Analysis
-
max time kernel
137s -
max time network
130s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
03-12-2020 13:08
Static task
static1
Behavioral task
behavioral1
Sample
fatti_12.01.2020.doc
Resource
win7v20201028
General
-
Target
fatti_12.01.2020.doc
-
Size
91KB
-
MD5
01d08478561aed72242e32f692701293
-
SHA1
0da6033daef2c2db0da17c51b8620c9cec3c1477
-
SHA256
b5a82f358804fb1b59046aaba192e8159c806b627aa63a648b210c88e02f38ab
-
SHA512
e065eff23943ff8618704e866da6cb7759d3b19701085f5cc24eccbf790421907da1c66b87f4ea2b979b736f2d5ded97daa13da7560a94b4cea2b2bc31cb1542
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ms.compid process 3024 ms.com -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 2112 regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Processes:
iexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "25672380" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d000000000200000000001066000000010000200000006c3728cffb6af43abd951a3db4bc5710dacc3a0ed1e65cc0807029d20165d9ea000000000e8000000002000020000000dc2923b25060be4bec3421a1d56639a3ff089e9c07c0669e16c9ef8b6c401d362000000017249e6b571bc516c33696388a27e6ebb7592fa49bd164966fdcd0f212ba02f3400000009c6bbe32e111e71d7e454598e188b25ac3123b74a43b78213364ba59462f8ded979a9c605364f4a5a4d29ca60071f8e20b234b4c4f1b5f9f64aed4dd3c88f604 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D0D80DB-3569-11EB-BEBD-CA79033726AB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B2E615C-3569-11EB-BEBD-CA79033726AB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d000000000200000000001066000000010000200000003d48351a8f053f098259a623a8eac4d93c06ec096556a12e2de4fba01a998c38000000000e80000000020000200000003ae17a217d4519dc6c79e704b06fb27a35d4456b90999e204f2061809759193620000000e4033d99c030acac066b324272ead3596150bddf3feb29a07994d854b3667c61400000008fb78af98530409383f13c680b2ef045d5c1957afe62ef130a8c13d96bf0fb063129fafe88f676f505fce2b53f766714af1513be2e74aacb6aeb83bf2e4197a8 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2067582676c9d601 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "25672380" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30853494" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0e34f0a76c9d601 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d0000000002000000000010660000000100002000000073aa353fd22af1118c31972651bf514cee618dcbdc8cbff176d21874dda15ae9000000000e8000000002000020000000e3252854ee974a53715a09b7fe5fb858d576757619697d45fff983f0620e459520000000b449dfa11259b1221fb62d386993a89d169afc1407332d2899ab2dd14e94b35f40000000a5d2feae8d8768f13667c9790845333c153dbdbf0496be670e6ba6a65d8805ae2be96b5274348a1c2438bdc9e289f4355da58e5fbcf5598bb60542f4fe178fac iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900f570a76c9d601 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d00000000020000000000106600000001000020000000d64d0db66ec1a277de67ec0bd4af4a10ca3eb2ad8bcd43e03d251905a3fd198b000000000e800000000200002000000042b67a79f8244b25b0ff436b3df790b4bdd788ce526e0a6ffb680f1e247595c720000000f00ae4d04c18247888b337be79138e71b2accba4d438342cd1515eb51d268fbe40000000ecbc2e7fa526c279cf5c37e311cf66a1ecbb128885ce1553de70f1e6a8ab2d7d4ea7ee821145cf31febce5734240eacccac814c50d35b37ca184f80eae1ffe0e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E4845F0-3569-11EB-BEBD-CA79033726AB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8030211176c9d601 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30853494" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 756 WINWORD.EXE 756 WINWORD.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exepid process 2668 iexplore.exe 2192 iexplore.exe 3484 iexplore.exe -
Suspicious use of SetWindowsHookEx 30 IoCs
Processes:
