Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
15-11-2022 05:16
Static task
static1
Behavioral task
behavioral1
Sample
1904e154b1df12cd6c301715558741dff366b333bf3aea52624d4d9cba5607d7.exe
Resource
win10-20220812-en
General
-
Target
1904e154b1df12cd6c301715558741dff366b333bf3aea52624d4d9cba5607d7.exe
-
Size
233KB
-
MD5
adae8b4ffd76b2b57efaabbb1a35ecf7
-
SHA1
a2081c11015f8d5a43d9b957a1bdac1fe1490f52
-
SHA256
1904e154b1df12cd6c301715558741dff366b333bf3aea52624d4d9cba5607d7
-
SHA512
16716b9255ae9341beabb3fa19677829fef210285edfad4f466012b6106aa5aa39b11fe09c8d15bf2abf3e5a56cbc07fc711d5b99b5bd3a34c8672152f906581
-
SSDEEP
3072:ZXO+9FJLVU84/IW/F7nd+vTGMoGI267uiOhjSPL9Xlx1MLpvu55MW:9HrJLVI/I476TCw663hWj9XqdQ5
Malware Config
Extracted
redline
123
78.153.144.3:2510
-
auth_value
cd6abb0af211bce081d7bf127cc26835
Extracted
redline
rozena1114
jalocliche.xyz:81
chardhesha.xyz:81
-
auth_value
9fefd743a3b62bcd7c3e17a70fbdb3a8
Signatures
-
Detect Amadey credential stealer module 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll amadey_cred_module \Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll amadey_cred_module \Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll amadey_cred_module -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/3768-251-0x00000000025A0000-0x00000000025DE000-memory.dmp family_redline behavioral1/memory/3768-260-0x0000000002620000-0x000000000265C000-memory.dmp family_redline behavioral1/memory/4716-933-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 87 3732 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
484.exeCE2.exe1157.exerovwer.exerovwer.exepid process 3768 484.exe 4852 CE2.exe 2932 1157.exe 688 rovwer.exe 4612 rovwer.exe -
Deletes itself 1 IoCs
Processes:
pid process 2636 -
Loads dropped DLL 3 IoCs
Processes:
CE2.exerundll32.exepid process 4852 CE2.exe 3732 rundll32.exe 3732 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
CE2.exedescription pid process target process PID 4852 set thread context of 4716 4852 CE2.exe ngentask.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
1904e154b1df12cd6c301715558741dff366b333bf3aea52624d4d9cba5607d7.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1904e154b1df12cd6c301715558741dff366b333bf3aea52624d4d9cba5607d7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1904e154b1df12cd6c301715558741dff366b333bf3aea52624d4d9cba5607d7.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1904e154b1df12cd6c301715558741dff366b333bf3aea52624d4d9cba5607d7.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1904e154b1df12cd6c301715558741dff366b333bf3aea52624d4d9cba5607d7.exepid process 2628 1904e154b1df12cd6c301715558741dff366b333bf3aea52624d4d9cba5607d7.exe 2628 1904e154b1df12cd6c301715558741dff366b333bf3aea52624d4d9cba5607d7.exe 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2636 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
1904e154b1df12cd6c301715558741dff366b333bf3aea52624d4d9cba5607d7.exepid process 2628 1904e154b1df12cd6c301715558741dff366b333bf3aea52624d4d9cba5607d7.exe 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 2636 -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
484.exedescription pid process Token: SeDebugPrivilege 3768 484.exe Token: SeShutdownPrivilege 2636 Token: SeCreatePagefilePrivilege 2636 Token: SeShutdownPrivilege 2636 Token: SeCreatePagefilePrivilege 2636 Token: SeShutdownPrivilege 2636 Token: SeCreatePagefilePrivilege 2636 Token: SeShutdownPrivilege 2636 Token: SeCreatePagefilePrivilege 2636 Token: SeShutdownPrivilege 2636 Token: SeCreatePagefilePrivilege 2636 Token: SeShutdownPrivilege 2636 Token: SeCreatePagefilePrivilege 2636 Token: SeShutdownPrivilege 2636 Token: SeCreatePagefilePrivilege 2636 Token: SeShutdownPrivilege 2636 Token: SeCreatePagefilePrivilege 2636 Token: SeShutdownPrivilege 2636 Token: SeCreatePagefilePrivilege 2636 Token: SeShutdownPrivilege 2636 Token: SeCreatePagefilePrivilege 2636 Token: SeShutdownPrivilege 2636 Token: SeCreatePagefilePrivilege 2636 Token: SeShutdownPrivilege 2636 Token: SeCreatePagefilePrivilege 2636 Token: SeShutdownPrivilege 2636 Token: SeCreatePagefilePrivilege 2636 Token: SeShutdownPrivilege 2636 Token: SeCreatePagefilePrivilege 2636 Token: SeShutdownPrivilege 2636 Token: SeCreatePagefilePrivilege 2636 Token: SeShutdownPrivilege 2636 Token: SeCreatePagefilePrivilege 2636 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1157.exerovwer.execmd.exedescription pid process target process PID 2636 wrote to memory of 3768 2636 484.exe PID 2636 wrote to memory of 3768 2636 484.exe PID 2636 wrote to memory of 3768 2636 484.exe PID 2636 wrote to memory of 4852 2636 CE2.exe PID 2636 wrote to memory of 4852 2636 CE2.exe PID 2636 wrote to memory of 4852 2636 CE2.exe PID 2636 wrote to memory of 2932 2636 1157.exe PID 2636 wrote to memory of 2932 2636 1157.exe PID 2636 wrote to memory of 2932 2636 1157.exe PID 2636 wrote to memory of 4900 2636 explorer.exe PID 2636 wrote to memory of 4900 2636 explorer.exe PID 2636 wrote to memory of 4900 2636 explorer.exe PID 2636 wrote to memory of 4900 2636 explorer.exe PID 2636 wrote to memory of 1212 2636 explorer.exe PID 2636 wrote to memory of 1212 2636 explorer.exe PID 2636 wrote to memory of 1212 2636 explorer.exe PID 2636 wrote to memory of 3692 2636 explorer.exe PID 2636 wrote to memory of 3692 2636 explorer.exe PID 2636 wrote to memory of 3692 2636 explorer.exe PID 2636 wrote to memory of 3692 2636 explorer.exe PID 2636 wrote to memory of 4472 2636 explorer.exe PID 2636 wrote to memory of 4472 2636 explorer.exe PID 2636 wrote to memory of 4472 2636 explorer.exe PID 2636 wrote to memory of 5020 2636 explorer.exe PID 2636 wrote to memory of 5020 2636 explorer.exe PID 2636 wrote to memory of 5020 2636 explorer.exe PID 2636 wrote to memory of 5020 2636 explorer.exe PID 2636 wrote to memory of 3848 2636 explorer.exe PID 2636 wrote to memory of 3848 2636 explorer.exe PID 2636 wrote to memory of 3848 2636 explorer.exe PID 2636 wrote to memory of 3848 2636 explorer.exe PID 2932 wrote to memory of 688 2932 1157.exe rovwer.exe PID 2932 wrote to memory of 688 2932 1157.exe rovwer.exe PID 2932 wrote to memory of 688 2932 1157.exe rovwer.exe PID 2636 wrote to memory of 240 2636 explorer.exe PID 2636 wrote to memory of 240 2636 explorer.exe PID 2636 wrote to memory of 240 2636 explorer.exe PID 2636 wrote to memory of 240 2636 explorer.exe PID 2636 wrote to memory of 1268 2636 explorer.exe PID 2636 wrote to memory of 1268 2636 explorer.exe PID 2636 wrote to memory of 1268 2636 explorer.exe PID 2636 wrote to memory of 2400 2636 explorer.exe PID 2636 wrote to memory of 2400 2636 explorer.exe PID 2636 wrote to memory of 2400 2636 explorer.exe PID 2636 wrote to memory of 2400 2636 explorer.exe PID 688 wrote to memory of 4112 688 rovwer.exe schtasks.exe PID 688 wrote to memory of 4112 688 rovwer.exe schtasks.exe PID 688 wrote to memory of 4112 688 rovwer.exe schtasks.exe PID 688 wrote to memory of 620 688 rovwer.exe cmd.exe PID 688 wrote to memory of 620 688 rovwer.exe cmd.exe PID 688 wrote to memory of 620 688 rovwer.exe cmd.exe PID 620 wrote to memory of 276 620 cmd.exe cmd.exe PID 620 wrote to memory of 276 620 cmd.exe cmd.exe PID 620 wrote to memory of 276 620 cmd.exe cmd.exe PID 620 wrote to memory of 1112 620 cmd.exe cacls.exe PID 620 wrote to memory of 1112 620 cmd.exe cacls.exe PID 620 wrote to memory of 1112 620 cmd.exe cacls.exe PID 620 wrote to memory of 2136 620 cmd.exe cacls.exe PID 620 wrote to memory of 2136 620 cmd.exe cacls.exe PID 620 wrote to memory of 2136 620 cmd.exe cacls.exe PID 620 wrote to memory of 388 620 cmd.exe cmd.exe PID 620 wrote to memory of 388 620 cmd.exe cmd.exe PID 620 wrote to memory of 388 620 cmd.exe cmd.exe PID 620 wrote to memory of 1508 620 cmd.exe cacls.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1904e154b1df12cd6c301715558741dff366b333bf3aea52624d4d9cba5607d7.exe"C:\Users\Admin\AppData\Local\Temp\1904e154b1df12cd6c301715558741dff366b333bf3aea52624d4d9cba5607d7.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\484.exeC:\Users\Admin\AppData\Local\Temp\484.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CE2.exeC:\Users\Admin\AppData\Local\Temp\CE2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1157.exeC:\Users\Admin\AppData\Local\Temp\1157.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rovwer.exe" /P "Admin:N"&&CACLS "rovwer.exe" /P "Admin:R" /E&&echo Y|CACLS "..\99e342142d" /P "Admin:N"&&CACLS "..\99e342142d" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:N"4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:R" /E4⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- outlook_win_path
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeC:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1157.exeFilesize
271KB
MD58c3830054606135932a63fc941b27925
SHA1f70b0a5a1393b3578c49487559654a0c73dfea90
SHA256b1a27627a65dd9fc135f84a093efc92f59f3d93d732ff35e4a1a8670cd18fa95
SHA512432a72c4ae453adad1d26866841c2f939320b00b3969b031576022a6cabff870f6f33cdf191b55e630c7dad9195578f0eeae90719e55039844a54219eea5af1f
-
C:\Users\Admin\AppData\Local\Temp\1157.exeFilesize
271KB
MD58c3830054606135932a63fc941b27925
SHA1f70b0a5a1393b3578c49487559654a0c73dfea90
SHA256b1a27627a65dd9fc135f84a093efc92f59f3d93d732ff35e4a1a8670cd18fa95
SHA512432a72c4ae453adad1d26866841c2f939320b00b3969b031576022a6cabff870f6f33cdf191b55e630c7dad9195578f0eeae90719e55039844a54219eea5af1f
-
C:\Users\Admin\AppData\Local\Temp\484.exeFilesize
321KB
MD581b608da4d3e6ca063a59866ca57d715
SHA169e0df230d75141e188400bdf4df294013082de6
SHA256137262dfc1f2f0e5225160f7b72cdfcf94317c4b12049b77dd4f0cbbcdb291e6
SHA512fae8f8277e8e08212822a6841530ad1e55ff44f1cc70ff504b593a50500f963e64bba5a261d39caf872cce90ce8a01fc5af8ec38d2c407fa70a96c59162c45b1
-
C:\Users\Admin\AppData\Local\Temp\484.exeFilesize
321KB
MD581b608da4d3e6ca063a59866ca57d715
SHA169e0df230d75141e188400bdf4df294013082de6
SHA256137262dfc1f2f0e5225160f7b72cdfcf94317c4b12049b77dd4f0cbbcdb291e6
SHA512fae8f8277e8e08212822a6841530ad1e55ff44f1cc70ff504b593a50500f963e64bba5a261d39caf872cce90ce8a01fc5af8ec38d2c407fa70a96c59162c45b1
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
271KB
MD58c3830054606135932a63fc941b27925
SHA1f70b0a5a1393b3578c49487559654a0c73dfea90
SHA256b1a27627a65dd9fc135f84a093efc92f59f3d93d732ff35e4a1a8670cd18fa95
SHA512432a72c4ae453adad1d26866841c2f939320b00b3969b031576022a6cabff870f6f33cdf191b55e630c7dad9195578f0eeae90719e55039844a54219eea5af1f
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
271KB
MD58c3830054606135932a63fc941b27925
SHA1f70b0a5a1393b3578c49487559654a0c73dfea90
SHA256b1a27627a65dd9fc135f84a093efc92f59f3d93d732ff35e4a1a8670cd18fa95
SHA512432a72c4ae453adad1d26866841c2f939320b00b3969b031576022a6cabff870f6f33cdf191b55e630c7dad9195578f0eeae90719e55039844a54219eea5af1f
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exeFilesize
271KB
MD58c3830054606135932a63fc941b27925
SHA1f70b0a5a1393b3578c49487559654a0c73dfea90
SHA256b1a27627a65dd9fc135f84a093efc92f59f3d93d732ff35e4a1a8670cd18fa95
SHA512432a72c4ae453adad1d26866841c2f939320b00b3969b031576022a6cabff870f6f33cdf191b55e630c7dad9195578f0eeae90719e55039844a54219eea5af1f
-
C:\Users\Admin\AppData\Local\Temp\CE2.exeFilesize
1.1MB
MD55e7c07b9aa0668fa2971747bb4fade1e
SHA17fae544f73f2a8fb7a340a20ec47f76370fbd487
SHA256431a1c4ceae3411f5476eed27fc30ebd55138afb4c4e9dac3db9d4b8addbb361
SHA5125c9c65c99f0c8a5aaa2beac1a0c4304a1cb2ea808eeb6bbe11c2852d6e9fbad8bb68faa5f778848dade617e1c5ee1fb9dae566d7a064b05fdaa30a03019b868f
-
C:\Users\Admin\AppData\Local\Temp\CE2.exeFilesize
1.1MB
MD55e7c07b9aa0668fa2971747bb4fade1e
SHA17fae544f73f2a8fb7a340a20ec47f76370fbd487
SHA256431a1c4ceae3411f5476eed27fc30ebd55138afb4c4e9dac3db9d4b8addbb361
SHA5125c9c65c99f0c8a5aaa2beac1a0c4304a1cb2ea808eeb6bbe11c2852d6e9fbad8bb68faa5f778848dade617e1c5ee1fb9dae566d7a064b05fdaa30a03019b868f
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
126KB
MD5507e9dc7b9c42f535b6df96d79179835
SHA1acf41fb549750023115f060071aa5ca8c33f249e
SHA2563b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af
SHA51270907ec4c395b0d2219bfe98907ec130bfcbc6d4bec7bd73965a9b1e422553e27daaead3d6647620fcf5392d85a2e975bce0f7c79c0bc665dd33ce65f7d44302
-
\Users\Admin\AppData\Local\Temp\advapi32.dllFilesize
1.1MB
MD5486536825ff5e3219a8702319e064907
SHA134f7f9211e2fd9c166fb36ed1d4121ebd427bebd
SHA2566ab2023a2bd76692a694a812bf86c341696810c61666586c09a343832f05dc01
SHA512f77404db724b9f8e93d84f2f9f0cee10b05638bda4445facbfd262eca52f073e285c10f153133fc35f9a426eb84e87e8e0b320f2815b2405ca3ada7ac2fded4c
-
\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
126KB
MD5507e9dc7b9c42f535b6df96d79179835
SHA1acf41fb549750023115f060071aa5ca8c33f249e
SHA2563b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af
SHA51270907ec4c395b0d2219bfe98907ec130bfcbc6d4bec7bd73965a9b1e422553e27daaead3d6647620fcf5392d85a2e975bce0f7c79c0bc665dd33ce65f7d44302
-
\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
126KB
MD5507e9dc7b9c42f535b6df96d79179835
SHA1acf41fb549750023115f060071aa5ca8c33f249e
SHA2563b82a0ea49d855327b64073872ebb6b63eee056e182be6b1935aa512628252af
SHA51270907ec4c395b0d2219bfe98907ec130bfcbc6d4bec7bd73965a9b1e422553e27daaead3d6647620fcf5392d85a2e975bce0f7c79c0bc665dd33ce65f7d44302
-
memory/240-985-0x00000000005E0000-0x00000000005E6000-memory.dmpFilesize
24KB
-
memory/240-722-0x00000000005D0000-0x00000000005DB000-memory.dmpFilesize
44KB
-
memory/240-719-0x00000000005E0000-0x00000000005E6000-memory.dmpFilesize
24KB
-
memory/240-440-0x0000000000000000-mapping.dmp
-
memory/276-803-0x0000000000000000-mapping.dmp
-
memory/388-856-0x0000000000000000-mapping.dmp
-
memory/620-768-0x0000000000000000-mapping.dmp
-
memory/688-732-0x0000000000400000-0x0000000000846000-memory.dmpFilesize
4.3MB
-
memory/688-980-0x0000000000400000-0x0000000000846000-memory.dmpFilesize
4.3MB
-
memory/688-979-0x0000000000940000-0x0000000000A8A000-memory.dmpFilesize
1.3MB
-
memory/688-687-0x0000000000940000-0x0000000000A8A000-memory.dmpFilesize
1.3MB
-
memory/688-424-0x0000000000000000-mapping.dmp
-
memory/1112-817-0x0000000000000000-mapping.dmp
-
memory/1212-676-0x0000000000680000-0x0000000000689000-memory.dmpFilesize
36KB
-
memory/1212-296-0x0000000000680000-0x0000000000689000-memory.dmpFilesize
36KB
-
memory/1212-280-0x0000000000000000-mapping.dmp
-
memory/1212-298-0x00000000003F0000-0x00000000003FF000-memory.dmpFilesize
60KB
-
memory/1268-528-0x0000000000E00000-0x0000000000E07000-memory.dmpFilesize
28KB
-
memory/1268-497-0x0000000000BF0000-0x0000000000BFD000-memory.dmpFilesize
52KB
-
memory/1268-474-0x0000000000000000-mapping.dmp
-
memory/1268-865-0x0000000000E00000-0x0000000000E07000-memory.dmpFilesize
28KB
-
memory/1508-858-0x0000000000000000-mapping.dmp
-
memory/2136-842-0x0000000000000000-mapping.dmp
-
memory/2220-877-0x0000000000000000-mapping.dmp
-
memory/2400-508-0x0000000000000000-mapping.dmp
-
memory/2400-987-0x0000000000A90000-0x0000000000A98000-memory.dmpFilesize
32KB
-
memory/2400-737-0x0000000000A90000-0x0000000000A98000-memory.dmpFilesize
32KB
-
memory/2400-767-0x0000000000A80000-0x0000000000A8B000-memory.dmpFilesize
44KB
-
memory/2628-144-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-127-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-142-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-149-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-135-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-145-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-141-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-139-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-140-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-120-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-146-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-147-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-138-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-158-0x0000000000400000-0x000000000083D000-memory.dmpFilesize
4.2MB
-
memory/2628-136-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-137-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-134-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-133-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-157-0x0000000000400000-0x000000000083D000-memory.dmpFilesize
4.2MB
-
memory/2628-156-0x00000000008E0000-0x000000000098E000-memory.dmpFilesize
696KB
-
memory/2628-132-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-131-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-130-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-148-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-129-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-155-0x00000000008E0000-0x000000000098E000-memory.dmpFilesize
696KB
-
memory/2628-150-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-121-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-128-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-153-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-154-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-122-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-152-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-126-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-151-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-125-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-124-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2628-123-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/2932-439-0x0000000000400000-0x0000000000846000-memory.dmpFilesize
4.3MB
-
memory/2932-201-0x0000000000000000-mapping.dmp
-
memory/2932-434-0x0000000002440000-0x000000000247E000-memory.dmpFilesize
248KB
-
memory/2932-333-0x0000000000400000-0x0000000000846000-memory.dmpFilesize
4.3MB
-
memory/2932-290-0x0000000000850000-0x00000000008FE000-memory.dmpFilesize
696KB
-
memory/2932-294-0x0000000002440000-0x000000000247E000-memory.dmpFilesize
248KB
-
memory/3692-550-0x0000000000670000-0x0000000000675000-memory.dmpFilesize
20KB
-
memory/3692-307-0x0000000000000000-mapping.dmp
-
memory/3692-586-0x0000000000660000-0x0000000000669000-memory.dmpFilesize
36KB
-
memory/3732-997-0x0000000000000000-mapping.dmp
-
memory/3768-161-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-174-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-260-0x0000000002620000-0x000000000265C000-memory.dmpFilesize
240KB
-
memory/3768-159-0x0000000000000000-mapping.dmp
-
memory/3768-162-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-163-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-164-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-165-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-396-0x00000000053C0000-0x00000000059C6000-memory.dmpFilesize
6.0MB
-
memory/3768-995-0x0000000000400000-0x00000000005A8000-memory.dmpFilesize
1.7MB
-
memory/3768-166-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-403-0x0000000005290000-0x000000000539A000-memory.dmpFilesize
1.0MB
-
memory/3768-256-0x0000000004D90000-0x000000000528E000-memory.dmpFilesize
5.0MB
-
memory/3768-251-0x00000000025A0000-0x00000000025DE000-memory.dmpFilesize
248KB
-
memory/3768-167-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-225-0x0000000000400000-0x00000000005A8000-memory.dmpFilesize
1.7MB
-
memory/3768-189-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-170-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-429-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/3768-416-0x0000000004D00000-0x0000000004D12000-memory.dmpFilesize
72KB
-
memory/3768-464-0x0000000005AD0000-0x0000000005B1B000-memory.dmpFilesize
300KB
-
memory/3768-192-0x00000000005B0000-0x000000000065E000-memory.dmpFilesize
696KB
-
memory/3768-485-0x00000000005B0000-0x000000000065E000-memory.dmpFilesize
696KB
-
memory/3768-491-0x00000000021E0000-0x000000000221E000-memory.dmpFilesize
248KB
-
memory/3768-982-0x0000000007470000-0x000000000799C000-memory.dmpFilesize
5.2MB
-
memory/3768-981-0x00000000072A0000-0x0000000007462000-memory.dmpFilesize
1.8MB
-
memory/3768-196-0x00000000021E0000-0x000000000221E000-memory.dmpFilesize
248KB
-
memory/3768-195-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-536-0x0000000000400000-0x00000000005A8000-memory.dmpFilesize
1.7MB
-
memory/3768-171-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-191-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-190-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-172-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-267-0x0000000004BD0000-0x0000000004C62000-memory.dmpFilesize
584KB
-
memory/3768-188-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-175-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-173-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-169-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-715-0x0000000005C40000-0x0000000005CA6000-memory.dmpFilesize
408KB
-
memory/3768-187-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-176-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3768-184-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/3848-679-0x00000000005D0000-0x00000000005D5000-memory.dmpFilesize
20KB
-
memory/3848-401-0x0000000000000000-mapping.dmp
-
memory/3848-965-0x00000000005D0000-0x00000000005D5000-memory.dmpFilesize
20KB
-
memory/3848-683-0x00000000005C0000-0x00000000005C9000-memory.dmpFilesize
36KB
-
memory/4112-763-0x0000000000000000-mapping.dmp
-
memory/4472-339-0x0000000000000000-mapping.dmp
-
memory/4472-367-0x0000000000190000-0x0000000000196000-memory.dmpFilesize
24KB
-
memory/4472-765-0x0000000000190000-0x0000000000196000-memory.dmpFilesize
24KB
-
memory/4472-371-0x0000000000180000-0x000000000018C000-memory.dmpFilesize
48KB
-
memory/4612-1114-0x0000000000400000-0x0000000000846000-memory.dmpFilesize
4.3MB
-
memory/4716-933-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4852-841-0x0000000011340000-0x00000000114BF000-memory.dmpFilesize
1.5MB
-
memory/4852-194-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/4852-182-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/4852-185-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/4852-183-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/4852-735-0x0000000000E80000-0x0000000000F7F000-memory.dmpFilesize
1020KB
-
memory/4852-186-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/4852-543-0x00000000028D0000-0x0000000002DE9000-memory.dmpFilesize
5.1MB
-
memory/4852-197-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/4852-180-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/4852-179-0x0000000077C80000-0x0000000077E0E000-memory.dmpFilesize
1.6MB
-
memory/4852-229-0x00000000028D0000-0x0000000002DE9000-memory.dmpFilesize
5.1MB
-
memory/4852-986-0x0000000000E80000-0x0000000000F7F000-memory.dmpFilesize
1020KB
-
memory/4852-177-0x0000000000000000-mapping.dmp
-
memory/4900-406-0x0000000000CB0000-0x0000000000CB7000-memory.dmpFilesize
28KB
-
memory/4900-448-0x0000000000CA0000-0x0000000000CAB000-memory.dmpFilesize
44KB
-
memory/4900-257-0x0000000000000000-mapping.dmp
-
memory/5020-647-0x0000000000800000-0x0000000000822000-memory.dmpFilesize
136KB
-
memory/5020-372-0x0000000000000000-mapping.dmp
-
memory/5020-962-0x0000000000800000-0x0000000000822000-memory.dmpFilesize
136KB
-
memory/5020-651-0x00000000005D0000-0x00000000005F7000-memory.dmpFilesize
156KB