Analysis
-
max time kernel
137s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
03-12-2020 13:08
Static task
static1
Behavioral task
behavioral1
Sample
ordinare_12.01.2020.doc
Resource
win7v20201028
General
-
Target
ordinare_12.01.2020.doc
-
Size
91KB
-
MD5
5cebb6813b6717852b51bb82235bf5a6
-
SHA1
6c465ea7366e478013f1581a2e4a57675b767f0d
-
SHA256
a861f29a0b1f6cc24f3090bb4260cb9388466326e9d320db378f3bdc08e7c267
-
SHA512
d174ee80939b84a89e69f1912ee835cfa10b9e7c79613264cc862717c27c137a861d40b7f2ddcaf90804146370c8d68b596f536434ce09035bcf1ff65c3c8342
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ms.compid process 3236 ms.com -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 4504 regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Processes:
iexplore.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30853494" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d000000000200000000001066000000010000200000000ff4f5de05b4876116bc3e780f55e43faab694c384555cb1cc37749549cad0d7000000000e8000000002000020000000b8cb205320e5bffb4c2e77d52f2e1e21956751781e30d6628a5f6cf256c7ff52200000003dde85042a282a7c3fe1e96a83a248e3424d5230fd3b5c43435dce974230cab0400000002ac1c2aa58450f42cf821017627ae17e698df06b53c149e523802c5d7f1fafffbe77737fe34e7cc5b482162dd3dc87f24421f21829604121e1a06d38d62b54b8 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d03d990976c9d601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "10420287" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 802c7b1076c9d601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d00000000020000000000106600000001000020000000e45b5aad70e7729a70e903d5a64131cd9b81afab765d869a6f75ade559f08a19000000000e80000000020000200000009aadc9c65873ff07f07e89742ce7b14e1e80f890932e5cfd7fd213cb05691b4220000000a88242d6512b0f8eb305dc0e8dbb76a34d8852bf2fac9108fe98d7a1eb2bc199400000008960eb9988c4ca49d7cdc93b224f7737f0eb1ab04dc33af95faaf0b3800d1246083b0b14ffc65c483383eee25fba38fdf222f87d38a0b5c69cb3a0ffc3520b8d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30853494" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d00000000020000000000106600000001000020000000ff94f3727abf0e4ba9fef22e8299e1c32b457a1bdaf9577d0f6436a83f2c084e000000000e8000000002000020000000dd70e95b7ec439956b140cf9b8e955a77ab009b6b6e4c4227803e08bb50c497820000000cf4e4052f9aed9124b5560abb95aec1e671bc1ae1f595591bf591d6ded6523744000000093c83f44526d4e6725a8270c53175bf2a5346a7476f0b97ebbb3e05f86df2a24cd8474a58ef81023d8e26d169582265db2d17c2068c45e7e178e97155ec3483b iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A6E2CAC-3569-11EB-BEBD-DE6DDC9D1B26} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "10420287" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7069932576c9d601 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c78f0976c9d601 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D834F41-3569-11EB-BEBD-DE6DDC9D1B26} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d00000000020000000000106600000001000020000000e38fa3bb57e208066161c656296a1a435ef8bb29f79256206fd38ca5bcc93684000000000e800000000200002000000076c49fad5e2c49a11b9f33e761118fee9ce012426e179f8aae2c8ba28f87527020000000ac26abbaaaf2210d09b2e0b6a1411d1c4de7021f8b0aadde11417858bc290acc40000000a60ebb2e5a1b8b54e13b8dcfe9f011f3e23faa5632d9297809f9c149116f0f8139afbd15221f77495cb1d064f408a03415af224becfc6d10facaab1600f3eff0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C46262D-3569-11EB-BEBD-DE6DDC9D1B26} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4768 WINWORD.EXE 4768 WINWORD.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
iexplore.exeiexplore.exeiexplore.exepid process 1620 iexplore.exe 2888 iexplore.exe 4628 iexplore.exe -
Suspicious use of SetWindowsHookEx 30 IoCs
Processes:
WINWORD.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEpid process 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 4768 WINWORD.EXE 1620 iexplore.exe 1620 iexplore.exe 4372 IEXPLORE.EXE 4372 IEXPLORE.EXE 2888 iexplore.exe 2888 iexplore.exe 4732 IEXPLORE.EXE 4732 IEXPLORE.EXE 4628 iexplore.exe 4628 iexplore.exe 3660 IEXPLORE.EXE 3660 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
ms.comregsvr32.exeiexplore.exeiexplore.exeiexplore.exedescription pid process target process PID 3236 wrote to memory of 4476 3236 ms.com regsvr32.exe PID 3236 wrote to memory of 4476 3236 ms.com regsvr32.exe PID 4476 wrote to memory of 4504 4476 regsvr32.exe regsvr32.exe PID 4476 wrote to memory of 4504 4476 regsvr32.exe regsvr32.exe PID 4476 wrote to memory of 4504 4476 regsvr32.exe regsvr32.exe PID 1620 wrote to memory of 4372 1620 iexplore.exe IEXPLORE.EXE PID 1620 wrote to memory of 4372 1620 iexplore.exe IEXPLORE.EXE PID 1620 wrote to memory of 4372 1620 iexplore.exe IEXPLORE.EXE PID 2888 wrote to memory of 4732 2888 iexplore.exe IEXPLORE.EXE PID 2888 wrote to memory of 4732 2888 iexplore.exe IEXPLORE.EXE PID 2888 wrote to memory of 4732 2888 iexplore.exe IEXPLORE.EXE PID 4628 wrote to memory of 3660 4628 iexplore.exe IEXPLORE.EXE PID 4628 wrote to memory of 3660 4628 iexplore.exe IEXPLORE.EXE PID 4628 wrote to memory of 3660 4628 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ordinare_12.01.2020.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\users\public\ms.comC:\users\public\ms.com C:\users\public\ms.html1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\temp.tmp2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Users\Admin\AppData\Local\Temp\temp.tmp3⤵
- Loads dropped DLL
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1620 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4628 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\temp.tmpMD5
5ef10b7334c3ed9f0c905339f5aa1b46
SHA12a3870cf287b9d24f1a9112955308eece5cdcc03
SHA2564457d83321c2ff730f7ed316daff71b37b4ba420bf2f6af3bc9551b627ff1469
SHA51222b05b19f5f5c25b6bd3f0d7c824381f194cf4e3e35fbe04601c50bf5f4c58e89524347f69230df7e669b5afc6d8370bbcb3b40def3033388a2956a67956c18e
-
C:\Users\Public\ms.comMD5
98447a7f26ee9dac6b806924d6e21c90
SHA1a67909346a56289b7087821437efcaa51da3b083
SHA256c162abe51a04727507be4f98b95db6356dd64decd042dfb4090e57fa0101f2ed
SHA512c708672a28072c7754eb99f0cf2aa81bf7205d8512ae44242848c2160acf26454029bfb4b76f928bac27a3bed260f95a71bd12bcf2620865b756ba89d66f261b
-
C:\users\public\ms.comMD5
98447a7f26ee9dac6b806924d6e21c90
SHA1a67909346a56289b7087821437efcaa51da3b083
SHA256c162abe51a04727507be4f98b95db6356dd64decd042dfb4090e57fa0101f2ed
SHA512c708672a28072c7754eb99f0cf2aa81bf7205d8512ae44242848c2160acf26454029bfb4b76f928bac27a3bed260f95a71bd12bcf2620865b756ba89d66f261b
-
C:\users\public\ms.htmlMD5
7f908f1ee0bbb0b276589f06368a008d
SHA1ee9d0fa4c45aeb9c75750aa003e7c0f0f22e348d
SHA2568b23a9189fd2fe4cc89459224ed36e7a64121de9589d3ac9ceae9e4deef7f23a
SHA5123fbebbcd1b5f2a731470037a702ba58eefbc0764874d465539e90b6fcd4ba16e93221e8eb402bf2d3b603a6b4d81e3b1a2e68ea3625a93716f4ef991fa625633
-
\Users\Admin\AppData\Local\Temp\temp.tmpMD5
5ef10b7334c3ed9f0c905339f5aa1b46
SHA12a3870cf287b9d24f1a9112955308eece5cdcc03
SHA2564457d83321c2ff730f7ed316daff71b37b4ba420bf2f6af3bc9551b627ff1469
SHA51222b05b19f5f5c25b6bd3f0d7c824381f194cf4e3e35fbe04601c50bf5f4c58e89524347f69230df7e669b5afc6d8370bbcb3b40def3033388a2956a67956c18e
-
memory/3660-17-0x0000000000000000-mapping.dmp
-
memory/4372-15-0x0000000000000000-mapping.dmp
-
memory/4476-11-0x0000000000000000-mapping.dmp
-
memory/4504-13-0x0000000000000000-mapping.dmp
-
memory/4732-16-0x0000000000000000-mapping.dmp
-
memory/4768-7-0x000001732C410000-0x000001732C420000-memory.dmpFilesize
64KB
-
memory/4768-6-0x000001732C3E0000-0x000001732C3E5000-memory.dmpFilesize
20KB
-
memory/4768-4-0x000001732C3D7000-0x000001732C3E0000-memory.dmpFilesize
36KB
-
memory/4768-5-0x000001732C3D7000-0x000001732C3E0000-memory.dmpFilesize
36KB
-
memory/4768-3-0x000001732A43A000-0x000001732A44D000-memory.dmpFilesize
76KB
-
memory/4768-2-0x0000017320AE0000-0x0000017321117000-memory.dmpFilesize
6.2MB