Analysis
-
max time kernel
132s -
max time network
167s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
26-11-2022 03:50
Static task
static1
Behavioral task
behavioral1
Sample
209bad4a03d0983d2c52bf41358d97c31d205b42858ce769c660f9720220b08e.exe
Resource
win10-20220812-en
General
-
Target
209bad4a03d0983d2c52bf41358d97c31d205b42858ce769c660f9720220b08e.exe
-
Size
206KB
-
MD5
99eb0821bf77a45bb19300819ba8712f
-
SHA1
8a45e7af8b9c5e6bc66068375d783b93fdfa9447
-
SHA256
209bad4a03d0983d2c52bf41358d97c31d205b42858ce769c660f9720220b08e
-
SHA512
c87a7000117569c04f8b77b6f9aea86279e083b720843814af556871604972b1cb9a94c91e6950bbc9c4fdc679500d4f8e55f7abd1bc2a26cbada78c3375770b
-
SSDEEP
3072:R0cVsFuzOk14P0j65XRWude3ZnKPUnEp40R/zXy9tAHyQnEnd/G8ZjfSNItdoh:R/s3kGPiua1I+EFR/jGCH2pZjAuo
Malware Config
Extracted
amadey
3.50
31.41.244.17/hfk3vK9/index.php
Extracted
redline
pops
31.41.244.14:4694
-
auth_value
c377eb074ac3f12f85b0ff38d543b16d
Extracted
laplas
clipper.guru
-
api_key
ace492e9661223449782fcc8096dc6ef6289032d08d03a7b0a92179622c35bdb
Extracted
redline
NewYear2023
185.106.92.111:2510
-
auth_value
99e9bde3b38509ea98c3316cc27e6106
Signatures
-
Detect Amadey credential stealer module 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll amadey_cred_module \Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll amadey_cred_module -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000002001\laba.exe family_redline C:\Users\Admin\AppData\Local\Temp\1000002001\laba.exe family_redline behavioral1/memory/2640-287-0x0000000000220000-0x0000000000248000-memory.dmp family_redline behavioral1/memory/2116-571-0x0000000002600000-0x000000000263E000-memory.dmp family_redline behavioral1/memory/2116-579-0x0000000004CD0000-0x0000000004D0C000-memory.dmp family_redline -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 9 3916 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 8 IoCs
Processes:
gntuud.exelaba.exelinda5.exegala.exegntuud.exeanon.exegntuud.exeJnEdxrtoRb.exepid process 2224 gntuud.exe 2640 laba.exe 4672 linda5.exe 2468 gala.exe 912 gntuud.exe 2116 anon.exe 504 gntuud.exe 1776 JnEdxrtoRb.exe -
Loads dropped DLL 2 IoCs
Processes:
msiexec.exerundll32.exepid process 4780 msiexec.exe 3916 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
gntuud.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\linda5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000003001\\linda5.exe" gntuud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\gala.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000004001\\gala.exe" gntuud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\anon.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000005001\\anon.exe" gntuud.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\laba.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000002001\\laba.exe" gntuud.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2168 schtasks.exe 4732 schtasks.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 13 Go-http-client/1.1 -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
laba.exeanon.exerundll32.exepid process 2640 laba.exe 2640 laba.exe 2116 anon.exe 2116 anon.exe 3916 rundll32.exe 3916 rundll32.exe 3916 rundll32.exe 3916 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
laba.exeanon.exedescription pid process Token: SeDebugPrivilege 2640 laba.exe Token: SeDebugPrivilege 2116 anon.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
209bad4a03d0983d2c52bf41358d97c31d205b42858ce769c660f9720220b08e.exegntuud.exelinda5.exegala.execmd.exedescription pid process target process PID 2476 wrote to memory of 2224 2476 209bad4a03d0983d2c52bf41358d97c31d205b42858ce769c660f9720220b08e.exe gntuud.exe PID 2476 wrote to memory of 2224 2476 209bad4a03d0983d2c52bf41358d97c31d205b42858ce769c660f9720220b08e.exe gntuud.exe PID 2476 wrote to memory of 2224 2476 209bad4a03d0983d2c52bf41358d97c31d205b42858ce769c660f9720220b08e.exe gntuud.exe PID 2224 wrote to memory of 2168 2224 gntuud.exe schtasks.exe PID 2224 wrote to memory of 2168 2224 gntuud.exe schtasks.exe PID 2224 wrote to memory of 2168 2224 gntuud.exe schtasks.exe PID 2224 wrote to memory of 2640 2224 gntuud.exe laba.exe PID 2224 wrote to memory of 2640 2224 gntuud.exe laba.exe PID 2224 wrote to memory of 2640 2224 gntuud.exe laba.exe PID 2224 wrote to memory of 4672 2224 gntuud.exe linda5.exe PID 2224 wrote to memory of 4672 2224 gntuud.exe linda5.exe PID 2224 wrote to memory of 4672 2224 gntuud.exe linda5.exe PID 4672 wrote to memory of 4780 4672 linda5.exe msiexec.exe PID 4672 wrote to memory of 4780 4672 linda5.exe msiexec.exe PID 4672 wrote to memory of 4780 4672 linda5.exe msiexec.exe PID 2224 wrote to memory of 2468 2224 gntuud.exe gala.exe PID 2224 wrote to memory of 2468 2224 gntuud.exe gala.exe PID 2224 wrote to memory of 2468 2224 gntuud.exe gala.exe PID 2224 wrote to memory of 2116 2224 gntuud.exe anon.exe PID 2224 wrote to memory of 2116 2224 gntuud.exe anon.exe PID 2224 wrote to memory of 2116 2224 gntuud.exe anon.exe PID 2224 wrote to memory of 3916 2224 gntuud.exe rundll32.exe PID 2224 wrote to memory of 3916 2224 gntuud.exe rundll32.exe PID 2224 wrote to memory of 3916 2224 gntuud.exe rundll32.exe PID 2468 wrote to memory of 388 2468 gala.exe cmd.exe PID 2468 wrote to memory of 388 2468 gala.exe cmd.exe PID 2468 wrote to memory of 388 2468 gala.exe cmd.exe PID 388 wrote to memory of 4732 388 cmd.exe schtasks.exe PID 388 wrote to memory of 4732 388 cmd.exe schtasks.exe PID 388 wrote to memory of 4732 388 cmd.exe schtasks.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\209bad4a03d0983d2c52bf41358d97c31d205b42858ce769c660f9720220b08e.exe"C:\Users\Admin\AppData\Local\Temp\209bad4a03d0983d2c52bf41358d97c31d205b42858ce769c660f9720220b08e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000002001\laba.exe"C:\Users\Admin\AppData\Local\Temp\1000002001\laba.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000003001\linda5.exe"C:\Users\Admin\AppData\Local\Temp\1000003001\linda5.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /y .\D_AQ.DM4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1000004001\gala.exe"C:\Users\Admin\AppData\Local\Temp\1000004001\gala.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C schtasks /create /tn KaAOqfgxzZ /tr C:\Users\Admin\AppData\Roaming\KaAOqfgxzZ\JnEdxrtoRb.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn KaAOqfgxzZ /tr C:\Users\Admin\AppData\Roaming\KaAOqfgxzZ\JnEdxrtoRb.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000005001\anon.exe"C:\Users\Admin\AppData\Local\Temp\1000005001\anon.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeC:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeC:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\KaAOqfgxzZ\JnEdxrtoRb.exeC:\Users\Admin\AppData\Roaming\KaAOqfgxzZ\JnEdxrtoRb.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000002001\laba.exeFilesize
137KB
MD59299834655f07e6896b1ff0b9e92c7b4
SHA1acba1e9262b4aebf020758e30326afdc99c714ad
SHA256fe105a23e4bee42b0401669d6ce9d34dbc7816a6cbef7c7108e11adc3c339257
SHA5127ab23ac1eedb82044946bb9e6afb308580d434be45f3ebd18c5fc90cd98281738e4f50e75a3506315785e60d93e90cc4facc285fe7760985dfe0fd47771bc650
-
C:\Users\Admin\AppData\Local\Temp\1000002001\laba.exeFilesize
137KB
MD59299834655f07e6896b1ff0b9e92c7b4
SHA1acba1e9262b4aebf020758e30326afdc99c714ad
SHA256fe105a23e4bee42b0401669d6ce9d34dbc7816a6cbef7c7108e11adc3c339257
SHA5127ab23ac1eedb82044946bb9e6afb308580d434be45f3ebd18c5fc90cd98281738e4f50e75a3506315785e60d93e90cc4facc285fe7760985dfe0fd47771bc650
-
C:\Users\Admin\AppData\Local\Temp\1000003001\linda5.exeFilesize
1.5MB
MD589e70a7dd9cbd34890ffdd00a31361c7
SHA1620ffce6b3ac4a78b7b2a5286f623e74ef9bd3c5
SHA256a573b2a0698ff19b367283a882cae90c64005381d8777589c32d0fc4fd627a55
SHA51253f7088276f6185ad747287f3301e5f3e8c6035b1db0be6e3a0685778500c0517da7e703f437367824a19dac9018f8b6fc90adba5db761cfed48a3527729bccf
-
C:\Users\Admin\AppData\Local\Temp\1000003001\linda5.exeFilesize
1.5MB
MD589e70a7dd9cbd34890ffdd00a31361c7
SHA1620ffce6b3ac4a78b7b2a5286f623e74ef9bd3c5
SHA256a573b2a0698ff19b367283a882cae90c64005381d8777589c32d0fc4fd627a55
SHA51253f7088276f6185ad747287f3301e5f3e8c6035b1db0be6e3a0685778500c0517da7e703f437367824a19dac9018f8b6fc90adba5db761cfed48a3527729bccf
-
C:\Users\Admin\AppData\Local\Temp\1000004001\gala.exeFilesize
4.6MB
MD5f6829a19455a7b24a79e0b984d2a42d9
SHA1c71d657301d721b42c52c0252aa5fe0dbfb04f9f
SHA2567dc8f90673b102c2945e36747763ccccd243519500eca01fd1cfdbbfcb61d61b
SHA512e3d8db3d3938366e9fe8c1645647dbf29bfb5c9a6210f54bdfca05b9782f005b9b40df2a7980f160143c48139a638c5a4ff6b091d0d846a839d363eba94bce4c
-
C:\Users\Admin\AppData\Local\Temp\1000004001\gala.exeFilesize
4.6MB
MD5f6829a19455a7b24a79e0b984d2a42d9
SHA1c71d657301d721b42c52c0252aa5fe0dbfb04f9f
SHA2567dc8f90673b102c2945e36747763ccccd243519500eca01fd1cfdbbfcb61d61b
SHA512e3d8db3d3938366e9fe8c1645647dbf29bfb5c9a6210f54bdfca05b9782f005b9b40df2a7980f160143c48139a638c5a4ff6b091d0d846a839d363eba94bce4c
-
C:\Users\Admin\AppData\Local\Temp\1000005001\anon.exeFilesize
297KB
MD53091f1775af3bb34121b2caddb4eb353
SHA11661bf18cf8d266b2c3f1ac50c282dc945e568c8
SHA2562282a4fcfa986d6781501636dfd04375c471e05fdfcb65732b088211bd9fff72
SHA51270f1406e446944459f8488db52e7589d399cfb65460028f89a7ad58d1ddc93d68ffdb942f929c1674df26adaf6478caed1c7fef2798ae490b6bfefa7ddb0b348
-
C:\Users\Admin\AppData\Local\Temp\1000005001\anon.exeFilesize
297KB
MD53091f1775af3bb34121b2caddb4eb353
SHA11661bf18cf8d266b2c3f1ac50c282dc945e568c8
SHA2562282a4fcfa986d6781501636dfd04375c471e05fdfcb65732b088211bd9fff72
SHA51270f1406e446944459f8488db52e7589d399cfb65460028f89a7ad58d1ddc93d68ffdb942f929c1674df26adaf6478caed1c7fef2798ae490b6bfefa7ddb0b348
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
206KB
MD599eb0821bf77a45bb19300819ba8712f
SHA18a45e7af8b9c5e6bc66068375d783b93fdfa9447
SHA256209bad4a03d0983d2c52bf41358d97c31d205b42858ce769c660f9720220b08e
SHA512c87a7000117569c04f8b77b6f9aea86279e083b720843814af556871604972b1cb9a94c91e6950bbc9c4fdc679500d4f8e55f7abd1bc2a26cbada78c3375770b
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
206KB
MD599eb0821bf77a45bb19300819ba8712f
SHA18a45e7af8b9c5e6bc66068375d783b93fdfa9447
SHA256209bad4a03d0983d2c52bf41358d97c31d205b42858ce769c660f9720220b08e
SHA512c87a7000117569c04f8b77b6f9aea86279e083b720843814af556871604972b1cb9a94c91e6950bbc9c4fdc679500d4f8e55f7abd1bc2a26cbada78c3375770b
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
206KB
MD599eb0821bf77a45bb19300819ba8712f
SHA18a45e7af8b9c5e6bc66068375d783b93fdfa9447
SHA256209bad4a03d0983d2c52bf41358d97c31d205b42858ce769c660f9720220b08e
SHA512c87a7000117569c04f8b77b6f9aea86279e083b720843814af556871604972b1cb9a94c91e6950bbc9c4fdc679500d4f8e55f7abd1bc2a26cbada78c3375770b
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
206KB
MD599eb0821bf77a45bb19300819ba8712f
SHA18a45e7af8b9c5e6bc66068375d783b93fdfa9447
SHA256209bad4a03d0983d2c52bf41358d97c31d205b42858ce769c660f9720220b08e
SHA512c87a7000117569c04f8b77b6f9aea86279e083b720843814af556871604972b1cb9a94c91e6950bbc9c4fdc679500d4f8e55f7abd1bc2a26cbada78c3375770b
-
C:\Users\Admin\AppData\Local\Temp\D_AQ.DMFilesize
1.7MB
MD50715f3957f748c70b4b83eb8aea7fe19
SHA1c05aec7821f03fce1ce27e4e6dd1d0c9f39234e4
SHA2560b78d133d81daa15d90a934d1f9eb457ef46e18fdd4484a7485438bf0f6ae582
SHA512a1f474dfa8aaf862aeaff99bccb3d01a4f9db979bd68983a18ac8b50f26d5f8edb57e2af625c94f14a3a651aad1b37cbddfc45e4bd986be339f32a05229c8cac
-
C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dllFilesize
126KB
MD5adbaf286228c46522e50371c4be31a03
SHA1a29d644c4663b2e2b2bd92046ba0df629537c297
SHA256d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0
SHA51274a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d
-
C:\Users\Admin\AppData\Roaming\KaAOqfgxzZ\JnEdxrtoRb.exeFilesize
364.5MB
MD5e29bbb30b000b441214093454be4919c
SHA1b9dd41b1c591b316adfb1b89263e4fce7629db31
SHA256ba1e245e19cff9718067a21648efcd3b41e54131ebc3d11332528d486343e45a
SHA512071c2cc1bf16728f199589aeb62734cd58b29b06c0ae1288b2b47be6bee0bcaa72275c421fa0f0c2a172f3f7802f752df1cef187981ff6a096dce641ce24fc8b
-
C:\Users\Admin\AppData\Roaming\KaAOqfgxzZ\JnEdxrtoRb.exeFilesize
348.9MB
MD52d5479c2bd0959b01b4af4c44f9e0548
SHA15c8eb2d159ad1b6f76eb0bfa5140c90adb6b8da3
SHA2566825dfebb1cce7bb3fd945de6555c5cb7e38119966ad0e17579fb5fa8bea09af
SHA512c15035016d60533cf84badd7787f84a5720d6d243ef6e55e9667a7303f97888e220bc6243c136e0430ead3bb1c18551bd1c847d401f435da9473d86ae1350673
-
\Users\Admin\AppData\Local\Temp\D_Aq.DmFilesize
1.7MB
MD50715f3957f748c70b4b83eb8aea7fe19
SHA1c05aec7821f03fce1ce27e4e6dd1d0c9f39234e4
SHA2560b78d133d81daa15d90a934d1f9eb457ef46e18fdd4484a7485438bf0f6ae582
SHA512a1f474dfa8aaf862aeaff99bccb3d01a4f9db979bd68983a18ac8b50f26d5f8edb57e2af625c94f14a3a651aad1b37cbddfc45e4bd986be339f32a05229c8cac
-
\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dllFilesize
126KB
MD5adbaf286228c46522e50371c4be31a03
SHA1a29d644c4663b2e2b2bd92046ba0df629537c297
SHA256d3e9a3365f73a34e2dd9022a318abcc2c55af98bafb2dc302cbb55f5398bb9a0
SHA51274a55cc8d8c3af54e5ba290a34b968918da994ea2d55b5f0d1f39e83cb9a39d73226227933c760b48f2e0bdb646f8243967517ef8202e02d88411d2d19ae217d
-
memory/388-717-0x0000000000000000-mapping.dmp
-
memory/504-776-0x0000000000D1E000-0x0000000000D3D000-memory.dmpFilesize
124KB
-
memory/504-777-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/912-511-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/2116-578-0x0000000000840000-0x000000000098A000-memory.dmpFilesize
1.3MB
-
memory/2116-527-0x0000000000000000-mapping.dmp
-
memory/2116-571-0x0000000002600000-0x000000000263E000-memory.dmpFilesize
248KB
-
memory/2116-577-0x0000000000840000-0x000000000098A000-memory.dmpFilesize
1.3MB
-
memory/2116-579-0x0000000004CD0000-0x0000000004D0C000-memory.dmpFilesize
240KB
-
memory/2116-716-0x0000000000400000-0x000000000072C000-memory.dmpFilesize
3.2MB
-
memory/2116-581-0x0000000000400000-0x000000000072C000-memory.dmpFilesize
3.2MB
-
memory/2116-664-0x0000000000840000-0x000000000098A000-memory.dmpFilesize
1.3MB
-
memory/2116-665-0x0000000000840000-0x000000000098A000-memory.dmpFilesize
1.3MB
-
memory/2168-219-0x0000000000000000-mapping.dmp
-
memory/2224-184-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2224-250-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/2224-224-0x0000000000BA0000-0x0000000000C4E000-memory.dmpFilesize
696KB
-
memory/2224-249-0x0000000000BA0000-0x0000000000C4E000-memory.dmpFilesize
696KB
-
memory/2224-187-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2224-186-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2224-185-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2224-170-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2224-183-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2224-182-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2224-181-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2224-228-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/2224-180-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2224-179-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2224-178-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2224-176-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2224-175-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2224-173-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2224-172-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2224-165-0x0000000000000000-mapping.dmp
-
memory/2224-167-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2224-168-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2468-453-0x0000000000000000-mapping.dmp
-
memory/2476-147-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-140-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-174-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/2476-164-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-169-0x0000000000DDA000-0x0000000000DF9000-memory.dmpFilesize
124KB
-
memory/2476-163-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-162-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-161-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-160-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-159-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-158-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-157-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/2476-156-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-155-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-154-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-153-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-152-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-151-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-150-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-149-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-148-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-115-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-146-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-116-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-145-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-144-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-117-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-118-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-119-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-120-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-121-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-122-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-143-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-123-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-142-0x0000000000D70000-0x0000000000DAE000-memory.dmpFilesize
248KB
-
memory/2476-124-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-141-0x0000000000DDA000-0x0000000000DF9000-memory.dmpFilesize
124KB
-
memory/2476-171-0x0000000000D70000-0x0000000000DAE000-memory.dmpFilesize
248KB
-
memory/2476-125-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-126-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-127-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-128-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-129-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-139-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-138-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-137-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-136-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-135-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-130-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-134-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-133-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-131-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2476-132-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/2640-606-0x0000000006300000-0x0000000006376000-memory.dmpFilesize
472KB
-
memory/2640-313-0x0000000004AC0000-0x0000000004AFE000-memory.dmpFilesize
248KB
-
memory/2640-442-0x0000000005AC0000-0x0000000005FBE000-memory.dmpFilesize
5.0MB
-
memory/2640-441-0x0000000004E30000-0x0000000004EC2000-memory.dmpFilesize
584KB
-
memory/2640-589-0x0000000006390000-0x0000000006552000-memory.dmpFilesize
1.8MB
-
memory/2640-594-0x0000000006A90000-0x0000000006FBC000-memory.dmpFilesize
5.2MB
-
memory/2640-445-0x0000000004ED0000-0x0000000004F36000-memory.dmpFilesize
408KB
-
memory/2640-607-0x0000000006560000-0x00000000065B0000-memory.dmpFilesize
320KB
-
memory/2640-287-0x0000000000220000-0x0000000000248000-memory.dmpFilesize
160KB
-
memory/2640-251-0x0000000000000000-mapping.dmp
-
memory/2640-311-0x0000000004A60000-0x0000000004A72000-memory.dmpFilesize
72KB
-
memory/2640-308-0x0000000004FB0000-0x00000000055B6000-memory.dmpFilesize
6.0MB
-
memory/2640-309-0x0000000004B30000-0x0000000004C3A000-memory.dmpFilesize
1.0MB
-
memory/2640-315-0x0000000004C40000-0x0000000004C8B000-memory.dmpFilesize
300KB
-
memory/3916-622-0x0000000000000000-mapping.dmp
-
memory/4672-319-0x0000000000000000-mapping.dmp
-
memory/4732-723-0x0000000000000000-mapping.dmp
-
memory/4780-517-0x0000000005590000-0x0000000005681000-memory.dmpFilesize
964KB
-
memory/4780-388-0x0000000000000000-mapping.dmp
-
memory/4780-440-0x0000000005590000-0x0000000005681000-memory.dmpFilesize
964KB
-
memory/4780-439-0x0000000005350000-0x0000000005497000-memory.dmpFilesize
1.3MB