Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-01-2021 15:25
Static task
static1
Behavioral task
behavioral1
Sample
aqw.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
aqw.exe
Resource
win10v20201028
General
-
Target
aqw.exe
-
Size
1.7MB
-
MD5
c4b5c5da311f94d1df0ae07b51c03f71
-
SHA1
57caade886741b41fd1766af6ebc57caee772909
-
SHA256
adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
-
SHA512
42a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
Malware Config
Extracted
remcos
swryijgrvcsgkopnmcdertvgdswbvmophtfdczxs.ydns.eu:2017
Signatures
-
ServiceHost packer 12 IoCs
Detects ServiceHost packer used for .NET malware
Processes:
resource yara_rule behavioral2/memory/2180-45-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2180-46-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2180-47-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2180-48-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2180-49-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2180-50-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2180-51-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2180-52-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2180-53-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2180-54-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2180-55-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2180-56-0x0000000000000000-mapping.dmp servicehost -
Executes dropped EXE 5 IoCs
Processes:
vlc.exevlc.exevlc.exevlc.exevlc.exepid process 2180 vlc.exe 2088 vlc.exe 3268 vlc.exe 3896 vlc.exe 1556 vlc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
aqw.exevlc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\ aqw.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" aqw.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vlc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" vlc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
Processes:
aqw.exevlc.exepid process 428 aqw.exe 428 aqw.exe 428 aqw.exe 428 aqw.exe 428 aqw.exe 428 aqw.exe 428 aqw.exe 428 aqw.exe 428 aqw.exe 428 aqw.exe 428 aqw.exe 428 aqw.exe 2180 vlc.exe 2180 vlc.exe 2180 vlc.exe 2180 vlc.exe 2180 vlc.exe 2180 vlc.exe 2180 vlc.exe 2180 vlc.exe 2180 vlc.exe 2180 vlc.exe 2180 vlc.exe 2180 vlc.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
aqw.exevlc.exevlc.exedescription pid process target process PID 428 set thread context of 500 428 aqw.exe aqw.exe PID 2180 set thread context of 2088 2180 vlc.exe vlc.exe PID 2088 set thread context of 3268 2088 vlc.exe vlc.exe PID 2088 set thread context of 3896 2088 vlc.exe vlc.exe PID 2088 set thread context of 1556 2088 vlc.exe vlc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1600 428 WerFault.exe aqw.exe 3524 2180 WerFault.exe vlc.exe -
Delays execution with timeout.exe 6 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 1008 timeout.exe 752 timeout.exe 2456 timeout.exe 1440 timeout.exe 200 timeout.exe 1920 timeout.exe -
Modifies registry class 1 IoCs
Processes:
aqw.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings aqw.exe -
Suspicious behavior: EnumeratesProcesses 43 IoCs
Processes:
aqw.exeWerFault.exevlc.exeWerFault.exevlc.exevlc.exepid process 428 aqw.exe 428 aqw.exe 428 aqw.exe 428 aqw.exe 428 aqw.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 2180 vlc.exe 2180 vlc.exe 2180 vlc.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3268 vlc.exe 3268 vlc.exe 3896 vlc.exe 3896 vlc.exe 3268 vlc.exe 3268 vlc.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
aqw.exeWerFault.exevlc.exeWerFault.exevlc.exedescription pid process Token: SeDebugPrivilege 428 aqw.exe Token: SeRestorePrivilege 1600 WerFault.exe Token: SeBackupPrivilege 1600 WerFault.exe Token: SeDebugPrivilege 1600 WerFault.exe Token: SeDebugPrivilege 2180 vlc.exe Token: SeDebugPrivilege 3524 WerFault.exe Token: SeDebugPrivilege 3896 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 2088 vlc.exe -
Suspicious use of WriteProcessMemory 92 IoCs
Processes:
aqw.execmd.execmd.execmd.exeaqw.exeWScript.execmd.exevlc.execmd.execmd.execmd.exedescription pid process target process PID 428 wrote to memory of 844 428 aqw.exe cmd.exe PID 428 wrote to memory of 844 428 aqw.exe cmd.exe PID 428 wrote to memory of 844 428 aqw.exe cmd.exe PID 844 wrote to memory of 200 844 cmd.exe timeout.exe PID 844 wrote to memory of 200 844 cmd.exe timeout.exe PID 844 wrote to memory of 200 844 cmd.exe timeout.exe PID 428 wrote to memory of 2880 428 aqw.exe cmd.exe PID 428 wrote to memory of 2880 428 aqw.exe cmd.exe PID 428 wrote to memory of 2880 428 aqw.exe cmd.exe PID 2880 wrote to memory of 1920 2880 cmd.exe timeout.exe PID 2880 wrote to memory of 1920 2880 cmd.exe timeout.exe PID 2880 wrote to memory of 1920 2880 cmd.exe timeout.exe PID 428 wrote to memory of 1616 428 aqw.exe cmd.exe PID 428 wrote to memory of 1616 428 aqw.exe cmd.exe PID 428 wrote to memory of 1616 428 aqw.exe cmd.exe PID 1616 wrote to memory of 1008 1616 cmd.exe timeout.exe PID 1616 wrote to memory of 1008 1616 cmd.exe timeout.exe PID 1616 wrote to memory of 1008 1616 cmd.exe timeout.exe PID 428 wrote to memory of 3632 428 aqw.exe aqw.exe PID 428 wrote to memory of 3632 428 aqw.exe aqw.exe PID 428 wrote to memory of 3632 428 aqw.exe aqw.exe PID 428 wrote to memory of 500 428 aqw.exe aqw.exe PID 428 wrote to memory of 500 428 aqw.exe aqw.exe PID 428 wrote to memory of 500 428 aqw.exe aqw.exe PID 428 wrote to memory of 500 428 aqw.exe aqw.exe PID 428 wrote to memory of 500 428 aqw.exe aqw.exe PID 428 wrote to memory of 500 428 aqw.exe aqw.exe PID 428 wrote to memory of 500 428 aqw.exe aqw.exe PID 428 wrote to memory of 500 428 aqw.exe aqw.exe PID 428 wrote to memory of 500 428 aqw.exe aqw.exe PID 428 wrote to memory of 500 428 aqw.exe aqw.exe PID 500 wrote to memory of 1308 500 aqw.exe WScript.exe PID 500 wrote to memory of 1308 500 aqw.exe WScript.exe PID 500 wrote to memory of 1308 500 aqw.exe WScript.exe PID 1308 wrote to memory of 4068 1308 WScript.exe cmd.exe PID 1308 wrote to memory of 4068 1308 WScript.exe cmd.exe PID 1308 wrote to memory of 4068 1308 WScript.exe cmd.exe PID 4068 wrote to memory of 2180 4068 cmd.exe vlc.exe PID 4068 wrote to memory of 2180 4068 cmd.exe vlc.exe PID 4068 wrote to memory of 2180 4068 cmd.exe vlc.exe PID 2180 wrote to memory of 2204 2180 vlc.exe cmd.exe PID 2180 wrote to memory of 2204 2180 vlc.exe cmd.exe PID 2180 wrote to memory of 2204 2180 vlc.exe cmd.exe PID 2204 wrote to memory of 752 2204 cmd.exe timeout.exe PID 2204 wrote to memory of 752 2204 cmd.exe timeout.exe PID 2204 wrote to memory of 752 2204 cmd.exe timeout.exe PID 2180 wrote to memory of 3648 2180 vlc.exe cmd.exe PID 2180 wrote to memory of 3648 2180 vlc.exe cmd.exe PID 2180 wrote to memory of 3648 2180 vlc.exe cmd.exe PID 3648 wrote to memory of 2456 3648 cmd.exe timeout.exe PID 3648 wrote to memory of 2456 3648 cmd.exe timeout.exe PID 3648 wrote to memory of 2456 3648 cmd.exe timeout.exe PID 2180 wrote to memory of 1328 2180 vlc.exe cmd.exe PID 2180 wrote to memory of 1328 2180 vlc.exe cmd.exe PID 2180 wrote to memory of 1328 2180 vlc.exe cmd.exe PID 1328 wrote to memory of 1440 1328 cmd.exe timeout.exe PID 1328 wrote to memory of 1440 1328 cmd.exe timeout.exe PID 1328 wrote to memory of 1440 1328 cmd.exe timeout.exe PID 2180 wrote to memory of 2088 2180 vlc.exe vlc.exe PID 2180 wrote to memory of 2088 2180 vlc.exe vlc.exe PID 2180 wrote to memory of 2088 2180 vlc.exe vlc.exe PID 2180 wrote to memory of 2088 2180 vlc.exe vlc.exe PID 2180 wrote to memory of 2088 2180 vlc.exe vlc.exe PID 2180 wrote to memory of 2088 2180 vlc.exe vlc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aqw.exe"C:\Users\Admin\AppData\Local\Temp\aqw.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\aqw.exe"C:\Users\Admin\AppData\Local\Temp\aqw.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\aqw.exe"C:\Users\Admin\AppData\Local\Temp\aqw.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\vlc.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\vlc.exe"C:\Users\Admin\AppData\Roaming\vlc.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe /stext "C:\Users\Admin\AppData\Local\Temp\pkmqosprbfudgfuhhnch"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe /stext "C:\Users\Admin\AppData\Local\Temp\zfzjpkakpnmqqmqlyxpbddp"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe /stext "C:\Users\Admin\AppData\Local\Temp\khfuidkmdvevsaepiiccgicuhx"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 15206⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 428 -s 15842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
0fd303b21c1a43c6a9078e6f5280ca85
SHA10db8f1ae34f4e2e72184e337951fde826c0bd26f
SHA2565d8c6cfdf8fc198c4fd279487e5c1620ece89e39781c6337f4cb5e111e606ddc
SHA512be4cdd48940bead0274c7cf08abd9bc75b5db468159cbf883198712d0bb15ad81a069638c628eba62237cfa0a197f845c0d9e1f4727c9608a8d642f7aba38671
-
C:\Users\Admin\AppData\Local\Temp\pkmqosprbfudgfuhhnchMD5
814b5ce4cad79d36055d2d4b5958cc31
SHA12a06a869615f0858479371b0415899681fb0c7d8
SHA2566d1fa1a75faec2b39e8a2a1df8dd0f15e5256de7da7c527225ecf22fdacaf559
SHA512a82fa1594ccbe1df93a973a01c787a6baa0ce8a97c0b0b0a844c90cb6be092b1094636b4d88c568fece95cd9bdfe4412875011abe318373a4fcfc218f93d1278
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c4b5c5da311f94d1df0ae07b51c03f71
SHA157caade886741b41fd1766af6ebc57caee772909
SHA256adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
SHA51242a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c4b5c5da311f94d1df0ae07b51c03f71
SHA157caade886741b41fd1766af6ebc57caee772909
SHA256adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
SHA51242a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c4b5c5da311f94d1df0ae07b51c03f71
SHA157caade886741b41fd1766af6ebc57caee772909
SHA256adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
SHA51242a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c4b5c5da311f94d1df0ae07b51c03f71
SHA157caade886741b41fd1766af6ebc57caee772909
SHA256adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
SHA51242a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c4b5c5da311f94d1df0ae07b51c03f71
SHA157caade886741b41fd1766af6ebc57caee772909
SHA256adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
SHA51242a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
c4b5c5da311f94d1df0ae07b51c03f71
SHA157caade886741b41fd1766af6ebc57caee772909
SHA256adb13ebc133a1e008a91f3a8e62f440eef16612cbaaa7a360a25f5a76a8a19c8
SHA51242a8aa386db8a818a0a6e20592e621548b34d301a4f7a638ed94c4968548af7a45e039e779d0fbef35463df5133c6a89051492124d98c0e30321fb6c7ef6ab4e
-
memory/200-8-0x0000000000000000-mapping.dmp
-
memory/428-2-0x0000000073160000-0x000000007384E000-memory.dmpFilesize
6.9MB
-
memory/428-3-0x0000000000900000-0x0000000000901000-memory.dmpFilesize
4KB
-
memory/428-5-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/428-11-0x0000000006500000-0x0000000006501000-memory.dmpFilesize
4KB
-
memory/428-6-0x00000000054A0000-0x00000000054D0000-memory.dmpFilesize
192KB
-
memory/500-15-0x0000000000413FA4-mapping.dmp
-
memory/500-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/500-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/752-32-0x0000000000000000-mapping.dmp
-
memory/844-7-0x0000000000000000-mapping.dmp
-
memory/1008-13-0x0000000000000000-mapping.dmp
-
memory/1308-17-0x0000000000000000-mapping.dmp
-
memory/1328-36-0x0000000000000000-mapping.dmp
-
memory/1440-37-0x0000000000000000-mapping.dmp
-
memory/1556-70-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1556-68-0x0000000000455238-mapping.dmp
-
memory/1556-66-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1556-71-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1600-19-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/1616-12-0x0000000000000000-mapping.dmp
-
memory/1920-10-0x0000000000000000-mapping.dmp
-
memory/2088-41-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2088-39-0x0000000000413FA4-mapping.dmp
-
memory/2180-51-0x0000000000000000-mapping.dmp
-
memory/2180-46-0x0000000000000000-mapping.dmp
-
memory/2180-47-0x0000000000000000-mapping.dmp
-
memory/2180-48-0x0000000000000000-mapping.dmp
-
memory/2180-49-0x0000000000000000-mapping.dmp
-
memory/2180-50-0x0000000000000000-mapping.dmp
-
memory/2180-45-0x0000000000000000-mapping.dmp
-
memory/2180-52-0x0000000000000000-mapping.dmp
-
memory/2180-53-0x0000000000000000-mapping.dmp
-
memory/2180-54-0x0000000000000000-mapping.dmp
-
memory/2180-55-0x0000000000000000-mapping.dmp
-
memory/2180-56-0x0000000000000000-mapping.dmp
-
memory/2180-23-0x0000000000000000-mapping.dmp
-
memory/2180-26-0x0000000073160000-0x000000007384E000-memory.dmpFilesize
6.9MB
-
memory/2204-31-0x0000000000000000-mapping.dmp
-
memory/2456-34-0x0000000000000000-mapping.dmp
-
memory/2880-9-0x0000000000000000-mapping.dmp
-
memory/3268-58-0x0000000000476274-mapping.dmp
-
memory/3268-61-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3268-65-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3268-57-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3524-42-0x00000000040E0000-0x00000000040E1000-memory.dmpFilesize
4KB
-
memory/3648-33-0x0000000000000000-mapping.dmp
-
memory/3896-62-0x0000000000422206-mapping.dmp
-
memory/3896-67-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/3896-64-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/3896-60-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4068-22-0x0000000000000000-mapping.dmp