WINWORD.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEpid process 756 WINWORD.EXE 756 WINWORD.EXE 756 WINWORD.EXE 756 WINWORD.EXE 756 WINWORD.EXE 756 WINWORD.EXE 756 WINWORD.EXE 756 WINWORD.EXE 756 WINWORD.EXE 756 WINWORD.EXE 756 WINWORD.EXE 756 WINWORD.EXE 756 WINWORD.EXE 756 WINWORD.EXE 756 WINWORD.EXE 756 WINWORD.EXE 756 WINWORD.EXE 756 WINWORD.EXE 2668 iexplore.exe 2668 iexplore.exe 1888 IEXPLORE.EXE 1888 IEXPLORE.EXE 2192 iexplore.exe 2192 iexplore.exe 508 IEXPLORE.EXE 508 IEXPLORE.EXE 3484 iexplore.exe 3484 iexplore.exe 1076 IEXPLORE.EXE 1076 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
ms.comregsvr32.exeiexplore.exeiexplore.exeiexplore.exedescription pid process target process PID 3024 wrote to memory of 1096 3024 ms.com regsvr32.exe PID 3024 wrote to memory of 1096 3024 ms.com regsvr32.exe PID 1096 wrote to memory of 2112 1096 regsvr32.exe regsvr32.exe PID 1096 wrote to memory of 2112 1096 regsvr32.exe regsvr32.exe PID 1096 wrote to memory of 2112 1096 regsvr32.exe regsvr32.exe PID 2668 wrote to memory of 1888 2668 iexplore.exe IEXPLORE.EXE PID 2668 wrote to memory of 1888 2668 iexplore.exe IEXPLORE.EXE PID 2668 wrote to memory of 1888 2668 iexplore.exe IEXPLORE.EXE PID 2192 wrote to memory of 508 2192 iexplore.exe IEXPLORE.EXE PID 2192 wrote to memory of 508 2192 iexplore.exe IEXPLORE.EXE PID 2192 wrote to memory of 508 2192 iexplore.exe IEXPLORE.EXE PID 3484 wrote to memory of 1076 3484 iexplore.exe IEXPLORE.EXE PID 3484 wrote to memory of 1076 3484 iexplore.exe IEXPLORE.EXE PID 3484 wrote to memory of 1076 3484 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\fatti_12.01.2020.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\users\public\ms.comC:\users\public\ms.com C:\users\public\ms.html1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\temp.tmp2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Users\Admin\AppData\Local\Temp\temp.tmp3⤵
- Loads dropped DLL
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3484 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\temp.tmpMD5
5ef10b7334c3ed9f0c905339f5aa1b46
SHA12a3870cf287b9d24f1a9112955308eece5cdcc03
SHA2564457d83321c2ff730f7ed316daff71b37b4ba420bf2f6af3bc9551b627ff1469
SHA51222b05b19f5f5c25b6bd3f0d7c824381f194cf4e3e35fbe04601c50bf5f4c58e89524347f69230df7e669b5afc6d8370bbcb3b40def3033388a2956a67956c18e
-
C:\Users\Public\ms.comMD5
98447a7f26ee9dac6b806924d6e21c90
SHA1a67909346a56289b7087821437efcaa51da3b083
SHA256c162abe51a04727507be4f98b95db6356dd64decd042dfb4090e57fa0101f2ed
SHA512c708672a28072c7754eb99f0cf2aa81bf7205d8512ae44242848c2160acf26454029bfb4b76f928bac27a3bed260f95a71bd12bcf2620865b756ba89d66f261b
-
C:\users\public\ms.comMD5
98447a7f26ee9dac6b806924d6e21c90
SHA1a67909346a56289b7087821437efcaa51da3b083
SHA256c162abe51a04727507be4f98b95db6356dd64decd042dfb4090e57fa0101f2ed
SHA512c708672a28072c7754eb99f0cf2aa81bf7205d8512ae44242848c2160acf26454029bfb4b76f928bac27a3bed260f95a71bd12bcf2620865b756ba89d66f261b
-
C:\users\public\ms.htmlMD5
7f908f1ee0bbb0b276589f06368a008d
SHA1ee9d0fa4c45aeb9c75750aa003e7c0f0f22e348d
SHA2568b23a9189fd2fe4cc89459224ed36e7a64121de9589d3ac9ceae9e4deef7f23a
SHA5123fbebbcd1b5f2a731470037a702ba58eefbc0764874d465539e90b6fcd4ba16e93221e8eb402bf2d3b603a6b4d81e3b1a2e68ea3625a93716f4ef991fa625633
-
\Users\Admin\AppData\Local\Temp\temp.tmpMD5
5ef10b7334c3ed9f0c905339f5aa1b46
SHA12a3870cf287b9d24f1a9112955308eece5cdcc03
SHA2564457d83321c2ff730f7ed316daff71b37b4ba420bf2f6af3bc9551b627ff1469
SHA51222b05b19f5f5c25b6bd3f0d7c824381f194cf4e3e35fbe04601c50bf5f4c58e89524347f69230df7e669b5afc6d8370bbcb3b40def3033388a2956a67956c18e
-
memory/508-17-0x0000000000000000-mapping.dmp
-
memory/756-2-0x00007FFFD2160000-0x00007FFFD2797000-memory.dmpFilesize
6.2MB
-
memory/1076-18-0x0000000000000000-mapping.dmp
-
memory/1096-12-0x0000000000000000-mapping.dmp
-
memory/1888-16-0x0000000000000000-mapping.dmp
-
memory/2112-14-0x0000000000000000-mapping.dmp