Analysis
-
max time kernel
112s -
max time network
16s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
19-04-2021 18:51
Static task
static1
Behavioral task
behavioral1
Sample
payment receipt.doc
Resource
win7v20210408
Behavioral task
behavioral2
Sample
payment receipt.doc
Resource
win10v20210410
General
-
Target
payment receipt.doc
-
Size
566KB
-
MD5
62a7b3f94fccff2290554183030a7295
-
SHA1
2ecc1fcffe96a21bfdc33a30a1f79195f96b3cf8
-
SHA256
77ff0fe733a29458872bac397a3f6bf6a6abf878edcd7cdd21b4b7fc396ec56e
-
SHA512
ef6608e72b01c272665245367d22258980f173e3bd70b9a8a7a1f21a59a88aaa0380845d3615f2bb41cd0667c457d201c17d88f00f5c265b1cade0059c3f1427
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.orienttech.com.qa - Port:
587 - Username:
[email protected] - Password:
Op{^fLb9gN[!
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1412-75-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1412-76-0x00000000004374DE-mapping.dmp family_agenttesla behavioral1/memory/1412-78-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 7 1856 EQNEDT32.EXE -
Executes dropped EXE 2 IoCs
Processes:
ellawealtho368398.exeellawealtho368398.exepid process 1292 ellawealtho368398.exe 1412 ellawealtho368398.exe -
Loads dropped DLL 1 IoCs
Processes:
EQNEDT32.EXEpid process 1856 EQNEDT32.EXE -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ellawealtho368398.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\EpJdKQ = "C:\\Users\\Admin\\AppData\\Roaming\\EpJdKQ\\EpJdKQ.exe" ellawealtho368398.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
ellawealtho368398.exepid process 1292 ellawealtho368398.exe 1292 ellawealtho368398.exe 1292 ellawealtho368398.exe 1292 ellawealtho368398.exe 1292 ellawealtho368398.exe 1292 ellawealtho368398.exe 1292 ellawealtho368398.exe 1292 ellawealtho368398.exe 1292 ellawealtho368398.exe 1292 ellawealtho368398.exe 1292 ellawealtho368398.exe 1292 ellawealtho368398.exe 1292 ellawealtho368398.exe 1292 ellawealtho368398.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ellawealtho368398.exedescription pid process target process PID 1292 set thread context of 1412 1292 ellawealtho368398.exe ellawealtho368398.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1328 timeout.exe -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE -
Processes:
ellawealtho368398.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 ellawealtho368398.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 ellawealtho368398.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 ellawealtho368398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 ellawealtho368398.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1028 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
ellawealtho368398.exeellawealtho368398.exepid process 1292 ellawealtho368398.exe 1292 ellawealtho368398.exe 1292 ellawealtho368398.exe 1412 ellawealtho368398.exe 1412 ellawealtho368398.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ellawealtho368398.exeellawealtho368398.exedescription pid process Token: SeDebugPrivilege 1292 ellawealtho368398.exe Token: SeDebugPrivilege 1412 ellawealtho368398.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
WINWORD.EXEellawealtho368398.exepid process 1028 WINWORD.EXE 1028 WINWORD.EXE 1412 ellawealtho368398.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
EQNEDT32.EXEellawealtho368398.execmd.exeWINWORD.EXEdescription pid process target process PID 1856 wrote to memory of 1292 1856 EQNEDT32.EXE ellawealtho368398.exe PID 1856 wrote to memory of 1292 1856 EQNEDT32.EXE ellawealtho368398.exe PID 1856 wrote to memory of 1292 1856 EQNEDT32.EXE ellawealtho368398.exe PID 1856 wrote to memory of 1292 1856 EQNEDT32.EXE ellawealtho368398.exe PID 1292 wrote to memory of 1592 1292 ellawealtho368398.exe cmd.exe PID 1292 wrote to memory of 1592 1292 ellawealtho368398.exe cmd.exe PID 1292 wrote to memory of 1592 1292 ellawealtho368398.exe cmd.exe PID 1292 wrote to memory of 1592 1292 ellawealtho368398.exe cmd.exe PID 1592 wrote to memory of 1328 1592 cmd.exe timeout.exe PID 1592 wrote to memory of 1328 1592 cmd.exe timeout.exe PID 1592 wrote to memory of 1328 1592 cmd.exe timeout.exe PID 1592 wrote to memory of 1328 1592 cmd.exe timeout.exe PID 1292 wrote to memory of 1412 1292 ellawealtho368398.exe ellawealtho368398.exe PID 1292 wrote to memory of 1412 1292 ellawealtho368398.exe ellawealtho368398.exe PID 1292 wrote to memory of 1412 1292 ellawealtho368398.exe ellawealtho368398.exe PID 1292 wrote to memory of 1412 1292 ellawealtho368398.exe ellawealtho368398.exe PID 1292 wrote to memory of 1412 1292 ellawealtho368398.exe ellawealtho368398.exe PID 1292 wrote to memory of 1412 1292 ellawealtho368398.exe ellawealtho368398.exe PID 1292 wrote to memory of 1412 1292 ellawealtho368398.exe ellawealtho368398.exe PID 1292 wrote to memory of 1412 1292 ellawealtho368398.exe ellawealtho368398.exe PID 1292 wrote to memory of 1412 1292 ellawealtho368398.exe ellawealtho368398.exe PID 1028 wrote to memory of 1848 1028 WINWORD.EXE splwow64.exe PID 1028 wrote to memory of 1848 1028 WINWORD.EXE splwow64.exe PID 1028 wrote to memory of 1848 1028 WINWORD.EXE splwow64.exe PID 1028 wrote to memory of 1848 1028 WINWORD.EXE splwow64.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\payment receipt.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ellawealtho368398.exe"C:\Users\Admin\AppData\Roaming\ellawealtho368398.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\ellawealtho368398.exe"C:\Users\Admin\AppData\Roaming\ellawealtho368398.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ellawealtho368398.exeMD5
0389d0b86a7342d646fc52945033e0c3
SHA16d1fa84447923f045673c8510269cc8679332322
SHA2562a39871fcfc1b15b312efc820839f57a21288c09be793ca1ddaf41d821ce3c01
SHA5125575d21a2a44d1b56fee70bade21c5e9bf0bab620afacc660f02c7f3980af538bb7164c1a845db47010b3e66adb51d9e03aa9f469b638d580e42e5cc371b6208
-
C:\Users\Admin\AppData\Roaming\ellawealtho368398.exeMD5
0389d0b86a7342d646fc52945033e0c3
SHA16d1fa84447923f045673c8510269cc8679332322
SHA2562a39871fcfc1b15b312efc820839f57a21288c09be793ca1ddaf41d821ce3c01
SHA5125575d21a2a44d1b56fee70bade21c5e9bf0bab620afacc660f02c7f3980af538bb7164c1a845db47010b3e66adb51d9e03aa9f469b638d580e42e5cc371b6208
-
C:\Users\Admin\AppData\Roaming\ellawealtho368398.exeMD5
0389d0b86a7342d646fc52945033e0c3
SHA16d1fa84447923f045673c8510269cc8679332322
SHA2562a39871fcfc1b15b312efc820839f57a21288c09be793ca1ddaf41d821ce3c01
SHA5125575d21a2a44d1b56fee70bade21c5e9bf0bab620afacc660f02c7f3980af538bb7164c1a845db47010b3e66adb51d9e03aa9f469b638d580e42e5cc371b6208
-
\Users\Admin\AppData\Roaming\ellawealtho368398.exeMD5
0389d0b86a7342d646fc52945033e0c3
SHA16d1fa84447923f045673c8510269cc8679332322
SHA2562a39871fcfc1b15b312efc820839f57a21288c09be793ca1ddaf41d821ce3c01
SHA5125575d21a2a44d1b56fee70bade21c5e9bf0bab620afacc660f02c7f3980af538bb7164c1a845db47010b3e66adb51d9e03aa9f469b638d580e42e5cc371b6208
-
memory/1028-61-0x0000000070141000-0x0000000070143000-memory.dmpFilesize
8KB
-
memory/1028-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1028-83-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1028-60-0x00000000726C1000-0x00000000726C4000-memory.dmpFilesize
12KB
-
memory/1292-65-0x0000000000000000-mapping.dmp
-
memory/1292-71-0x0000000004720000-0x0000000004721000-memory.dmpFilesize
4KB
-
memory/1292-72-0x0000000000180000-0x00000000001D4000-memory.dmpFilesize
336KB
-
memory/1292-68-0x0000000000930000-0x0000000000931000-memory.dmpFilesize
4KB
-
memory/1328-74-0x0000000000000000-mapping.dmp
-
memory/1412-75-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1412-76-0x00000000004374DE-mapping.dmp
-
memory/1412-78-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1412-80-0x0000000004750000-0x0000000004751000-memory.dmpFilesize
4KB
-
memory/1412-84-0x0000000004751000-0x0000000004752000-memory.dmpFilesize
4KB
-
memory/1592-73-0x0000000000000000-mapping.dmp
-
memory/1848-81-0x0000000000000000-mapping.dmp
-
memory/1848-82-0x000007FEFBD61000-0x000007FEFBD63000-memory.dmpFilesize
8KB
-
memory/1856-63-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB