Analysis
-
max time kernel
87s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
19-04-2024 08:55
General
-
Target
Vitaminerne/Taksonomiske24/Trephining/Piloters/Recepternes.ps1
-
Size
57KB
-
MD5
24e44ec408c4fb8b429adb0ee5869985
-
SHA1
1913f35995281fec0c9f586fd73d6a2f4e64a5ca
-
SHA256
cf1db414b602f31a34655222809a3542f96a8ffcf0e43dfdbc341192f8298f71
-
SHA512
76b152a80b4f9537c1cd3fb6209021040946c0e7c75fe907f9b95e9f4446b2f12ef54be9721de7b13929df0e1d555db38f470d43f9142b4c1b87e74768819425
-
SSDEEP
1536:sHoiMTmNr5n2YDREJfm7g0ctkXRR7f8zYXJ4l:QoxOHifKciRdf8zYK
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 7 IoCs
-
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 6 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Vitaminerne\Taksonomiske24\Trephining\Piloters\Recepternes.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"2⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
471B
MD5d167bef885776a71caa9137918853a44
SHA1938e9840d92645b708450c23ea59d988b79c0f14
SHA256a97ae8fa2227175303e2f3ea42160aced0e5d03108b249f2607aa89d25d78c40
SHA512b79448a89d8f1b8afd68c5d16ac20348d4eee9f49aff3384b2419766f49183b7213e82a57da91230b1b780038fc7d3d6d507913c45e206c53e01745e4fe3ad57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
412B
MD51bc9f99fa476c4d84ba89d0012806f99
SHA1cad241246b16cc2dedc7c8b794e84dd661b2fbd7
SHA256138e5177b661d80eead79c42174d10ffb868a8386aad5d65c6cd9ac5069a2a0f
SHA512a167f453d9657e487b34ce0d890239fd51b334026a09b878379a34769d34594684848831c1478726614bf6ed6dbf47e25561e39fa42349ac0c08dbfa5532db73
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HXTVQGKM\microsoft.windows[1].xmlFilesize
96B
MD55d26d9282453709bb4b92b0583342fd8
SHA18234c2a047cb4d78cb8b47067fd1b11888df1497
SHA2565ebc9ae28489a17a5ed56d73764ffe5c2b085c30736ac46e30f7a256e78b2d1d
SHA512c44746b66392f0773090ee792e56b72bd1374fdaeb046cf0e7b3f05cd10ac2982ed16f66257d0f57366ad72fb66a5efb3c283965e958a9b33d9222f1dd28ef70
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ndpi34j.0uf.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/216-142-0x00000287502C0000-0x00000287502E0000-memory.dmpFilesize
128KB
-
memory/216-144-0x0000028750280000-0x00000287502A0000-memory.dmpFilesize
128KB
-
memory/216-146-0x0000028750690000-0x00000287506B0000-memory.dmpFilesize
128KB
-
memory/532-132-0x0000000002AD0000-0x0000000002AD1000-memory.dmpFilesize
4KB
-
memory/764-81-0x00000228AF670000-0x00000228AF690000-memory.dmpFilesize
128KB
-
memory/764-79-0x00000228AF6B0000-0x00000228AF6D0000-memory.dmpFilesize
128KB
-
memory/764-83-0x00000228AFC80000-0x00000228AFCA0000-memory.dmpFilesize
128KB
-
memory/988-318-0x00000000040B0000-0x00000000040B1000-memory.dmpFilesize
4KB
-
memory/1004-134-0x00000000047E0000-0x00000000047E1000-memory.dmpFilesize
4KB
-
memory/1184-251-0x0000000002620000-0x0000000002621000-memory.dmpFilesize
4KB
-
memory/1196-34-0x00000217D05F0000-0x00000217D0610000-memory.dmpFilesize
128KB
-
memory/1196-37-0x00000217D0A00000-0x00000217D0A20000-memory.dmpFilesize
128KB
-
memory/1196-32-0x00000217D0630000-0x00000217D0650000-memory.dmpFilesize
128KB
-
memory/1760-295-0x00000000042A0000-0x00000000042A1000-memory.dmpFilesize
4KB
-
memory/2024-349-0x0000024D407D0000-0x0000024D407F0000-memory.dmpFilesize
128KB
-
memory/2024-351-0x0000024D40790000-0x0000024D407B0000-memory.dmpFilesize
128KB
-
memory/2024-353-0x0000024D40BA0000-0x0000024D40BC0000-memory.dmpFilesize
128KB
-
memory/2160-71-0x00000000047D0000-0x00000000047D1000-memory.dmpFilesize
4KB
-
memory/2196-302-0x0000021CEE600000-0x0000021CEE620000-memory.dmpFilesize
128KB
-
memory/2196-304-0x0000021CEE3B0000-0x0000021CEE3D0000-memory.dmpFilesize
128KB
-
memory/2196-307-0x0000021CEE9C0000-0x0000021CEE9E0000-memory.dmpFilesize
