Analysis
-
max time kernel
104s -
max time network
160s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
29-10-2021 19:10
Behavioral task
behavioral1
Sample
rcvuy.6 faddlyb6 oy.luff6 py.cka6 ymgkc.ltq6 g.etai.6 vvtervma.e6 dnvi.kmiq6 i.cwk6 gdanevr.d6 dyhlsm.j6 .pdf
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
rcvuy.6 faddlyb6 oy.luff6 py.cka6 ymgkc.ltq6 g.etai.6 vvtervma.e6 dnvi.kmiq6 i.cwk6 gdanevr.d6 dyhlsm.j6 .pdf
Resource
win10-en-20211014
General
-
Target
rcvuy.6 faddlyb6 oy.luff6 py.cka6 ymgkc.ltq6 g.etai.6 vvtervma.e6 dnvi.kmiq6 i.cwk6 gdanevr.d6 dyhlsm.j6 .pdf
-
Size
108KB
-
MD5
f742a8719bd2a9e8af1266e5e92db09f
-
SHA1
0353106156c3693a74a3ba9ae39c849e35d50b86
-
SHA256
a7a6cbd0038ced432b95bab117f58e7c7b7da16f8fd4d6a997b822dd8ba3a42b
-
SHA512
d9cdff7a35cf7cfee6071d5064d4b4f9b22488340c6f43d76dba071890779e05ce3c1cda6d803ed6109a7aeb7109c41f1f6330ae5035d0c89c017c5353c46d14
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
AcroRd32.exepid process 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 3388 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe 3388 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 3388 wrote to memory of 1176 3388 AcroRd32.exe RdrCEF.exe PID 3388 wrote to memory of 1176 3388 AcroRd32.exe RdrCEF.exe PID 3388 wrote to memory of 1176 3388 AcroRd32.exe RdrCEF.exe PID 3388 wrote to memory of 1956 3388 AcroRd32.exe RdrCEF.exe PID 3388 wrote to memory of 1956 3388 AcroRd32.exe RdrCEF.exe PID 3388 wrote to memory of 1956 3388 AcroRd32.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 644 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 2588 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 2588 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 2588 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 2588 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 2588 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 2588 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 2588 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 2588 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 2588 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 2588 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 2588 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 2588 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 2588 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 2588 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 2588 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 2588 1176 RdrCEF.exe RdrCEF.exe PID 1176 wrote to memory of 2588 1176 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\rcvuy.6 faddlyb6 oy.luff6 py.cka6 ymgkc.ltq6 g.etai.6 vvtervma.e6 dnvi.kmiq6 i.cwk6 gdanevr.d6 dyhlsm.j6 .pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DB5A3FD0C24BE130399EAA2E8EEB30C0 --mojo-platform-channel-handle=1636 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FCD4F2C35B732C13B9C388E254F322DD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FCD4F2C35B732C13B9C388E254F322DD --renderer-client-id=2 --mojo-platform-channel-handle=1656 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=702C4BC77AA317FBC1E6BB5CDA29DF49 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=702C4BC77AA317FBC1E6BB5CDA29DF49 --renderer-client-id=4 --mojo-platform-channel-handle=2080 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=17A4E5ED661607F8CE6A9FA58D63BCAD --mojo-platform-channel-handle=2476 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DD165CD05FF2D3746441253AD8B5D616 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=37345909DA795212243A53E066C66119 --mojo-platform-channel-handle=2552 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/644-122-0x0000000000000000-mapping.dmp
-
memory/644-120-0x00000000775F2000-0x00000000775F3000-memory.dmpFilesize
4KB
-
memory/644-121-0x0000000000E01000-0x0000000000E02000-memory.dmpFilesize
4KB
-
memory/644-123-0x0000000000B30000-0x0000000000B31000-memory.dmpFilesize
4KB
-
memory/820-136-0x00000000775F2000-0x00000000775F3000-memory.dmpFilesize
4KB
-
memory/820-138-0x0000000000000000-mapping.dmp
-
memory/820-137-0x0000000001B49000-0x0000000001B4A000-memory.dmpFilesize
4KB
-
memory/1176-118-0x0000000000000000-mapping.dmp
-
memory/1956-119-0x0000000000000000-mapping.dmp
-
memory/2016-130-0x00000000775F2000-0x00000000775F3000-memory.dmpFilesize
4KB
-
memory/2016-131-0x000000000091A000-0x000000000091B000-memory.dmpFilesize
4KB
-
memory/2016-132-0x0000000000000000-mapping.dmp
-
memory/2076-146-0x0000000000000000-mapping.dmp
-
memory/2076-145-0x00000000009E5000-0x00000000009E6000-memory.dmpFilesize
4KB
-
memory/2076-144-0x00000000775F2000-0x00000000775F3000-memory.dmpFilesize
4KB
-
memory/2328-140-0x00000000775F2000-0x00000000775F3000-memory.dmpFilesize
4KB
-
memory/2328-141-0x00000000007D4000-0x00000000007D5000-memory.dmpFilesize
4KB
-
memory/2328-142-0x0000000000000000-mapping.dmp
-
memory/2588-129-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/2588-124-0x00000000775F2000-0x00000000775F3000-memory.dmpFilesize
4KB
-
memory/2588-128-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/2588-125-0x0000000000D98000-0x0000000000D99000-memory.dmpFilesize
4KB
-
memory/2588-126-0x0000000000000000-mapping.dmp