ee19ff1d07963af76c1e290d77b15
SHA100a8e6bf6915b34e18c56c3e6e9a29102a2b7a6a
SHA25674b3d905ebd25524fea43911c5ea3f6abf477baac2ad9f4f4905b11e925632a1
SHA5127c451c8aa5ab5ba1543f8ab73cd1c297995c14d95747d4c9185c8c6dc5712319382e3bb52083f829420c6aaf6e059731bc5a3807e998d41daf39ea6036bf0ee7
-
\Users\Admin\AppData\Local\Temp\1000004001\gala.exeFilesize
4.6MB
MD5f6829a19455a7b24a79e0b984d2a42d9
SHA1c71d657301d721b42c52c0252aa5fe0dbfb04f9f
SHA2567dc8f90673b102c2945e36747763ccccd243519500eca01fd1cfdbbfcb61d61b
SHA512e3d8db3d3938366e9fe8c1645647dbf29bfb5c9a6210f54bdfca05b9782f005b9b40df2a7980f160143c48139a638c5a4ff6b091d0d846a839d363eba94bce4c
-
\Users\Admin\AppData\Local\Temp\1000004001\gala.exeFilesize
4.6MB
MD5f6829a19455a7b24a79e0b984d2a42d9
SHA1c71d657301d721b42c52c0252aa5fe0dbfb04f9f
SHA2567dc8f90673b102c2945e36747763ccccd243519500eca01fd1cfdbbfcb61d61b
SHA512e3d8db3d3938366e9fe8c1645647dbf29bfb5c9a6210f54bdfca05b9782f005b9b40df2a7980f160143c48139a638c5a4ff6b091d0d846a839d363eba94bce4c
-
\Users\Admin\AppData\Local\Temp\1000005001\anon.exeFilesize
297KB
MD53091f1775af3bb34121b2caddb4eb353
SHA11661bf18cf8d266b2c3f1ac50c282dc945e568c8
SHA2562282a4fcfa986d6781501636dfd04375c471e05fdfcb65732b088211bd9fff72
SHA51270f1406e446944459f8488db52e7589d399cfb65460028f89a7ad58d1ddc93d68ffdb942f929c1674df26adaf6478caed1c7fef2798ae490b6bfefa7ddb0b348
-
\Users\Admin\AppData\Local\Temp\1000005001\anon.exeFilesize
297KB
MD53091f1775af3bb34121b2caddb4eb353
SHA11661bf18cf8d266b2c3f1ac50c282dc945e568c8
SHA2562282a4fcfa986d6781501636dfd04375c471e05fdfcb65732b088211bd9fff72
SHA51270f1406e446944459f8488db52e7589d399cfb65460028f89a7ad58d1ddc93d68ffdb942f929c1674df26adaf6478caed1c7fef2798ae490b6bfefa7ddb0b348
-
\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
226KB
MD512c05a7b1c02b9bd7ad1304033c4aa53
SHA19c572b4011cd59574e70c2be69af7ea7cc744a1e
SHA2569ef87b2bc8bfae10e017c5ff603cf1600b1a0830cbbedf1f20fba6be41e2cffe
SHA512407e627b0de3762dfcd013ea1ce4d1c35eae0276c2bde35882e6c9f0e979fb6f55cdd656b5c23a75db9a15dac24f0bb03b3f71ec2a4af2b33bb0b5113598811d
-
\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
226KB
MD512c05a7b1c02b9bd7ad1304033c4aa53
SHA19c572b4011cd59574e70c2be69af7ea7cc744a1e
SHA2569ef87b2bc8bfae10e017c5ff603cf1600b1a0830cbbedf1f20fba6be41e2cffe
SHA512407e627b0de3762dfcd013ea1ce4d1c35eae0276c2bde35882e6c9f0e979fb6f55cdd656b5c23a75db9a15dac24f0bb03b3f71ec2a4af2b33bb0b5113598811d
-
\Users\Admin\AppData\Local\Temp\WMLHQpOp.gDFilesize
1.8MB
MD5942723194669b920653e223cce23c667
SHA1f9792616cdb48c272f83f94c383ede45030c5eac
SHA256debd0b3b1e89683a28e1c97eb45b2a4bf4044dd5b6fa855215f4b3582b6caa20
SHA512619245acdd16b21dfc2ac2e08f197df39a1e28b18d9c97b93a9a65bc5ee5d0cfce9b19c9cc5f8cf4fa702882c8e707c45661393f38ea5f258a348e47ae9b0938
-
\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dllFilesize
126KB
MD5adbaf286228c46522e50371c4be31a03
SHA1a29d644c4663b2e2b2bd92046ba0df629537c297
SHA256d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0
SHA51274a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d
-
\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dllFilesize
126KB
MD5adbaf286228c46522e50371c4be31a03
SHA1a29d644c4663b2e2b2bd92046ba0df629537c297
SHA256d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0
SHA51274a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d
-
\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dllFilesize
126KB
MD5adbaf286228c46522e50371c4be31a03
SHA1a29d644c4663b2e2b2bd92046ba0df629537c297
SHA256d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0
SHA51274a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d
-
\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dllFilesize
126KB
MD5adbaf286228c46522e50371c4be31a03
SHA1a29d644c4663b2e2b2bd92046ba0df629537c297
SHA256d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0
SHA51274a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d
-
memory/112-103-0x0000000000980000-0x0000000000A45000-memory.dmpFilesize
788KB
-
memory/112-95-0x00000000028E0000-0x00000000029DE000-memory.dmpFilesize
1016KB
-
memory/112-80-0x0000000000000000-mapping.dmp
-
memory/112-109-0x00000000028E0000-0x00000000029DE000-memory.dmpFilesize
1016KB
-
memory/112-94-0x0000000002680000-0x00000000027D9000-memory.dmpFilesize
1.3MB
-
memory/112-90-0x0000000002250000-0x000000000241F000-memory.dmpFilesize
1.8MB
-
memory/112-104-0x00000000029E0000-0x0000000002A91000-memory.dmpFilesize
708KB
-
memory/296-108-0x0000000002330000-0x000000000236C000-memory.dmpFilesize
240KB
-
memory/296-102-0x0000000000400000-0x000000000072C000-memory.dmpFilesize
3.2MB
-
memory/296-107-0x00000000020A0000-0x00000000020DE000-memory.dmpFilesize
248KB
-
memory/296-101-0x0000000000730000-0x000000000076E000-memory.dmpFilesize
248KB
-
memory/296-100-0x00000000002AB000-0x00000000002DC000-memory.dmpFilesize
196KB
-
memory/296-98-0x0000000000000000-mapping.dmp
-
memory/296-110-0x00000000002AB000-0x00000000002DC000-memory.dmpFilesize
196KB
-
memory/636-66-0x0000000000000000-mapping.dmp
-
memory/1112-64-0x0000000000400000-0x000000000071A000-memory.dmpFilesize
3.1MB
-
memory/1112-54-0x0000000075881000-0x0000000075883000-memory.dmpFilesize
8KB
-
memory/1112-63-0x0000000000220000-0x000000000025E000-memory.dmpFilesize
248KB
-
memory/1112-62-0x000000000086B000-0x000000000088A000-memory.dmpFilesize
124KB
-
memory/1112-55-0x000000000086B000-0x000000000088A000-memory.dmpFilesize
124KB
-
memory/1112-56-0x0000000000220000-0x000000000025E000-memory.dmpFilesize
248KB
-
memory/1112-57-0x0000000000400000-0x000000000071A000-memory.dmpFilesize
3.1MB
-
memory/1212-60-0x0000000000000000-mapping.dmp
-
memory/1212-69-0x0000000000400000-0x000000000071A000-memory.dmpFilesize
3.1MB
-
memory/1212-70-0x0000000000400000-0x000000000071A000-memory.dmpFilesize
3.1MB
-
memory/1212-68-0x00000000008DB000-0x00000000008FA000-memory.dmpFilesize
124KB
-
memory/1648-86-0x00000000001E0000-0x0000000000204000-memory.dmpFilesize
144KB
-
memory/1648-78-0x0000000000000000-mapping.dmp
-
memory/1672-113-0x0000000000000000-mapping.dmp
-
memory/1704-76-0x0000000000000000-mapping.dmp
-
memory/1704-92-0x000000000090B000-0x000000000092A000-memory.dmpFilesize
124KB
-
memory/1704-93-0x0000000000400000-0x000000000071A000-memory.dmpFilesize
3.1MB
-
memory/2000-72-0x0000000000000000-mapping.dmp