Analysis
-
max time kernel
120s -
max time network
141s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
06-12-2022 02:38
Static task
static1
Behavioral task
behavioral1
Sample
1f2a80d5d23e63f348c5aaa589f2c004235e1fb6298caf91d1b25773381a8d58.exe
Resource
win10-20220812-en
General
-
Target
1f2a80d5d23e63f348c5aaa589f2c004235e1fb6298caf91d1b25773381a8d58.exe
-
Size
331KB
-
MD5
bcbc4a4faf06b1fa399e2107b6869b22
-
SHA1
1b96550abad623743c7e44c5116fda8388b8fcff
-
SHA256
1f2a80d5d23e63f348c5aaa589f2c004235e1fb6298caf91d1b25773381a8d58
-
SHA512
a8ec68e651fbec2fc2c52118c55eabb7e23bc0da4ba5b8f7cd321d34f4cb2be4fc770d0856117140c553238e341edb5b7f12c1c881fcfb73fc63a879d24083a2
-
SSDEEP
6144:0BCHhF1mmfgV8praPlIb9TbuaiIDcZpHVS:0BCBFHtpraPliTS2DcPHVS
Malware Config
Extracted
amadey
3.50
62.204.41.6/p9cWxH/index.php
Extracted
redline
wosh
31.41.244.14:4683
-
auth_value
f0ec85e2aaa9e62929e2fb9e09d843f4
Signatures
-
Detect Amadey credential stealer module 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll amadey_cred_module \Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll amadey_cred_module -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 10 2740 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
gntuud.exelinda5.exewish.exegntuud.exegntuud.exepid process 60 gntuud.exe 5092 linda5.exe 4600 wish.exe 684 gntuud.exe 2344 gntuud.exe -
Loads dropped DLL 3 IoCs
Processes:
msiexec.exerundll32.exepid process 3048 msiexec.exe 3048 msiexec.exe 2740 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
gntuud.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\linda5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000027001\\linda5.exe" gntuud.exe Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\wish.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000028001\\wish.exe" gntuud.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
wish.exerundll32.exepid process 4600 wish.exe 4600 wish.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe 2740 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
wish.exedescription pid process Token: SeDebugPrivilege 4600 wish.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
1f2a80d5d23e63f348c5aaa589f2c004235e1fb6298caf91d1b25773381a8d58.exegntuud.exelinda5.exedescription pid process target process PID 2692 wrote to memory of 60 2692 1f2a80d5d23e63f348c5aaa589f2c004235e1fb6298caf91d1b25773381a8d58.exe gntuud.exe PID 2692 wrote to memory of 60 2692 1f2a80d5d23e63f348c5aaa589f2c004235e1fb6298caf91d1b25773381a8d58.exe gntuud.exe PID 2692 wrote to memory of 60 2692 1f2a80d5d23e63f348c5aaa589f2c004235e1fb6298caf91d1b25773381a8d58.exe gntuud.exe PID 60 wrote to memory of 2408 60 gntuud.exe schtasks.exe PID 60 wrote to memory of 2408 60 gntuud.exe schtasks.exe PID 60 wrote to memory of 2408 60 gntuud.exe schtasks.exe PID 60 wrote to memory of 5092 60 gntuud.exe linda5.exe PID 60 wrote to memory of 5092 60 gntuud.exe linda5.exe PID 60 wrote to memory of 5092 60 gntuud.exe linda5.exe PID 5092 wrote to memory of 3048 5092 linda5.exe msiexec.exe PID 5092 wrote to memory of 3048 5092 linda5.exe msiexec.exe PID 5092 wrote to memory of 3048 5092 linda5.exe msiexec.exe PID 60 wrote to memory of 4600 60 gntuud.exe wish.exe PID 60 wrote to memory of 4600 60 gntuud.exe wish.exe PID 60 wrote to memory of 4600 60 gntuud.exe wish.exe PID 60 wrote to memory of 2740 60 gntuud.exe rundll32.exe PID 60 wrote to memory of 2740 60 gntuud.exe rundll32.exe PID 60 wrote to memory of 2740 60 gntuud.exe rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f2a80d5d23e63f348c5aaa589f2c004235e1fb6298caf91d1b25773381a8d58.exe"C:\Users\Admin\AppData\Local\Temp\1f2a80d5d23e63f348c5aaa589f2c004235e1fb6298caf91d1b25773381a8d58.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000027001\linda5.exe"C:\Users\Admin\AppData\Local\Temp\1000027001\linda5.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" -Y .\7XTYN.V54⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1000028001\wish.exe"C:\Users\Admin\AppData\Local\Temp\1000028001\wish.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000027001\linda5.exeFilesize
1.9MB
MD5f40d30ad5a07181de930673467bf6697
SHA19ee0a9a29920e271df6a195940cb860821eae575
SHA256d47859ae7aa502aba88afe352abdca99bb78ea7d50690ecac3d77166206becb6
SHA512b51ac99f6e6a682871dba45a74e0359e30b69ae2e85506e252e4c6ae277a1e0eb37d6d6bdef7e68ab44bf28e71a0e6f51ca2424fb92a8f79a89fb99e682d80f2
-
C:\Users\Admin\AppData\Local\Temp\1000027001\linda5.exeFilesize
1.9MB
MD5f40d30ad5a07181de930673467bf6697
SHA19ee0a9a29920e271df6a195940cb860821eae575
SHA256d47859ae7aa502aba88afe352abdca99bb78ea7d50690ecac3d77166206becb6
SHA512b51ac99f6e6a682871dba45a74e0359e30b69ae2e85506e252e4c6ae277a1e0eb37d6d6bdef7e68ab44bf28e71a0e6f51ca2424fb92a8f79a89fb99e682d80f2
-
C:\Users\Admin\AppData\Local\Temp\1000028001\wish.exeFilesize
175KB
MD53b6246132b7fb972ed877b79d700e32e
SHA1af68ac119ccce9c7be5aeefa1e86102ee4019ebb
SHA2564743bad8f6939aa7645a043208010c2a9e75fbbcbbc8ca597a0c2a74ce7b6cc0
SHA51203573c63e3d03d89d2a2971d761d33e8d89895680ae8b7e5ceb3a78c8582666f8a300aad4c6c4a7c1cd118ac774ffce03053c96a57df9e66a02773111dbcfcca
-
C:\Users\Admin\AppData\Local\Temp\1000028001\wish.exeFilesize
175KB
MD53b6246132b7fb972ed877b79d700e32e
SHA1af68ac119ccce9c7be5aeefa1e86102ee4019ebb
SHA2564743bad8f6939aa7645a043208010c2a9e75fbbcbbc8ca597a0c2a74ce7b6cc0
SHA51203573c63e3d03d89d2a2971d761d33e8d89895680ae8b7e5ceb3a78c8582666f8a300aad4c6c4a7c1cd118ac774ffce03053c96a57df9e66a02773111dbcfcca
-
C:\Users\Admin\AppData\Local\Temp\7XTYN.V5Filesize
3.1MB
MD544ce4500d3429c08d64f5b03c982d6c7
SHA1aee441ec6ebd2975a385339939fe55f2cb75991e
SHA2564ab65f2873f36b6923fc57a71bf00f6589cbb4cc1f67a299d827536705574aab
SHA51241d329d063aa286fa3257b094915f4653dd641a13fce13bcc1498b3cec7ae3e3254ebe7ff762be679dfe0c287a4d1237facfd774319fd450ead5a049cd9a4348
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exeFilesize
331KB
MD5bcbc4a4faf06b1fa399e2107b6869b22
SHA11b96550abad623743c7e44c5116fda8388b8fcff
SHA2561f2a80d5d23e63f348c5aaa589f2c004235e1fb6298caf91d1b25773381a8d58
SHA512a8ec68e651fbec2fc2c52118c55eabb7e23bc0da4ba5b8f7cd321d34f4cb2be4fc770d0856117140c553238e341edb5b7f12c1c881fcfb73fc63a879d24083a2
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exeFilesize
331KB
MD5bcbc4a4faf06b1fa399e2107b6869b22
SHA11b96550abad623743c7e44c5116fda8388b8fcff
SHA2561f2a80d5d23e63f348c5aaa589f2c004235e1fb6298caf91d1b25773381a8d58
SHA512a8ec68e651fbec2fc2c52118c55eabb7e23bc0da4ba5b8f7cd321d34f4cb2be4fc770d0856117140c553238e341edb5b7f12c1c881fcfb73fc63a879d24083a2
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exeFilesize
331KB
MD5bcbc4a4faf06b1fa399e2107b6869b22
SHA11b96550abad623743c7e44c5116fda8388b8fcff
SHA2561f2a80d5d23e63f348c5aaa589f2c004235e1fb6298caf91d1b25773381a8d58
SHA512a8ec68e651fbec2fc2c52118c55eabb7e23bc0da4ba5b8f7cd321d34f4cb2be4fc770d0856117140c553238e341edb5b7f12c1c881fcfb73fc63a879d24083a2
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\gntuud.exeFilesize
331KB
MD5bcbc4a4faf06b1fa399e2107b6869b22
SHA11b96550abad623743c7e44c5116fda8388b8fcff
SHA2561f2a80d5d23e63f348c5aaa589f2c004235e1fb6298caf91d1b25773381a8d58
SHA512a8ec68e651fbec2fc2c52118c55eabb7e23bc0da4ba5b8f7cd321d34f4cb2be4fc770d0856117140c553238e341edb5b7f12c1c881fcfb73fc63a879d24083a2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
126KB
MD598cc0f811ad5ff43fedc262961002498
SHA137e48635fcef35c0b3db3c1f0c35833899eb53d8
SHA25662d5b300b911a022c5c146ea010769cd0c2fdcc86aba7e5be25aff1f799220be
SHA512d2ae90628acf92c6f7d176a4c866a0b6a6cfcfd722f0aec89cb48afead4318311c3ca95fe6865ac254b601b70ef5f289a35f4b26fba67a4c9b3cc5e68c7bf9c1
-
\Users\Admin\AppData\Local\Temp\7XtYN.V5Filesize
3.1MB
MD544ce4500d3429c08d64f5b03c982d6c7
SHA1aee441ec6ebd2975a385339939fe55f2cb75991e
SHA2564ab65f2873f36b6923fc57a71bf00f6589cbb4cc1f67a299d827536705574aab
SHA51241d329d063aa286fa3257b094915f4653dd641a13fce13bcc1498b3cec7ae3e3254ebe7ff762be679dfe0c287a4d1237facfd774319fd450ead5a049cd9a4348
-
\Users\Admin\AppData\Local\Temp\7XtYN.V5Filesize
3.1MB
MD544ce4500d3429c08d64f5b03c982d6c7
SHA1aee441ec6ebd2975a385339939fe55f2cb75991e
SHA2564ab65f2873f36b6923fc57a71bf00f6589cbb4cc1f67a299d827536705574aab
SHA51241d329d063aa286fa3257b094915f4653dd641a13fce13bcc1498b3cec7ae3e3254ebe7ff762be679dfe0c287a4d1237facfd774319fd450ead5a049cd9a4348
-
\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
126KB
MD598cc0f811ad5ff43fedc262961002498
SHA137e48635fcef35c0b3db3c1f0c35833899eb53d8
SHA25662d5b300b911a022c5c146ea010769cd0c2fdcc86aba7e5be25aff1f799220be
SHA512d2ae90628acf92c6f7d176a4c866a0b6a6cfcfd722f0aec89cb48afead4318311c3ca95fe6865ac254b601b70ef5f289a35f4b26fba67a4c9b3cc5e68c7bf9c1
-
memory/60-186-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/60-175-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/60-181-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/60-185-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/60-171-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/60-215-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/60-214-0x0000000000480000-0x000000000052E000-memory.dmpFilesize
696KB
-
memory/60-190-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/60-189-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/60-183-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/60-187-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/60-170-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/60-168-0x0000000000000000-mapping.dmp
-
memory/60-172-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/60-308-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/60-180-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/60-179-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/60-176-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/60-178-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/60-307-0x0000000000480000-0x000000000052E000-memory.dmpFilesize
696KB
-
memory/60-174-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/60-173-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/684-504-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/684-503-0x000000000081C000-0x000000000083A000-memory.dmpFilesize
120KB
-
memory/2344-627-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/2408-223-0x0000000000000000-mapping.dmp
-
memory/2692-145-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-135-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-159-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-160-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-161-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-162-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-163-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-164-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-165-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-166-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-167-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-157-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-156-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/2692-155-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-154-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-153-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-152-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-151-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-150-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-149-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-148-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-147-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-146-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-117-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-144-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-182-0x00000000021B0000-0x00000000021EE000-memory.dmpFilesize
248KB
-
memory/2692-184-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/2692-143-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-142-0x00000000021B0000-0x00000000021EE000-memory.dmpFilesize
248KB
-
memory/2692-141-0x0000000000560000-0x00000000006AA000-memory.dmpFilesize
1.3MB
-
memory/2692-140-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-139-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-138-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-137-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-136-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-158-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-118-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-134-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-133-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-131-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-130-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-119-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-120-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-129-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-128-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-127-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-126-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-125-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-121-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-122-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-123-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2692-124-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2740-509-0x0000000000000000-mapping.dmp
-
memory/3048-397-0x00000000052A0000-0x00000000053DF000-memory.dmpFilesize
1.2MB
-
memory/3048-322-0x0000000000000000-mapping.dmp
-
memory/3048-395-0x0000000004FC0000-0x0000000005298000-memory.dmpFilesize
2.8MB
-
memory/3048-445-0x00000000052A0000-0x00000000053DF000-memory.dmpFilesize
1.2MB
-
memory/4600-450-0x0000000006490000-0x000000000698E000-memory.dmpFilesize
5.0MB
-
memory/4600-482-0x0000000006A90000-0x0000000006AE0000-memory.dmpFilesize
320KB
-
memory/4600-460-0x0000000006330000-0x00000000063C2000-memory.dmpFilesize
584KB
-
memory/4600-462-0x0000000006B70000-0x0000000006D32000-memory.dmpFilesize
1.8MB
-
memory/4600-463-0x0000000007270000-0x000000000779C000-memory.dmpFilesize
5.2MB
-
memory/4600-432-0x0000000005980000-0x0000000005F86000-memory.dmpFilesize
6.0MB
-
memory/4600-481-0x0000000006A10000-0x0000000006A86000-memory.dmpFilesize
472KB
-
memory/4600-452-0x0000000005780000-0x00000000057E6000-memory.dmpFilesize
408KB
-
memory/4600-411-0x0000000000BA0000-0x0000000000BD2000-memory.dmpFilesize
200KB
-
memory/4600-433-0x00000000054C0000-0x00000000055CA000-memory.dmpFilesize
1.0MB
-
memory/4600-439-0x0000000005470000-0x00000000054BB000-memory.dmpFilesize
300KB
-
memory/4600-437-0x0000000005430000-0x000000000546E000-memory.dmpFilesize
248KB
-
memory/4600-361-0x0000000000000000-mapping.dmp
-
memory/4600-435-0x0000000005410000-0x0000000005422000-memory.dmpFilesize
72KB
-
memory/5092-251-0x0000000000000000-mapping.dmp