Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
20-01-2021 11:09
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe
Resource
win10v20201028
General
-
Target
SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe
-
Size
1.3MB
-
MD5
022d116c9e8cc50f7b3d837b69eef49a
-
SHA1
15acead8bc9052f5716454e21e99493123e1cd42
-
SHA256
fdd7a11713768ea1228de9054ac3d7ae9f85fac1d6f3461f8192daf8c385b6d1
-
SHA512
f3b174d2deea097ae25da281d79e3f46c65cf3f809a8b2a5dd7603b95191032ef0996230ccc8b68de56e2e2cbe229491e5dc4f8239fcf0c47b8dfb64cb6b47b2
Malware Config
Extracted
remcos
swryijgrvcsgkopnmcdertvgdswbvmophtfdczxs.ydns.eu:2017
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
vlc.exevlc.exepid process 1900 vlc.exe 564 vlc.exe -
Loads dropped DLL 5 IoCs
Processes:
cmd.exeWerFault.exepid process 1776 cmd.exe 1776 cmd.exe 992 WerFault.exe 992 WerFault.exe 992 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exevlc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vlc.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" vlc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exevlc.exepid process 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe 1900 vlc.exe 1900 vlc.exe 1900 vlc.exe 1900 vlc.exe 1900 vlc.exe 1900 vlc.exe 1900 vlc.exe 1900 vlc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exevlc.exedescription pid process target process PID 1648 set thread context of 1104 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe PID 1900 set thread context of 564 1900 vlc.exe vlc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 576 1648 WerFault.exe SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe 992 1900 WerFault.exe vlc.exe -
Delays execution with timeout.exe 6 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 1036 timeout.exe 776 timeout.exe 1792 timeout.exe 1124 timeout.exe 776 timeout.exe 1788 timeout.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exeWerFault.exevlc.exeWerFault.exepid process 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe 576 WerFault.exe 576 WerFault.exe 576 WerFault.exe 576 WerFault.exe 576 WerFault.exe 1900 vlc.exe 1900 vlc.exe 1900 vlc.exe 992 WerFault.exe 992 WerFault.exe 992 WerFault.exe 992 WerFault.exe 992 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 576 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exeWerFault.exevlc.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe Token: SeDebugPrivilege 576 WerFault.exe Token: SeDebugPrivilege 1900 vlc.exe Token: SeDebugPrivilege 992 WerFault.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 564 vlc.exe -
Suspicious use of WriteProcessMemory 90 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.execmd.execmd.execmd.exeSecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exeWScript.execmd.exevlc.execmd.execmd.exedescription pid process target process PID 1648 wrote to memory of 368 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe cmd.exe PID 1648 wrote to memory of 368 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe cmd.exe PID 1648 wrote to memory of 368 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe cmd.exe PID 1648 wrote to memory of 368 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe cmd.exe PID 368 wrote to memory of 776 368 cmd.exe timeout.exe PID 368 wrote to memory of 776 368 cmd.exe timeout.exe PID 368 wrote to memory of 776 368 cmd.exe timeout.exe PID 368 wrote to memory of 776 368 cmd.exe timeout.exe PID 1648 wrote to memory of 1276 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe cmd.exe PID 1648 wrote to memory of 1276 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe cmd.exe PID 1648 wrote to memory of 1276 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe cmd.exe PID 1648 wrote to memory of 1276 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe cmd.exe PID 1276 wrote to memory of 1792 1276 cmd.exe timeout.exe PID 1276 wrote to memory of 1792 1276 cmd.exe timeout.exe PID 1276 wrote to memory of 1792 1276 cmd.exe timeout.exe PID 1276 wrote to memory of 1792 1276 cmd.exe timeout.exe PID 1648 wrote to memory of 1344 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe cmd.exe PID 1648 wrote to memory of 1344 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe cmd.exe PID 1648 wrote to memory of 1344 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe cmd.exe PID 1648 wrote to memory of 1344 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe cmd.exe PID 1344 wrote to memory of 1124 1344 cmd.exe timeout.exe PID 1344 wrote to memory of 1124 1344 cmd.exe timeout.exe PID 1344 wrote to memory of 1124 1344 cmd.exe timeout.exe PID 1344 wrote to memory of 1124 1344 cmd.exe timeout.exe PID 1648 wrote to memory of 1104 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe PID 1648 wrote to memory of 1104 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe PID 1648 wrote to memory of 1104 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe PID 1648 wrote to memory of 1104 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe PID 1648 wrote to memory of 1104 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe PID 1648 wrote to memory of 1104 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe PID 1648 wrote to memory of 1104 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe PID 1648 wrote to memory of 1104 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe PID 1648 wrote to memory of 1104 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe PID 1648 wrote to memory of 1104 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe PID 1648 wrote to memory of 1104 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe PID 1104 wrote to memory of 1680 1104 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe WScript.exe PID 1104 wrote to memory of 1680 1104 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe WScript.exe PID 1104 wrote to memory of 1680 1104 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe WScript.exe PID 1104 wrote to memory of 1680 1104 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe WScript.exe PID 1648 wrote to memory of 576 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe WerFault.exe PID 1648 wrote to memory of 576 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe WerFault.exe PID 1648 wrote to memory of 576 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe WerFault.exe PID 1648 wrote to memory of 576 1648 SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe WerFault.exe PID 1680 wrote to memory of 1776 1680 WScript.exe cmd.exe PID 1680 wrote to memory of 1776 1680 WScript.exe cmd.exe PID 1680 wrote to memory of 1776 1680 WScript.exe cmd.exe PID 1680 wrote to memory of 1776 1680 WScript.exe cmd.exe PID 1776 wrote to memory of 1900 1776 cmd.exe vlc.exe PID 1776 wrote to memory of 1900 1776 cmd.exe vlc.exe PID 1776 wrote to memory of 1900 1776 cmd.exe vlc.exe PID 1776 wrote to memory of 1900 1776 cmd.exe vlc.exe PID 1900 wrote to memory of 2004 1900 vlc.exe cmd.exe PID 1900 wrote to memory of 2004 1900 vlc.exe cmd.exe PID 1900 wrote to memory of 2004 1900 vlc.exe cmd.exe PID 1900 wrote to memory of 2004 1900 vlc.exe cmd.exe PID 2004 wrote to memory of 776 2004 cmd.exe timeout.exe PID 2004 wrote to memory of 776 2004 cmd.exe timeout.exe PID 2004 wrote to memory of 776 2004 cmd.exe timeout.exe PID 2004 wrote to memory of 776 2004 cmd.exe timeout.exe PID 1900 wrote to memory of 668 1900 vlc.exe cmd.exe PID 1900 wrote to memory of 668 1900 vlc.exe cmd.exe PID 1900 wrote to memory of 668 1900 vlc.exe cmd.exe PID 1900 wrote to memory of 668 1900 vlc.exe cmd.exe PID 668 wrote to memory of 1788 668 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.510.21742.1465.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\vlc.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\vlc.exe"C:\Users\Admin\AppData\Roaming\vlc.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 9526⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 9442⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
0fd303b21c1a43c6a9078e6f5280ca85
SHA10db8f1ae34f4e2e72184e337951fde826c0bd26f
SHA2565d8c6cfdf8fc198c4fd279487e5c1620ece89e39781c6337f4cb5e111e606ddc
SHA512be4cdd48940bead0274c7cf08abd9bc75b5db468159cbf883198712d0bb15ad81a069638c628eba62237cfa0a197f845c0d9e1f4727c9608a8d642f7aba38671
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
022d116c9e8cc50f7b3d837b69eef49a
SHA115acead8bc9052f5716454e21e99493123e1cd42
SHA256fdd7a11713768ea1228de9054ac3d7ae9f85fac1d6f3461f8192daf8c385b6d1
SHA512f3b174d2deea097ae25da281d79e3f46c65cf3f809a8b2a5dd7603b95191032ef0996230ccc8b68de56e2e2cbe229491e5dc4f8239fcf0c47b8dfb64cb6b47b2
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
022d116c9e8cc50f7b3d837b69eef49a
SHA115acead8bc9052f5716454e21e99493123e1cd42
SHA256fdd7a11713768ea1228de9054ac3d7ae9f85fac1d6f3461f8192daf8c385b6d1
SHA512f3b174d2deea097ae25da281d79e3f46c65cf3f809a8b2a5dd7603b95191032ef0996230ccc8b68de56e2e2cbe229491e5dc4f8239fcf0c47b8dfb64cb6b47b2
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
022d116c9e8cc50f7b3d837b69eef49a
SHA115acead8bc9052f5716454e21e99493123e1cd42
SHA256fdd7a11713768ea1228de9054ac3d7ae9f85fac1d6f3461f8192daf8c385b6d1
SHA512f3b174d2deea097ae25da281d79e3f46c65cf3f809a8b2a5dd7603b95191032ef0996230ccc8b68de56e2e2cbe229491e5dc4f8239fcf0c47b8dfb64cb6b47b2
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
022d116c9e8cc50f7b3d837b69eef49a
SHA115acead8bc9052f5716454e21e99493123e1cd42
SHA256fdd7a11713768ea1228de9054ac3d7ae9f85fac1d6f3461f8192daf8c385b6d1
SHA512f3b174d2deea097ae25da281d79e3f46c65cf3f809a8b2a5dd7603b95191032ef0996230ccc8b68de56e2e2cbe229491e5dc4f8239fcf0c47b8dfb64cb6b47b2
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
022d116c9e8cc50f7b3d837b69eef49a
SHA115acead8bc9052f5716454e21e99493123e1cd42
SHA256fdd7a11713768ea1228de9054ac3d7ae9f85fac1d6f3461f8192daf8c385b6d1
SHA512f3b174d2deea097ae25da281d79e3f46c65cf3f809a8b2a5dd7603b95191032ef0996230ccc8b68de56e2e2cbe229491e5dc4f8239fcf0c47b8dfb64cb6b47b2
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
022d116c9e8cc50f7b3d837b69eef49a
SHA115acead8bc9052f5716454e21e99493123e1cd42
SHA256fdd7a11713768ea1228de9054ac3d7ae9f85fac1d6f3461f8192daf8c385b6d1
SHA512f3b174d2deea097ae25da281d79e3f46c65cf3f809a8b2a5dd7603b95191032ef0996230ccc8b68de56e2e2cbe229491e5dc4f8239fcf0c47b8dfb64cb6b47b2
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
022d116c9e8cc50f7b3d837b69eef49a
SHA115acead8bc9052f5716454e21e99493123e1cd42
SHA256fdd7a11713768ea1228de9054ac3d7ae9f85fac1d6f3461f8192daf8c385b6d1
SHA512f3b174d2deea097ae25da281d79e3f46c65cf3f809a8b2a5dd7603b95191032ef0996230ccc8b68de56e2e2cbe229491e5dc4f8239fcf0c47b8dfb64cb6b47b2
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
022d116c9e8cc50f7b3d837b69eef49a
SHA115acead8bc9052f5716454e21e99493123e1cd42
SHA256fdd7a11713768ea1228de9054ac3d7ae9f85fac1d6f3461f8192daf8c385b6d1
SHA512f3b174d2deea097ae25da281d79e3f46c65cf3f809a8b2a5dd7603b95191032ef0996230ccc8b68de56e2e2cbe229491e5dc4f8239fcf0c47b8dfb64cb6b47b2
-
memory/368-7-0x0000000000000000-mapping.dmp
-
memory/564-49-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/564-42-0x0000000000413FA4-mapping.dmp
-
memory/576-18-0x0000000000000000-mapping.dmp
-
memory/576-19-0x0000000002250000-0x0000000002261000-memory.dmpFilesize
68KB
-
memory/576-33-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/668-37-0x0000000000000000-mapping.dmp
-
memory/776-36-0x0000000000000000-mapping.dmp
-
memory/776-8-0x0000000000000000-mapping.dmp
-
memory/900-39-0x0000000000000000-mapping.dmp
-
memory/992-45-0x0000000000000000-mapping.dmp
-
memory/992-46-0x0000000001F30000-0x0000000001F41000-memory.dmpFilesize
68KB
-
memory/992-51-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1036-40-0x0000000000000000-mapping.dmp
-
memory/1104-14-0x0000000000413FA4-mapping.dmp
-
memory/1104-15-0x0000000074B31000-0x0000000074B33000-memory.dmpFilesize
8KB
-
memory/1104-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1104-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1124-12-0x0000000000000000-mapping.dmp
-
memory/1276-9-0x0000000000000000-mapping.dmp
-
memory/1344-11-0x0000000000000000-mapping.dmp
-
memory/1648-3-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1648-5-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/1648-6-0x0000000000490000-0x00000000004BF000-memory.dmpFilesize
188KB
-
memory/1648-2-0x0000000074110000-0x00000000747FE000-memory.dmpFilesize
6.9MB
-
memory/1680-23-0x0000000002750000-0x0000000002754000-memory.dmpFilesize
16KB
-
memory/1680-17-0x0000000000000000-mapping.dmp
-
memory/1776-22-0x0000000000000000-mapping.dmp
-
memory/1788-38-0x0000000000000000-mapping.dmp
-
memory/1792-10-0x0000000000000000-mapping.dmp
-
memory/1900-27-0x0000000000000000-mapping.dmp
-
memory/1900-34-0x00000000021D0000-0x00000000021D1000-memory.dmpFilesize
4KB
-
memory/1900-30-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/1900-29-0x0000000074110000-0x00000000747FE000-memory.dmpFilesize
6.9MB
-
memory/2004-35-0x0000000000000000-mapping.dmp