Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05-06-2023 11:34
Static task
static1
Behavioral task
behavioral1
Sample
497181638d2830749115aff8751dfaddc201d4a9de50e731c7e999381575f714.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
497181638d2830749115aff8751dfaddc201d4a9de50e731c7e999381575f714.exe
Resource
win10v2004-20230220-en
General
-
Target
497181638d2830749115aff8751dfaddc201d4a9de50e731c7e999381575f714.exe
-
Size
114KB
-
MD5
53d4ab9c429de02b7efc94d7be3e6059
-
SHA1
2dba6ac014c7115407fbd56e6367c3f57679404f
-
SHA256
497181638d2830749115aff8751dfaddc201d4a9de50e731c7e999381575f714
-
SHA512
a19570164b7bc47c6975b93835b408c80f7fed8a9874d398cf0227e2dd2c033d4e31f0bb332c800bab0f60073eec084a0bebac4abc6ba069aa3547c27c9622cb
-
SSDEEP
3072:1toI3eJY6z2cQEjbCTb6TbEVDR2fxvPXj5:1aJJ9zpblEVDsvj5
Malware Config
Extracted
remcos
RemoteHost
pekonomia.duckdns.org:30861
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-B0VP4N
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\fsgdhfgjf\\dgfshjk.exe," reg.exe -
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1100-98-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral1/memory/1100-124-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1344-97-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/1344-116-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral1/memory/1344-119-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1100-98-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral1/memory/1344-97-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/1788-102-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/1788-103-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/1344-116-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/1052-117-0x0000000004F00000-0x0000000004F40000-memory.dmp Nirsoft behavioral1/memory/1344-119-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/1100-124-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft -
Downloads MZ/PE file
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1384 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
H2.exeori.exepid process 996 H2.exe 1052 ori.exe -
Loads dropped DLL 2 IoCs
Processes:
497181638d2830749115aff8751dfaddc201d4a9de50e731c7e999381575f714.exeaspnet_compiler.exepid process 2028 497181638d2830749115aff8751dfaddc201d4a9de50e731c7e999381575f714.exe 1724 aspnet_compiler.exe -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
aspnet_compiler.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts aspnet_compiler.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
H2.exeaspnet_compiler.exedescription pid process target process PID 996 set thread context of 1724 996 H2.exe aspnet_compiler.exe PID 1724 set thread context of 1344 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 set thread context of 1100 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 set thread context of 1788 1724 aspnet_compiler.exe aspnet_compiler.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 928 PING.EXE 1532 PING.EXE 1244 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
aspnet_compiler.exeori.exepid process 1344 aspnet_compiler.exe 1344 aspnet_compiler.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe 1052 ori.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
aspnet_compiler.exepid process 1724 aspnet_compiler.exe 1724 aspnet_compiler.exe 1724 aspnet_compiler.exe 1724 aspnet_compiler.exe 1724 aspnet_compiler.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
497181638d2830749115aff8751dfaddc201d4a9de50e731c7e999381575f714.exeaspnet_compiler.exeori.exedescription pid process Token: SeDebugPrivilege 2028 497181638d2830749115aff8751dfaddc201d4a9de50e731c7e999381575f714.exe Token: SeDebugPrivilege 1788 aspnet_compiler.exe Token: SeDebugPrivilege 1052 ori.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
497181638d2830749115aff8751dfaddc201d4a9de50e731c7e999381575f714.execmd.exeH2.exeaspnet_compiler.exeori.execmd.execmd.exedescription pid process target process PID 2028 wrote to memory of 996 2028 497181638d2830749115aff8751dfaddc201d4a9de50e731c7e999381575f714.exe H2.exe PID 2028 wrote to memory of 996 2028 497181638d2830749115aff8751dfaddc201d4a9de50e731c7e999381575f714.exe H2.exe PID 2028 wrote to memory of 996 2028 497181638d2830749115aff8751dfaddc201d4a9de50e731c7e999381575f714.exe H2.exe PID 2028 wrote to memory of 1384 2028 497181638d2830749115aff8751dfaddc201d4a9de50e731c7e999381575f714.exe cmd.exe PID 2028 wrote to memory of 1384 2028 497181638d2830749115aff8751dfaddc201d4a9de50e731c7e999381575f714.exe cmd.exe PID 2028 wrote to memory of 1384 2028 497181638d2830749115aff8751dfaddc201d4a9de50e731c7e999381575f714.exe cmd.exe PID 1384 wrote to memory of 576 1384 cmd.exe choice.exe PID 1384 wrote to memory of 576 1384 cmd.exe choice.exe PID 1384 wrote to memory of 576 1384 cmd.exe choice.exe PID 996 wrote to memory of 1724 996 H2.exe aspnet_compiler.exe PID 996 wrote to memory of 1724 996 H2.exe aspnet_compiler.exe PID 996 wrote to memory of 1724 996 H2.exe aspnet_compiler.exe PID 996 wrote to memory of 1724 996 H2.exe aspnet_compiler.exe PID 996 wrote to memory of 1724 996 H2.exe aspnet_compiler.exe PID 996 wrote to memory of 1724 996 H2.exe aspnet_compiler.exe PID 996 wrote to memory of 1724 996 H2.exe aspnet_compiler.exe PID 996 wrote to memory of 1724 996 H2.exe aspnet_compiler.exe PID 996 wrote to memory of 1724 996 H2.exe aspnet_compiler.exe PID 996 wrote to memory of 1724 996 H2.exe aspnet_compiler.exe PID 996 wrote to memory of 1724 996 H2.exe aspnet_compiler.exe PID 996 wrote to memory of 1724 996 H2.exe aspnet_compiler.exe PID 996 wrote to memory of 1724 996 H2.exe aspnet_compiler.exe PID 1724 wrote to memory of 1344 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1344 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1344 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1344 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1344 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1100 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1100 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1100 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1100 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1100 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1144 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1144 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1144 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1144 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 892 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 892 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 892 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 892 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1788 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1788 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1788 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1788 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1788 1724 aspnet_compiler.exe aspnet_compiler.exe PID 1724 wrote to memory of 1052 1724 aspnet_compiler.exe ori.exe PID 1724 wrote to memory of 1052 1724 aspnet_compiler.exe ori.exe PID 1724 wrote to memory of 1052 1724 aspnet_compiler.exe ori.exe PID 1724 wrote to memory of 1052 1724 aspnet_compiler.exe ori.exe PID 1052 wrote to memory of 1776 1052 ori.exe cmd.exe PID 1052 wrote to memory of 1776 1052 ori.exe cmd.exe PID 1052 wrote to memory of 1776 1052 ori.exe cmd.exe PID 1052 wrote to memory of 1776 1052 ori.exe cmd.exe PID 1776 wrote to memory of 928 1776 cmd.exe PING.EXE PID 1776 wrote to memory of 928 1776 cmd.exe PING.EXE PID 1776 wrote to memory of 928 1776 cmd.exe PING.EXE PID 1776 wrote to memory of 928 1776 cmd.exe PING.EXE PID 1052 wrote to memory of 1216 1052 ori.exe cmd.exe PID 1052 wrote to memory of 1216 1052 ori.exe cmd.exe PID 1052 wrote to memory of 1216 1052 ori.exe cmd.exe PID 1052 wrote to memory of 1216 1052 ori.exe cmd.exe PID 1216 wrote to memory of 1532 1216 cmd.exe PING.EXE PID 1216 wrote to memory of 1532 1216 cmd.exe PING.EXE PID 1216 wrote to memory of 1532 1216 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\497181638d2830749115aff8751dfaddc201d4a9de50e731c7e999381575f714.exe"C:\Users\Admin\AppData\Local\Temp\497181638d2830749115aff8751dfaddc201d4a9de50e731c7e999381575f714.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\H2.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\H2.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\bqcilchzwfwdsqetoilxbqjthfxietxeuq"4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\ekhblm"4⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\onvlmfcvgv"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\onvlmfcvgv"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\onvlmfcvgv"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ori.exe"C:\Users\Admin\AppData\Local\Temp\ori.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 39 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\fsgdhfgjf\dgfshjk.exe,"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 396⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\fsgdhfgjf\dgfshjk.exe,"6⤵
- Modifies WinLogon for persistence
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 44 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ori.exe" "C:\Users\Admin\AppData\Roaming\fsgdhfgjf\dgfshjk.exe" && ping 127.0.0.1 -n 44 > nul && "C:\Users\Admin\AppData\Roaming\fsgdhfgjf\dgfshjk.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 446⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 446⤵
- Runs ping.exe
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Local\Temp\497181638d2830749115aff8751dfaddc201d4a9de50e731c7e999381575f714.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 13⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bqcilchzwfwdsqetoilxbqjthfxietxeuqFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\ori.exeFilesize
765KB
MD5c6d43b7e399cdb8f37c3b920cd592b6b
SHA1756c5d2d46bb796e7af63e53a7c00e747a65c5f9
SHA2565f274df0116006f2ab64521860026e68ab2c9b980523d23997920a3e4a0693d5
SHA512b827aae2673750b4392ae96e5c2f77da5ddc0841afbe4f1b8fe05bfef206871f8ff0b5ac64216f9363916d20a7ae326ba28849baa6215390d8b31883faed9c1c
-
C:\Users\Admin\AppData\Local\Temp\ori.exeFilesize
765KB
MD5c6d43b7e399cdb8f37c3b920cd592b6b
SHA1756c5d2d46bb796e7af63e53a7c00e747a65c5f9
SHA2565f274df0116006f2ab64521860026e68ab2c9b980523d23997920a3e4a0693d5
SHA512b827aae2673750b4392ae96e5c2f77da5ddc0841afbe4f1b8fe05bfef206871f8ff0b5ac64216f9363916d20a7ae326ba28849baa6215390d8b31883faed9c1c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\H2.exeFilesize
571KB
MD583e968ea79da03bc0e20716cd99d5fcb
SHA143234878888b72b4d6e9b7704f5c7715edff72c2
SHA2566ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3
SHA5120f27f08b933fe2566bbfcc5b99bf748948a35d8e977aa9bb75a45201fec7e1e005462e3b454725142f902906999247634cff533c43002507817f6e7c9fa93162
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\H2.exeFilesize
571KB
MD583e968ea79da03bc0e20716cd99d5fcb
SHA143234878888b72b4d6e9b7704f5c7715edff72c2
SHA2566ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3
SHA5120f27f08b933fe2566bbfcc5b99bf748948a35d8e977aa9bb75a45201fec7e1e005462e3b454725142f902906999247634cff533c43002507817f6e7c9fa93162
-
C:\Users\Admin\AppData\Roaming\fsgdhfgjf\dgfshjk.exeFilesize
765KB
MD5c6d43b7e399cdb8f37c3b920cd592b6b
SHA1756c5d2d46bb796e7af63e53a7c00e747a65c5f9
SHA2565f274df0116006f2ab64521860026e68ab2c9b980523d23997920a3e4a0693d5
SHA512b827aae2673750b4392ae96e5c2f77da5ddc0841afbe4f1b8fe05bfef206871f8ff0b5ac64216f9363916d20a7ae326ba28849baa6215390d8b31883faed9c1c
-
\Users\Admin\AppData\Local\Temp\ori.exeFilesize
765KB
MD5c6d43b7e399cdb8f37c3b920cd592b6b
SHA1756c5d2d46bb796e7af63e53a7c00e747a65c5f9
SHA2565f274df0116006f2ab64521860026e68ab2c9b980523d23997920a3e4a0693d5
SHA512b827aae2673750b4392ae96e5c2f77da5ddc0841afbe4f1b8fe05bfef206871f8ff0b5ac64216f9363916d20a7ae326ba28849baa6215390d8b31883faed9c1c
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\H2.exeFilesize
571KB
MD583e968ea79da03bc0e20716cd99d5fcb
SHA143234878888b72b4d6e9b7704f5c7715edff72c2
SHA2566ca06d119da53e4bcd4752e62971541d0d4d2cfc86bad01b9ba8253c3d2615d3
SHA5120f27f08b933fe2566bbfcc5b99bf748948a35d8e977aa9bb75a45201fec7e1e005462e3b454725142f902906999247634cff533c43002507817f6e7c9fa93162
-
memory/996-62-0x00000000012B0000-0x0000000001344000-memory.dmpFilesize
592KB
-
memory/996-63-0x0000000000020000-0x0000000000026000-memory.dmpFilesize
24KB
-
memory/996-64-0x00000000005E0000-0x00000000005EC000-memory.dmpFilesize
48KB
-
memory/1052-112-0x0000000000950000-0x0000000000A16000-memory.dmpFilesize
792KB
-
memory/1052-123-0x0000000004F00000-0x0000000004F40000-memory.dmpFilesize
256KB
-
memory/1052-122-0x00000000004F0000-0x0000000000508000-memory.dmpFilesize
96KB
-
memory/1052-121-0x00000000004A0000-0x00000000004EA000-memory.dmpFilesize
296KB
-
memory/1052-125-0x0000000004F00000-0x0000000004F40000-memory.dmpFilesize
256KB
-
memory/1052-117-0x0000000004F00000-0x0000000004F40000-memory.dmpFilesize
256KB
-
memory/1052-135-0x0000000004F00000-0x0000000004F40000-memory.dmpFilesize
256KB
-
memory/1052-136-0x0000000004F00000-0x0000000004F40000-memory.dmpFilesize
256KB
-
memory/1052-137-0x0000000004F00000-0x0000000004F40000-memory.dmpFilesize
256KB
-
memory/1100-124-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1100-91-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1100-98-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1100-94-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1344-97-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1344-93-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1344-119-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1344-88-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1344-116-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1724-132-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/1724-141-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-80-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-71-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-70-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-140-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-139-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-138-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-79-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-78-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-77-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-110-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-76-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-82-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-74-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-84-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-73-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1724-72-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-65-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-81-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-68-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-69-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-126-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/1724-129-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/1724-130-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-131-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-83-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-133-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-134-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-67-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1724-66-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/1788-103-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1788-102-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1788-101-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1788-99-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2028-54-0x0000000000220000-0x000000000023C000-memory.dmpFilesize
112KB
-
memory/2028-55-0x000000001BA20000-0x000000001BAA0000-memory.dmpFilesize
512KB