Analysis
-
max time kernel
110s -
max time network
141s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
31-10-2021 19:09
Behavioral task
behavioral1
Sample
747004742p 4*4476*377p 71*8474*7p 45875*15p 94158*p 6610p *750p 277*86570*p 871038*p 2934p 236*54879.pdf
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
747004742p 4*4476*377p 71*8474*7p 45875*15p 94158*p 6610p *750p 277*86570*p 871038*p 2934p 236*54879.pdf
Resource
win10-en-20211014
General
-
Target
747004742p 4*4476*377p 71*8474*7p 45875*15p 94158*p 6610p *750p 277*86570*p 871038*p 2934p 236*54879.pdf
-
Size
159KB
-
MD5
8f4ad7199c402d24735c2158171538f4
-
SHA1
9c2ea479b4f58148dffc447b53c8409c8a33b0c7
-
SHA256
4c541b030cdccd422dcdfe4a782cfde6c4b2e10e7adae9ddfac13ed4261bfed8
-
SHA512
26b510c2f60105e909181d63d097d0af48fcb7cf745dfa45a9d0fbb80df708375ad6fcd3712f52d387794210ca2a6eebc32bd3f8444d6d0ffecde27bb0ece243
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
AcroRd32.exepid process 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 2804 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 2804 wrote to memory of 2336 2804 AcroRd32.exe RdrCEF.exe PID 2804 wrote to memory of 2336 2804 AcroRd32.exe RdrCEF.exe PID 2804 wrote to memory of 2336 2804 AcroRd32.exe RdrCEF.exe PID 2804 wrote to memory of 1340 2804 AcroRd32.exe RdrCEF.exe PID 2804 wrote to memory of 1340 2804 AcroRd32.exe RdrCEF.exe PID 2804 wrote to memory of 1340 2804 AcroRd32.exe RdrCEF.exe PID 2804 wrote to memory of 2772 2804 AcroRd32.exe RdrCEF.exe PID 2804 wrote to memory of 2772 2804 AcroRd32.exe RdrCEF.exe PID 2804 wrote to memory of 2772 2804 AcroRd32.exe RdrCEF.exe PID 2804 wrote to memory of 372 2804 AcroRd32.exe RdrCEF.exe PID 2804 wrote to memory of 372 2804 AcroRd32.exe RdrCEF.exe PID 2804 wrote to memory of 372 2804 AcroRd32.exe RdrCEF.exe PID 2804 wrote to memory of 860 2804 AcroRd32.exe RdrCEF.exe PID 2804 wrote to memory of 860 2804 AcroRd32.exe RdrCEF.exe PID 2804 wrote to memory of 860 2804 AcroRd32.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1660 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1828 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1828 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1828 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1828 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1828 860 RdrCEF.exe RdrCEF.exe PID 860 wrote to memory of 1828 860 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\747004742p 4_4476_377p 71_8474_7p 45875_15p 94158_p 6610p _750p 277_86570_p 871038_p 2934p 236_54879.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=279EF337C28F5FCCF83C8D38D1109DCB --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=279EF337C28F5FCCF83C8D38D1109DCB --renderer-client-id=2 --mojo-platform-channel-handle=1604 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AEE101EFB2160E8A56224684E79D5766 --mojo-platform-channel-handle=1924 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=86538CA2EB2889963B57D765059F3903 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=86538CA2EB2889963B57D765059F3903 --renderer-client-id=4 --mojo-platform-channel-handle=2224 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0B4A3E73801B8A413C3D13E080A3825F --mojo-platform-channel-handle=2480 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6DBF8AF3895D2322C10033F02B0E07FA --mojo-platform-channel-handle=1916 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=444E3F4B8E4F514F4451A4339C446C14 --mojo-platform-channel-handle=1916 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/372-118-0x0000000000000000-mapping.dmp
-
memory/860-119-0x0000000000000000-mapping.dmp
-
memory/1224-144-0x00000000773A2000-0x00000000773A3000-memory.dmpFilesize
4KB
-
memory/1224-146-0x0000000000000000-mapping.dmp
-
memory/1224-145-0x00000000007F1000-0x00000000007F2000-memory.dmpFilesize
4KB
-
memory/1340-116-0x0000000000000000-mapping.dmp
-
memory/1660-120-0x00000000773A2000-0x00000000773A3000-memory.dmpFilesize
4KB
-
memory/1660-121-0x00000000018F0000-0x00000000018F1000-memory.dmpFilesize
4KB
-
memory/1660-122-0x0000000000000000-mapping.dmp
-
memory/1660-123-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/1660-124-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/1660-125-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/1828-127-0x0000000001BC9000-0x0000000001BCA000-memory.dmpFilesize
4KB
-
memory/1828-128-0x0000000000000000-mapping.dmp
-
memory/1828-126-0x00000000773A2000-0x00000000773A3000-memory.dmpFilesize
4KB
-
memory/2336-115-0x0000000000000000-mapping.dmp
-
memory/2772-117-0x0000000000000000-mapping.dmp
-
memory/3160-130-0x00000000773A2000-0x00000000773A3000-memory.dmpFilesize
4KB
-
memory/3160-131-0x000000000180E000-0x000000000180F000-memory.dmpFilesize
4KB
-
memory/3160-132-0x0000000000000000-mapping.dmp
-
memory/3188-142-0x0000000000000000-mapping.dmp
-
memory/3188-141-0x0000000000E5C000-0x0000000000E5D000-memory.dmpFilesize
4KB
-
memory/3188-140-0x00000000773A2000-0x00000000773A3000-memory.dmpFilesize
4KB
-
memory/3888-138-0x0000000000000000-mapping.dmp
-
memory/3888-137-0x0000000000E2C000-0x0000000000E2D000-memory.dmpFilesize
4KB
-
memory/3888-136-0x00000000773A2000-0x00000000773A3000-memory.dmpFilesize
4KB