Analysis
-
max time kernel
294s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
05-12-2022 08:23
Static task
static1
Behavioral task
behavioral1
Sample
Attachment.iso
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
8969122ef3485d.ps1
Resource
win10-20220901-en
Behavioral task
behavioral3
Sample
8969122ef3485df.ps1
Resource
win10-20220812-en
Behavioral task
behavioral4
Sample
Attachment.lnk
Resource
win10-20220812-en
Behavioral task
behavioral5
Sample
document.pdf
Resource
win10-20220812-en
General
-
Target
8969122ef3485d.ps1
-
Size
23KB
-
MD5
914dd9891afe574b611e2e38a162ae1f
-
SHA1
ad4c9126bcf2e534cd355107c301d01832889610
-
SHA256
304d6a87f624d74df2bf37c458b2f06c525aad947886413befac892c1d89a394
-
SHA512
33a70a75e956bcdb70c22b27c2f3044d6c527e3a10446cb6654431ecfbe326d69631b8ad61bb8f8bc8399f6122bdc229dfc01a607cec38587d39dccc67dd902c
-
SSDEEP
384:k6dBkkPyac1Vzzgq2wjvulFcagjATRdMa5oE4BW2d4yvnR:/bXPY1VzzgOecag0DMaclDfR
Malware Config
Signatures
-
Blocklisted process makes network request 17 IoCs
Processes:
powershell.exeflow pid process 3 2172 powershell.exe 16 2172 powershell.exe 23 2172 powershell.exe 24 2172 powershell.exe 27 2172 powershell.exe 28 2172 powershell.exe 29 2172 powershell.exe 30 2172 powershell.exe 31 2172 powershell.exe 32 2172 powershell.exe 33 2172 powershell.exe 34 2172 powershell.exe 35 2172 powershell.exe 36 2172 powershell.exe 37 2172 powershell.exe 38 2172 powershell.exe 39 2172 powershell.exe -
Drops startup file 1 IoCs
Processes:
powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\295.lnk powershell.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 1 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
powershell.exeAcroRd32.exepid process 2172 powershell.exe 2172 powershell.exe 2172 powershell.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2172 powershell.exe Token: SeIncreaseQuotaPrivilege 2172 powershell.exe Token: SeSecurityPrivilege 2172 powershell.exe Token: SeTakeOwnershipPrivilege 2172 powershell.exe Token: SeLoadDriverPrivilege 2172 powershell.exe Token: SeSystemProfilePrivilege 2172 powershell.exe Token: SeSystemtimePrivilege 2172 powershell.exe Token: SeProfSingleProcessPrivilege 2172 powershell.exe Token: SeIncBasePriorityPrivilege 2172 powershell.exe Token: SeCreatePagefilePrivilege 2172 powershell.exe Token: SeBackupPrivilege 2172 powershell.exe Token: SeRestorePrivilege 2172 powershell.exe Token: SeShutdownPrivilege 2172 powershell.exe Token: SeDebugPrivilege 2172 powershell.exe Token: SeSystemEnvironmentPrivilege 2172 powershell.exe Token: SeRemoteShutdownPrivilege 2172 powershell.exe Token: SeUndockPrivilege 2172 powershell.exe Token: SeManageVolumePrivilege 2172 powershell.exe Token: 33 2172 powershell.exe Token: 34 2172 powershell.exe Token: 35 2172 powershell.exe Token: 36 2172 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 1360 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe 1360 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
powershell.exeAcroRd32.exeRdrCEF.exedescription pid process target process PID 2172 wrote to memory of 1360 2172 powershell.exe AcroRd32.exe PID 2172 wrote to memory of 1360 2172 powershell.exe AcroRd32.exe PID 2172 wrote to memory of 1360 2172 powershell.exe AcroRd32.exe PID 1360 wrote to memory of 5080 1360 AcroRd32.exe RdrCEF.exe PID 1360 wrote to memory of 5080 1360 AcroRd32.exe RdrCEF.exe PID 1360 wrote to memory of 5080 1360 AcroRd32.exe RdrCEF.exe PID 1360 wrote to memory of 2104 1360 AcroRd32.exe RdrCEF.exe PID 1360 wrote to memory of 2104 1360 AcroRd32.exe RdrCEF.exe PID 1360 wrote to memory of 2104 1360 AcroRd32.exe RdrCEF.exe PID 1360 wrote to memory of 884 1360 AcroRd32.exe RdrCEF.exe PID 1360 wrote to memory of 884 1360 AcroRd32.exe RdrCEF.exe PID 1360 wrote to memory of 884 1360 AcroRd32.exe RdrCEF.exe PID 1360 wrote to memory of 4532 1360 AcroRd32.exe RdrCEF.exe PID 1360 wrote to memory of 4532 1360 AcroRd32.exe RdrCEF.exe PID 1360 wrote to memory of 4532 1360 AcroRd32.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1364 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1592 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1592 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1592 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1592 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1592 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1592 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1592 884 RdrCEF.exe RdrCEF.exe PID 884 wrote to memory of 1592 884 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\8969122ef3485d.ps11⤵
- Blocklisted process makes network request
- Drops startup file
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\document.pdf"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=277C11D0089B58489AB0A171BE7B1AFC --mojo-platform-channel-handle=1624 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C9E038080C565EA139DF6438CF3509A5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C9E038080C565EA139DF6438CF3509A5 --renderer-client-id=2 --mojo-platform-channel-handle=1616 --allow-no-sandbox-job /prefetch:14⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8B177BC530055F67C0AD281AB8C3117A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8B177BC530055F67C0AD281AB8C3117A --renderer-client-id=4 --mojo-platform-channel-handle=2052 --allow-no-sandbox-job /prefetch:14⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/884-397-0x0000000000000000-mapping.dmp
-
memory/1360-215-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-226-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-179-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-180-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-181-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-182-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-183-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-184-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-185-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-186-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-187-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-188-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-189-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-190-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-191-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-213-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-193-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-194-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-196-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-197-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-198-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-199-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-195-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-200-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-202-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-201-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-203-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-204-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-205-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-206-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-207-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-208-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-209-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-210-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-211-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-212-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-192-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-177-0x0000000000000000-mapping.dmp
-
memory/1360-178-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-216-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-217-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-218-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-219-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-221-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-220-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-222-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-223-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-224-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-225-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-214-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-227-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-228-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-229-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-230-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-231-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-232-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-233-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-234-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-235-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-236-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-237-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-238-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-239-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-240-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1360-241-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/1364-511-0x0000000000000000-mapping.dmp
-
memory/1592-543-0x0000000000000000-mapping.dmp
-
memory/2104-327-0x0000000000000000-mapping.dmp
-
memory/2172-125-0x0000022EC64A0000-0x0000022EC64C2000-memory.dmpFilesize
136KB
-
memory/2172-130-0x0000022EC87A0000-0x0000022EC8816000-memory.dmpFilesize
472KB
-
memory/2172-495-0x0000022EC9160000-0x0000022EC91A0000-memory.dmpFilesize
256KB
-
memory/2172-815-0x0000022EC9160000-0x0000022EC91A0000-memory.dmpFilesize
256KB
-
memory/3548-572-0x0000000000000000-mapping.dmp
-
memory/4532-469-0x0000000000000000-mapping.dmp
-
memory/5080-261-0x0000000000000000-mapping.dmp