Overview

overview

10

Static

static

Attachment.iso

windows10-1703-x64

10

8969122ef3485d.ps1

windows10-1703-x64

8

8969122ef3485df.ps1

windows10-1703-x64

8

Attachment.lnk

windows10-1703-x64

8

document.pdf

windows10-1703-x64

1

Analysis

  • max time kernel
    287s
  • max time network
    291s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05-12-2022 08:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Attachment.iso

  • Size

    822KB

  • MD5

    1ff6225f783595cf3a0c11720fa945d8

  • SHA1

    4d71522a9cbf2f050f1b369f18351f6eec89b46e

  • SHA256

    d0d1b77c34afe7bec255227fc946e32890e7f6abff67e913d7ef4ea5e33efacb

  • SHA512

    3074e2212e10ac32b5bee3eca1ce9b324a85c5866b24c0086838b5ce336c380276f0616befe6c0c10d9cbdd1c95ed9c6de5eb3f3101d4f91cccb890f74b7b669

  • SSDEEP

    12288:3hU0sdb34MkPGI4MpPBrCi1y05XlXNgLZRwUm14nY:vpki13jgLZRwUm1v

Score
10/10
cobaltstrike0backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

0

Attributes
  • watermark

    0

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Blocklisted process makes network request 14 IoCs
  • Drops startup file 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Attachment.iso
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2584
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
    1⤵
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:3740
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4804
    • C:\Program Files\7-Zip\7zG.exe
      "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Attachment\" -ad -an -ai#7zMap5938:100:7zEvent29960
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:5060
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log
      1⤵
      • Opens file in notepad (likely ransom note)
      PID:3352
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -windowstyle hidden -command get-content 8969122ef3485d.log|out-string|iex
      1⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Attachment\document.pdf"
        2⤵
        • Checks processor information in registry
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4008
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F8052C1B3809711B02134207C443216F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F8052C1B3809711B02134207C443216F --renderer-client-id=2 --mojo-platform-channel-handle=1596 --allow-no-sandbox-job /prefetch:1
            4⤵
              PID:164
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C600BA8914FD9E9E49313555BC669C15 --mojo-platform-channel-handle=1632 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
              4⤵
                PID:4696
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2B203EF3E84831FC87CCE980A8A611F6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2B203EF3E84831FC87CCE980A8A611F6 --renderer-client-id=4 --mojo-platform-channel-handle=2092 --allow-no-sandbox-job /prefetch:1
                4⤵
                  PID:1284
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -windowstyle hidden -command get-content 8969122ef3485d.log|out-string|iex
            1⤵
            • Blocklisted process makes network request
            • Drops startup file
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5048
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Attachment\document.pdf"
              2⤵
              • Checks processor information in registry
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              PID:3404
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Attachment\document.pdf"
            1⤵
            • Checks processor information in registry
            • Suspicious use of SetWindowsHookEx
            PID:4520
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Attachment\8969122ef3485d.log
            1⤵
            • Opens file in notepad (likely ransom note)
            PID:2304

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Privilege Escalation

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Discovery

          System Information Discovery

          3
          T1082

          Query Registry

          2
          T1012

          Peripheral Device Discovery

          1
          T1120

          Lateral Movement

          Collection

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Attachment\8969122ef3485d.log
            Filesize

            23KB

            MD5

            914dd9891afe574b611e2e38a162ae1f

            SHA1

            ad4c9126bcf2e534cd355107c301d01832889610

            SHA256

            304d6a87f624d74df2bf37c458b2f06c525aad947886413befac892c1d89a394

            SHA512

            33a70a75e956bcdb70c22b27c2f3044d6c527e3a10446cb6654431ecfbe326d69631b8ad61bb8f8bc8399f6122bdc229dfc01a607cec38587d39dccc67dd902c

            Download Submit
          • C:\Attachment\8969122ef3485df.log
            Filesize

            420KB

            MD5

            06b8feae2c9d9f2940cb9dca40d553c3

            SHA1

            b246ed8055ad9e7bb760795e054224d406ec8a20

            SHA256

            93b0f19011468a4864c114bcbcfc55f460e2c789b14ea893c26ce450d3c21a9e

            SHA512

            d0285b2a638ff76fe846f41118c7e6e2ac741ab071ec63432fc8406b181ebf187c0d77f45740eb26a193f348b15db478a7d6c96c6f92df6a7464b46c9a3f6818

            Download Submit
          • C:\Attachment\Attachment.lnk
            Filesize

            2KB

            MD5

            4f86eb0c1fac722e4c7b4f6f089bd127

            SHA1

            9d459b6ebc01d6e937785e1e118000bebdd3f700

            SHA256

            89a1a6cb000a66b841ad26a8d0d5af507cc17efc00a109d61d52a65caa4cef43

            SHA512

            c8f1d53629d14ddbe84b6878104a773e7a1bd8da47ab2b3d5ac04955916978bd79db0a9c3a94652889580344cf21416d7791b2982afeb7da5839ce33c7cc76a0

            Download Submit
          • C:\Attachment\document.pdf
            Filesize

            10KB

            MD5

            8a7cadbe3c40344007c5334b41f0e8cf

            SHA1

            fbc916f065157cc5a13f22453c19f7dfecc3c228

            SHA256

            3902e1734b1d0187d3404dafa4616212342630cb46913242060f485e58201a75

            SHA512

            8c5e0d7a938ac13537041335d5ea185e83e025b6da138c0c3c49794825e873a52c048b08579711a888bae6e9fedc03996dbb5a2696844bb5335b8f96017dcbdb

            Download Submit
          • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat
            Filesize

            213KB

            MD5

            8eb849082e565b535238d47b1f5d6b41

            SHA1

            88be2de349e5ff0a9db05051abf84a5952cabeba

            SHA256

            08a45cc1e94cc381c9895f7e2fa5df1fe7e9a2db0ea849205107fe69aa2b8ef9

            SHA512

            e9781778332a0522bbffd502c6cc451bd840e9a5ab45c123b1afc16a554ae9c9cb7ce1e39c7425ee31971ba214b134720d5c87de565f4b5c30238aeb25f89895

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store
            Filesize

            10KB

            MD5

            4aea452713333cd65981888f0dc7be4e

            SHA1

            d49c69aa4b5ba939b502f4e60d38b450d3de8e6f

            SHA256

            e7f7c446e12cf95c6b49172f46dfdaa4fd99f76b09110b26f18ab810a8fefeff

            SHA512

            eadfc5ba926ef93874dc2006a0600f7e712fb09769a8122bcd5e0b8c6c9669d7e1d376dcf96779a2ad5c752b875b735e92f2bd45a3abe840bc522b26bec295dc

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei
            Filesize

            23KB

            MD5

            31bced9502ed4be2d1b213844d87e83e

            SHA1

            efe383d157dce8d9769258f38b2e94605997c7e4

            SHA256

            3b9c2d4459c877744381b4d43bf519cbbc476ba3030e2774b65efe3dff792797

            SHA512

            2c403bc2e392840091b0bcef2336213102e0b36ce2e4771e7f94d7f40d918975933957a22e4c440687f7a8a461f77dd06f94b768e6d099589805db8bc51fa0dc

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\80576f709de8a7c8.customDestinations-ms
            Filesize

            4KB

            MD5

            18959bbcf51401449a173beedce8aaf0

            SHA1

            0f858c4b18f57f520203c707342c2a3e5a6004c5

            SHA256

            24190665f80269e5bd8ea5d05a19016c86a01d27ff95c5ede494d3db8077797c

            SHA512

            ccde75da49748b09bfffbd521eed65f6192c03d756ff9376da93d556f062f0b3d2a7506bf8cd791b5e534e0baca80e3d1d868c2514d1cd7e76fa161d50aaea4f

            Download Submit
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\295.lnk
            Filesize

            2KB

            MD5

            9f1300da55efd9e9335801622ffa7b8d

            SHA1

            73a31ed10ff6922f29c15b208f5a413b347dea64

            SHA256

            c6b4ae83818e82ee213a8f7ffbaa0c2484eaf9cee46fa134c72f89810c40b6c9

            SHA512

            19f42883338c45135261a3695d2671c268f384b715e2122e7d99416b4592bb613de6745e56d1707bd097cbe4dcde682cc024c60dd3c9f45f00dc402c98f2cf68

            Download Submit
          • memory/164-595-0x0000000000000000-mapping.dmp
            Download
          • memory/1284-745-0x0000000000000000-mapping.dmp
            Download
          • memory/1932-217-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-224-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-188-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-189-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-191-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-190-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-192-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-193-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-194-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-195-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-196-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-198-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-197-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-200-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-199-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-201-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-203-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-202-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-204-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-205-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-207-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-208-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-209-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-210-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-211-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-206-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-212-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-213-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-214-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-215-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-216-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-186-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-219-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-220-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-222-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-223-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-221-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-187-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-226-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-230-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-232-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-233-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-235-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-236-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-234-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-237-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-238-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-239-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-241-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-247-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-250-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-180-0x0000000000000000-mapping.dmp
            Download
          • memory/1932-181-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-182-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-184-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-183-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-252-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-185-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/1932-245-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/3060-129-0x000002985B430000-0x000002985B4A6000-memory.dmp
            Filesize

            472KB

            Download
          • memory/3060-835-0x000002985B8E0000-0x000002985B920000-memory.dmp
            Filesize

            256KB

            Download
          • memory/3060-832-0x000002985B8E0000-0x000002985B920000-memory.dmp
            Filesize

            256KB

            Download
          • memory/3060-123-0x0000029859200000-0x0000029859222000-memory.dmp
            Filesize

            136KB

            Download
          • memory/3404-442-0x0000000000000000-mapping.dmp
            Download
          • memory/4008-377-0x0000000000000000-mapping.dmp
            Download
          • memory/4520-249-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/4520-244-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/4520-242-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/4520-248-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/4520-246-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/4520-251-0x0000000077A40000-0x0000000077BCE000-memory.dmp
            Filesize

            1.6MB

            Download
          • memory/4696-603-0x0000000000000000-mapping.dmp
            Download
          • memory/5048-834-0x0000024E7B9A0000-0x0000024E7B9E0000-memory.dmp
            Filesize

            256KB

            Download
          • memory/5048-836-0x0000024E7B9A0000-0x0000024E7B9E0000-memory.dmp
            Filesize

            256KB

            Download