Analysis
-
max time kernel
40s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
24-04-2024 01:20
General
-
Target
Michelines.ps1
-
Size
56KB
-
MD5
82340892cba1f6e4faaa080bb634cf9c
-
SHA1
56b029cbcada747897e9beff7c8f1013b8c9b6ce
-
SHA256
a03bb54517df231824d324ad20b79094efef9af20eff855e30a6f459bcc43912
-
SHA512
dfea5297d9aef9004af38f8604e74313f99d477199e797dbeec5367ec3e6c0000a4c62eeab54425deee14de5b1adb224f09956a10619cf03b821b2b91b84f5c7
-
SSDEEP
1536:aY1v3JTUB3Z1un5G97KwaJx8NIodV4kIj+1S78:auBUEnY7za0NIMa+k8
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 30 IoCs
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of FindShellTrayWindow 41 IoCs
-
Suspicious use of SendNotifyMessage 30 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Michelines.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"2⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3752 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
471B
MD503e296746458db5be4025467ef9e333c
SHA14046effe3766b0ccca8ce56860d709c6c80a1427
SHA2562c513c9b10c5b23fdd371e4a32ed4a3aaec636d10e8d078e634b894b4a4d8a83
SHA5128b0420a88ff0dea72b4d7b7500b584dd8df938f8d03eeb3c188702fc0113891f785d77e7f4c6e77408d8fb0d106a525fda9cd03a8cd9f9493805ae4a92f5e146
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53Filesize
412B
MD52f0905fc98b45db6ff5ad9402890df43
SHA1ba60f7cc7b2ce1d5d42e75d8f96b3e22fd842298
SHA2568e05e3340675ff15c5b04c6b1b7b94b6969f924a7d8286cd2e82dd42309e7864
SHA512b71f003b0c279f70aa28f6d01cc11d87e13d962f3b439df4bee56133cc0f9a28a025ea925cd1ff9828ac8d28c342ad0f7789d028bdb2f665366bd6cbd00f3392
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbresFilesize
2KB
MD50441fb446b05c5b538408917a6e7e7a6
SHA1104703c3346501b758b4234bc0b849df350b90d2
SHA2560a6eafca63499bfdf6ceedf1c342fc514bf69bd579e06e4a1c1445831cf53f13
SHA512afaef80a1a7003534b9aa6455acbc72ca20264696c982782fe071246d34a27bcdbf6d6e10a7fc00eac759f7076bbd83e28ad875d504b76e46e16ea30241b40a6
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133583952416885466.txtFilesize
74KB
MD580dffedad36ef4c303579f8c9be9dbd7
SHA1792ca2a83d616ca82d973ece361ed9e95c95a0d8
SHA256590ca4d2f62a7864a62ccb1075c55191f7f9d5c5304ea3446961bb50f9e3916e
SHA512826b97a4de7c765f8f5ebc520960f68381fd9f4bfe68c2fbe46c6118110c9c14a87dcb8ed8102e60a954b4b3c408f72e7a93fd96317be3d51120a2ddd2faa3ea
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5MIHM5LV\microsoft.windows[1].xmlFilesize
96B
MD584209e171da10686915fe7efcd51552d
SHA16bf96e86a533a68eba4d703833de374e18ce6113
SHA25604d6050009ea3c99cc718ad1c07c5d15268b459fcfb63fcb990bc9761738907b
SHA51248d2524000911cfb68ef866dedac78ee430d79aa3f4b68399f645dc2066841e6962e11a3362cbcec46680357dcd3e58cfef9994450fed1d8af04df44f76b0dfd
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ce31t2ej.ks1.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/524-245-0x0000000004AA0000-0x0000000004AA1000-memory.dmpFilesize
4KB
-
memory/844-149-0x0000025141300000-0x0000025141320000-memory.dmpFilesize
128KB
-
memory/844-151-0x00000251412C0000-0x00000251412E0000-memory.dmpFilesize
128KB
-
memory/844-153-0x00000251418E0000-0x0000025141900000-memory.dmpFilesize
128KB
-
memory/1224-71-0x00000000046D0000-0x00000000046D1000-memory.dmpFilesize
4KB
-
memory/1432-119-0x0000000004D40000-0x0000000004D41000-memory.dmpFilesize
4KB
-
memory/1580-108-0x0000021536B30000-0x0000021536B50000-memory.dmpFilesize
128KB
-
memory/1580-103-0x0000021536760000-0x0000021536780000-memory.dmpFilesize
128KB
-
memory/1580-105-0x0000021536720000-0x0000021536740000-memory.dmpFilesize
128KB
-
memory/1604-213-0x000001643E5A0000-0x000001643E5C0000-memory.dmpFilesize
128KB
-
memory/1604-206-0x000001643DFC0000-0x000001643DFE0000-memory.dmpFilesize
128KB
-
memory/1604-209-0x000001643DF80000-0x000001643DFA0000-memory.dmpFilesize
128KB
-
memory/1840-221-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/1940-174-0x0000020E45780000-0x0000020E457A0000-memory.dmpFilesize
128KB
-
memory/1940-169-0x0000020E45290000-0x0000020E452B0000-memory.dmpFilesize
128KB
-
memory/1940-167-0x0000020E452D0000-0x0000020E452F0000-memory.dmpFilesize
128KB
-
memory/2016-199-0x0000000004160000-0x0000000004161000-memory.dmpFilesize
4KB
-
memory/2104-44-0x0000000004470000-0x0000000004471000-memory.dmpFilesize
4KB
-
memory/2224-253-0x0000016F06100000-0x0000016F06120000-memory.dmpFilesize
128KB
-
memory/2224-255-0x0000016F060C0000-0x0000016F060E0000-memory.dmpFilesize
128KB
-
memory/2224-259-0x0000016F06780000-0x0000016F067A0000-memory.dmpFilesize
128KB
-
memory/2324-229-0x000001A4F8DC0000-0x000001A4F8DE0000-memory.dmpFilesize
128KB
-
memory/2324-233-0x000001A4F8D80000-0x000001A4F8DA0000-memory.dmpFilesize
128KB
-
memory/2324-235-0x000001A4F9390000-0x000001A4F93B0000-memory.dmpFilesize
128KB
-
memory/2456-128-0x000002736B790000-0x000002736B7B0000-memory.dmpFilesize
128KB
-
memory/2456-130-0x000002736BBA0000-0x000002736BBC0000-memory.dmpFilesize
128KB
-
memory/2456-126-0x000002736B7D0000-0x000002736B7F0000-memory.dmpFilesize
128KB
-
memory/2792-78-0x0000027F6AB90000-0x0000027F6ABB0000-memory.dmpFilesize
128KB
-
memory/2792-83-0x0000027F6AF60000-0x0000027F6AF80000-memory.dmpFilesize
128KB
-
memory/2792-80-0x0000027F6AB50000-0x0000027F6AB70000-memory.dmpFilesize
128KB
-
memory/2868-96-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/2964-10-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmpFilesize
10.8MB
-
memory/2964-13-0x000001B3BD0D0000-0x000001B3BD0E0000-memory.dmpFilesize
64KB
-
memory/2964-5-0x000001B3BD1A0000-0x000001B3BD1C2000-memory.dmpFilesize
136KB
-
memory/2964-11-0x000001B3BD0D0000-0x000001B3BD0E0000-memory.dmpFilesize
64KB
-
memory/2964-12-0x000001B3BD0D0000-0x000001B3BD0E0000-memory.dmpFilesize
64KB
-
memory/2964-15-0x000001B3BD0D0000-0x000001B3BD0E0000-memory.dmpFilesize
64KB
-
memory/2964-20-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmpFilesize
10.8MB
-
memory/2964-28-0x00007FFEAC100000-0x00007FFEACBC1000-memory.dmpFilesize
10.8MB
-
memory/2964-25-0x000001B3BD0D0000-0x000001B3BD0E0000-memory.dmpFilesize
64KB
-
memory/2964-26-0x000001B3BD0D0000-0x000001B3BD0E0000-memory.dmpFilesize
64KB
-
memory/4108-189-0x000002382F350000-0x000002382F370000-memory.dmpFilesize
128KB
-
memory/4108-186-0x000002382EF40000-0x000002382EF60000-memory.dmpFilesize
128KB
-
memory/4108-183-0x000002382EF80000-0x000002382EFA0000-memory.dmpFilesize
128KB
-
memory/4312-141-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/4624-266-0x00000000048A0000-0x00000000048A1000-memory.dmpFilesize
4KB
-
memory/4764-290-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/4812-303-0x0000023909460000-0x0000023909480000-memory.dmpFilesize
128KB
-
memory/4812-299-0x0000023909050000-0x0000023909070000-memory.dmpFilesize
128KB
-
memory/4812-297-0x0000023909090000-0x00000239090B0000-memory.dmpFilesize
128KB
-
memory/4824-276-0x000001E6BB440000-0x000001E6BB460000-memory.dmpFilesize
128KB
-
memory/4824-278-0x000001E6BB850000-0x000001E6BB870000-memory.dmpFilesize
128KB
-
memory/4824-274-0x000001E6BB480000-0x000001E6BB4A0000-memory.dmpFilesize
128KB
-
memory/4948-51-0x00000263D8C40000-0x00000263D8C60000-memory.dmpFilesize
128KB
-
memory/4948-55-0x00000263D9240000-0x00000263D9260000-memory.dmpFilesize
128KB
-
memory/4948-53-0x00000263D8C00000-0x00000263D8C20000-memory.dmpFilesize
128KB