Analysis
-
max time kernel
152s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28-03-2023 07:37
Static task
static1
Behavioral task
behavioral1
Sample
Lectura de cargos.exe
Resource
win7-20230220-en
General
-
Target
Lectura de cargos.exe
-
Size
420.0MB
-
MD5
3699f52d9d6cf60fcf8cfc3b2594d0a6
-
SHA1
90a772e4d65d65dfcd7673de798180dbdf143ea2
-
SHA256
4b49dcfe526fbd91184caa931c60b6e430c72ddd0b05b1df3ffa855bebf9499b
-
SHA512
1549f3e6df361332077fdf4740b7b3aa5bd8a986470d847ed5b53899427bb2d7bc10dd8bb6dbe479cc86731280ce354cdf65c51b7df61336a4638f1a810b3093
-
SSDEEP
12288:sixvWiHIG85ZOTahHYByyT/0rrdmPLxUkol6F6yayQXm0kWqJbYyM2NoqA0:PWi0gQly5NxO6VayL0ktb3nNPl
Malware Config
Extracted
remcos
21-marzo
20.38.13.217:2524
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-KUGK7N
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
Word.exeWord.exeWord.exepid process 540 Word.exe 1404 Word.exe 648 Word.exe -
Drops file in System32 directory 3 IoCs
Processes:
powershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Lectura de cargos.exeWord.exeWord.exeWord.exedescription pid process target process PID 1700 set thread context of 1144 1700 Lectura de cargos.exe csc.exe PID 540 set thread context of 1604 540 Word.exe csc.exe PID 1404 set thread context of 292 1404 Word.exe csc.exe PID 648 set thread context of 1940 648 Word.exe csc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1524 schtasks.exe 676 schtasks.exe 784 schtasks.exe 1304 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 1932 powershell.exe 1916 powershell.exe 1696 powershell.exe 1920 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1932 powershell.exe Token: SeDebugPrivilege 1916 powershell.exe Token: SeDebugPrivilege 1696 powershell.exe Token: SeDebugPrivilege 1920 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
csc.exepid process 1144 csc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Lectura de cargos.execmd.exetaskeng.exeWord.execmd.exedescription pid process target process PID 1700 wrote to memory of 1308 1700 Lectura de cargos.exe cmd.exe PID 1700 wrote to memory of 1308 1700 Lectura de cargos.exe cmd.exe PID 1700 wrote to memory of 1308 1700 Lectura de cargos.exe cmd.exe PID 1700 wrote to memory of 1308 1700 Lectura de cargos.exe cmd.exe PID 1700 wrote to memory of 1388 1700 Lectura de cargos.exe cmd.exe PID 1700 wrote to memory of 1388 1700 Lectura de cargos.exe cmd.exe PID 1700 wrote to memory of 1388 1700 Lectura de cargos.exe cmd.exe PID 1700 wrote to memory of 1388 1700 Lectura de cargos.exe cmd.exe PID 1308 wrote to memory of 676 1308 cmd.exe schtasks.exe PID 1308 wrote to memory of 676 1308 cmd.exe schtasks.exe PID 1308 wrote to memory of 676 1308 cmd.exe schtasks.exe PID 1308 wrote to memory of 676 1308 cmd.exe schtasks.exe PID 1700 wrote to memory of 1932 1700 Lectura de cargos.exe powershell.exe PID 1700 wrote to memory of 1932 1700 Lectura de cargos.exe powershell.exe PID 1700 wrote to memory of 1932 1700 Lectura de cargos.exe powershell.exe PID 1700 wrote to memory of 1932 1700 Lectura de cargos.exe powershell.exe PID 1700 wrote to memory of 1144 1700 Lectura de cargos.exe csc.exe PID 1700 wrote to memory of 1144 1700 Lectura de cargos.exe csc.exe PID 1700 wrote to memory of 1144 1700 Lectura de cargos.exe csc.exe PID 1700 wrote to memory of 1144 1700 Lectura de cargos.exe csc.exe PID 1700 wrote to memory of 1144 1700 Lectura de cargos.exe csc.exe PID 1700 wrote to memory of 1144 1700 Lectura de cargos.exe csc.exe PID 1700 wrote to memory of 1144 1700 Lectura de cargos.exe csc.exe PID 1700 wrote to memory of 1144 1700 Lectura de cargos.exe csc.exe PID 1700 wrote to memory of 1144 1700 Lectura de cargos.exe csc.exe PID 1700 wrote to memory of 1144 1700 