Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
21-01-2021 10:16
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe
Resource
win10v20201028
General
-
Target
SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe
-
Size
1.3MB
-
MD5
33c35598a22a81d9d62986a910bc4d46
-
SHA1
9177c4636517c04dad78521286ffe8928b3c8672
-
SHA256
0a5a4665f8d532812a8c8992b8ecc0e58efb56e7730382268ca3ca65a0f74f38
-
SHA512
4dba8eeb9f9d2861c13dd9107a90e98d89412ef815aa19ed502cc292d6afed79ff582bdc5faad1d9b9d74c73e887a5bb83a49c64c69e04cc53270bbb3fae03d0
Malware Config
Extracted
remcos
swryijgrvcsgkopnmcdertvgdswbvmophtfdczxs.ydns.eu:2017
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
vlc.exevlc.exevlc.exepid process 1520 vlc.exe 4744 vlc.exe 4404 vlc.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exevlc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vlc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" vlc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exevlc.exepid process 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exevlc.exedescription pid process target process PID 4772 set thread context of 4480 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe PID 1520 set thread context of 4404 1520 vlc.exe vlc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4632 4772 WerFault.exe SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 208 1520 WerFault.exe vlc.exe -
Delays execution with timeout.exe 6 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 3340 timeout.exe 3148 timeout.exe 4052 timeout.exe 2384 timeout.exe 2864 timeout.exe 4736 timeout.exe -
Modifies registry class 1 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exeWerFault.exevlc.exeWerFault.exepid process 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe 4632 WerFault.exe 4632 WerFault.exe 4632 WerFault.exe 4632 WerFault.exe 4632 WerFault.exe 4632 WerFault.exe 4632 WerFault.exe 4632 WerFault.exe 4632 WerFault.exe 4632 WerFault.exe 4632 WerFault.exe 4632 WerFault.exe 4632 WerFault.exe 4632 WerFault.exe 4632 WerFault.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 1520 vlc.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe 208 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 4404 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exeWerFault.exevlc.exeWerFault.exedescription pid process Token: SeDebugPrivilege 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe Token: SeRestorePrivilege 4632 WerFault.exe Token: SeBackupPrivilege 4632 WerFault.exe Token: SeDebugPrivilege 4632 WerFault.exe Token: SeDebugPrivilege 1520 vlc.exe Token: SeDebugPrivilege 208 WerFault.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 4404 vlc.exe -
Suspicious use of WriteProcessMemory 74 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.execmd.execmd.execmd.exeSecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exeWScript.execmd.exevlc.execmd.execmd.execmd.exedescription pid process target process PID 4772 wrote to memory of 4172 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe cmd.exe PID 4772 wrote to memory of 4172 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe cmd.exe PID 4772 wrote to memory of 4172 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe cmd.exe PID 4172 wrote to memory of 3340 4172 cmd.exe timeout.exe PID 4172 wrote to memory of 3340 4172 cmd.exe timeout.exe PID 4172 wrote to memory of 3340 4172 cmd.exe timeout.exe PID 4772 wrote to memory of 3164 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe cmd.exe PID 4772 wrote to memory of 3164 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe cmd.exe PID 4772 wrote to memory of 3164 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe cmd.exe PID 3164 wrote to memory of 3148 3164 cmd.exe timeout.exe PID 3164 wrote to memory of 3148 3164 cmd.exe timeout.exe PID 3164 wrote to memory of 3148 3164 cmd.exe timeout.exe PID 4772 wrote to memory of 3432 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe cmd.exe PID 4772 wrote to memory of 3432 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe cmd.exe PID 4772 wrote to memory of 3432 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe cmd.exe PID 3432 wrote to memory of 4052 3432 cmd.exe timeout.exe PID 3432 wrote to memory of 4052 3432 cmd.exe timeout.exe PID 3432 wrote to memory of 4052 3432 cmd.exe timeout.exe PID 4772 wrote to memory of 4488 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe PID 4772 wrote to memory of 4488 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe PID 4772 wrote to memory of 4488 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe PID 4772 wrote to memory of 4496 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe PID 4772 wrote to memory of 4496 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe PID 4772 wrote to memory of 4496 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe PID 4772 wrote to memory of 4480 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe PID 4772 wrote to memory of 4480 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe PID 4772 wrote to memory of 4480 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe PID 4772 wrote to memory of 4480 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe PID 4772 wrote to memory of 4480 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe PID 4772 wrote to memory of 4480 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe PID 4772 wrote to memory of 4480 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe PID 4772 wrote to memory of 4480 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe PID 4772 wrote to memory of 4480 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe PID 4772 wrote to memory of 4480 4772 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe PID 4480 wrote to memory of 4572 4480 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe WScript.exe PID 4480 wrote to memory of 4572 4480 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe WScript.exe PID 4480 wrote to memory of 4572 4480 SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe WScript.exe PID 4572 wrote to memory of 1280 4572 WScript.exe cmd.exe PID 4572 wrote to memory of 1280 4572 WScript.exe cmd.exe PID 4572 wrote to memory of 1280 4572 WScript.exe cmd.exe PID 1280 wrote to memory of 1520 1280 cmd.exe vlc.exe PID 1280 wrote to memory of 1520 1280 cmd.exe vlc.exe PID 1280 wrote to memory of 1520 1280 cmd.exe vlc.exe PID 1520 wrote to memory of 1828 1520 vlc.exe cmd.exe PID 1520 wrote to memory of 1828 1520 vlc.exe cmd.exe PID 1520 wrote to memory of 1828 1520 vlc.exe cmd.exe PID 1828 wrote to memory of 2384 1828 cmd.exe timeout.exe PID 1828 wrote to memory of 2384 1828 cmd.exe timeout.exe PID 1828 wrote to memory of 2384 1828 cmd.exe timeout.exe PID 1520 wrote to memory of 2592 1520 vlc.exe cmd.exe PID 1520 wrote to memory of 2592 1520 vlc.exe cmd.exe PID 1520 wrote to memory of 2592 1520 vlc.exe cmd.exe PID 2592 wrote to memory of 2864 2592 cmd.exe timeout.exe PID 2592 wrote to memory of 2864 2592 cmd.exe timeout.exe PID 2592 wrote to memory of 2864 2592 cmd.exe timeout.exe PID 1520 wrote to memory of 2696 1520 vlc.exe cmd.exe PID 1520 wrote to memory of 2696 1520 vlc.exe cmd.exe PID 1520 wrote to memory of 2696 1520 vlc.exe cmd.exe PID 2696 wrote to memory of 4736 2696 cmd.exe timeout.exe PID 2696 wrote to memory of 4736 2696 cmd.exe timeout.exe PID 2696 wrote to memory of 4736 2696 cmd.exe timeout.exe PID 1520 wrote to memory of 4744 1520 vlc.exe vlc.exe PID 1520 wrote to memory of 4744 1520 vlc.exe vlc.exe PID 1520 wrote to memory of 4744 1520 vlc.exe vlc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.tz.3504.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\vlc.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\vlc.exe"C:\Users\Admin\AppData\Roaming\vlc.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\vlc.exe"C:\Users\Admin\AppData\Roaming\vlc.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 15606⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 15602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
0fd303b21c1a43c6a9078e6f5280ca85
SHA10db8f1ae34f4e2e72184e337951fde826c0bd26f
SHA2565d8c6cfdf8fc198c4fd279487e5c1620ece89e39781c6337f4cb5e111e606ddc
SHA512be4cdd48940bead0274c7cf08abd9bc75b5db468159cbf883198712d0bb15ad81a069638c628eba62237cfa0a197f845c0d9e1f4727c9608a8d642f7aba38671
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
33c35598a22a81d9d62986a910bc4d46
SHA19177c4636517c04dad78521286ffe8928b3c8672
SHA2560a5a4665f8d532812a8c8992b8ecc0e58efb56e7730382268ca3ca65a0f74f38
SHA5124dba8eeb9f9d2861c13dd9107a90e98d89412ef815aa19ed502cc292d6afed79ff582bdc5faad1d9b9d74c73e887a5bb83a49c64c69e04cc53270bbb3fae03d0
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
33c35598a22a81d9d62986a910bc4d46
SHA19177c4636517c04dad78521286ffe8928b3c8672
SHA2560a5a4665f8d532812a8c8992b8ecc0e58efb56e7730382268ca3ca65a0f74f38
SHA5124dba8eeb9f9d2861c13dd9107a90e98d89412ef815aa19ed502cc292d6afed79ff582bdc5faad1d9b9d74c73e887a5bb83a49c64c69e04cc53270bbb3fae03d0
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
33c35598a22a81d9d62986a910bc4d46
SHA19177c4636517c04dad78521286ffe8928b3c8672
SHA2560a5a4665f8d532812a8c8992b8ecc0e58efb56e7730382268ca3ca65a0f74f38
SHA5124dba8eeb9f9d2861c13dd9107a90e98d89412ef815aa19ed502cc292d6afed79ff582bdc5faad1d9b9d74c73e887a5bb83a49c64c69e04cc53270bbb3fae03d0
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
33c35598a22a81d9d62986a910bc4d46
SHA19177c4636517c04dad78521286ffe8928b3c8672
SHA2560a5a4665f8d532812a8c8992b8ecc0e58efb56e7730382268ca3ca65a0f74f38
SHA5124dba8eeb9f9d2861c13dd9107a90e98d89412ef815aa19ed502cc292d6afed79ff582bdc5faad1d9b9d74c73e887a5bb83a49c64c69e04cc53270bbb3fae03d0
-
memory/208-49-0x0000000004540000-0x0000000004541000-memory.dmpFilesize
4KB
-
memory/1280-25-0x0000000000000000-mapping.dmp
-
memory/1520-40-0x0000000004EF0000-0x0000000004EF1000-memory.dmpFilesize
4KB
-
memory/1520-29-0x0000000073370000-0x0000000073A5E000-memory.dmpFilesize
6.9MB
-
memory/1520-26-0x0000000000000000-mapping.dmp
-
memory/1828-37-0x0000000000000000-mapping.dmp
-
memory/2384-38-0x0000000000000000-mapping.dmp
-
memory/2592-39-0x0000000000000000-mapping.dmp
-
memory/2696-42-0x0000000000000000-mapping.dmp
-
memory/2864-41-0x0000000000000000-mapping.dmp
-
memory/3148-14-0x0000000000000000-mapping.dmp
-
memory/3164-13-0x0000000000000000-mapping.dmp
-
memory/3340-12-0x0000000000000000-mapping.dmp
-
memory/3432-15-0x0000000000000000-mapping.dmp
-
memory/4052-16-0x0000000000000000-mapping.dmp
-
memory/4172-11-0x0000000000000000-mapping.dmp
-
memory/4404-46-0x0000000000413FA4-mapping.dmp
-
memory/4404-48-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4480-24-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4480-18-0x0000000000413FA4-mapping.dmp
-
memory/4480-17-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4572-19-0x0000000000000000-mapping.dmp
-
memory/4632-20-0x0000000004380000-0x0000000004381000-memory.dmpFilesize
4KB
-
memory/4736-43-0x0000000000000000-mapping.dmp
-
memory/4772-7-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/4772-2-0x0000000073370000-0x0000000073A5E000-memory.dmpFilesize
6.9MB
-
memory/4772-8-0x0000000004E00000-0x0000000004E01000-memory.dmpFilesize
4KB
-
memory/4772-6-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/4772-9-0x0000000004B10000-0x0000000004B11000-memory.dmpFilesize
4KB
-
memory/4772-5-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/4772-10-0x0000000004DB0000-0x0000000004DE0000-memory.dmpFilesize
192KB
-
memory/4772-3-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB