Analysis
-
max time kernel
84s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
13-02-2023 08:58
Static task
static1
General
-
Target
dotNetLoader.exe
-
Size
137KB
-
MD5
4a500e5d391f84b7c4e93b767964c0d8
-
SHA1
a4f090fd514cc9e59c62b8956eb95dab6106d760
-
SHA256
3c37d7351c091a9c2fce72ecde4bcd1265f148dc3b77017d468e08741091bc50
-
SHA512
8dfc13eb5a573d900ed4722b53ff10095a2391c91c490878808461275f4e6acff8896b1ffabe37b593eaa1cbb3b1b3d86f91abcf8950a51874699a98a69ef283
-
SSDEEP
3072:sOkOF8tLK2I3ORbspUy3r5c61aW4zOEbwG/EiLQPsIZlglo7Y91:sOkOF8Ne3xSy3r5VoW32EP7klt9
Malware Config
Extracted
asyncrat
0.5.7B
Default
207.244.236.205:6606
207.244.236.205:7707
207.244.236.205:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2696-120-0x0000000001270000-0x0000000001282000-memory.dmp asyncrat -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 1 IoCs
Processes:
dotNetLoader.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings dotNetLoader.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
AcroRd32.exepid process 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
dotNetLoader.exedescription pid process Token: SeDebugPrivilege 2696 dotNetLoader.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 1828 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe 1828 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dotNetLoader.exeAcroRd32.exeRdrCEF.exedescription pid process target process PID 2696 wrote to memory of 1828 2696 dotNetLoader.exe AcroRd32.exe PID 2696 wrote to memory of 1828 2696 dotNetLoader.exe AcroRd32.exe PID 2696 wrote to memory of 1828 2696 dotNetLoader.exe AcroRd32.exe PID 1828 wrote to memory of 4672 1828 AcroRd32.exe RdrCEF.exe PID 1828 wrote to memory of 4672 1828 AcroRd32.exe RdrCEF.exe PID 1828 wrote to memory of 4672 1828 AcroRd32.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 428 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 1372 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 1372 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 1372 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 1372 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 1372 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 1372 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 1372 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 1372 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 1372 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 1372 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 1372 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 1372 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 1372 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 1372 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 1372 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 1372 4672 RdrCEF.exe RdrCEF.exe PID 4672 wrote to memory of 1372 4672 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dotNetLoader.exe"C:\Users\Admin\AppData\Local\Temp\dotNetLoader.exe"1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Ticket_Reprint.pdf"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=41DE8E883F9A2B465DF0E18FBFDC8EDA --mojo-platform-channel-handle=1644 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F5F402E878C8D233E011D62527A5BDB3 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F5F402E878C8D233E011D62527A5BDB3 --renderer-client-id=2 --mojo-platform-channel-handle=1656 --allow-no-sandbox-job /prefetch:14⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A3930BBB520A148727E138A163440340 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A3930BBB520A148727E138A163440340 --renderer-client-id=4 --mojo-platform-channel-handle=2068 --allow-no-sandbox-job /prefetch:14⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D153E342FB942188DA5057B29EFDD7E8 --mojo-platform-channel-handle=2488 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7741046AB7D7818B9BD9BD0B0E6A7803 --mojo-platform-channel-handle=1784 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4D9D0599048C84A05E07933236373A8E --mojo-platform-channel-handle=2476 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Ticket_Reprint.pdfFilesize
105KB
MD5a9ab9ec7dd9b66247260a41d173c5c80
SHA10b22f19448a6c5e7cc898ba338a5863a72d8fb72
SHA256101e408316eb7997bc4d2a383db92ab5a60da4742ebd7a7b8f15ca5d4d54bebe
SHA5128e85d5e376764e6c4761525ce8dd493b42cc31aa1f698cd2644c17a3aaf3e94978be2adf49335abf32fecee9e398ba724543715fbc38dc968f0291c76ffbd78c
-
memory/428-322-0x0000000000000000-mapping.dmp
-
memory/684-687-0x0000000000000000-mapping.dmp
-
memory/1188-363-0x0000000000000000-mapping.dmp
-
memory/1372-342-0x0000000000000000-mapping.dmp
-
memory/1828-154-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-128-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-125-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-126-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-127-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-158-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-129-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-130-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-131-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-132-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-159-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-134-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-135-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-136-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-137-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-138-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-139-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-140-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-141-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-142-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-143-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-144-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-145-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-146-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-147-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-148-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-149-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-150-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-151-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-157-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-153-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-123-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-155-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-156-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-152-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-124-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-133-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-160-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-161-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-162-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-163-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-164-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-165-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-166-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-167-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-168-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-169-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-170-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-171-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-172-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-173-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-174-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-175-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-176-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-177-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-178-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-179-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-180-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-181-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-182-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-183-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-184-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-185-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/1828-121-0x0000000000000000-mapping.dmp
-
memory/1828-122-0x0000000077840000-0x00000000779CE000-memory.dmpFilesize
1.6MB
-
memory/2696-120-0x0000000001270000-0x0000000001282000-memory.dmpFilesize
72KB
-
memory/2696-119-0x0000000000C20000-0x0000000000C48000-memory.dmpFilesize
160KB
-
memory/4160-812-0x0000000000000000-mapping.dmp
-
memory/4584-579-0x0000000000000000-mapping.dmp
-
memory/4672-206-0x0000000000000000-mapping.dmp