Analysis
-
max time kernel
129s -
max time network
145s -
platform
windows10_x64 -
resource
win10 -
submitted
12-07-2020 08:09
Static task
static1
Behavioral task
behavioral1
Sample
acrord32.dll
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
acrord32.dll
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
acrord32.dll
-
Size
364KB
-
MD5
6060f7dc35c4d43728d5ca5286327c01
-
SHA1
35ff54838cb6db9a1829d110d2a6b47001648f17
-
SHA256
8a07c265a20279d4b60da2cc26f2bb041730c90c6d3eca64a8dd9f4a032d85d3
-
SHA512
4898e9afb3858fa1f3eb493ea4d6eb6b3f9701aafceb7ed70aa71ec170fc06530bcbe6e1058547e0473d40630fa85484a37a9aadd143e575144948764ba089b3
Score
8/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4004 3216 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
WerFault.exeAcroRd32.exepid process 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 4004 WerFault.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 3948 AcroRd32.exe -
Modifies registry class 1 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings rundll32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of WriteProcessMemory 259 IoCs
Processes:
rundll32.exerundll32.exeAcroRd32.exeRdrCEF.exedescription pid process target process PID 2948 wrote to memory of 3216 2948 rundll32.exe rundll32.exe PID 2948 wrote to memory of 3216 2948 rundll32.exe rundll32.exe PID 2948 wrote to memory of 3216 2948 rundll32.exe rundll32.exe PID 3216 wrote to memory of 3948 3216 rundll32.exe AcroRd32.exe PID 3216 wrote to memory of 3948 3216 rundll32.exe AcroRd32.exe PID 3216 wrote to memory of 3948 3216 rundll32.exe AcroRd32.exe PID 3948 wrote to memory of 684 3948 AcroRd32.exe RdrCEF.exe PID 3948 wrote to memory of 684 3948 AcroRd32.exe RdrCEF.exe PID 3948 wrote to memory of 684 3948 AcroRd32.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1452 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1640 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1640 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1640 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1640 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1640 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1640 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1640 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1640 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1640 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1640 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1640 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1640 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1640 684 RdrCEF.exe RdrCEF.exe PID 684 wrote to memory of 1640 684 RdrCEF.exe RdrCEF.exe -
Blacklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 4 3216 rundll32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
AcroRd32.exepid process 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe 3948 AcroRd32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 4004 WerFault.exe Token: SeBackupPrivilege 4004 WerFault.exe Token: SeDebugPrivilege 4004 WerFault.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\acrord32.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\acrord32.dll,#12⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
- Blacklisted process makes network request
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DOC-2020-05-15T092742.441.pdf"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Checks processor information in registry
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140434⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E26C28C44D7810A6652083BC2A96B2C4 --mojo-platform-channel-handle=1636 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B3427870F15EB384D8F4EB88078BD8F5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B3427870F15EB384D8F4EB88078BD8F5 --renderer-client-id=2 --mojo-platform-channel-handle=1648 --allow-no-sandbox-job /prefetch:15⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9CFE189A09606D4876B974355F676C14 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9CFE189A09606D4876B974355F676C14 --renderer-client-id=4 --mojo-platform-channel-handle=2224 --allow-no-sandbox-job /prefetch:15⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=20A5662BD9D733E906B9A717C64C0D68 --mojo-platform-channel-handle=2380 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=80E9798F31F126D3D9FF91C8DA1F5036 --mojo-platform-channel-handle=2668 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=71758DD892CB8D8F9E4BA1C57F9DD4CC --mojo-platform-channel-handle=2740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 16563⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DOC-2020-05-15T092742.441.pdf
-
memory/684-19-0x0000000000000000-mapping.dmp
-
memory/1452-21-0x0000000000000000-mapping.dmp
-
memory/1452-20-0x00000000772F2000-0x00000000772F200C-memory.dmpFilesize
12B
-
memory/1640-24-0x0000000000000000-mapping.dmp
-
memory/1640-23-0x00000000772F2000-0x00000000772F200C-memory.dmpFilesize
12B
-
memory/2140-29-0x0000000000000000-mapping.dmp
-
memory/2140-28-0x00000000772F2000-0x00000000772F200C-memory.dmpFilesize
12B
-
memory/2336-34-0x0000000000000000-mapping.dmp
-
memory/2336-33-0x00000000772F2000-0x00000000772F200C-memory.dmpFilesize
12B
-
memory/3028-37-0x0000000000000000-mapping.dmp
-
memory/3028-36-0x00000000772F2000-0x00000000772F200C-memory.dmpFilesize
12B
-
memory/3216-7-0x0000000000000000-mapping.dmp
-
memory/3216-8-0x0000000000000000-mapping.dmp
-
memory/3216-4-0x0000000000000000-mapping.dmp
-
memory/3216-12-0x0000000000000000-mapping.dmp
-
memory/3216-11-0x0000000000000000-mapping.dmp
-
memory/3216-10-0x0000000000000000-mapping.dmp
-
memory/3216-9-0x0000000000000000-mapping.dmp
-
memory/3216-13-0x0000000000000000-mapping.dmp
-
memory/3216-0-0x0000000000000000-mapping.dmp
-
memory/3216-6-0x0000000000000000-mapping.dmp
-
memory/3216-5-0x0000000000000000-mapping.dmp
-
memory/3672-39-0x00000000772F2000-0x00000000772F200C-memory.dmpFilesize
12B
-
memory/3672-40-0x0000000000000000-mapping.dmp
-
memory/3948-1-0x0000000000000000-mapping.dmp
-
memory/4004-14-0x00000000048E0000-0x00000000048E1000-memory.dmpFilesize
4KB
-
memory/4004-2-0x00000000044F0000-0x00000000044F1000-memory.dmpFilesize
4KB