Lectura de cargos.exe csc.exe PID 1700 wrote to memory of 1144 1700 Lectura de cargos.exe csc.exe PID 1700 wrote to memory of 1144 1700 Lectura de cargos.exe csc.exe PID 1700 wrote to memory of 1144 1700 Lectura de cargos.exe csc.exe PID 2024 wrote to memory of 540 2024 taskeng.exe Word.exe PID 2024 wrote to memory of 540 2024 taskeng.exe Word.exe PID 2024 wrote to memory of 540 2024 taskeng.exe Word.exe PID 2024 wrote to memory of 540 2024 taskeng.exe Word.exe PID 540 wrote to memory of 788 540 Word.exe cmd.exe PID 540 wrote to memory of 788 540 Word.exe cmd.exe PID 540 wrote to memory of 788 540 Word.exe cmd.exe PID 540 wrote to memory of 788 540 Word.exe cmd.exe PID 540 wrote to memory of 1092 540 Word.exe cmd.exe PID 540 wrote to memory of 1092 540 Word.exe cmd.exe PID 540 wrote to memory of 1092 540 Word.exe cmd.exe PID 540 wrote to memory of 1092 540 Word.exe cmd.exe PID 788 wrote to memory of 784 788 cmd.exe schtasks.exe PID 788 wrote to memory of 784 788 cmd.exe schtasks.exe PID 788 wrote to memory of 784 788 cmd.exe schtasks.exe PID 788 wrote to memory of 784 788 cmd.exe schtasks.exe PID 540 wrote to memory of 1916 540 Word.exe powershell.exe PID 540 wrote to memory of 1916 540 Word.exe powershell.exe PID 540 wrote to memory of 1916 540 Word.exe powershell.exe PID 540 wrote to memory of 1916 540 Word.exe powershell.exe PID 540 wrote to memory of 1604 540 Word.exe csc.exe PID 540 wrote to memory of 1604 540 Word.exe csc.exe PID 540 wrote to memory of 1604 540 Word.exe csc.exe PID 540 wrote to memory of 1604 540 Word.exe csc.exe PID 540 wrote to memory of 1604 540 Word.exe csc.exe PID 540 wrote to memory of 1604 540 Word.exe csc.exe PID 540 wrote to memory of 1604 540 Word.exe csc.exe PID 540 wrote to memory of 1604 540 Word.exe csc.exe PID 540 wrote to memory of 1604 540 Word.exe csc.exe PID 540 wrote to memory of 1604 540 Word.exe csc.exe PID 540 wrote to memory of 1604 540 Word.exe csc.exe PID 540 wrote to memory of 1604 540 Word.exe csc.exe PID 540 wrote to memory of 1604 540 Word.exe csc.exe PID 2024 wrote to memory of 1404 2024 taskeng.exe Word.exe PID 2024 wrote to memory of 1404 2024 taskeng.exe Word.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lectura de cargos.exe"C:\Users\Admin\AppData\Local\Temp\Lectura de cargos.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Word.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Word.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\Lectura de cargos.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Word.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\Admin\AppData\Local\Temp\Lectura de cargos.exe'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskeng.exetaskeng.exe {C9AD4B51-9C70-4483-8C5C-4E6DBE489D96} S-1-5-21-3430344531-3702557399-3004411149-1000:WFSTZEPN\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Word.exeC:\Users\Admin\AppData\Roaming\Microsoft\Word.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Word.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Word.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\Microsoft\Word.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Word.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\Admin\AppData\Roaming\Microsoft\Word.exe'"3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Word.exeC:\Users\Admin\AppData\Roaming\Microsoft\Word.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Word.exe'" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Word.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\Microsoft\Word.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Word.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\Admin\AppData\Roaming\Microsoft\Word.exe'"3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Word.exeC:\Users\Admin\AppData\Roaming\Microsoft\Word.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Word.exe'" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Word.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\Microsoft\Word.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Word.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\Admin\AppData\Roaming\Microsoft\Word.exe'"3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\remcos\logs.datFilesize
144B
MD5d93d94921448749cc85932e67ac62376
SHA13d3423ee6ae3b6daaaf416bd6f292917153222a3
SHA2561494e04b88fdb26ea86820163e2460dd9ff1cdb15140676a9c93afc0702df031
SHA51236f3430e0e447505524d3353b2d0e23448037aa508d0ca44332afd41adf92f22afe6392beeb13e80c4afb2618c07eb163e07c334b0656d7f42e3de5fe243e876
-
C:\ProgramData\remcos\logs.datFilesize
228B
MD53308fd85cfb8facb2274249ea404cb3f
SHA1e0b5d87295d7b9f50a7991742091fd23a9426373
SHA2561ffb7dbec12b757e3b247ab83845388bb3d676dc330e6417f880302cf1a39089
SHA512ea31fab2a3557a4ef60a9a47d66eca717927b965683a0179101f5d5f57cd98fb9abaa6aa33b0600b5162302b13925b4076dd194ba26558214fea86ca750c0def
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HQXB42ZJSWZPDBYAP9GC.tempFilesize
7KB
MD5fc8c3cc6226b435a9661da45d47a31c9
SHA1a128ca65bb9937e20f0aad59e01d94e0b135cffd
SHA256f159267c2fdda603b4c3bbbec54c649da821e845604599be2ad32d8b60bb28ce
SHA512bb4ef9c7d29b93d97daf29a50a4dfe4cfa8b754f1e8b433bb2d2cb09dfd1c71797f9415783cc0a1cc0f81d565e79f0681b6ec63d51cf7783d37af8881d6f9325
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5fc8c3cc6226b435a9661da45d47a31c9
SHA1a128ca65bb9937e20f0aad59e01d94e0b135cffd
SHA256f159267c2fdda603b4c3bbbec54c649da821e845604599be2ad32d8b60bb28ce
SHA512bb4ef9c7d29b93d97daf29a50a4dfe4cfa8b754f1e8b433bb2d2cb09dfd1c71797f9415783cc0a1cc0f81d565e79f0681b6ec63d51cf7783d37af8881d6f9325
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5fc8c3cc6226b435a9661da45d47a31c9
SHA1a128ca65bb9937e20f0aad59e01d94e0b135cffd
SHA256f159267c2fdda603b4c3bbbec54c649da821e845604599be2ad32d8b60bb28ce
SHA512bb4ef9c7d29b93d97daf29a50a4dfe4cfa8b754f1e8b433bb2d2cb09dfd1c71797f9415783cc0a1cc0f81d565e79f0681b6ec63d51cf7783d37af8881d6f9325
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD52804b7976a82e0526ef5bb23c85d23b5
SHA12be768d06c93581e414d0c1cf69551a4a9d59d3f
SHA256c9c8686c8cbc4bdb477351668c8365260a9b13c19b78cb123f8cf7e1ef3af12f
SHA512c0d13750ab14b00f17f68edb82a4f7802bdcc5f0ee68f15466c4e115969da0d16b4b1a06b07a03b887501859312667717b524cf21e6fe3c69076686c99ee106d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Word.exeFilesize
420.0MB
MD53699f52d9d6cf60fcf8cfc3b2594d0a6
SHA190a772e4d65d65dfcd7673de798180dbdf143ea2
SHA2564b49dcfe526fbd91184caa931c60b6e430c72ddd0b05b1df3ffa855bebf9499b
SHA5121549f3e6df361332077fdf4740b7b3aa5bd8a986470d847ed5b53899427bb2d7bc10dd8bb6dbe479cc86731280ce354cdf65c51b7df61336a4638f1a810b3093
-
C:\Users\Admin\AppData\Roaming\Microsoft\Word.exeFilesize
174.0MB
MD53f5ef71aa2518835d7d01cda472ece49
SHA1356514e9ed082b9180a157349e94cf7bf90c1b39
SHA2563524255ba9c8fa599463feffabdc882850dcd51c9eb412bc88849e883e91e027
SHA5128a87aa099444c2b0a375d8fb505c449abe44a018c5af7243697b61f7e396d7a2fdd7019723090e38035f6a6c86b60b3480052493fd3967be744fa2cd5253f852
-
C:\Users\Admin\AppData\Roaming\Microsoft\Word.exeFilesize
420.0MB
MD53699f52d9d6cf60fcf8cfc3b2594d0a6
SHA190a772e4d65d65dfcd7673de798180dbdf143ea2
SHA2564b49dcfe526fbd91184caa931c60b6e430c72ddd0b05b1df3ffa855bebf9499b
SHA5121549f3e6df361332077fdf4740b7b3aa5bd8a986470d847ed5b53899427bb2d7bc10dd8bb6dbe479cc86731280ce354cdf65c51b7df61336a4638f1a810b3093
-
C:\Users\Admin\AppData\Roaming\Microsoft\Word.exeFilesize
420.0MB
MD53699f52d9d6cf60fcf8cfc3b2594d0a6
SHA190a772e4d65d65dfcd7673de798180dbdf143ea2
SHA2564b49dcfe526fbd91184caa931c60b6e430c72ddd0b05b1df3ffa855bebf9499b
SHA5121549f3e6df361332077fdf4740b7b3aa5bd8a986470d847ed5b53899427bb2d7bc10dd8bb6dbe479cc86731280ce354cdf65c51b7df61336a4638f1a810b3093
-
memory/540-103-0x0000000000E90000-0x0000000000ED0000-memory.dmpFilesize
256KB
-
memory/540-96-0x0000000001080000-0x00000000012A6000-memory.dmpFilesize
2.1MB
-
memory/648-251-0x00000000048E0000-0x0000000004920000-memory.dmpFilesize
256KB
-
memory/648-240-0x0000000000BF0000-0x0000000000E16000-memory.dmpFilesize
2.1MB
-
memory/1144-64-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-69-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/1144-89-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-90-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-82-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-62-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-68-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-92-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-71-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-76-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-95-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-139-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-98-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-99-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-100-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-102-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-61-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-65-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-110-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-127-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-137-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-135-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-84-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-63-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-133-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-86-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-85-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-140-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-141-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-143-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-144-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-145-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-67-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-66-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1144-81-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/1404-178-0x0000000002200000-0x0000000002240000-memory.dmpFilesize
256KB
-
memory/1404-168-0x0000000000180000-0x00000000003A6000-memory.dmpFilesize
2.1MB
-
memory/1696-183-0x0000000002650000-0x0000000002690000-memory.dmpFilesize
256KB
-
memory/1696-182-0x0000000002650000-0x0000000002690000-memory.dmpFilesize
256KB
-
memory/1700-55-0x0000000000A80000-0x0000000000B00000-memory.dmpFilesize
512KB
-
memory/1700-56-0x0000000004A50000-0x0000000004A90000-memory.dmpFilesize
256KB
-
memory/1700-54-0x0000000001310000-0x0000000001536000-memory.dmpFilesize
2.1MB
-
memory/1916-136-0x0000000002060000-0x00000000020A0000-memory.dmpFilesize
256KB
-
memory/1916-134-0x0000000002060000-0x00000000020A0000-memory.dmpFilesize
256KB
-
memory/1920-252-0x0000000002710000-0x0000000002750000-memory.dmpFilesize
256KB
-
memory/1920-254-0x0000000002710000-0x0000000002750000-memory.dmpFilesize
256KB
-
memory/1920-253-0x0000000002710000-0x0000000002750000-memory.dmpFilesize
256KB
-
memory/1932-87-0x00000000027C0000-0x0000000002800000-memory.dmpFilesize
256KB
-
memory/1932-88-0x00000000027C0000-0x0000000002800000-memory.dmpFilesize
256KB