Analysis
-
max time kernel
149s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-04-2021 06:08
Static task
static1
Behavioral task
behavioral1
Sample
PRC-20-518 ORIGINAL.xlsx
Resource
win7v20201028
Behavioral task
behavioral2
Sample
PRC-20-518 ORIGINAL.xlsx
Resource
win10v20201028
General
-
Target
PRC-20-518 ORIGINAL.xlsx
-
Size
2.3MB
-
MD5
c80ada6775e717cdd47af7b4fda60728
-
SHA1
c6e714a491490359f48fbb35fba4b0ec00e60d5a
-
SHA256
ef838475e670d8af60da44f03fb314461f97070e67bade2b89e52e6e59c4054a
-
SHA512
e3042a0b487c210a1d68d653b65131a22bcf5dbcb75fe41d6b2399cc1a829befa8c28e2843903947b92018bde5593468dd0fac810e1cd0f686d2d22a58b9fc8e
Malware Config
Extracted
xloader
2.3
http://www.frontierglasseastaurora.com/g050/
threephotonics.com
ancientalgorithms.com
macroissance.com
baldhousemusic.com
intotechsolutions.com
mitklassik.com
mybadnews.com
westport-quayside.com
hospitalscales.net
automatedplatforms.com
simplepartyplanningcourse.com
zuluforest.com
jflindsey.com
xamap.club
businesslaunchbox.net
higashiyamajin.xyz
solutionsolvegh.com
vtolvertiportservices.com
customroofunderlayment.com
conflictcyber.com
demooijtransport.com
sageconceptscatering.com
trongrand.com
etiquality.net
kuppers.info
derevafood.com
doxaconstructora.com
bespago.com
santamonicaseafooddock.com
rtstsllc.com
yaopingtu.com
xingchenjc.com
2greatoaksroad.com
youyescap.com
techyara.com
puptrimmerpro.com
freakyskull.com
riseandgrindbb.com
chitrakaah.com
sofritia.com
gosunnydale.com
7evy0.com
aschaillestt.com
l7zexitam.xyz
redefirolli.xyz
myuhc4me.com
recruitina.com
iopco.com
comerciaras.com
ice-tracker.com
amorgoliakos.com
halalnoidasdahome.online
kenlibowsandaccessories.com
camgirladdiction.com
chronicleofheroes.com
aoneindiatour.com
getcheckedeasy.com
mrehawaii.com
2020collateralmonitoring.com
familyfinancial.online
leptitoxus.club
grupornps.com
straightaheadflixfilms.com
webumu.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/520-204-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/520-205-0x000000000041D0A0-mapping.dmp xloader behavioral1/memory/1356-214-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Blocklisted process makes network request 3 IoCs
Processes:
EQNEDT32.EXEflow pid process 7 1528 EQNEDT32.EXE 9 1528 EQNEDT32.EXE 11 1528 EQNEDT32.EXE -
Executes dropped EXE 2 IoCs
Processes:
vbc.exevbc.exepid process 1940 vbc.exe 520 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 1528 EQNEDT32.EXE 1528 EQNEDT32.EXE 1528 EQNEDT32.EXE 1528 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exeNAPSTAT.EXEdescription pid process target process PID 1940 set thread context of 520 1940 vbc.exe vbc.exe PID 520 set thread context of 1264 520 vbc.exe Explorer.EXE PID 1356 set thread context of 1264 1356 NAPSTAT.EXE Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1108 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
vbc.exevbc.exeNAPSTAT.EXEpid process 1940 vbc.exe 1940 vbc.exe 520 vbc.exe 520 vbc.exe 1356 NAPSTAT.EXE 1356 NAPSTAT.EXE 1356 NAPSTAT.EXE 1356 NAPSTAT.EXE 1356 NAPSTAT.EXE 1356 NAPSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exeNAPSTAT.EXEpid process 520 vbc.exe 520 vbc.exe 520 vbc.exe 1356 NAPSTAT.EXE 1356 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vbc.exevbc.exeNAPSTAT.EXEdescription pid process Token: SeDebugPrivilege 1940 vbc.exe Token: SeDebugPrivilege 520 vbc.exe Token: SeDebugPrivilege 1356 NAPSTAT.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1108 EXCEL.EXE 1108 EXCEL.EXE 1108 EXCEL.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXENAPSTAT.EXEdescription pid process target process PID 1528 wrote to memory of 1940 1528 EQNEDT32.EXE vbc.exe PID 1528 wrote to memory of 1940 1528 EQNEDT32.EXE vbc.exe PID 1528 wrote to memory of 1940 1528 EQNEDT32.EXE vbc.exe PID 1528 wrote to memory of 1940 1528 EQNEDT32.EXE vbc.exe PID 1940 wrote to memory of 520 1940 vbc.exe vbc.exe PID 1940 wrote to memory of 520 1940 vbc.exe vbc.exe PID 1940 wrote to memory of 520 1940 vbc.exe vbc.exe PID 1940 wrote to memory of 520 1940 vbc.exe vbc.exe PID 1940 wrote to memory of 520 1940 vbc.exe vbc.exe PID 1940 wrote to memory of 520 1940 vbc.exe vbc.exe PID 1940 wrote to memory of 520 1940 vbc.exe vbc.exe PID 1264 wrote to memory of 1356 1264 Explorer.EXE NAPSTAT.EXE PID 1264 wrote to memory of 1356 1264 Explorer.EXE NAPSTAT.EXE PID 1264 wrote to memory of 1356 1264 Explorer.EXE NAPSTAT.EXE PID 1264 wrote to memory of 1356 1264 Explorer.EXE NAPSTAT.EXE PID 1356 wrote to memory of 1992 1356 NAPSTAT.EXE cmd.exe PID 1356 wrote to memory of 1992 1356 NAPSTAT.EXE cmd.exe PID 1356 wrote to memory of 1992 1356 NAPSTAT.EXE cmd.exe PID 1356 wrote to memory of 1992 1356 NAPSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\PRC-20-518 ORIGINAL.xlsx"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeMD5
1db39e128ada4c68357664c1b44c0e84
SHA1a3201ab63b7c34c0f19cb92c8aaf7c45a8d5ce07
SHA2562fa1b077d0c0a2f292e166dd47f72ca444ceac3c43a1936b4f9a03d7c34d032a
SHA512306c7c501c88383be3f2f2acf1215ec68fe209ddf1946ca6a70b05ba5e56c06890cb722489794ba95f7c377be5e4261f8dc4ad9d3917f4a4955fb2f7ae537522
-
C:\Users\Public\vbc.exeMD5
1db39e128ada4c68357664c1b44c0e84
SHA1a3201ab63b7c34c0f19cb92c8aaf7c45a8d5ce07
SHA2562fa1b077d0c0a2f292e166dd47f72ca444ceac3c43a1936b4f9a03d7c34d032a
SHA512306c7c501c88383be3f2f2acf1215ec68fe209ddf1946ca6a70b05ba5e56c06890cb722489794ba95f7c377be5e4261f8dc4ad9d3917f4a4955fb2f7ae537522
-
C:\Users\Public\vbc.exeMD5
1db39e128ada4c68357664c1b44c0e84
SHA1a3201ab63b7c34c0f19cb92c8aaf7c45a8d5ce07
SHA2562fa1b077d0c0a2f292e166dd47f72ca444ceac3c43a1936b4f9a03d7c34d032a
SHA512306c7c501c88383be3f2f2acf1215ec68fe209ddf1946ca6a70b05ba5e56c06890cb722489794ba95f7c377be5e4261f8dc4ad9d3917f4a4955fb2f7ae537522
-
\Users\Public\vbc.exeMD5
1db39e128ada4c68357664c1b44c0e84
SHA1a3201ab63b7c34c0f19cb92c8aaf7c45a8d5ce07
SHA2562fa1b077d0c0a2f292e166dd47f72ca444ceac3c43a1936b4f9a03d7c34d032a
SHA512306c7c501c88383be3f2f2acf1215ec68fe209ddf1946ca6a70b05ba5e56c06890cb722489794ba95f7c377be5e4261f8dc4ad9d3917f4a4955fb2f7ae537522
-
\Users\Public\vbc.exeMD5
1db39e128ada4c68357664c1b44c0e84
SHA1a3201ab63b7c34c0f19cb92c8aaf7c45a8d5ce07
SHA2562fa1b077d0c0a2f292e166dd47f72ca444ceac3c43a1936b4f9a03d7c34d032a
SHA512306c7c501c88383be3f2f2acf1215ec68fe209ddf1946ca6a70b05ba5e56c06890cb722489794ba95f7c377be5e4261f8dc4ad9d3917f4a4955fb2f7ae537522
-
\Users\Public\vbc.exeMD5
1db39e128ada4c68357664c1b44c0e84
SHA1a3201ab63b7c34c0f19cb92c8aaf7c45a8d5ce07
SHA2562fa1b077d0c0a2f292e166dd47f72ca444ceac3c43a1936b4f9a03d7c34d032a
SHA512306c7c501c88383be3f2f2acf1215ec68fe209ddf1946ca6a70b05ba5e56c06890cb722489794ba95f7c377be5e4261f8dc4ad9d3917f4a4955fb2f7ae537522
-
\Users\Public\vbc.exeMD5
1db39e128ada4c68357664c1b44c0e84
SHA1a3201ab63b7c34c0f19cb92c8aaf7c45a8d5ce07
SHA2562fa1b077d0c0a2f292e166dd47f72ca444ceac3c43a1936b4f9a03d7c34d032a
SHA512306c7c501c88383be3f2f2acf1215ec68fe209ddf1946ca6a70b05ba5e56c06890cb722489794ba95f7c377be5e4261f8dc4ad9d3917f4a4955fb2f7ae537522
-
memory/520-208-0x0000000000C20000-0x0000000000F23000-memory.dmpFilesize
3.0MB
-
memory/520-209-0x0000000000180000-0x0000000000191000-memory.dmpFilesize
68KB
-
memory/520-205-0x000000000041D0A0-mapping.dmp
-
memory/520-204-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1108-104-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-122-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-2-0x000000002F511000-0x000000002F514000-memory.dmpFilesize
12KB
-
memory/1108-17-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-19-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-21-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-22-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-23-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-24-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-26-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-28-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-30-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-32-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-34-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-36-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-38-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-40-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-42-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-3-0x0000000071251000-0x0000000071253000-memory.dmpFilesize
8KB
-
memory/1108-45-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-47-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-49-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-51-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-53-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-55-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-57-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-59-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-61-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-62-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-63-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-66-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-65-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-64-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-68-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-70-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-72-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-74-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-76-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-78-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-80-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-82-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-118-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-86-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-88-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-90-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-92-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-94-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-96-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-98-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-100-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-102-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1108-106-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-108-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-110-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-112-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-174-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-198-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-84-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-120-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-116-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-124-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-126-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-128-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-130-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-132-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-134-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-136-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-138-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-140-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-142-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-144-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-146-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-148-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-150-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-152-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-154-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-156-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-158-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-160-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-162-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-164-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-166-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-168-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-170-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-172-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-114-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-176-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-178-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-180-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-182-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-184-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-186-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-188-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-190-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-192-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-194-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1108-196-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/1264-210-0x0000000002A00000-0x0000000002AB0000-memory.dmpFilesize
704KB
-
memory/1356-215-0x0000000001FC0000-0x00000000022C3000-memory.dmpFilesize
3.0MB
-
memory/1356-213-0x0000000000710000-0x0000000000756000-memory.dmpFilesize
280KB
-
memory/1356-214-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1356-211-0x0000000000000000-mapping.dmp
-
memory/1356-216-0x0000000001D30000-0x0000000001DC0000-memory.dmpFilesize
576KB
-
memory/1528-5-0x00000000760D1000-0x00000000760D3000-memory.dmpFilesize
8KB
-
memory/1684-6-0x000007FEF7510000-0x000007FEF778A000-memory.dmpFilesize
2.5MB
-
memory/1940-200-0x00000000005A0000-0x00000000005A4000-memory.dmpFilesize
16KB
-
memory/1940-201-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1940-14-0x000000006BDA0000-0x000000006C48E000-memory.dmpFilesize
6.9MB
-
memory/1940-203-0x00000000009A0000-0x00000000009CE000-memory.dmpFilesize
184KB
-
memory/1940-202-0x00000000050A0000-0x0000000005110000-memory.dmpFilesize
448KB
-
memory/1940-15-0x0000000000B70000-0x0000000000B71000-memory.dmpFilesize
4KB
-
memory/1940-44-0x0000000004080000-0x0000000004081000-memory.dmpFilesize
4KB
-
memory/1940-11-0x0000000000000000-mapping.dmp
-
memory/1992-212-0x0000000000000000-mapping.dmp