Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-11-2022 09:23
Static task
static1
Behavioral task
behavioral1
Sample
2022-11-4 报价请求.PDF.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2022-11-4 报价请求.PDF.exe
Resource
win10v2004-20220901-en
General
-
Target
2022-11-4 报价请求.PDF.exe
-
Size
1.1MB
-
MD5
b80414e3202a808673a8254aec607a12
-
SHA1
fef5c52c3af36689f3c794ce586d83b0a458afa5
-
SHA256
5c09c1cfdc80893c1a64a68ed969bd26c929c78fb125747ad01064c5b237ad7b
-
SHA512
3e1a4e4918b2b64238403811348248ff5955793cf405087edaac332461c74ee3d26b21f814565d22ae4f30cc4436821ac7f9fcdc61cae38d1ce8adf3ff2609b3
-
SSDEEP
24576:ZH14Ct7BwWTmQHsOzj4j85M1hUQDAxzJX4K4hGxosG:ZHGW7BwWtsOzj4jGM1aK4FX3
Malware Config
Extracted
remcos
NEW REM STUB
valvesco.duckdns.org:5050
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-48V73L
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\mnvcbn .exe," reg.exe -
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1968-106-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral1/memory/1968-112-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1600-102-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1760-96-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/1600-102-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/1968-106-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral1/memory/1968-112-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft -
Executes dropped EXE 3 IoCs
Processes:
mnvcbn .exe mnvcbnqa.exe mnvcbnqa.exepid process 1248 mnvcbn .exe 1496 mnvcbnqa.exe 624 mnvcbnqa.exe -
Loads dropped DLL 3 IoCs
Processes:
cmd.exemnvcbn .exe mnvcbnqa.exepid process 772 cmd.exe 1248 mnvcbn .exe 1496 mnvcbnqa.exe -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts AddInProcess32.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
mnvcbn .exeAddInProcess32.exedescription pid process target process PID 1248 set thread context of 1820 1248 mnvcbn .exe AddInProcess32.exe PID 1820 set thread context of 1600 1820 AddInProcess32.exe AddInProcess32.exe PID 1820 set thread context of 1968 1820 AddInProcess32.exe AddInProcess32.exe PID 1820 set thread context of 1760 1820 AddInProcess32.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 1004 PING.EXE 1944 PING.EXE 316 PING.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
2022-11-4 报价请求.PDF.exemnvcbn .exeAddInProcess32.exe mnvcbnqa.exe mnvcbnqa.exepid process 1048 2022-11-4 报价请求.PDF.exe 1048 2022-11-4 报价请求.PDF.exe 1048 2022-11-4 报价请求.PDF.exe 1248 mnvcbn .exe 1248 mnvcbn .exe 1248 mnvcbn .exe 1600 AddInProcess32.exe 1600 AddInProcess32.exe 1496 mnvcbnqa.exe 624 mnvcbnqa.exe 624 mnvcbnqa.exe 624 mnvcbnqa.exe 1248 mnvcbn .exe 1248 mnvcbn .exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
AddInProcess32.exepid process 1820 AddInProcess32.exe 1820 AddInProcess32.exe 1820 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
2022-11-4 报价请求.PDF.exemnvcbn .exeAddInProcess32.exe mnvcbnqa.exe mnvcbnqa.exedescription pid process Token: SeDebugPrivilege 1048 2022-11-4 报价请求.PDF.exe Token: SeDebugPrivilege 1248 mnvcbn .exe Token: SeDebugPrivilege 1760 AddInProcess32.exe Token: SeDebugPrivilege 1496 mnvcbnqa.exe Token: SeDebugPrivilege 624 mnvcbnqa.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AddInProcess32.exepid process 1820 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2022-11-4 报价请求.PDF.execmd.execmd.exemnvcbn .exeAddInProcess32.exe mnvcbnqa.exedescription pid process target process PID 1048 wrote to memory of 1284 1048 2022-11-4 报价请求.PDF.exe cmd.exe PID 1048 wrote to memory of 1284 1048 2022-11-4 报价请求.PDF.exe cmd.exe PID 1048 wrote to memory of 1284 1048 2022-11-4 报价请求.PDF.exe cmd.exe PID 1048 wrote to memory of 1284 1048 2022-11-4 报价请求.PDF.exe cmd.exe PID 1284 wrote to memory of 1004 1284 cmd.exe PING.EXE PID 1284 wrote to memory of 1004 1284 cmd.exe PING.EXE PID 1284 wrote to memory of 1004 1284 cmd.exe PING.EXE PID 1284 wrote to memory of 1004 1284 cmd.exe PING.EXE PID 1048 wrote to memory of 772 1048 2022-11-4 报价请求.PDF.exe cmd.exe PID 1048 wrote to memory of 772 1048 2022-11-4 报价请求.PDF.exe cmd.exe PID 1048 wrote to memory of 772 1048 2022-11-4 报价请求.PDF.exe cmd.exe PID 1048 wrote to memory of 772 1048 2022-11-4 报价请求.PDF.exe cmd.exe PID 772 wrote to memory of 1944 772 cmd.exe PING.EXE PID 772 wrote to memory of 1944 772 cmd.exe PING.EXE PID 772 wrote to memory of 1944 772 cmd.exe PING.EXE PID 772 wrote to memory of 1944 772 cmd.exe PING.EXE PID 1284 wrote to memory of 1708 1284 cmd.exe reg.exe PID 1284 wrote to memory of 1708 1284 cmd.exe reg.exe PID 1284 wrote to memory of 1708 1284 cmd.exe reg.exe PID 1284 wrote to memory of 1708 1284 cmd.exe reg.exe PID 772 wrote to memory of 316 772 cmd.exe PING.EXE PID 772 wrote to memory of 316 772 cmd.exe PING.EXE PID 772 wrote to memory of 316 772 cmd.exe PING.EXE PID 772 wrote to memory of 316 772 cmd.exe PING.EXE PID 772 wrote to memory of 1248 772 cmd.exe mnvcbn .exe PID 772 wrote to memory of 1248 772 cmd.exe mnvcbn .exe PID 772 wrote to memory of 1248 772 cmd.exe mnvcbn .exe PID 772 wrote to memory of 1248 772 cmd.exe mnvcbn .exe PID 1248 wrote to memory of 1820 1248 mnvcbn .exe AddInProcess32.exe PID 1248 wrote to memory of 1820 1248 mnvcbn .exe AddInProcess32.exe PID 1248 wrote to memory of 1820 1248 mnvcbn .exe AddInProcess32.exe PID 1248 wrote to memory of 1820 1248 mnvcbn .exe AddInProcess32.exe PID 1248 wrote to memory of 1820 1248 mnvcbn .exe AddInProcess32.exe PID 1248 wrote to memory of 1820 1248 mnvcbn .exe AddInProcess32.exe PID 1248 wrote to memory of 1820 1248 mnvcbn .exe AddInProcess32.exe PID 1248 wrote to memory of 1820 1248 mnvcbn .exe AddInProcess32.exe PID 1248 wrote to memory of 1820 1248 mnvcbn .exe AddInProcess32.exe PID 1248 wrote to memory of 1820 1248 mnvcbn .exe AddInProcess32.exe PID 1248 wrote to memory of 1820 1248 mnvcbn .exe AddInProcess32.exe PID 1248 wrote to memory of 1820 1248 mnvcbn .exe AddInProcess32.exe PID 1248 wrote to memory of 1820 1248 mnvcbn .exe AddInProcess32.exe PID 1820 wrote to memory of 1600 1820 AddInProcess32.exe AddInProcess32.exe PID 1820 wrote to memory of 1600 1820 AddInProcess32.exe AddInProcess32.exe PID 1820 wrote to memory of 1600 1820 AddInProcess32.exe AddInProcess32.exe PID 1820 wrote to memory of 1600 1820 AddInProcess32.exe AddInProcess32.exe PID 1820 wrote to memory of 1600 1820 AddInProcess32.exe AddInProcess32.exe PID 1820 wrote to memory of 1968 1820 AddInProcess32.exe AddInProcess32.exe PID 1820 wrote to memory of 1968 1820 AddInProcess32.exe AddInProcess32.exe PID 1820 wrote to memory of 1968 1820 AddInProcess32.exe AddInProcess32.exe PID 1820 wrote to memory of 1968 1820 AddInProcess32.exe AddInProcess32.exe PID 1820 wrote to memory of 1968 1820 AddInProcess32.exe AddInProcess32.exe PID 1820 wrote to memory of 1760 1820 AddInProcess32.exe AddInProcess32.exe PID 1820 wrote to memory of 1760 1820 AddInProcess32.exe AddInProcess32.exe PID 1820 wrote to memory of 1760 1820 AddInProcess32.exe AddInProcess32.exe PID 1820 wrote to memory of 1760 1820 AddInProcess32.exe AddInProcess32.exe PID 1820 wrote to memory of 1760 1820 AddInProcess32.exe AddInProcess32.exe PID 1248 wrote to memory of 1496 1248 mnvcbn .exe mnvcbnqa.exe PID 1248 wrote to memory of 1496 1248 mnvcbn .exe mnvcbnqa.exe PID 1248 wrote to memory of 1496 1248 mnvcbn .exe mnvcbnqa.exe PID 1248 wrote to memory of 1496 1248 mnvcbn .exe mnvcbnqa.exe PID 1496 wrote to memory of 624 1496 mnvcbnqa.exe mnvcbnqa.exe PID 1496 wrote to memory of 624 1496 mnvcbnqa.exe mnvcbnqa.exe PID 1496 wrote to memory of 624 1496 mnvcbnqa.exe mnvcbnqa.exe PID 1496 wrote to memory of 624 1496 mnvcbnqa.exe mnvcbnqa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2022-11-4 报价请求.PDF.exe"C:\Users\Admin\AppData\Local\Temp\2022-11-4 报价请求.PDF.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\mnvcbn .exe,"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 73⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\mnvcbn .exe,"3⤵
- Modifies WinLogon for persistence
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 9 > nul && copy "C:\Users\Admin\AppData\Local\Temp\2022-11-4 报价请求.PDF.exe" "C:\Users\Admin\AppData\Roaming\mnvcbn .exe" && ping 127.0.0.1 -n 9 > nul && "C:\Users\Admin\AppData\Roaming\mnvcbn .exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 93⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 93⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\mnvcbn .exe"C:\Users\Admin\AppData\Roaming\mnvcbn .exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\dtlrgitodanwjkkyuwgezebkxaapt"5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\ovrkhaeirifblqycehsgkrwtghryuyrtl"5⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\ypeuh"5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ mnvcbnqa.exe"C:\Users\Admin\AppData\Local\Temp\ mnvcbnqa.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ mnvcbnqa.exe"C:\Users\Admin\AppData\Local\Temp\ mnvcbnqa.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ mnvcbnqa.exeFilesize
76KB
MD50e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
C:\Users\Admin\AppData\Local\Temp\ mnvcbnqa.exeFilesize
76KB
MD50e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
C:\Users\Admin\AppData\Local\Temp\ mnvcbnqa.exeFilesize
76KB
MD50e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
C:\Users\Admin\AppData\Local\Temp\ mnvcbnqa.txtFilesize
53B
MD5dffb1d7b769d6bf08834d09bcf3691c4
SHA1deba945ca3d66fe6d8d0f57576106dddd493c27c
SHA2566dd30a533e073ce29213abc5c0d5fd9426ff9784bcfacadbc279935b047edd6d
SHA512ddb4b305ccff7a47b3ea404d44d1e5f8b36253f5c5450b25b610ec9836e2f421e89335a488823ab4dbd58ccd09f16c5c80285cc2a15b157a2c0dde5b59e6bbea
-
C:\Users\Admin\AppData\Local\Temp\ mnvcbnqa.txtFilesize
56B
MD50762b57b129b6f609006846041fcf41d
SHA1f553de9bedf9e34c94e29f16d45af85e089c3468
SHA256adf850d6eaa74ae3166ae7bfd520a0c579a67cb079dff1e4eab01b89dc2e4fd3
SHA512d99ff0067160847b9db070fccda7ae6fe84464914a90ecf42613bb8ff85975c878ae94f71c2a13e0632dde4c6bbae2486cd40baac03a81d88808b4cc67054f85
-
C:\Users\Admin\AppData\Local\Temp\ mnvcbnqa.txtFilesize
55B
MD5bf8a773c55bb66b15054d54f2e88017b
SHA1b8b408c9d49e569501052c2782aa7a4cbc10f494
SHA2564fec57cd5500be4a29b398d60957e33fdd2390be0bab103d900fb776b2dcc019
SHA512806a4003405df5c335624405f05560a5599dcda5a5163ddbd8846c5063b0e92c05315192cf4afbce1166aa1beabe794302066192eee0230bd34f5af98c960459
-
C:\Users\Admin\AppData\Local\Temp\dtlrgitodanwjkkyuwgezebkxaaptFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\mnvcbn .exeFilesize
1.1MB
MD5b80414e3202a808673a8254aec607a12
SHA1fef5c52c3af36689f3c794ce586d83b0a458afa5
SHA2565c09c1cfdc80893c1a64a68ed969bd26c929c78fb125747ad01064c5b237ad7b
SHA5123e1a4e4918b2b64238403811348248ff5955793cf405087edaac332461c74ee3d26b21f814565d22ae4f30cc4436821ac7f9fcdc61cae38d1ce8adf3ff2609b3
-
C:\Users\Admin\AppData\Roaming\mnvcbn .exeFilesize
1.1MB
MD5b80414e3202a808673a8254aec607a12
SHA1fef5c52c3af36689f3c794ce586d83b0a458afa5
SHA2565c09c1cfdc80893c1a64a68ed969bd26c929c78fb125747ad01064c5b237ad7b
SHA5123e1a4e4918b2b64238403811348248ff5955793cf405087edaac332461c74ee3d26b21f814565d22ae4f30cc4436821ac7f9fcdc61cae38d1ce8adf3ff2609b3
-
\Users\Admin\AppData\Local\Temp\ mnvcbnqa.exeFilesize
76KB
MD50e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
\Users\Admin\AppData\Local\Temp\ mnvcbnqa.exeFilesize
76KB
MD50e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
\Users\Admin\AppData\Roaming\mnvcbn .exeFilesize
1.1MB
MD5b80414e3202a808673a8254aec607a12
SHA1fef5c52c3af36689f3c794ce586d83b0a458afa5
SHA2565c09c1cfdc80893c1a64a68ed969bd26c929c78fb125747ad01064c5b237ad7b
SHA5123e1a4e4918b2b64238403811348248ff5955793cf405087edaac332461c74ee3d26b21f814565d22ae4f30cc4436821ac7f9fcdc61cae38d1ce8adf3ff2609b3
-
memory/316-63-0x0000000000000000-mapping.dmp
-
memory/624-108-0x0000000000000000-mapping.dmp
-
memory/772-60-0x0000000000000000-mapping.dmp
-
memory/1004-59-0x0000000000000000-mapping.dmp
-
memory/1048-54-0x0000000001340000-0x0000000001460000-memory.dmpFilesize
1.1MB
-
memory/1048-57-0x0000000000B00000-0x0000000000B18000-memory.dmpFilesize
96KB
-
memory/1048-56-0x0000000000500000-0x0000000000530000-memory.dmpFilesize
192KB
-
memory/1048-55-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1248-65-0x0000000000000000-mapping.dmp
-
memory/1248-71-0x0000000000CE0000-0x0000000000CE6000-memory.dmpFilesize
24KB
-
memory/1248-68-0x00000000010B0000-0x00000000011D0000-memory.dmpFilesize
1.1MB
-
memory/1248-70-0x0000000000C30000-0x0000000000C4A000-memory.dmpFilesize
104KB
-
memory/1284-58-0x0000000000000000-mapping.dmp
-
memory/1496-98-0x0000000000000000-mapping.dmp
-
memory/1496-101-0x0000000000070000-0x000000000008A000-memory.dmpFilesize
104KB
-
memory/1600-102-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1600-90-0x0000000000476274-mapping.dmp
-
memory/1708-62-0x0000000000000000-mapping.dmp
-
memory/1760-96-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1760-94-0x0000000000422206-mapping.dmp
-
memory/1820-73-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1820-72-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1820-75-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1820-78-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1820-85-0x00000000004327A4-mapping.dmp
-
memory/1820-77-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1820-89-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1820-79-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1820-84-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1820-113-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1820-82-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1820-80-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1820-88-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1944-61-0x0000000000000000-mapping.dmp
-
memory/1968-91-0x0000000000455238-mapping.dmp
-
memory/1968-112-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1968-106-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB