Analysis
-
max time kernel
163s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
06-12-2022 10:25
Static task
static1
Behavioral task
behavioral1
Sample
45f5d001df4f8e4cf4cd1c271443184d89298f141c2973a4252ca6e6b50a3d0f.exe
Resource
win10-20220812-en
General
-
Target
45f5d001df4f8e4cf4cd1c271443184d89298f141c2973a4252ca6e6b50a3d0f.exe
-
Size
359KB
-
MD5
e3fd151f5354feffa3ae6a284458c87f
-
SHA1
bf49e09e5590833fa84ae977a2c96afdd8d7a321
-
SHA256
45f5d001df4f8e4cf4cd1c271443184d89298f141c2973a4252ca6e6b50a3d0f
-
SHA512
126dfc20fae95c6838d036407b8cf9d4d12a6915eb618a1e361223184170a6894f7a6a2aaf250a4357ef447aaa1ed83a77e5277d49b5c0a2a353a689f23a51f9
-
SSDEEP
6144:fBX5jyr2LSFHl90etgI8cerpo+yuJR6rRXRXZ4F:fBXVyyeFHl902gI8cerprzaRXL4F
Malware Config
Extracted
amadey
3.50
31.41.244.167/v7eWcjs/index.php
Extracted
redline
nosh
31.41.244.14:4683
-
auth_value
7455ba4498ca1bfb73b0efbf830fb9b4
Signatures
-
Detect Amadey credential stealer module 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll amadey_cred_module \Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll amadey_cred_module -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 11 3592 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
Processes:
gntuud.exelinda5.exenash.exegntuud.exegntuud.exegntuud.exepid process 2108 gntuud.exe 3196 linda5.exe 3360 nash.exe 2492 gntuud.exe 3004 gntuud.exe 808 gntuud.exe -
Loads dropped DLL 3 IoCs
Processes:
rundll32.exerundll32.exerundll32.exepid process 824 rundll32.exe 2280 rundll32.exe 3592 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
gntuud.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\linda5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000012001\\linda5.exe" gntuud.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\nash.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000013001\\nash.exe" gntuud.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 1 IoCs
Processes:
linda5.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings linda5.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
nash.exerundll32.exepid process 3360 nash.exe 3360 nash.exe 3592 rundll32.exe 3592 rundll32.exe 3592 rundll32.exe 3592 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nash.exedescription pid process Token: SeDebugPrivilege 3360 nash.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
45f5d001df4f8e4cf4cd1c271443184d89298f141c2973a4252ca6e6b50a3d0f.exegntuud.exelinda5.execontrol.exerundll32.exeRunDll32.exedescription pid process target process PID 4036 wrote to memory of 2108 4036 45f5d001df4f8e4cf4cd1c271443184d89298f141c2973a4252ca6e6b50a3d0f.exe gntuud.exe PID 4036 wrote to memory of 2108 4036 45f5d001df4f8e4cf4cd1c271443184d89298f141c2973a4252ca6e6b50a3d0f.exe gntuud.exe PID 4036 wrote to memory of 2108 4036 45f5d001df4f8e4cf4cd1c271443184d89298f141c2973a4252ca6e6b50a3d0f.exe gntuud.exe PID 2108 wrote to memory of 3848 2108 gntuud.exe schtasks.exe PID 2108 wrote to memory of 3848 2108 gntuud.exe schtasks.exe PID 2108 wrote to memory of 3848 2108 gntuud.exe schtasks.exe PID 2108 wrote to memory of 3196 2108 gntuud.exe linda5.exe PID 2108 wrote to memory of 3196 2108 gntuud.exe linda5.exe PID 2108 wrote to memory of 3196 2108 gntuud.exe linda5.exe PID 3196 wrote to memory of 4288 3196 linda5.exe control.exe PID 3196 wrote to memory of 4288 3196 linda5.exe control.exe PID 3196 wrote to memory of 4288 3196 linda5.exe control.exe PID 4288 wrote to memory of 824 4288 control.exe rundll32.exe PID 4288 wrote to memory of 824 4288 control.exe rundll32.exe PID 4288 wrote to memory of 824 4288 control.exe rundll32.exe PID 2108 wrote to memory of 3360 2108 gntuud.exe nash.exe PID 2108 wrote to memory of 3360 2108 gntuud.exe nash.exe PID 2108 wrote to memory of 3360 2108 gntuud.exe nash.exe PID 824 wrote to memory of 3104 824 rundll32.exe RunDll32.exe PID 824 wrote to memory of 3104 824 rundll32.exe RunDll32.exe PID 3104 wrote to memory of 2280 3104 RunDll32.exe rundll32.exe PID 3104 wrote to memory of 2280 3104 RunDll32.exe rundll32.exe PID 3104 wrote to memory of 2280 3104 RunDll32.exe rundll32.exe PID 2108 wrote to memory of 3592 2108 gntuud.exe rundll32.exe PID 2108 wrote to memory of 3592 2108 gntuud.exe rundll32.exe PID 2108 wrote to memory of 3592 2108 gntuud.exe rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45f5d001df4f8e4cf4cd1c271443184d89298f141c2973a4252ca6e6b50a3d0f.exe"C:\Users\Admin\AppData\Local\Temp\45f5d001df4f8e4cf4cd1c271443184d89298f141c2973a4252ca6e6b50a3d0f.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000012001\linda5.exe"C:\Users\Admin\AppData\Local\Temp\1000012001\linda5.exe"3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\Mh3S.cPL",4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\Mh3S.cPL",5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\Mh3S.cPL",6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\Mh3S.cPL",7⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1000013001\nash.exe"C:\Users\Admin\AppData\Local\Temp\1000013001\nash.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeC:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeC:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeC:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000012001\linda5.exeFilesize
2.1MB
MD5b47357997a325e63a00c2b90013b60c9
SHA173a1359ab64bf57b5fc6c93c243564cb6374b46f
SHA256d43e5f2eba52317cd2e284c356f5aedfd40de74cd1074a02b6f3a0e2840bd3a8
SHA512f8e158c27c62189a6fbf070451d8a234c0e6c97fc515aede4b218269747e492137927fee009192afe0ec8901e82254daa4d0cdcc4a6be953536e9a66baca2474
-
C:\Users\Admin\AppData\Local\Temp\1000012001\linda5.exeFilesize
2.1MB
MD5b47357997a325e63a00c2b90013b60c9
SHA173a1359ab64bf57b5fc6c93c243564cb6374b46f
SHA256d43e5f2eba52317cd2e284c356f5aedfd40de74cd1074a02b6f3a0e2840bd3a8
SHA512f8e158c27c62189a6fbf070451d8a234c0e6c97fc515aede4b218269747e492137927fee009192afe0ec8901e82254daa4d0cdcc4a6be953536e9a66baca2474
-
C:\Users\Admin\AppData\Local\Temp\1000013001\nash.exeFilesize
175KB
MD5f9021651b165064dfbe6662f543e1792
SHA1104ab0e4fb3302dd77489f9d41ee28b60d06adc0
SHA256fc0e730c9b09606eb09f91f39d9e780f005bd0f1674ee411cbb0de75acbe4bae
SHA5121b747dd451092bfa6115c0993e7ad84b4262cbf4b0b91f6418544d5796d145b9cc6fec8bcf4b6a63644b9458f987469ded3580ac6aa378cb435fe86fe14ab96f
-
C:\Users\Admin\AppData\Local\Temp\1000013001\nash.exeFilesize
175KB
MD5f9021651b165064dfbe6662f543e1792
SHA1104ab0e4fb3302dd77489f9d41ee28b60d06adc0
SHA256fc0e730c9b09606eb09f91f39d9e780f005bd0f1674ee411cbb0de75acbe4bae
SHA5121b747dd451092bfa6115c0993e7ad84b4262cbf4b0b91f6418544d5796d145b9cc6fec8bcf4b6a63644b9458f987469ded3580ac6aa378cb435fe86fe14ab96f
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
359KB
MD5e3fd151f5354feffa3ae6a284458c87f
SHA1bf49e09e5590833fa84ae977a2c96afdd8d7a321
SHA25645f5d001df4f8e4cf4cd1c271443184d89298f141c2973a4252ca6e6b50a3d0f
SHA512126dfc20fae95c6838d036407b8cf9d4d12a6915eb618a1e361223184170a6894f7a6a2aaf250a4357ef447aaa1ed83a77e5277d49b5c0a2a353a689f23a51f9
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
359KB
MD5e3fd151f5354feffa3ae6a284458c87f
SHA1bf49e09e5590833fa84ae977a2c96afdd8d7a321
SHA25645f5d001df4f8e4cf4cd1c271443184d89298f141c2973a4252ca6e6b50a3d0f
SHA512126dfc20fae95c6838d036407b8cf9d4d12a6915eb618a1e361223184170a6894f7a6a2aaf250a4357ef447aaa1ed83a77e5277d49b5c0a2a353a689f23a51f9
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
359KB
MD5e3fd151f5354feffa3ae6a284458c87f
SHA1bf49e09e5590833fa84ae977a2c96afdd8d7a321
SHA25645f5d001df4f8e4cf4cd1c271443184d89298f141c2973a4252ca6e6b50a3d0f
SHA512126dfc20fae95c6838d036407b8cf9d4d12a6915eb618a1e361223184170a6894f7a6a2aaf250a4357ef447aaa1ed83a77e5277d49b5c0a2a353a689f23a51f9
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
359KB
MD5e3fd151f5354feffa3ae6a284458c87f
SHA1bf49e09e5590833fa84ae977a2c96afdd8d7a321
SHA25645f5d001df4f8e4cf4cd1c271443184d89298f141c2973a4252ca6e6b50a3d0f
SHA512126dfc20fae95c6838d036407b8cf9d4d12a6915eb618a1e361223184170a6894f7a6a2aaf250a4357ef447aaa1ed83a77e5277d49b5c0a2a353a689f23a51f9
-
C:\Users\Admin\AppData\Local\Temp\3f904562a0\gntuud.exeFilesize
359KB
MD5e3fd151f5354feffa3ae6a284458c87f
SHA1bf49e09e5590833fa84ae977a2c96afdd8d7a321
SHA25645f5d001df4f8e4cf4cd1c271443184d89298f141c2973a4252ca6e6b50a3d0f
SHA512126dfc20fae95c6838d036407b8cf9d4d12a6915eb618a1e361223184170a6894f7a6a2aaf250a4357ef447aaa1ed83a77e5277d49b5c0a2a353a689f23a51f9
-
C:\Users\Admin\AppData\Local\Temp\Mh3S.cPLFilesize
3.2MB
MD527792968ec2904b771fbd0d9fc288435
SHA1223b49526c963bd365004b11ec29df20dd4168ce
SHA2569a4f7dc41257dd244a00ae4808527a7790f8f3e5bed11ccf4e80f9be9e582cbd
SHA51279dee9573feeb9feb0720e7d9f16c864b7ff961fb0a2dd6a7a65ff6beec2f53241cd967b579b6e28ce59140ce1caf98253f4a32fd6f31e27a0efebd8a8e0af15
-
C:\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dllFilesize
126KB
MD5aebf8cd9ea982decded5ee6f3777c6d7
SHA1406e723158cd5697503d1d04839d3bc7a5051603
SHA256104af593683398f0980f2c86e6513b8c1b7dededc1f924d4693ad92410d51a62
SHA512f28fbb9b155348a6aca1105abf6f88640bb68374c07e023a7c9e06577006002d09b53b7629923c2486d7e9811f7254a296d19e566940077431e5089b06a13981
-
\Users\Admin\AppData\Local\Temp\Mh3S.cplFilesize
3.2MB
MD527792968ec2904b771fbd0d9fc288435
SHA1223b49526c963bd365004b11ec29df20dd4168ce
SHA2569a4f7dc41257dd244a00ae4808527a7790f8f3e5bed11ccf4e80f9be9e582cbd
SHA51279dee9573feeb9feb0720e7d9f16c864b7ff961fb0a2dd6a7a65ff6beec2f53241cd967b579b6e28ce59140ce1caf98253f4a32fd6f31e27a0efebd8a8e0af15
-
\Users\Admin\AppData\Local\Temp\Mh3S.cplFilesize
3.2MB
MD527792968ec2904b771fbd0d9fc288435
SHA1223b49526c963bd365004b11ec29df20dd4168ce
SHA2569a4f7dc41257dd244a00ae4808527a7790f8f3e5bed11ccf4e80f9be9e582cbd
SHA51279dee9573feeb9feb0720e7d9f16c864b7ff961fb0a2dd6a7a65ff6beec2f53241cd967b579b6e28ce59140ce1caf98253f4a32fd6f31e27a0efebd8a8e0af15
-
\Users\Admin\AppData\Roaming\56a1c3d463f381\cred64.dllFilesize
126KB
MD5aebf8cd9ea982decded5ee6f3777c6d7
SHA1406e723158cd5697503d1d04839d3bc7a5051603
SHA256104af593683398f0980f2c86e6513b8c1b7dededc1f924d4693ad92410d51a62
SHA512f28fbb9b155348a6aca1105abf6f88640bb68374c07e023a7c9e06577006002d09b53b7629923c2486d7e9811f7254a296d19e566940077431e5089b06a13981
-
memory/808-752-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/824-405-0x0000000004FE0000-0x00000000052CD000-memory.dmpFilesize
2.9MB
-
memory/824-358-0x0000000000000000-mapping.dmp
-
memory/824-406-0x0000000005420000-0x0000000005568000-memory.dmpFilesize
1.3MB
-
memory/824-598-0x0000000005420000-0x0000000005568000-memory.dmpFilesize
1.3MB
-
memory/2108-454-0x0000000000460000-0x00000000005AA000-memory.dmpFilesize
1.3MB
-
memory/2108-179-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/2108-172-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/2108-169-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/2108-168-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/2108-166-0x0000000000000000-mapping.dmp
-
memory/2108-174-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/2108-176-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/2108-175-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/2108-178-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/2108-463-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/2108-452-0x00000000006D1000-0x00000000006F0000-memory.dmpFilesize
124KB
-
memory/2108-171-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/2108-216-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/2108-188-0x00000000006D1000-0x00000000006F0000-memory.dmpFilesize
124KB
-
memory/2108-191-0x0000000000460000-0x00000000005AA000-memory.dmpFilesize
1.3MB
-
memory/2108-189-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/2108-187-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/2108-186-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/2108-185-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/2108-184-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/2108-183-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/2108-182-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/2108-181-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/2108-180-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/2280-520-0x0000000000000000-mapping.dmp
-
memory/2280-567-0x00000000051D0000-0x0000000005318000-memory.dmpFilesize
1.3MB
-
memory/2280-566-0x0000000004D90000-0x000000000507D000-memory.dmpFilesize
2.9MB
-
memory/2280-597-0x00000000051D0000-0x0000000005318000-memory.dmpFilesize
1.3MB
-
memory/2492-512-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/3004-716-0x00000000007D4000-0x00000000007F3000-memory.dmpFilesize
124KB
-
memory/3004-717-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/3104-519-0x0000000000000000-mapping.dmp
-
memory/3196-248-0x0000000000000000-mapping.dmp
-
memory/3360-477-0x00000000049A0000-0x00000000049B2000-memory.dmpFilesize
72KB
-
memory/3360-572-0x0000000004DF0000-0x0000000004E56000-memory.dmpFilesize
408KB
-
memory/3360-407-0x0000000000000000-mapping.dmp
-
memory/3360-586-0x00000000064E0000-0x0000000006530000-memory.dmpFilesize
320KB
-
memory/3360-585-0x0000000006460000-0x00000000064D6000-memory.dmpFilesize
472KB
-
memory/3360-581-0x0000000006810000-0x0000000006D3C000-memory.dmpFilesize
5.2MB
-
memory/3360-580-0x0000000006110000-0x00000000062D2000-memory.dmpFilesize
1.8MB
-
memory/3360-450-0x0000000000150000-0x0000000000182000-memory.dmpFilesize
200KB
-
memory/3360-569-0x0000000005A40000-0x0000000005F3E000-memory.dmpFilesize
5.0MB
-
memory/3360-568-0x0000000004D50000-0x0000000004DE2000-memory.dmpFilesize
584KB
-
memory/3360-481-0x0000000004B80000-0x0000000004BCB000-memory.dmpFilesize
300KB
-
memory/3360-479-0x0000000004A20000-0x0000000004A5E000-memory.dmpFilesize
248KB
-
memory/3360-475-0x0000000004A70000-0x0000000004B7A000-memory.dmpFilesize
1.0MB
-
memory/3360-474-0x0000000004F30000-0x0000000005536000-memory.dmpFilesize
6.0MB
-
memory/3592-600-0x0000000000000000-mapping.dmp
-
memory/3848-220-0x0000000000000000-mapping.dmp
-
memory/4036-127-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-158-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-152-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-151-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-150-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-149-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-154-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-134-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-148-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-133-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-117-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-132-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-131-0x00000000001C0000-0x00000000001FE000-memory.dmpFilesize
248KB
-
memory/4036-130-0x00000000004E0000-0x000000000062A000-memory.dmpFilesize
1.3MB
-
memory/4036-129-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-128-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-136-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-155-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-126-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-125-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-156-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/4036-147-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-116-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-146-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-157-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-153-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-137-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-159-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-160-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-145-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-144-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-143-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-124-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-142-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-141-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-161-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-162-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-135-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-163-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-164-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-165-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-170-0x00000000001C0000-0x00000000001FE000-memory.dmpFilesize
248KB
-
memory/4036-140-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-122-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-173-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/4036-121-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-120-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-119-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-139-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-138-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4036-118-0x0000000077C20000-0x0000000077DAE000-memory.dmpFilesize
1.6MB
-
memory/4288-313-0x0000000000000000-mapping.dmp