128KB
-
memory/2448-58-0x0000029367D20000-0x0000029367D40000-memory.dmpFilesize
128KB
-
memory/2448-61-0x0000029368120000-0x0000029368140000-memory.dmpFilesize
128KB
-
memory/2448-56-0x0000029367D60000-0x0000029367D80000-memory.dmpFilesize
128KB
-
memory/2580-264-0x000002032C320000-0x000002032C340000-memory.dmpFilesize
128KB
-
memory/2580-260-0x000002032BF20000-0x000002032BF40000-memory.dmpFilesize
128KB
-
memory/2580-258-0x000002032BF60000-0x000002032BF80000-memory.dmpFilesize
128KB
-
memory/2888-48-0x0000000004990000-0x0000000004991000-memory.dmpFilesize
4KB
-
memory/3248-274-0x0000000002E60000-0x0000000002E61000-memory.dmpFilesize
4KB
-
memory/3584-104-0x0000014583A80000-0x0000014583AA0000-memory.dmpFilesize
128KB
-
memory/3584-102-0x0000014583AC0000-0x0000014583AE0000-memory.dmpFilesize
128KB
-
memory/3584-106-0x00000145840A0000-0x00000145840C0000-memory.dmpFilesize
128KB
-
memory/3684-189-0x000001C466C20000-0x000001C466C40000-memory.dmpFilesize
128KB
-
memory/3684-191-0x000001C4669D0000-0x000001C4669F0000-memory.dmpFilesize
128KB
-
memory/3684-193-0x000001C466FE0000-0x000001C467000000-memory.dmpFilesize
128KB
-
memory/3928-235-0x000001EDCD210000-0x000001EDCD230000-memory.dmpFilesize
128KB
-
memory/3928-237-0x000001EDCD1D0000-0x000001EDCD1F0000-memory.dmpFilesize
128KB
-
memory/3928-240-0x000001EDCD5E0000-0x000001EDCD600000-memory.dmpFilesize
128KB
-
memory/4196-212-0x000001ED5F020000-0x000001ED5F040000-memory.dmpFilesize
128KB
-
memory/4196-216-0x000001ED5F3E0000-0x000001ED5F400000-memory.dmpFilesize
128KB
-
memory/4196-214-0x000001ED5EDD0000-0x000001ED5EDF0000-memory.dmpFilesize
128KB
-
memory/4236-326-0x0000021C51520000-0x0000021C51540000-memory.dmpFilesize
128KB
-
memory/4236-328-0x0000021C511D0000-0x0000021C511F0000-memory.dmpFilesize
128KB
-
memory/4236-330-0x0000021C518E0000-0x0000021C51900000-memory.dmpFilesize
128KB
-
memory/4280-204-0x00000000044E0000-0x00000000044E1000-memory.dmpFilesize
4KB
-
memory/4352-166-0x00000305CEF70000-0x00000305CEF90000-memory.dmpFilesize
128KB
-
memory/4352-168-0x00000305CEF30000-0x00000305CEF50000-memory.dmpFilesize
128KB
-
memory/4352-171-0x00000305CF340000-0x00000305CF360000-memory.dmpFilesize
128KB
-
memory/4468-181-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/4488-94-0x00000000045F0000-0x00000000045F1000-memory.dmpFilesize
4KB
-
memory/4524-158-0x0000000002810000-0x0000000002811000-memory.dmpFilesize
4KB
-
memory/4764-121-0x0000018D564B0000-0x0000018D564D0000-memory.dmpFilesize
128KB
-
memory/4764-123-0x0000018D56470000-0x0000018D56490000-memory.dmpFilesize
128KB
-
memory/4764-125-0x0000018D56A80000-0x0000018D56AA0000-memory.dmpFilesize
128KB
-
memory/4864-341-0x0000000004920000-0x0000000004921000-memory.dmpFilesize
4KB
-
memory/4944-227-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4944-20-0x00007FFD33C50000-0x00007FFD34711000-memory.dmpFilesize
10.8MB
-
memory/4944-19-0x00000211F2FD0000-0x00000211F2FE0000-memory.dmpFilesize
64KB
-
memory/4944-13-0x00000211F2FD0000-0x00000211F2FE0000-memory.dmpFilesize
64KB
-
memory/4944-5-0x00000211F2F10000-0x00000211F2F32000-memory.dmpFilesize
136KB
-
memory/4944-12-0x00000211F2FD0000-0x00000211F2FE0000-memory.dmpFilesize
64KB
-
memory/4944-11-0x00000211F2FD0000-0x00000211F2FE0000-memory.dmpFilesize
64KB
-
memory/4944-10-0x00007FFD33C50000-0x00007FFD34711000-memory.dmpFilesize
10.8MB
-
memory/4984-289-0x000002039DCC0000-0x000002039DCE0000-memory.dmpFilesize
128KB
-
memory/4984-284-0x000002039D6B0000-0x000002039D6D0000-memory.dmpFilesize
128KB
-
memory/4984-282-0x000002039D6F0000-0x000002039D710000-memory.dmpFilesize
128KB
-
memory/4988-26-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB