Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
26-11-2022 12:05
Static task
static1
Behavioral task
behavioral1
Sample
69f302a7eee65729f07618d57c39f954e5dbde0ecf41b9b0012a4c3682711263.exe
Resource
win10-20220812-en
General
-
Target
69f302a7eee65729f07618d57c39f954e5dbde0ecf41b9b0012a4c3682711263.exe
-
Size
206KB
-
MD5
b8f1431509582798dbc86ad48dc29d02
-
SHA1
ba44150969065a9e60ac03625287584bf2978a7e
-
SHA256
69f302a7eee65729f07618d57c39f954e5dbde0ecf41b9b0012a4c3682711263
-
SHA512
1bcdd40cd256d6dc5dae963e6023b5015be2d97c89b9277f9d9ff8a5bff6c322c73f99e7869b0297a8687c3152190069c32179ba04f2ca33ee2b68aefbf234bc
-
SSDEEP
3072:xaRCh82CnttAv5Vh7eAfky9G+D1vCcCOeviVJ9kjfnM2PJ9OW15+K37O:yU82CttU7eAfd9LPAab9kjfM2T3
Malware Config
Extracted
amadey
3.50
193.56.146.194/h49vlBP/index.php
Extracted
laplas
clipper.guru
-
api_key
ace492e9661223449782fcc8096dc6ef6289032d08d03a7b0a92179622c35bdb
Extracted
redline
NewYear2023
185.106.92.111:2510
-
auth_value
99e9bde3b38509ea98c3316cc27e6106
Signatures
-
Detect Amadey credential stealer module 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll amadey_cred_module \Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll amadey_cred_module -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4252-383-0x0000000002960000-0x000000000299E000-memory.dmp family_redline behavioral1/memory/4252-405-0x0000000002C50000-0x0000000002C8C000-memory.dmp family_redline -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 8 916 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
Processes:
rovwer.exeanon.exegala.exerovwer.exerovwer.exeJnEdxrtoRb.exepid process 5104 rovwer.exe 4252 anon.exe 4244 gala.exe 4832 rovwer.exe 2896 rovwer.exe 5028 JnEdxrtoRb.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 916 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
rovwer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\gala.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000147001\\gala.exe" rovwer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\anon.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000146001\\anon.exe" rovwer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1332 schtasks.exe 4932 schtasks.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 13 Go-http-client/1.1 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
rundll32.exeanon.exepid process 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 916 rundll32.exe 4252 anon.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
anon.exedescription pid process Token: SeDebugPrivilege 4252 anon.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
69f302a7eee65729f07618d57c39f954e5dbde0ecf41b9b0012a4c3682711263.exerovwer.exegala.execmd.exedescription pid process target process PID 2384 wrote to memory of 5104 2384 69f302a7eee65729f07618d57c39f954e5dbde0ecf41b9b0012a4c3682711263.exe rovwer.exe PID 2384 wrote to memory of 5104 2384 69f302a7eee65729f07618d57c39f954e5dbde0ecf41b9b0012a4c3682711263.exe rovwer.exe PID 2384 wrote to memory of 5104 2384 69f302a7eee65729f07618d57c39f954e5dbde0ecf41b9b0012a4c3682711263.exe rovwer.exe PID 5104 wrote to memory of 1332 5104 rovwer.exe schtasks.exe PID 5104 wrote to memory of 1332 5104 rovwer.exe schtasks.exe PID 5104 wrote to memory of 1332 5104 rovwer.exe schtasks.exe PID 5104 wrote to memory of 4252 5104 rovwer.exe anon.exe PID 5104 wrote to memory of 4252 5104 rovwer.exe anon.exe PID 5104 wrote to memory of 4252 5104 rovwer.exe anon.exe PID 5104 wrote to memory of 4244 5104 rovwer.exe gala.exe PID 5104 wrote to memory of 4244 5104 rovwer.exe gala.exe PID 5104 wrote to memory of 4244 5104 rovwer.exe gala.exe PID 4244 wrote to memory of 4764 4244 gala.exe cmd.exe PID 4244 wrote to memory of 4764 4244 gala.exe cmd.exe PID 4244 wrote to memory of 4764 4244 gala.exe cmd.exe PID 4764 wrote to memory of 4932 4764 cmd.exe schtasks.exe PID 4764 wrote to memory of 4932 4764 cmd.exe schtasks.exe PID 4764 wrote to memory of 4932 4764 cmd.exe schtasks.exe PID 5104 wrote to memory of 916 5104 rovwer.exe rundll32.exe PID 5104 wrote to memory of 916 5104 rovwer.exe rundll32.exe PID 5104 wrote to memory of 916 5104 rovwer.exe rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69f302a7eee65729f07618d57c39f954e5dbde0ecf41b9b0012a4c3682711263.exe"C:\Users\Admin\AppData\Local\Temp\69f302a7eee65729f07618d57c39f954e5dbde0ecf41b9b0012a4c3682711263.