Analysis
-
max time kernel
123s -
max time network
131s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
19-10-2021 11:29
Static task
static1
Behavioral task
behavioral1
Sample
PO_SHZ41.EXE
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
PO_SHZ41.EXE
Resource
win10-en-20211014
General
-
Target
PO_SHZ41.EXE
-
Size
72KB
-
MD5
410cce7e5da174865ae1c5d65458d92c
-
SHA1
0ea38171202123c4f0115cb5cefc578bc0b664a3
-
SHA256
8dc1640499a6b1cac921adb0e5899e2fe02f4902b2f6acfa5d4f7c2f277e54cc
-
SHA512
f7eca94b7ec65a7e932d0faeb37703c716b5856f71a696378c01e44ea3c4749b10892e877f4efc75797319648fbe77ad143cf53ba01f4324eb76e4be32128a20
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.mail.ru - Port:
587 - Username:
[email protected] - Password:
xxxlahot2
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5076-179-0x0000000007400000-0x0000000007436000-memory.dmp family_agenttesla -
Nirsoft 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\9e581b13-0802-4144-829d-f78bdb45693f\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\9e581b13-0802-4144-829d-f78bdb45693f\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\9e581b13-0802-4144-829d-f78bdb45693f\AdvancedRun.exe Nirsoft -
Executes dropped EXE 2 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepid process 2280 AdvancedRun.exe 2796 AdvancedRun.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
PO_SHZ41.EXEdescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\⾈⾊⽘⽴⾊⽚⽞⽖⾋⽛⽟⽙⽾⽛⾊\svchost.exe = "0" PO_SHZ41.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\PO_SHZ41.EXE = "0" PO_SHZ41.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" PO_SHZ41.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" PO_SHZ41.EXE Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features PO_SHZ41.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" PO_SHZ41.EXE Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths PO_SHZ41.EXE Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection PO_SHZ41.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" PO_SHZ41.EXE Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet PO_SHZ41.EXE Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions PO_SHZ41.EXE -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
PO_SHZ41.EXEdescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO_SHZ41.EXE Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO_SHZ41.EXE Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO_SHZ41.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
PO_SHZ41.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\TmZaMAa = "C:\\Users\\Admin\\AppData\\Roaming\\TmZaMAa\\TmZaMAa.exe" PO_SHZ41.EXE -
Drops file in Windows directory 2 IoCs
Processes:
PO_SHZ41.EXEdescription ioc process File created C:\Windows\Microsoft.NET\Framework\⾈⾊⽘⽴⾊⽚⽞⽖⾋⽛⽟⽙⽾⽛⾊\svchost.exe PO_SHZ41.EXE File opened for modification C:\Windows\Microsoft.NET\Framework\⾈⾊⽘⽴⾊⽚⽞⽖⾋⽛⽟⽙⽾⽛⾊\svchost.exe PO_SHZ41.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
AdvancedRun.exepowershell.exepowershell.exepowershell.exeAdvancedRun.exePO_SHZ41.EXEpowershell.exepid process 2280 AdvancedRun.exe 2280 AdvancedRun.exe 2280 AdvancedRun.exe 2280 AdvancedRun.exe 644 powershell.exe 64 powershell.exe 4464 powershell.exe 2796 AdvancedRun.exe 2796 AdvancedRun.exe 2796 AdvancedRun.exe 2796 AdvancedRun.exe 644 powershell.exe 64 powershell.exe 4464 powershell.exe 4464 powershell.exe 644 powershell.exe 64 powershell.exe 5076 PO_SHZ41.EXE 5076 PO_SHZ41.EXE 2028 powershell.exe 2028 powershell.exe 2028 powershell.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
PO_SHZ41.EXEpowershell.exepowershell.exepowershell.exeAdvancedRun.exeAdvancedRun.exepowershell.exedescription pid process Token: SeDebugPrivilege 5076 PO_SHZ41.EXE Token: SeDebugPrivilege 64 powershell.exe Token: SeDebugPrivilege 4464 powershell.exe Token: SeDebugPrivilege 644 powershell.exe Token: SeDebugPrivilege 2280 AdvancedRun.exe Token: SeImpersonatePrivilege 2280 AdvancedRun.exe Token: SeDebugPrivilege 2796 AdvancedRun.exe Token: SeImpersonatePrivilege 2796 AdvancedRun.exe Token: SeDebugPrivilege 2028 powershell.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
PO_SHZ41.EXEAdvancedRun.exedescription pid process target process PID 5076 wrote to memory of 4464 5076 PO_SHZ41.EXE powershell.exe PID 5076 wrote to memory of 4464 5076 PO_SHZ41.EXE powershell.exe PID 5076 wrote to memory of 4464 5076 PO_SHZ41.EXE powershell.exe PID 5076 wrote to memory of 644 5076 PO_SHZ41.EXE powershell.exe PID 5076 wrote to memory of 644 5076 PO_SHZ41.EXE powershell.exe PID 5076 wrote to memory of 644 5076 PO_SHZ41.EXE powershell.exe PID 5076 wrote to memory of 64 5076 PO_SHZ41.EXE powershell.exe PID 5076 wrote to memory of 64 5076 PO_SHZ41.EXE powershell.exe PID 5076 wrote to memory of 64 5076 PO_SHZ41.EXE powershell.exe PID 5076 wrote to memory of 2280 5076 PO_SHZ41.EXE AdvancedRun.exe PID 5076 wrote to memory of 2280 5076 PO_SHZ41.EXE AdvancedRun.exe PID 5076 wrote to memory of 2280 5076 PO_SHZ41.EXE AdvancedRun.exe PID 2280 wrote to memory of 2796 2280 AdvancedRun.exe AdvancedRun.exe PID 2280 wrote to memory of 2796 2280 AdvancedRun.exe AdvancedRun.exe PID 2280 wrote to memory of 2796 2280 AdvancedRun.exe AdvancedRun.exe PID 5076 wrote to memory of 2028 5076 PO_SHZ41.EXE powershell.exe PID 5076 wrote to memory of 2028 5076 PO_SHZ41.EXE powershell.exe PID 5076 wrote to memory of 2028 5076 PO_SHZ41.EXE powershell.exe -
outlook_office_path 1 IoCs
Processes:
PO_SHZ41.EXEdescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO_SHZ41.EXE -
outlook_win_path 1 IoCs
Processes:
PO_SHZ41.EXEdescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PO_SHZ41.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO_SHZ41.EXE"C:\Users\Admin\AppData\Local\Temp\PO_SHZ41.EXE"1⤵
- Windows security modification
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\⾈⾊⽘⽴⾊⽚⽞⽖⾋⽛⽟⽙⽾⽛⾊\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO_SHZ41.EXE" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\⾈⾊⽘⽴⾊⽚⽞⽖⾋⽛⽟⽙⽾⽛⾊\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\9e581b13-0802-4144-829d-f78bdb45693f\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\9e581b13-0802-4144-829d-f78bdb45693f\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\9e581b13-0802-4144-829d-f78bdb45693f\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9e581b13-0802-4144-829d-f78bdb45693f\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\9e581b13-0802-4144-829d-f78bdb45693f\AdvancedRun.exe" /SpecialRun 4101d8 22803⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO_SHZ41.EXE" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
1c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheMD5
7247129cd0644457905b7d6bf17fd078
SHA1dbf9139b5a1b72141f170d2eae911bbbe7e128c8
SHA256dfa6e0d79449f29310b2a0400dc7fa5a3a6b08182233147a81902d1f80a0f8e4
SHA5129b1ebd7fe485811f10ec02778d90a7f7eccafa0231027b640b94eaed8408107051da7fcc4f17a9aa0eef900fa2595f44be7fd115331fb6da9b10076f5fcf87e0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheMD5
7247129cd0644457905b7d6bf17fd078
SHA1dbf9139b5a1b72141f170d2eae911bbbe7e128c8
SHA256dfa6e0d79449f29310b2a0400dc7fa5a3a6b08182233147a81902d1f80a0f8e4
SHA5129b1ebd7fe485811f10ec02778d90a7f7eccafa0231027b640b94eaed8408107051da7fcc4f17a9aa0eef900fa2595f44be7fd115331fb6da9b10076f5fcf87e0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
928440c8e6a174d3412708dc30433446
SHA17b54f4c4a1109c99f19ae4087d6985597b1cb796
SHA2569d9b21ab0952eb2ae527d27ba2373a38d985ea4e28067812f82cc461b46eb151
SHA512222bb6de16ee8298c4bbbc12e0048938e2b7dc0f9115d93650dbc3f3e44f5b1439e43323ead05e8ed73548153bd15fdfb57a6dd2150ceb017b58edcff00fca08
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
267bf23992de966460785b4afbad5d5f
SHA184b4cd7c72728b2e8f725697600edf0f7b0b31d1
SHA25656214cf58449e7563f557aa2ff5ae21c83c9dd913e0104f7e5b89b88816ab8f9
SHA5125bb23b6cd3db789b186aa22a332fca1a8484299c2b0dc59fb5d7084bfd48b357433f66f2bc84a6d225a107e9968c7e2b0d69dced23cd691c3adf80e0dd771481
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
267bf23992de966460785b4afbad5d5f
SHA184b4cd7c72728b2e8f725697600edf0f7b0b31d1
SHA25656214cf58449e7563f557aa2ff5ae21c83c9dd913e0104f7e5b89b88816ab8f9
SHA5125bb23b6cd3db789b186aa22a332fca1a8484299c2b0dc59fb5d7084bfd48b357433f66f2bc84a6d225a107e9968c7e2b0d69dced23cd691c3adf80e0dd771481
-
C:\Users\Admin\AppData\Local\Temp\9e581b13-0802-4144-829d-f78bdb45693f\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\9e581b13-0802-4144-829d-f78bdb45693f\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\9e581b13-0802-4144-829d-f78bdb45693f\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
memory/64-230-0x000000007EC80000-0x000000007EC81000-memory.dmpFilesize
4KB
-
memory/64-173-0x0000000002F90000-0x0000000002F91000-memory.dmpFilesize
4KB
-
memory/64-169-0x0000000008530000-0x0000000008531000-memory.dmpFilesize
4KB
-
memory/64-144-0x0000000003172000-0x0000000003173000-memory.dmpFilesize
4KB
-
memory/64-155-0x0000000007B10000-0x0000000007B11000-memory.dmpFilesize
4KB
-
memory/64-133-0x0000000002F90000-0x0000000002F91000-memory.dmpFilesize
4KB
-
memory/64-134-0x0000000002F90000-0x0000000002F91000-memory.dmpFilesize
4KB
-
memory/64-252-0x0000000003173000-0x0000000003174000-memory.dmpFilesize
4KB
-
memory/64-125-0x0000000000000000-mapping.dmp
-
memory/64-142-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/644-149-0x0000000006BB0000-0x0000000006BB1000-memory.dmpFilesize
4KB
-
memory/644-163-0x0000000006EB0000-0x0000000006EB1000-memory.dmpFilesize
4KB
-
memory/644-124-0x0000000000000000-mapping.dmp
-
memory/644-145-0x00000000068D2000-0x00000000068D3000-memory.dmpFilesize
4KB
-
memory/644-141-0x00000000068D0000-0x00000000068D1000-memory.dmpFilesize
4KB
-
memory/644-257-0x00000000068D3000-0x00000000068D4000-memory.dmpFilesize
4KB
-
memory/644-223-0x000000007F740000-0x000000007F741000-memory.dmpFilesize
4KB
-
memory/644-128-0x0000000000940000-0x0000000000941000-memory.dmpFilesize
4KB
-
memory/644-176-0x0000000000940000-0x0000000000941000-memory.dmpFilesize
4KB
-
memory/644-152-0x0000000006C50000-0x0000000006C51000-memory.dmpFilesize
4KB
-
memory/644-129-0x0000000000940000-0x0000000000941000-memory.dmpFilesize
4KB
-
memory/644-166-0x0000000007990000-0x0000000007991000-memory.dmpFilesize
4KB
-
memory/2028-177-0x0000000000000000-mapping.dmp
-
memory/2028-180-0x0000000004E00000-0x0000000004E01000-memory.dmpFilesize
4KB
-
memory/2028-374-0x0000000004F83000-0x0000000004F84000-memory.dmpFilesize
4KB
-
memory/2028-333-0x000000007ECC0000-0x000000007ECC1000-memory.dmpFilesize
4KB
-
memory/2028-188-0x0000000004F82000-0x0000000004F83000-memory.dmpFilesize
4KB
-
memory/2028-187-0x0000000004F80000-0x0000000004F81000-memory.dmpFilesize
4KB
-
memory/2028-181-0x0000000004E00000-0x0000000004E01000-memory.dmpFilesize
4KB
-
memory/2280-146-0x0000000000000000-mapping.dmp
-
memory/2796-158-0x0000000000000000-mapping.dmp
-
memory/4464-253-0x0000000007353000-0x0000000007354000-memory.dmpFilesize
4KB
-
memory/4464-140-0x0000000007350000-0x0000000007351000-memory.dmpFilesize
4KB
-
memory/4464-126-0x0000000003430000-0x0000000003431000-memory.dmpFilesize
4KB
-
memory/4464-127-0x0000000003430000-0x0000000003431000-memory.dmpFilesize
4KB
-
memory/4464-130-0x0000000004D90000-0x0000000004D91000-memory.dmpFilesize
4KB
-
memory/4464-226-0x000000007F750000-0x000000007F751000-memory.dmpFilesize
4KB
-
memory/4464-136-0x0000000007990000-0x0000000007991000-memory.dmpFilesize
4KB
-
memory/4464-123-0x0000000000000000-mapping.dmp
-
memory/4464-172-0x0000000003430000-0x0000000003431000-memory.dmpFilesize
4KB
-
memory/4464-143-0x0000000007352000-0x0000000007353000-memory.dmpFilesize
4KB
-
memory/4464-160-0x0000000008030000-0x0000000008031000-memory.dmpFilesize
4KB
-
memory/5076-179-0x0000000007400000-0x0000000007436000-memory.dmpFilesize
216KB
-
memory/5076-132-0x00000000072A0000-0x00000000072A1000-memory.dmpFilesize
4KB
-
memory/5076-117-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/5076-139-0x0000000007260000-0x0000000007261000-memory.dmpFilesize
4KB
-
memory/5076-122-0x00000000076A0000-0x00000000076A1000-memory.dmpFilesize
4KB
-
memory/5076-121-0x0000000002F20000-0x0000000002FA2000-memory.dmpFilesize
520KB
-
memory/5076-118-0x0000000007100000-0x0000000007101000-memory.dmpFilesize
4KB
-
memory/5076-115-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB