Analysis
-
max time kernel
153s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2022 21:19
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220812-en
General
-
Target
tmp.exe
-
Size
1.8MB
-
MD5
ed7fa6ec8aa0602b18ac40bf6abff7e6
-
SHA1
21f14e8533a1143001c0bc1a842cb4f9f4c69a8a
-
SHA256
341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4
-
SHA512
3388db86341f13ed30d40942df6b1844c6ebdbe7a360749edec9b23b87ca106ae90082c08648308fc9a9f78a4ffdd0c92855b090aeca52ddc00a903834d856e7
-
SSDEEP
12288:Lnjo5JZCGepoAgPBEudDgeOYnWZQzjFeM6DJOjB9sTTHyOx+mRfGrwmMeOS34MIy:6ZL0QpfnYQb6VOUROrwE
Malware Config
Extracted
Protocol: smtp- Host:
mail.fishtrans.ro - Port:
587 - Username:
depozit@fishtrans.ro - Password:
Filepangasius2000
Extracted
remcos
RemoteHost
mam.mastercoa.co:37824
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-3FCFQU
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/4224-152-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/4532-153-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/4532-158-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2344-151-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/4224-152-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/4532-153-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/4532-158-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
Executes dropped EXE 3 IoCs
Processes:
dwn.exedwn.exedwn.exepid process 2144 dwn.exe 2324 dwn.exe 2352 dwn.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exedwn.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation tmp.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation dwn.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts InstallUtil.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
dwn.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 dwn.exe Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 dwn.exe Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 dwn.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
tmp.exedwn.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Kbvypcxq = "\"C:\\Users\\Admin\\AppData\\Roaming\\Eygho\\Kbvypcxq.exe\"" tmp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uqvkhzka = "\"C:\\Users\\Admin\\AppData\\Roaming\\Iotsfyb\\Uqvkhzka.exe\"" dwn.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
tmp.exeInstallUtil.exedwn.exedescription pid process target process PID 792 set thread context of 2504 792 tmp.exe InstallUtil.exe PID 2504 set thread context of 4532 2504 InstallUtil.exe InstallUtil.exe PID 2504 set thread context of 4224 2504 InstallUtil.exe InstallUtil.exe PID 2504 set thread context of 2344 2504 InstallUtil.exe InstallUtil.exe PID 2144 set thread context of 2352 2144 dwn.exe dwn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
powershell.exeInstallUtil.exeInstallUtil.exepowershell.exedwn.exedwn.exepid process 3068 powershell.exe 3068 powershell.exe 2344 InstallUtil.exe 2344 InstallUtil.exe 4532 InstallUtil.exe 4532 InstallUtil.exe 4532 InstallUtil.exe 4532 InstallUtil.exe 936 powershell.exe 936 powershell.exe 2144 dwn.exe 2144 dwn.exe 2352 dwn.exe 2352 dwn.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
InstallUtil.exepid process 2504 InstallUtil.exe 2504 InstallUtil.exe 2504 InstallUtil.exe 2504 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
powershell.exetmp.exeInstallUtil.exepowershell.exedwn.exedwn.exedescription pid process Token: SeDebugPrivilege 3068 powershell.exe Token: SeDebugPrivilege 792 tmp.exe Token: SeDebugPrivilege 2344 InstallUtil.exe Token: SeDebugPrivilege 936 powershell.exe Token: SeDebugPrivilege 2144 dwn.exe Token: SeDebugPrivilege 2352 dwn.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 2504 InstallUtil.exe -
Suspicious use of WriteProcessMemory 47 IoCs
Processes:
tmp.exeInstallUtil.exedwn.exedescription pid process target process PID 792 wrote to memory of 3068 792 tmp.exe powershell.exe PID 792 wrote to memory of 3068 792 tmp.exe powershell.exe PID 792 wrote to memory of 3068 792 tmp.exe powershell.exe PID 792 wrote to memory of 2504 792 tmp.exe InstallUtil.exe PID 792 wrote to memory of 2504 792 tmp.exe InstallUtil.exe PID 792 wrote to memory of 2504 792 tmp.exe InstallUtil.exe PID 792 wrote to memory of 2504 792 tmp.exe InstallUtil.exe PID 792 wrote to memory of 2504 792 tmp.exe InstallUtil.exe PID 792 wrote to memory of 2504 792 tmp.exe InstallUtil.exe PID 792 wrote to memory of 2504 792 tmp.exe InstallUtil.exe PID 792 wrote to memory of 2504 792 tmp.exe InstallUtil.exe PID 792 wrote to memory of 2504 792 tmp.exe InstallUtil.exe PID 792 wrote to memory of 2504 792 tmp.exe InstallUtil.exe PID 792 wrote to memory of 2504 792 tmp.exe InstallUtil.exe PID 792 wrote to memory of 2504 792 tmp.exe InstallUtil.exe PID 2504 wrote to memory of 4180 2504 InstallUtil.exe InstallUtil.exe PID 2504 wrote to memory of 4180 2504 InstallUtil.exe InstallUtil.exe PID 2504 wrote to memory of 4180 2504 InstallUtil.exe InstallUtil.exe PID 2504 wrote to memory of 4532 2504 InstallUtil.exe InstallUtil.exe PID 2504 wrote to memory of 4532 2504 InstallUtil.exe InstallUtil.exe PID 2504 wrote to memory of 4532 2504 InstallUtil.exe InstallUtil.exe PID 2504 wrote to memory of 4532 2504 InstallUtil.exe InstallUtil.exe PID 2504 wrote to memory of 4224 2504 InstallUtil.exe InstallUtil.exe PID 2504 wrote to memory of 4224 2504 InstallUtil.exe InstallUtil.exe PID 2504 wrote to memory of 4224 2504 InstallUtil.exe InstallUtil.exe PID 2504 wrote to memory of 4224 2504 InstallUtil.exe InstallUtil.exe PID 2504 wrote to memory of 2344 2504 InstallUtil.exe InstallUtil.exe PID 2504 wrote to memory of 2344 2504 InstallUtil.exe InstallUtil.exe PID 2504 wrote to memory of 2344 2504 InstallUtil.exe InstallUtil.exe PID 2504 wrote to memory of 2344 2504 InstallUtil.exe InstallUtil.exe PID 2504 wrote to memory of 2144 2504 InstallUtil.exe dwn.exe PID 2504 wrote to memory of 2144 2504 InstallUtil.exe dwn.exe PID 2504 wrote to memory of 2144 2504 InstallUtil.exe dwn.exe PID 2144 wrote to memory of 936 2144 dwn.exe powershell.exe PID 2144 wrote to memory of 936 2144 dwn.exe powershell.exe PID 2144 wrote to memory of 936 2144 dwn.exe powershell.exe PID 2144 wrote to memory of 2324 2144 dwn.exe dwn.exe PID 2144 wrote to memory of 2324 2144 dwn.exe dwn.exe PID 2144 wrote to memory of 2324 2144 dwn.exe dwn.exe PID 2144 wrote to memory of 2352 2144 dwn.exe dwn.exe PID 2144 wrote to memory of 2352 2144 dwn.exe dwn.exe PID 2144 wrote to memory of 2352 2144 dwn.exe dwn.exe PID 2144 wrote to memory of 2352 2144 dwn.exe dwn.exe PID 2144 wrote to memory of 2352 2144 dwn.exe dwn.exe PID 2144 wrote to memory of 2352 2144 dwn.exe dwn.exe PID 2144 wrote to memory of 2352 2144 dwn.exe dwn.exe PID 2144 wrote to memory of 2352 2144 dwn.exe dwn.exe -
outlook_office_path 1 IoCs
Processes:
dwn.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 dwn.exe -
outlook_win_path 1 IoCs
Processes:
dwn.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 dwn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /stext "C:\Users\Admin\AppData\Local\Temp\vyrbubpborjkgpmh"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /stext "C:\Users\Admin\AppData\Local\Temp\vyrbubpborjkgpmh"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /stext "C:\Users\Admin\AppData\Local\Temp\xtxuumadczbxieatnzx"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /stext "C:\Users\Admin\AppData\Local\Temp\ivknvelwqitcskxxwcjtdsj"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\dwn.exe"C:\Users\Admin\AppData\Local\Temp\dwn.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAwAA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\dwn.exeC:\Users\Admin\AppData\Local\Temp\dwn.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\dwn.exeC:\Users\Admin\AppData\Local\Temp\dwn.exe4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dwn.exe.logFilesize
1KB
MD57e88081fcf716d85992bb3af3d9b6454
SHA12153780fbc71061b0102a7a7b665349e1013e250
SHA2565ffb4a3ea94a6a53c4f88e2191c6fec5fd8a7336e367aa113fe8c12631e0c4d2
SHA512ec606e14367ae221c04f213a61a6f797034495121198e4788e3afa4aa8db67bf59c5c5210a56afae5557158e8923b013b371b84c7d64303618c5b4c57a2224f7
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD56cdeccc3b83068359edc9e9af53035b6
SHA1b51b1113ee0d91931a4cc39fe96005d4c076c27a
SHA256a92a68317a9ec345a7f67afab48f87b76c25902d34fec6f926ede45adbbcf7b0
SHA5121ded1a606e1091d641b4c7e882733150a1fe29d025bd6f658596080a4ac8cfda0c23f89f518242a247a68f92c8c96618cfc516afbe9c9df69ee5d46cd6b9ba23
-
C:\Users\Admin\AppData\Local\Temp\dwn.exeFilesize
1.5MB
MD524a24d65b79918f7e66562a87fee6092
SHA18bfe971f81d0e660e923d097e54d8851d49f23b1
SHA256d985c6aae8f8244cae60bea8e32dc0be60af18ce2773dc1937e7080c4e851662
SHA5123f9e3fa44f52a5ab13d3cad82168a9cc215cd6d06edccd1ee0d3ca2023a10f9a9ff5a3e97316c5a2ea9e9124791181c3156b36b0ced099a9993b055f459d52eb
-
C:\Users\Admin\AppData\Local\Temp\dwn.exeFilesize
1.5MB
MD524a24d65b79918f7e66562a87fee6092
SHA18bfe971f81d0e660e923d097e54d8851d49f23b1
SHA256d985c6aae8f8244cae60bea8e32dc0be60af18ce2773dc1937e7080c4e851662
SHA5123f9e3fa44f52a5ab13d3cad82168a9cc215cd6d06edccd1ee0d3ca2023a10f9a9ff5a3e97316c5a2ea9e9124791181c3156b36b0ced099a9993b055f459d52eb
-
C:\Users\Admin\AppData\Local\Temp\dwn.exeFilesize
1.5MB
MD524a24d65b79918f7e66562a87fee6092
SHA18bfe971f81d0e660e923d097e54d8851d49f23b1
SHA256d985c6aae8f8244cae60bea8e32dc0be60af18ce2773dc1937e7080c4e851662
SHA5123f9e3fa44f52a5ab13d3cad82168a9cc215cd6d06edccd1ee0d3ca2023a10f9a9ff5a3e97316c5a2ea9e9124791181c3156b36b0ced099a9993b055f459d52eb
-
C:\Users\Admin\AppData\Local\Temp\dwn.exeFilesize
1.5MB
MD524a24d65b79918f7e66562a87fee6092
SHA18bfe971f81d0e660e923d097e54d8851d49f23b1
SHA256d985c6aae8f8244cae60bea8e32dc0be60af18ce2773dc1937e7080c4e851662
SHA5123f9e3fa44f52a5ab13d3cad82168a9cc215cd6d06edccd1ee0d3ca2023a10f9a9ff5a3e97316c5a2ea9e9124791181c3156b36b0ced099a9993b055f459d52eb
-
C:\Users\Admin\AppData\Local\Temp\vyrbubpborjkgpmhFilesize
4KB
MD530177e1276595fd69ea96b692f49d776
SHA175769c29031ca1ad8e175dd700c74b5e35c5b0c7
SHA25676d4066990e2ee2776f733a25ce23e9af545fd6f1a3b5760d603bdc05d9402d5
SHA512ccdf20174d299de8ec21445faaf4ebe95c04bd7634c9fe138ba54262b754620c2dfd53a5c94b7d53518181d2eab7b5c97d7933d3a66d05220b06aee120893d4b
-
memory/792-132-0x0000000000450000-0x0000000000616000-memory.dmpFilesize
1.8MB
-
memory/792-133-0x00000000059F0000-0x0000000005A12000-memory.dmpFilesize
136KB
-
memory/936-160-0x0000000000000000-mapping.dmp
-
memory/2144-154-0x0000000000000000-mapping.dmp
-
memory/2144-157-0x0000000000D00000-0x0000000000E86000-memory.dmpFilesize
1.5MB
-
memory/2324-165-0x0000000000000000-mapping.dmp
-
memory/2344-150-0x0000000000000000-mapping.dmp
-
memory/2344-151-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2352-167-0x0000000000000000-mapping.dmp
-
memory/2352-175-0x0000000006610000-0x000000000661A000-memory.dmpFilesize
40KB
-
memory/2352-174-0x0000000006680000-0x0000000006712000-memory.dmpFilesize
584KB
-
memory/2352-173-0x0000000006220000-0x0000000006270000-memory.dmpFilesize
320KB
-
memory/2352-172-0x0000000005090000-0x000000000512C000-memory.dmpFilesize
624KB
-
memory/2352-171-0x0000000005640000-0x0000000005BE4000-memory.dmpFilesize
5.6MB
-
memory/2352-168-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2504-146-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2504-164-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2504-145-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2504-142-0x0000000000000000-mapping.dmp
-
memory/2504-144-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2504-143-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3068-137-0x0000000005990000-0x00000000059F6000-memory.dmpFilesize
408KB
-
memory/3068-135-0x0000000002B90000-0x0000000002BC6000-memory.dmpFilesize
216KB
-
memory/3068-139-0x0000000006140000-0x000000000615E000-memory.dmpFilesize
120KB
-
memory/3068-140-0x0000000007990000-0x000000000800A000-memory.dmpFilesize
6.5MB
-
memory/3068-136-0x0000000005360000-0x0000000005988000-memory.dmpFilesize
6.2MB
-
memory/3068-141-0x0000000006630000-0x000000000664A000-memory.dmpFilesize
104KB
-
memory/3068-134-0x0000000000000000-mapping.dmp
-
memory/3068-138-0x0000000005AB0000-0x0000000005B16000-memory.dmpFilesize
408KB
-
memory/4180-147-0x0000000000000000-mapping.dmp
-
memory/4224-152-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/4224-149-0x0000000000000000-mapping.dmp
-
memory/4532-158-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4532-153-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4532-148-0x0000000000000000-mapping.dmp