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe"C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000146001\anon.exe"C:\Users\Admin\AppData\Local\Temp\1000146001\anon.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000147001\gala.exe"C:\Users\Admin\AppData\Local\Temp\1000147001\gala.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C schtasks /create /tn KaAOqfgxzZ /tr C:\Users\Admin\AppData\Roaming\KaAOqfgxzZ\JnEdxrtoRb.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn KaAOqfgxzZ /tr C:\Users\Admin\AppData\Roaming\KaAOqfgxzZ\JnEdxrtoRb.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exeC:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exeC:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\KaAOqfgxzZ\JnEdxrtoRb.exeC:\Users\Admin\AppData\Roaming\KaAOqfgxzZ\JnEdxrtoRb.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000146001\anon.exeFilesize
277KB
MD55704d240990a8dfbe08127c5ce988d35
SHA1691bd570e2e6369ddbab75dc98383161b3d1f538
SHA2561cba2f13cd958b884ca9e0f82c2781a93396b2f67362b35a77946e9770ea3a6a
SHA5128a3ddf3ba5c88b34646485e28d51132a6b3d657fc499fae2d16256cfcd951286eab2b2e38907f02dec48b8b4dd3efca09c432d3ceb4abaabbf8ea3fb7dddce4a
-
C:\Users\Admin\AppData\Local\Temp\1000146001\anon.exeFilesize
277KB
MD55704d240990a8dfbe08127c5ce988d35
SHA1691bd570e2e6369ddbab75dc98383161b3d1f538
SHA2561cba2f13cd958b884ca9e0f82c2781a93396b2f67362b35a77946e9770ea3a6a
SHA5128a3ddf3ba5c88b34646485e28d51132a6b3d657fc499fae2d16256cfcd951286eab2b2e38907f02dec48b8b4dd3efca09c432d3ceb4abaabbf8ea3fb7dddce4a
-
C:\Users\Admin\AppData\Local\Temp\1000147001\gala.exeFilesize
4.6MB
MD5f6829a19455a7b24a79e0b984d2a42d9
SHA1c71d657301d721b42c52c0252aa5fe0dbfb04f9f
SHA2567dc8f90673b102c2945e36747763ccccd243519500eca01fd1cfdbbfcb61d61b
SHA512e3d8db3d3938366e9fe8c1645647dbf29bfb5c9a6210f54bdfca05b9782f005b9b40df2a7980f160143c48139a638c5a4ff6b091d0d846a839d363eba94bce4c
-
C:\Users\Admin\AppData\Local\Temp\1000147001\gala.exeFilesize
4.6MB
MD5f6829a19455a7b24a79e0b984d2a42d9
SHA1c71d657301d721b42c52c0252aa5fe0dbfb04f9f
SHA2567dc8f90673b102c2945e36747763ccccd243519500eca01fd1cfdbbfcb61d61b
SHA512e3d8db3d3938366e9fe8c1645647dbf29bfb5c9a6210f54bdfca05b9782f005b9b40df2a7980f160143c48139a638c5a4ff6b091d0d846a839d363eba94bce4c
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exeFilesize
206KB
MD5b8f1431509582798dbc86ad48dc29d02
SHA1ba44150969065a9e60ac03625287584bf2978a7e
SHA25669f302a7eee65729f07618d57c39f954e5dbde0ecf41b9b0012a4c3682711263
SHA5121bcdd40cd256d6dc5dae963e6023b5015be2d97c89b9277f9d9ff8a5bff6c322c73f99e7869b0297a8687c3152190069c32179ba04f2ca33ee2b68aefbf234bc
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exeFilesize
206KB
MD5b8f1431509582798dbc86ad48dc29d02
SHA1ba44150969065a9e60ac03625287584bf2978a7e
SHA25669f302a7eee65729f07618d57c39f954e5dbde0ecf41b9b0012a4c3682711263
SHA5121bcdd40cd256d6dc5dae963e6023b5015be2d97c89b9277f9d9ff8a5bff6c322c73f99e7869b0297a8687c3152190069c32179ba04f2ca33ee2b68aefbf234bc
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exeFilesize
206KB
MD5b8f1431509582798dbc86ad48dc29d02
SHA1ba44150969065a9e60ac03625287584bf2978a7e
SHA25669f302a7eee65729f07618d57c39f954e5dbde0ecf41b9b0012a4c3682711263
SHA5121bcdd40cd256d6dc5dae963e6023b5015be2d97c89b9277f9d9ff8a5bff6c322c73f99e7869b0297a8687c3152190069c32179ba04f2ca33ee2b68aefbf234bc
-
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exeFilesize
206KB
MD5b8f1431509582798dbc86ad48dc29d02
SHA1ba44150969065a9e60ac03625287584bf2978a7e
SHA25669f302a7eee65729f07618d57c39f954e5dbde0ecf41b9b0012a4c3682711263
SHA5121bcdd40cd256d6dc5dae963e6023b5015be2d97c89b9277f9d9ff8a5bff6c322c73f99e7869b0297a8687c3152190069c32179ba04f2ca33ee2b68aefbf234bc
-
C:\Users\Admin\AppData\Roaming\KaAOqfgxzZ\JnEdxrtoRb.exeFilesize
91.4MB
MD5b75b001bcdb8006f02415234f1bc8988
SHA1ccd8852dbfe8e192a7ee50e35c061ac61aabae0d
SHA2569f223dfb2102e6b931e751813437bf583c0dc2bfd409da13ba0861e37173146a
SHA512938f0ee3d21b9e50281658cbfb4ba28a9b2607bc14f8cb9f4b1560632362c17f429c1ebb8d8f30daf16dd6ba34edbdb4d1a4212efe81ea01ee490b30620279c3
-
C:\Users\Admin\AppData\Roaming\KaAOqfgxzZ\JnEdxrtoRb.exeFilesize
89.5MB
MD592903e1fff1758533a719d3fcf65ed77
SHA16d42d56d8ffcbc7e0ac0d70bbdd9936c092493dd
SHA2565a5ce96481f66de4001324735c751495b0ff4ef243a38c8da3bd2b66ee8b134e
SHA512ff14e30cdca3f5adc52dadfe7e665ab91a01752d0bb1ad46a5b889b9960403787977c6b4177880c46213941ff3e6091bb62bf89a4f2aace43535f13952f3be21
-
C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dllFilesize
126KB
MD5674cec24e36e0dfaec6290db96dda86e
SHA1581e3a7a541cc04641e751fc850d92e07236681f
SHA256de81531468982b689451e85d249214d0aa484e2ffedfd32c58d43cf879f29ded
SHA5126d9898169073c240fe454bd45065fd7dc8458f1d323925b57eb58fa4305bb0d5631bbceb61835593b225e887e0867186ef637c440460279378cb29e832066029
-
\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dllFilesize
126KB
MD5674cec24e36e0dfaec6290db96dda86e
SHA1581e3a7a541cc04641e751fc850d92e07236681f
SHA256de81531468982b689451e85d249214d0aa484e2ffedfd32c58d43cf879f29ded
SHA5126d9898169073c240fe454bd45065fd7dc8458f1d323925b57eb58fa4305bb0d5631bbceb61835593b225e887e0867186ef637c440460279378cb29e832066029
-
memory/916-409-0x0000000000000000-mapping.dmp
-
memory/1332-228-0x0000000000000000-mapping.dmp
-
memory/2384-154-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-161-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-136-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-137-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-138-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-139-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-140-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-141-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-142-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-143-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-144-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-145-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-146-0x0000000000CAA000-0x0000000000CC9000-memory.dmpFilesize
124KB
-
memory/2384-147-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/2384-148-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-149-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-150-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-151-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-152-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-153-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-193-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/2384-155-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-156-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-157-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-158-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/2384-159-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-160-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-135-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-162-0x0000000000CAA000-0x0000000000CC9000-memory.dmpFilesize
124KB
-
memory/2384-163-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/2384-164-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-165-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-166-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-167-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-168-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-169-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-170-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-171-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-134-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-189-0x0000000000CAA000-0x0000000000CC9000-memory.dmpFilesize
124KB
-
memory/2384-133-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-132-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-131-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-130-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-129-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-128-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-127-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-126-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-125-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-121-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-124-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-120-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-123-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2384-122-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/2896-595-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/4244-299-0x0000000000000000-mapping.dmp
-
memory/4252-292-0x0000000000E3A000-0x0000000000E6B000-memory.dmpFilesize
196KB
-
memory/4252-407-0x0000000002E10000-0x0000000002EA2000-memory.dmpFilesize
584KB
-
memory/4252-605-0x0000000006AC0000-0x0000000006C82000-memory.dmpFilesize
1.8MB
-
memory/4252-575-0x0000000006410000-0x0000000006476000-memory.dmpFilesize
408KB
-
memory/4252-513-0x0000000005840000-0x000000000588B000-memory.dmpFilesize
300KB
-
memory/4252-511-0x0000000000D10000-0x0000000000D4E000-memory.dmpFilesize
248KB
-
memory/4252-509-0x0000000000CF0000-0x0000000000D02000-memory.dmpFilesize
72KB
-
memory/4252-507-0x0000000005BA0000-0x0000000005CAA000-memory.dmpFilesize
1.0MB
-
memory/4252-506-0x0000000005CE0000-0x00000000062E6000-memory.dmpFilesize
6.0MB
-
memory/4252-331-0x0000000000E3A000-0x0000000000E6B000-memory.dmpFilesize
196KB
-
memory/4252-405-0x0000000002C50000-0x0000000002C8C000-memory.dmpFilesize
240KB
-
memory/4252-259-0x0000000000000000-mapping.dmp
-
memory/4252-403-0x0000000005340000-0x000000000583E000-memory.dmpFilesize
5.0MB
-
memory/4252-332-0x0000000000B00000-0x0000000000C4A000-memory.dmpFilesize
1.3MB
-
memory/4252-383-0x0000000002960000-0x000000000299E000-memory.dmpFilesize
248KB
-
memory/4252-293-0x0000000000B00000-0x0000000000C4A000-memory.dmpFilesize
1.3MB
-
memory/4252-294-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/4764-333-0x0000000000000000-mapping.dmp
-
memory/4832-400-0x0000000000D5E000-0x0000000000D7D000-memory.dmpFilesize
124KB
-
memory/4832-401-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/4932-339-0x0000000000000000-mapping.dmp
-
memory/5104-179-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5104-192-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5104-191-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5104-182-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5104-184-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5104-185-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5104-186-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5104-187-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5104-258-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/5104-257-0x0000000000C20000-0x0000000000D6A000-memory.dmpFilesize
1.3MB
-
memory/5104-190-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5104-183-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5104-188-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5104-256-0x0000000000C20000-0x0000000000D6A000-memory.dmpFilesize
1.3MB
-
memory/5104-176-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5104-221-0x0000000000400000-0x0000000000AE5000-memory.dmpFilesize
6.9MB
-
memory/5104-219-0x0000000000C20000-0x0000000000D6A000-memory.dmpFilesize
1.3MB
-
memory/5104-220-0x0000000000C20000-0x0000000000D6A000-memory.dmpFilesize
1.3MB
-
memory/5104-178-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5104-172-0x0000000000000000-mapping.dmp
-
memory/5104-175-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5104-180-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5104-174-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB
-
memory/5104-177-0x0000000077A00000-0x0000000077B8E000-memory.dmpFilesize
1.6MB