Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 06:23
Static task
static1
Behavioral task
behavioral1
Sample
NEW PURCHASE REQUIREMENT.xlsx
Resource
win7v20201028
Behavioral task
behavioral2
Sample
NEW PURCHASE REQUIREMENT.xlsx
Resource
win10v20201028
General
-
Target
NEW PURCHASE REQUIREMENT.xlsx
-
Size
2.0MB
-
MD5
aaeb01806b14bb41c5a8424cf6341d19
-
SHA1
6754ba8ec4337bdfaac0f56a057e65344fd6863a
-
SHA256
360757d16d95ca36f9933d6fc3633fad8983ebc1fda48e0462bc6e0c107281f0
-
SHA512
8435c1f2823ee66e0b5d717dcbea55cd542fb893635a03387330e46888689b31e124b0bd50cafb46b2c787054b069bab1f131826f5ed82387dad0cff58b30e1c
Malware Config
Extracted
remcos
swryijgrvcsgkopnmcdertvgdswbvmophtfdczxs.ydns.eu:2017
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 6 836 EQNEDT32.EXE -
Executes dropped EXE 4 IoCs
Processes:
vbc.exevbc.exevlc.exevlc.exepid process 1400 vbc.exe 1660 vbc.exe 748 vlc.exe 1884 vlc.exe -
Loads dropped DLL 7 IoCs
Processes:
EQNEDT32.EXEcmd.exeWerFault.exepid process 836 EQNEDT32.EXE 836 EQNEDT32.EXE 480 cmd.exe 480 cmd.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
vbc.exevlc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" vbc.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vlc.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" vlc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs
Processes:
vbc.exevlc.exepid process 1400 vbc.exe 1400 vbc.exe 1400 vbc.exe 1400 vbc.exe 1400 vbc.exe 1400 vbc.exe 1400 vbc.exe 1400 vbc.exe 1400 vbc.exe 1400 vbc.exe 1400 vbc.exe 748 vlc.exe 748 vlc.exe 748 vlc.exe 748 vlc.exe 748 vlc.exe 748 vlc.exe 748 vlc.exe 748 vlc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
vbc.exevlc.exedescription pid process target process PID 1400 set thread context of 1660 1400 vbc.exe vbc.exe PID 748 set thread context of 1884 748 vlc.exe vlc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1004 748 WerFault.exe vlc.exe -
Delays execution with timeout.exe 6 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 648 timeout.exe 1692 timeout.exe 1676 timeout.exe 2016 timeout.exe 836 timeout.exe 1548 timeout.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1048 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
vbc.exevlc.exeWerFault.exepid process 1400 vbc.exe 1400 vbc.exe 1400 vbc.exe 748 vlc.exe 748 vlc.exe 748 vlc.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe 1004 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vbc.exevlc.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1400 vbc.exe Token: SeDebugPrivilege 748 vlc.exe Token: SeDebugPrivilege 1004 WerFault.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
EXCEL.EXEvlc.exepid process 1048 EXCEL.EXE 1048 EXCEL.EXE 1048 EXCEL.EXE 1884 vlc.exe -
Suspicious use of WriteProcessMemory 90 IoCs
Processes:
EQNEDT32.EXEvbc.execmd.execmd.execmd.exevbc.exeWScript.execmd.exevlc.execmd.execmd.exedescription pid process target process PID 836 wrote to memory of 1400 836 EQNEDT32.EXE vbc.exe PID 836 wrote to memory of 1400 836 EQNEDT32.EXE vbc.exe PID 836 wrote to memory of 1400 836 EQNEDT32.EXE vbc.exe PID 836 wrote to memory of 1400 836 EQNEDT32.EXE vbc.exe PID 1400 wrote to memory of 1804 1400 vbc.exe cmd.exe PID 1400 wrote to memory of 1804 1400 vbc.exe cmd.exe PID 1400 wrote to memory of 1804 1400 vbc.exe cmd.exe PID 1400 wrote to memory of 1804 1400 vbc.exe cmd.exe PID 1804 wrote to memory of 648 1804 cmd.exe timeout.exe PID 1804 wrote to memory of 648 1804 cmd.exe timeout.exe PID 1804 wrote to memory of 648 1804 cmd.exe timeout.exe PID 1804 wrote to memory of 648 1804 cmd.exe timeout.exe PID 1400 wrote to memory of 1068 1400 vbc.exe cmd.exe PID 1400 wrote to memory of 1068 1400 vbc.exe cmd.exe PID 1400 wrote to memory of 1068 1400 vbc.exe cmd.exe PID 1400 wrote to memory of 1068 1400 vbc.exe cmd.exe PID 1068 wrote to memory of 1692 1068 cmd.exe timeout.exe PID 1068 wrote to memory of 1692 1068 cmd.exe timeout.exe PID 1068 wrote to memory of 1692 1068 cmd.exe timeout.exe PID 1068 wrote to memory of 1692 1068 cmd.exe timeout.exe PID 1400 wrote to memory of 1808 1400 vbc.exe cmd.exe PID 1400 wrote to memory of 1808 1400 vbc.exe cmd.exe PID 1400 wrote to memory of 1808 1400 vbc.exe cmd.exe PID 1400 wrote to memory of 1808 1400 vbc.exe cmd.exe PID 1808 wrote to memory of 1676 1808 cmd.exe timeout.exe PID 1808 wrote to memory of 1676 1808 cmd.exe timeout.exe PID 1808 wrote to memory of 1676 1808 cmd.exe timeout.exe PID 1808 wrote to memory of 1676 1808 cmd.exe timeout.exe PID 1400 wrote to memory of 1660 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 1660 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 1660 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 1660 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 1660 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 1660 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 1660 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 1660 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 1660 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 1660 1400 vbc.exe vbc.exe PID 1400 wrote to memory of 1660 1400 vbc.exe vbc.exe PID 1660 wrote to memory of 1756 1660 vbc.exe WScript.exe PID 1660 wrote to memory of 1756 1660 vbc.exe WScript.exe PID 1660 wrote to memory of 1756 1660 vbc.exe WScript.exe PID 1660 wrote to memory of 1756 1660 vbc.exe WScript.exe PID 1756 wrote to memory of 480 1756 WScript.exe cmd.exe PID 1756 wrote to memory of 480 1756 WScript.exe cmd.exe PID 1756 wrote to memory of 480 1756 WScript.exe cmd.exe PID 1756 wrote to memory of 480 1756 WScript.exe cmd.exe PID 480 wrote to memory of 748 480 cmd.exe vlc.exe PID 480 wrote to memory of 748 480 cmd.exe vlc.exe PID 480 wrote to memory of 748 480 cmd.exe vlc.exe PID 480 wrote to memory of 748 480 cmd.exe vlc.exe PID 748 wrote to memory of 1688 748 vlc.exe cmd.exe PID 748 wrote to memory of 1688 748 vlc.exe cmd.exe PID 748 wrote to memory of 1688 748 vlc.exe cmd.exe PID 748 wrote to memory of 1688 748 vlc.exe cmd.exe PID 1688 wrote to memory of 2016 1688 cmd.exe timeout.exe PID 1688 wrote to memory of 2016 1688 cmd.exe timeout.exe PID 1688 wrote to memory of 2016 1688 cmd.exe timeout.exe PID 1688 wrote to memory of 2016 1688 cmd.exe timeout.exe PID 748 wrote to memory of 564 748 vlc.exe cmd.exe PID 748 wrote to memory of 564 748 vlc.exe cmd.exe PID 748 wrote to memory of 564 748 vlc.exe cmd.exe PID 748 wrote to memory of 564 748 vlc.exe cmd.exe PID 564 wrote to memory of 836 564 cmd.exe timeout.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE REQUIREMENT.xlsx"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\vlc.exe"5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 17⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 18⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 17⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 18⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 17⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 18⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\vlc.exe"C:\Users\Admin\AppData\Roaming\vlc.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 9407⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
0fd303b21c1a43c6a9078e6f5280ca85
SHA10db8f1ae34f4e2e72184e337951fde826c0bd26f
SHA2565d8c6cfdf8fc198c4fd279487e5c1620ece89e39781c6337f4cb5e111e606ddc
SHA512be4cdd48940bead0274c7cf08abd9bc75b5db468159cbf883198712d0bb15ad81a069638c628eba62237cfa0a197f845c0d9e1f4727c9608a8d642f7aba38671
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
C:\Users\Public\vbc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
C:\Users\Public\vbc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
C:\Users\Public\vbc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
\Users\Public\vbc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
\Users\Public\vbc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
memory/340-41-0x0000000000000000-mapping.dmp
-
memory/480-27-0x0000000000000000-mapping.dmp
-
memory/564-39-0x0000000000000000-mapping.dmp
-
memory/648-13-0x0000000000000000-mapping.dmp
-
memory/748-33-0x000000006C200000-0x000000006C8EE000-memory.dmpFilesize
6.9MB
-
memory/748-34-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/748-31-0x0000000000000000-mapping.dmp
-
memory/836-40-0x0000000000000000-mapping.dmp
-
memory/1004-47-0x0000000000000000-mapping.dmp
-
memory/1004-48-0x0000000001E10000-0x0000000001E21000-memory.dmpFilesize
68KB
-
memory/1068-14-0x0000000000000000-mapping.dmp
-
memory/1400-23-0x00000000007FF000-0x0000000000802000-memory.dmpFilesize
12KB
-
memory/1400-11-0x0000000000200000-0x0000000000230000-memory.dmpFilesize
192KB
-
memory/1400-9-0x00000000013B0000-0x00000000013B1000-memory.dmpFilesize
4KB
-
memory/1400-22-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/1400-8-0x000000006C200000-0x000000006C8EE000-memory.dmpFilesize
6.9MB
-
memory/1400-5-0x0000000000000000-mapping.dmp
-
memory/1548-42-0x0000000000000000-mapping.dmp
-
memory/1660-18-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1660-21-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1660-19-0x0000000000413FA4-mapping.dmp
-
memory/1664-2-0x000007FEF5F20000-0x000007FEF619A000-memory.dmpFilesize
2.5MB
-
memory/1676-17-0x0000000000000000-mapping.dmp
-
memory/1688-37-0x0000000000000000-mapping.dmp
-
memory/1692-15-0x0000000000000000-mapping.dmp
-
memory/1756-25-0x0000000000000000-mapping.dmp
-
memory/1804-12-0x0000000000000000-mapping.dmp
-
memory/1808-16-0x0000000000000000-mapping.dmp
-
memory/1884-46-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1884-44-0x0000000000413FA4-mapping.dmp
-
memory/2016-38-0x0000000000000000-mapping.dmp