Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-01-2021 15:25
Static task
static1
Behavioral task
behavioral1
Sample
aqw.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
aqw.exe
Resource
win10v20201028
General
-
Target
aqw.exe
-
Size
1.7MB
-
MD5
c4b5c5da311f94d1df0ae07b51c03f71
-
SHA1
57caade886741b41fd1766af6ebc57caee772909
-
SHA256
adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
-
SHA512
42a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
Malware Config
Extracted
remcos
swryijgrvcsgkopnmcdertvgdswbvmophtfdczxs.ydns.eu:2017
Signatures
-
Executes dropped EXE 9 IoCs
Processes:
vlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exepid process 472 vlc.exe 1316 vlc.exe 1384 vlc.exe 1484 vlc.exe 1732 vlc.exe 1552 vlc.exe 1236 vlc.exe 332 vlc.exe 436 vlc.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1648 cmd.exe 1648 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
vlc.exeaqw.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" vlc.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ aqw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" aqw.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vlc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
Processes:
aqw.exevlc.exepid process 932 aqw.exe 932 aqw.exe 932 aqw.exe 932 aqw.exe 932 aqw.exe 932 aqw.exe 932 aqw.exe 472 vlc.exe 472 vlc.exe 472 vlc.exe 472 vlc.exe 472 vlc.exe 472 vlc.exe 472 vlc.exe 472 vlc.exe -
Suspicious use of SetThreadContext 7 IoCs
Processes:
aqw.exevlc.exevlc.exedescription pid process target process PID 932 set thread context of 1680 932 aqw.exe aqw.exe PID 472 set thread context of 1484 472 vlc.exe vlc.exe PID 1484 set thread context of 1732 1484 vlc.exe vlc.exe PID 1484 set thread context of 1552 1484 vlc.exe vlc.exe PID 1484 set thread context of 1236 1484 vlc.exe vlc.exe PID 1484 set thread context of 332 1484 vlc.exe vlc.exe PID 1484 set thread context of 436 1484 vlc.exe vlc.exe -
Delays execution with timeout.exe 6 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 1644 timeout.exe 1504 timeout.exe 1184 timeout.exe 628 timeout.exe 1964 timeout.exe 1384 timeout.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
aqw.exevlc.exevlc.exevlc.exepid process 932 aqw.exe 932 aqw.exe 932 aqw.exe 472 vlc.exe 472 vlc.exe 472 vlc.exe 472 vlc.exe 472 vlc.exe 472 vlc.exe 472 vlc.exe 1732 vlc.exe 1236 vlc.exe 1236 vlc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
aqw.exevlc.exevlc.exedescription pid process Token: SeDebugPrivilege 932 aqw.exe Token: SeDebugPrivilege 472 vlc.exe Token: SeDebugPrivilege 332 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 1484 vlc.exe -
Suspicious use of WriteProcessMemory 143 IoCs
Processes:
aqw.execmd.execmd.execmd.exeaqw.exeWScript.execmd.exevlc.execmd.execmd.exedescription pid process target process PID 932 wrote to memory of 1984 932 aqw.exe cmd.exe PID 932 wrote to memory of 1984 932 aqw.exe cmd.exe PID 932 wrote to memory of 1984 932 aqw.exe cmd.exe PID 932 wrote to memory of 1984 932 aqw.exe cmd.exe PID 1984 wrote to memory of 1964 1984 cmd.exe timeout.exe PID 1984 wrote to memory of 1964 1984 cmd.exe timeout.exe PID 1984 wrote to memory of 1964 1984 cmd.exe timeout.exe PID 1984 wrote to memory of 1964 1984 cmd.exe timeout.exe PID 932 wrote to memory of 1360 932 aqw.exe cmd.exe PID 932 wrote to memory of 1360 932 aqw.exe cmd.exe PID 932 wrote to memory of 1360 932 aqw.exe cmd.exe PID 932 wrote to memory of 1360 932 aqw.exe cmd.exe PID 1360 wrote to memory of 1384 1360 cmd.exe timeout.exe PID 1360 wrote to memory of 1384 1360 cmd.exe timeout.exe PID 1360 wrote to memory of 1384 1360 cmd.exe timeout.exe PID 1360 wrote to memory of 1384 1360 cmd.exe timeout.exe PID 932 wrote to memory of 1684 932 aqw.exe cmd.exe PID 932 wrote to memory of 1684 932 aqw.exe cmd.exe PID 932 wrote to memory of 1684 932 aqw.exe cmd.exe PID 932 wrote to memory of 1684 932 aqw.exe cmd.exe PID 1684 wrote to memory of 1644 1684 cmd.exe timeout.exe PID 1684 wrote to memory of 1644 1684 cmd.exe timeout.exe PID 1684 wrote to memory of 1644 1684 cmd.exe timeout.exe PID 1684 wrote to memory of 1644 1684 cmd.exe timeout.exe PID 932 wrote to memory of 1680 932 aqw.exe aqw.exe PID 932 wrote to memory of 1680 932 aqw.exe aqw.exe PID 932 wrote to memory of 1680 932 aqw.exe aqw.exe PID 932 wrote to memory of 1680 932 aqw.exe aqw.exe PID 932 wrote to memory of 1680 932 aqw.exe aqw.exe PID 932 wrote to memory of 1680 932 aqw.exe aqw.exe PID 932 wrote to memory of 1680 932 aqw.exe aqw.exe PID 932 wrote to memory of 1680 932 aqw.exe aqw.exe PID 932 wrote to memory of 1680 932 aqw.exe aqw.exe PID 932 wrote to memory of 1680 932 aqw.exe aqw.exe PID 932 wrote to memory of 1680 932 aqw.exe aqw.exe PID 1680 wrote to memory of 568 1680 aqw.exe WScript.exe PID 1680 wrote to memory of 568 1680 aqw.exe WScript.exe PID 1680 wrote to memory of 568 1680 aqw.exe WScript.exe PID 1680 wrote to memory of 568 1680 aqw.exe WScript.exe PID 568 wrote to memory of 1648 568 WScript.exe cmd.exe PID 568 wrote to memory of 1648 568 WScript.exe cmd.exe PID 568 wrote to memory of 1648 568 WScript.exe cmd.exe PID 568 wrote to memory of 1648 568 WScript.exe cmd.exe PID 1648 wrote to memory of 472 1648 cmd.exe vlc.exe PID 1648 wrote to memory of 472 1648 cmd.exe vlc.exe PID 1648 wrote to memory of 472 1648 cmd.exe vlc.exe PID 1648 wrote to memory of 472 1648 cmd.exe vlc.exe PID 472 wrote to memory of 436 472 vlc.exe cmd.exe PID 472 wrote to memory of 436 472 vlc.exe cmd.exe PID 472 wrote to memory of 436 472 vlc.exe cmd.exe PID 472 wrote to memory of 436 472 vlc.exe cmd.exe PID 436 wrote to memory of 1504 436 cmd.exe timeout.exe PID 436 wrote to memory of 1504 436 cmd.exe timeout.exe PID 436 wrote to memory of 1504 436 cmd.exe timeout.exe PID 436 wrote to memory of 1504 436 cmd.exe timeout.exe PID 472 wrote to memory of 1584 472 vlc.exe cmd.exe PID 472 wrote to memory of 1584 472 vlc.exe cmd.exe PID 472 wrote to memory of 1584 472 vlc.exe cmd.exe PID 472 wrote to memory of 1584 472 vlc.exe cmd.exe PID 1584 wrote to memory of 1184 1584 cmd.exe timeout.exe PID 1584 wrote to memory of 1184 1584 cmd.exe timeout.exe PID 1584 wrote to memory of 1184 1584 cmd.exe timeout.exe PID 1584 wrote to memory of 1184 1584 cmd.exe timeout.exe PID 472 wrote to memory of 1220 472 vlc.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aqw.exe"C:\Users\Admin\AppData\Local\Temp\aqw.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1964 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1384 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\aqw.exe"C:\Users\Admin\AppData\Local\Temp\aqw.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\vlc.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
PID:1504 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
PID:1184 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵PID:1220
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
PID:628 -
C:\Users\Admin\AppData\Roaming\vlc.exe"C:\Users\Admin\AppData\Roaming\vlc.exe"6⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Roaming\vlc.exe"C:\Users\Admin\AppData\Roaming\vlc.exe"6⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Roaming\vlc.exe"C:\Users\Admin\AppData\Roaming\vlc.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1484 -
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe /stext "C:\Users\Admin\AppData\Local\Temp\uhdefxfoldhsy"7⤵PID:1588
-
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe /stext "C:\Users\Admin\AppData\Local\Temp\uhdefxfoldhsy"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1732 -
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe /stext "C:\Users\Admin\AppData\Local\Temp\xbipyqqizlzxjysx"7⤵PID:1460
-
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe /stext "C:\Users\Admin\AppData\Local\Temp\hdnhzajkntrklfgjauit"7⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe /stext "C:\Users\Admin\AppData\Local\Temp\pvizuwjqasaadejfnyahp"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1236 -
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe /stext "C:\Users\Admin\AppData\Local\Temp\zxosmouroasnnsxjebnaadbjm"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:332 -
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe /stext "C:\Users\Admin\AppData\Local\Temp\kstcnhflcikspztvnmacdiwaujzq"7⤵
- Executes dropped EXE
PID:436
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
0fd303b21c1a43c6a9078e6f5280ca85
SHA10db8f1ae34f4e2e72184e337951fde826c0bd26f
SHA2565d8c6cfdf8fc198c4fd279487e5c1620ece89e39781c6337f4cb5e111e606ddc
SHA512be4cdd48940bead0274c7cf08abd9bc75b5db468159cbf883198712d0bb15ad81a069638c628eba62237cfa0a197f845c0d9e1f4727c9608a8d642f7aba38671
-
C:\Users\Admin\AppData\Local\Temp\pvizuwjqasaadejfnyahpMD5
f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\uhdefxfoldhsyMD5
f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c4b5c5da311f94d1df0ae07b51c03f71
SHA157caade886741b41fd1766af6ebc57caee772909
SHA256adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
SHA51242a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c4b5c5da311f94d1df0ae07b51c03f71
SHA157caade886741b41fd1766af6ebc57caee772909
SHA256adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
SHA51242a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c4b5c5da311f94d1df0ae07b51c03f71
SHA157caade886741b41fd1766af6ebc57caee772909
SHA256adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
SHA51242a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c4b5c5da311f94d1df0ae07b51c03f71
SHA157caade886741b41fd1766af6ebc57caee772909
SHA256adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
SHA51242a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c4b5c5da311f94d1df0ae07b51c03f71
SHA157caade886741b41fd1766af6ebc57caee772909
SHA256adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
SHA51242a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c4b5c5da311f94d1df0ae07b51c03f71
SHA157caade886741b41fd1766af6ebc57caee772909
SHA256adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
SHA51242a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c4b5c5da311f94d1df0ae07b51c03f71
SHA157caade886741b41fd1766af6ebc57caee772909
SHA256adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
SHA51242a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c4b5c5da311f94d1df0ae07b51c03f71
SHA157caade886741b41fd1766af6ebc57caee772909
SHA256adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
SHA51242a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c4b5c5da311f94d1df0ae07b51c03f71
SHA157caade886741b41fd1766af6ebc57caee772909
SHA256adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
SHA51242a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c4b5c5da311f94d1df0ae07b51c03f71
SHA157caade886741b41fd1766af6ebc57caee772909
SHA256adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
SHA51242a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
c4b5c5da311f94d1df0ae07b51c03f71
SHA157caade886741b41fd1766af6ebc57caee772909
SHA256adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
SHA51242a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
c4b5c5da311f94d1df0ae07b51c03f71
SHA157caade886741b41fd1766af6ebc57caee772909
SHA256adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
SHA51242a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
-
memory/332-63-0x0000000000422206-mapping.dmp
-
memory/332-61-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/332-68-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/332-66-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/436-72-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/436-71-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/436-69-0x0000000000455238-mapping.dmp
-
memory/436-29-0x0000000000000000-mapping.dmp
-
memory/472-23-0x0000000000000000-mapping.dmp
-
memory/472-25-0x00000000734A0000-0x0000000073B8E000-memory.dmpFilesize
6.9MB
-
memory/472-26-0x0000000000AE0000-0x0000000000AE1000-memory.dmpFilesize
4KB
-
memory/568-19-0x0000000002830000-0x0000000002834000-memory.dmpFilesize
16KB
-
memory/568-16-0x0000000000000000-mapping.dmp
-
memory/628-34-0x0000000000000000-mapping.dmp
-
memory/932-3-0x00000000010A0000-0x00000000010A1000-memory.dmpFilesize
4KB
-
memory/932-15-0x00000000003D2000-0x0000000000412000-memory.dmpFilesize
256KB
-
memory/932-5-0x0000000000940000-0x0000000000970000-memory.dmpFilesize
192KB
-
memory/932-2-0x0000000074120000-0x000000007480E000-memory.dmpFilesize
6.9MB
-
memory/1184-32-0x0000000000000000-mapping.dmp
-
memory/1220-33-0x0000000000000000-mapping.dmp
-
memory/1236-59-0x0000000000476274-mapping.dmp
-
memory/1236-64-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1236-62-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1336-56-0x000007FEF6400000-0x000007FEF667A000-memory.dmpFilesize
2.5MB
-
memory/1360-8-0x0000000000000000-mapping.dmp
-
memory/1384-9-0x0000000000000000-mapping.dmp
-
memory/1484-38-0x0000000000413FA4-mapping.dmp
-
memory/1484-41-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1504-30-0x0000000000000000-mapping.dmp
-
memory/1552-53-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1552-55-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1552-51-0x0000000000455238-mapping.dmp
-
memory/1552-49-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1584-31-0x0000000000000000-mapping.dmp
-
memory/1644-11-0x0000000000000000-mapping.dmp
-
memory/1648-18-0x0000000000000000-mapping.dmp
-
memory/1680-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1680-13-0x0000000000413FA4-mapping.dmp
-
memory/1680-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1684-10-0x0000000000000000-mapping.dmp
-
memory/1732-46-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1732-54-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1732-50-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1732-47-0x0000000000476274-mapping.dmp
-
memory/1964-7-0x0000000000000000-mapping.dmp
-
memory/1984-6-0x0000000000000000-mapping.dmp