Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
29-03-2023 11:02
Static task
static1
Behavioral task
behavioral1
Sample
Lectura de cargos.exe
Resource
win7-20230220-en
General
-
Target
Lectura de cargos.exe
-
Size
670.0MB
-
MD5
bdb8cbc51cb8f186e4a8b56217ead338
-
SHA1
877b1f5e43bd90fc3be1bda08250c87565a10f3a
-
SHA256
7706a18ee5ae4110a77ee6b4b055cdcd46f120d00895e8568a246865cad9c18e
-
SHA512
e06a768c2c74f8d7f5cab67ba2e5f9925be6302c755d6cefa205b0c635bd2d1db793417ef18bd0f65ec701105ff055bc71160ab1f20206e1ec2ee5e84dcae535
-
SSDEEP
12288:vbi3O31sGfWn39miK2Ft2ktxEFSrb63M9/Zc3C/0Pw2ZG5VrVKQBybBr3:DD+39MQwktxEx3MRu3c59VKQBybBz
Malware Config
Extracted
remcos
28MARZO
20.38.13.217:2524
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-2GPJZT
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
Excel.exeExcel.exeExcel.exepid process 1868 Excel.exe 1356 Excel.exe 112 Excel.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Lectura de cargos.exeExcel.exeExcel.exedescription pid process target process PID 1348 set thread context of 392 1348 Lectura de cargos.exe csc.exe PID 1868 set thread context of 520 1868 Excel.exe csc.exe PID 1356 set thread context of 1804 1356 Excel.exe csc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1936 schtasks.exe 108 schtasks.exe 1508 schtasks.exe 1684 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 1164 powershell.exe 560 powershell.exe 1268 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1164 powershell.exe Token: SeDebugPrivilege 560 powershell.exe Token: SeDebugPrivilege 1268 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
csc.exepid process 392 csc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Lectura de cargos.execmd.exetaskeng.exeExcel.execmd.exedescription pid process target process PID 1348 wrote to memory of 2044 1348 Lectura de cargos.exe cmd.exe PID 1348 wrote to memory of 2044 1348 Lectura de cargos.exe cmd.exe PID 1348 wrote to memory of 2044 1348 Lectura de cargos.exe cmd.exe PID 1348 wrote to memory of 2044 1348 Lectura de cargos.exe cmd.exe PID 1348 wrote to memory of 1168 1348 Lectura de cargos.exe cmd.exe PID 1348 wrote to memory of 1168 1348 Lectura de cargos.exe cmd.exe PID 1348 wrote to memory of 1168 1348 Lectura de cargos.exe cmd.exe PID 1348 wrote to memory of 1168 1348 Lectura de cargos.exe cmd.exe PID 2044 wrote to memory of 108 2044 cmd.exe schtasks.exe PID 2044 wrote to memory of 108 2044 cmd.exe schtasks.exe PID 2044 wrote to memory of 108 2044 cmd.exe schtasks.exe PID 2044 wrote to memory of 108 2044 cmd.exe schtasks.exe PID 1348 wrote to memory of 1164 1348 Lectura de cargos.exe powershell.exe PID 1348 wrote to memory of 1164 1348 Lectura de cargos.exe powershell.exe PID 1348 wrote to memory of 1164 1348 Lectura de cargos.exe powershell.exe PID 1348 wrote to memory of 1164 1348 Lectura de cargos.exe powershell.exe PID 1348 wrote to memory of 392 1348 Lectura de cargos.exe csc.exe PID 1348 wrote to memory of 392 1348 Lectura de cargos.exe csc.exe PID 1348 wrote to memory of 392 1348 Lectura de cargos.exe csc.exe PID 1348 wrote to memory of 392 1348 Lectura de cargos.exe csc.exe PID 1348 wrote to memory of 392 1348 Lectura de cargos.exe csc.exe PID 1348 wrote to memory of 392 1348 Lectura de cargos.exe csc.exe PID 1348 wrote to memory of 392 1348 Lectura de cargos.exe csc.exe PID 1348 wrote to memory of 392 1348 Lectura de cargos.exe csc.exe PID 1348 wrote to memory of 392 1348 Lectura de cargos.exe csc.exe PID 1348 wrote to memory of 392 1348 Lectura de cargos.exe csc.exe PID 1348 wrote to memory of 392 1348 Lectura de cargos.exe csc.exe PID 1348 wrote to memory of 392 1348 Lectura de cargos.exe csc.exe PID 1348 wrote to memory of 392 1348 Lectura de cargos.exe csc.exe PID 1632 wrote to memory of 1868 1632 taskeng.exe Excel.exe PID 1632 wrote to memory of 1868 1632 taskeng.exe Excel.exe PID 1632 wrote to memory of 1868 1632 taskeng.exe Excel.exe PID 1632 wrote to memory of 1868 1632 taskeng.exe Excel.exe PID 1632 wrote to memory of 1868 1632 taskeng.exe Excel.exe PID 1632 wrote to memory of 1868 1632 taskeng.exe Excel.exe PID 1632 wrote to memory of 1868 1632 taskeng.exe Excel.exe PID 1868 wrote to memory of 1592 1868 Excel.exe cmd.exe PID 1868 wrote to memory of 1592 1868 Excel.exe cmd.exe PID 1868 wrote to memory of 1592 1868 Excel.exe cmd.exe PID 1868 wrote to memory of 1592 1868 Excel.exe cmd.exe PID 1868 wrote to memory of 1752 1868 Excel.exe cmd.exe PID 1868 wrote to memory of 1752 1868 Excel.exe cmd.exe PID 1868 wrote to memory of 1752 1868 Excel.exe cmd.exe PID 1868 wrote to memory of 1752 1868 Excel.exe cmd.exe PID 1868 wrote to memory of 560 1868 Excel.exe powershell.exe PID 1868 wrote to memory of 560 1868 Excel.exe powershell.exe PID 1868 wrote to memory of 560 1868 Excel.exe powershell.exe PID 1868 wrote to memory of 560 1868 Excel.exe powershell.exe PID 1868 wrote to memory of 520 1868 Excel.exe csc.exe PID 1868 wrote to memory of 520 1868 Excel.exe csc.exe PID 1868 wrote to memory of 520 1868 Excel.exe csc.exe PID 1868 wrote to memory of 520 1868 Excel.exe csc.exe PID 1868 wrote to memory of 520 1868 Excel.exe csc.exe PID 1868 wrote to memory of 520 1868 Excel.exe csc.exe PID 1868 wrote to memory of 520 1868 Excel.exe csc.exe PID 1868 wrote to memory of 520 1868 Excel.exe csc.exe PID 1868 wrote to memory of 520 1868 Excel.exe csc.exe PID 1868 wrote to memory of 520 1868 Excel.exe csc.exe PID 1868 wrote to memory of 520 1868 Excel.exe csc.exe PID 1868 wrote to memory of 520 1868 Excel.exe csc.exe PID 1868 wrote to memory of 520 1868 Excel.exe csc.exe PID 1592 wrote to memory of 1508 1592 cmd.exe schtasks.exe PID 1592 wrote to memory of 1508 1592 cmd.exe schtasks.exe PID 1592 wrote to memory of 1508 1592 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lectura de cargos.exe"C:\Users\Admin\AppData\Local\Temp\Lectura de cargos.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\Lectura de cargos.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\Admin\AppData\Local\Temp\Lectura de cargos.exe'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskeng.exetaskeng.exe {095462DA-8216-4A94-8C6A-7DBC5F548342} S-1-5-21-2647223082-2067913677-935928954-1000:BPOQNXYB\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exeC:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe'"3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exeC:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe'" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe'"3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exeC:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe'" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exe'"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\remcos\logs.datFilesize
144B
MD5e4af475f8dae2aec2136b9731567503d
SHA113b2a22511073a1e6f7787eecb4c112ce8690993
SHA256578aa407a43b237cfbfb287e4ff0cd5e2f4a956707e3e269f6068ff2ff2d0c9d
SHA5125986d813b6c462651f21668f0af2a0c7b18075e852f1ca13e99beca51c78fab0170476315f8b2d715e936d3ef3e789ccff77f4bc70cd0e4b2c1e3358ec425835
-
C:\ProgramData\remcos\logs.datFilesize
228B
MD56e9df8bec62ca3fe1db77871a58c8a92
SHA158a3d478d0534f93be339bea023ac70ac17122b1
SHA2560fcdc776891e985b6fc1d6fe884eefc69de92ebe4625d3e6e9318e24d2d2f75e
SHA512d11f9379e762718379c3f0155df5765bde93915217debcea906502cebeab90de3303ebeacc400da7468cca1329271c3817f4735b3d7f304f2b07c14f9e3e4c66
-
C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exeFilesize
554.8MB
MD54dd80c76752772c192843d7ded5fc40f
SHA18f3b29edfcccd49333326e41e9f71d98d7320850
SHA25668099cdb84c6f6a69d14c8bf28e46c0005dbfaa5f41641f9aa72914d5f8b0792
SHA5123096964b82ea3780bc61de7d7c5c1a95f4e24dc4988597453fc11431cb3b05c72b6dd5645be7ba57bd7499411e29d588d40d08ed0ab6134d8538e097596296f5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exeFilesize
106.5MB
MD5be0cad283abc730c5b9dd975ece9e2aa
SHA1b0b5d1ea3532d83d0f65a58bc2142db5015da18a
SHA256bd0ea134da140d7ae79385a90b9b01ea97fba6fe3986fadb4db342338e530a46
SHA5122a919621cf0b8e3dcf2b5f8d0922c18c0927f637cbf7b1f6188d327c419c86397ec0a49670c5d12420239b94ae266485ae4369ef964738102e9defd2a00da915
-
C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exeFilesize
670.0MB
MD5bdb8cbc51cb8f186e4a8b56217ead338
SHA1877b1f5e43bd90fc3be1bda08250c87565a10f3a
SHA2567706a18ee5ae4110a77ee6b4b055cdcd46f120d00895e8568a246865cad9c18e
SHA512e06a768c2c74f8d7f5cab67ba2e5f9925be6302c755d6cefa205b0c635bd2d1db793417ef18bd0f65ec701105ff055bc71160ab1f20206e1ec2ee5e84dcae535
-
C:\Users\Admin\AppData\Roaming\Microsoft\Excel.exeFilesize
670.0MB
MD5bdb8cbc51cb8f186e4a8b56217ead338
SHA1877b1f5e43bd90fc3be1bda08250c87565a10f3a
SHA2567706a18ee5ae4110a77ee6b4b055cdcd46f120d00895e8568a246865cad9c18e
SHA512e06a768c2c74f8d7f5cab67ba2e5f9925be6302c755d6cefa205b0c635bd2d1db793417ef18bd0f65ec701105ff055bc71160ab1f20206e1ec2ee5e84dcae535
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1VN2KZ1IQYYUBE22P59G.tempFilesize
7KB
MD58ac740a0f97d189df0ab02e2653bc02b
SHA1fee7d95fd27c0c1b57f0a9055304344b8fda118e
SHA25683a026c136a0a9e3c6e838000aeef3089a228c8fbcdf48cc42875bfb857498e8
SHA51210f5a07d80e79408ab3bf715e2fb7af0a3f2fe8fc7fc2703950197830ace0d4b37970a72366f8b3ca948f15746de3a26da7433da1363b1618d47abd223913bd8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD58ac740a0f97d189df0ab02e2653bc02b
SHA1fee7d95fd27c0c1b57f0a9055304344b8fda118e
SHA25683a026c136a0a9e3c6e838000aeef3089a228c8fbcdf48cc42875bfb857498e8
SHA51210f5a07d80e79408ab3bf715e2fb7af0a3f2fe8fc7fc2703950197830ace0d4b37970a72366f8b3ca948f15746de3a26da7433da1363b1618d47abd223913bd8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5714b323ac0a8894e1ba4d610f69c70e4
SHA1796282963705fb48d544c6d64e197649ddc7c979
SHA256513ab8869f951b9c97d842389b7665d7b017454112cdf13960cc7ff9e47044d5
SHA51234aa948c436a61beca7b685d1c1fe9e8d83f8748b27da69689e8dab144524bb1f2dcc39bbdb4f78a096c444f6cad00ac32f48d2cdfaccd579c0625bdf497262d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD58ac740a0f97d189df0ab02e2653bc02b
SHA1fee7d95fd27c0c1b57f0a9055304344b8fda118e
SHA25683a026c136a0a9e3c6e838000aeef3089a228c8fbcdf48cc42875bfb857498e8
SHA51210f5a07d80e79408ab3bf715e2fb7af0a3f2fe8fc7fc2703950197830ace0d4b37970a72366f8b3ca948f15746de3a26da7433da1363b1618d47abd223913bd8
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/112-184-0x0000000000280000-0x00000000005BC000-memory.dmpFilesize
3.2MB
-
memory/112-198-0x0000000004470000-0x00000000044B0000-memory.dmpFilesize
256KB
-
memory/392-91-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-122-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-59-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-68-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-81-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-84-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-86-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-87-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-88-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-89-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-90-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-60-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-93-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-61-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-62-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-63-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/392-76-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-123-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-64-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-65-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-133-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-134-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/392-66-0x0000000000080000-0x00000000000FF000-memory.dmpFilesize
508KB
-
memory/560-127-0x0000000002780000-0x00000000027C0000-memory.dmpFilesize
256KB
-
memory/1164-69-0x0000000001F90000-0x0000000001FD0000-memory.dmpFilesize
256KB
-
memory/1164-71-0x0000000001F90000-0x0000000001FD0000-memory.dmpFilesize
256KB
-
memory/1164-75-0x0000000001F90000-0x0000000001FD0000-memory.dmpFilesize
256KB
-
memory/1268-168-0x00000000020E0000-0x0000000002120000-memory.dmpFilesize
256KB
-
memory/1268-169-0x00000000020E0000-0x0000000002120000-memory.dmpFilesize
256KB
-
memory/1348-54-0x0000000000200000-0x000000000053C000-memory.dmpFilesize
3.2MB
-
memory/1348-56-0x0000000004B80000-0x0000000004BC0000-memory.dmpFilesize
256KB
-
memory/1348-55-0x00000000024A0000-0x0000000002520000-memory.dmpFilesize
512KB
-
memory/1356-141-0x0000000001140000-0x000000000147C000-memory.dmpFilesize
3.2MB
-
memory/1868-97-0x0000000000890000-0x0000000000BCC000-memory.dmpFilesize
3.2MB