Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-03-2024 11:52
Static task
static1
Behavioral task
behavioral1
Sample
b4a26290880d3fb80df39f433ebb0490.exe
Resource
win7-20240221-en
General
-
Target
b4a26290880d3fb80df39f433ebb0490.exe
-
Size
2.6MB
-
MD5
b4a26290880d3fb80df39f433ebb0490
-
SHA1
68e61782384bac82a8b2fbbac8958a1a5dd3fe5d
-
SHA256
49568dbced141895672057dc8244ce926ba027f7d04915a3a8504584f56b2c87
-
SHA512
96438799bcf1a79f992ddd11ecedb7101a0c816b1eff1db78f2c1b48239a110a08860a1ff0f36aad883332cbb3ff690a842478dd4dffb5a94f35082404ba2182
-
SSDEEP
49152:YCqoHMDzSvPB+6y3im0rc56ErvHHxjLH1yzJo9pPHq8jhWEgTi:YLosavPB9Frc56EjHxjLH1GipPN8Er
Malware Config
Extracted
bitrat
1.35
storage.nsupdate.info:8973
-
communication_password
bf771c9d082071fe80b18bb678220682
-
tor_process
tor
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral2/memory/3432-8-0x0000000005740000-0x0000000005752000-memory.dmp CustAttr -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
b4a26290880d3fb80df39f433ebb0490.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions b4a26290880d3fb80df39f433ebb0490.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
b4a26290880d3fb80df39f433ebb0490.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools b4a26290880d3fb80df39f433ebb0490.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
b4a26290880d3fb80df39f433ebb0490.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b4a26290880d3fb80df39f433ebb0490.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b4a26290880d3fb80df39f433ebb0490.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b4a26290880d3fb80df39f433ebb0490.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation b4a26290880d3fb80df39f433ebb0490.exe -
Processes:
resource yara_rule behavioral2/memory/4084-47-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-48-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-49-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-51-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-57-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-73-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-74-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-75-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-77-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-78-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-76-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-79-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-124-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-125-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-143-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-144-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-145-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-147-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-148-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-150-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-151-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-153-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-154-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-156-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral2/memory/4084-157-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
b4a26290880d3fb80df39f433ebb0490.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum b4a26290880d3fb80df39f433ebb0490.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 b4a26290880d3fb80df39f433ebb0490.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
MSBuild.exepid process 4084 MSBuild.exe 4084 MSBuild.exe 4084 MSBuild.exe 4084 MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b4a26290880d3fb80df39f433ebb0490.exedescription pid process target process PID 3432 set thread context of 4084 3432 b4a26290880d3fb80df39f433ebb0490.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
powershell.exepowershell.exeb4a26290880d3fb80df39f433ebb0490.exepowershell.exepid process 2656 powershell.exe 2656 powershell.exe 1604 powershell.exe 1604 powershell.exe 3432 b4a26290880d3fb80df39f433ebb0490.exe 3432 b4a26290880d3fb80df39f433ebb0490.exe 2656 powershell.exe 1604 powershell.exe 3432 b4a26290880d3fb80df39f433ebb0490.exe 3432 b4a26290880d3fb80df39f433ebb0490.exe 4528 powershell.exe 4528 powershell.exe 4528 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
powershell.exepowershell.exeb4a26290880d3fb80df39f433ebb0490.exepowershell.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 2656 powershell.exe Token: SeDebugPrivilege 1604 powershell.exe Token: SeDebugPrivilege 3432 b4a26290880d3fb80df39f433ebb0490.exe Token: SeDebugPrivilege 4528 powershell.exe Token: SeShutdownPrivilege 4084 MSBuild.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
MSBuild.exepid process 4084 MSBuild.exe 4084 MSBuild.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
b4a26290880d3fb80df39f433ebb0490.exedescription pid process target process PID 3432 wrote to memory of 2656 3432 b4a26290880d3fb80df39f433ebb0490.exe powershell.exe PID 3432 wrote to memory of 2656 3432 b4a26290880d3fb80df39f433ebb0490.exe powershell.exe PID 3432 wrote to memory of 2656 3432 b4a26290880d3fb80df39f433ebb0490.exe powershell.exe PID 3432 wrote to memory of 1604 3432 b4a26290880d3fb80df39f433ebb0490.exe powershell.exe PID 3432 wrote to memory of 1604 3432 b4a26290880d3fb80df39f433ebb0490.exe powershell.exe PID 3432 wrote to memory of 1604 3432 b4a26290880d3fb80df39f433ebb0490.exe powershell.exe PID 3432 wrote to memory of 856 3432 b4a26290880d3fb80df39f433ebb0490.exe schtasks.exe PID 3432 wrote to memory of 856 3432 b4a26290880d3fb80df39f433ebb0490.exe schtasks.exe PID 3432 wrote to memory of 856 3432 b4a26290880d3fb80df39f433ebb0490.exe schtasks.exe PID 3432 wrote to memory of 4528 3432 b4a26290880d3fb80df39f433ebb0490.exe powershell.exe PID 3432 wrote to memory of 4528 3432 b4a26290880d3fb80df39f433ebb0490.exe powershell.exe PID 3432 wrote to memory of 4528 3432 b4a26290880d3fb80df39f433ebb0490.exe powershell.exe PID 3432 wrote to memory of 3204 3432 b4a26290880d3fb80df39f433ebb0490.exe MSBuild.exe PID 3432 wrote to memory of 3204 3432 b4a26290880d3fb80df39f433ebb0490.exe MSBuild.exe PID 3432 wrote to memory of 3204 3432 b4a26290880d3fb80df39f433ebb0490.exe MSBuild.exe PID 3432 wrote to memory of 4084 3432 b4a26290880d3fb80df39f433ebb0490.exe MSBuild.exe PID 3432 wrote to memory of 4084 3432 b4a26290880d3fb80df39f433ebb0490.exe MSBuild.exe PID 3432 wrote to memory of 4084 3432 b4a26290880d3fb80df39f433ebb0490.exe MSBuild.exe PID 3432 wrote to memory of 4084 3432 b4a26290880d3fb80df39f433ebb0490.exe MSBuild.exe PID 3432 wrote to memory of 4084 3432 b4a26290880d3fb80df39f433ebb0490.exe MSBuild.exe PID 3432 wrote to memory of 4084 3432 b4a26290880d3fb80df39f433ebb0490.exe MSBuild.exe PID 3432 wrote to memory of 4084 3432 b4a26290880d3fb80df39f433ebb0490.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4a26290880d3fb80df39f433ebb0490.exe"C:\Users\Admin\AppData\Local\Temp\b4a26290880d3fb80df39f433ebb0490.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b4a26290880d3fb80df39f433ebb0490.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QhNsxxGtGmp.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QhNsxxGtGmp" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD4FE.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QhNsxxGtGmp.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD592ec09cc1d169a88bfccf8b115aa1ed6
SHA18f5d436ae6fd23c3d359be3d851864ad91d55f45
SHA2562310cbfe05b95767d4bcabf8cc68990a507191b7cd66f92db67c27b401c36c34
SHA512fd378e820ece518bf627780555f886387d9096af7ce72c914052ec1d5e2c249ac06d09e34b74955100e4e1eebf499a3ce7caefe2f5224146a859648eb5c6fd36
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5206245bb214f33b5f2eab06b4fd32cc3
SHA180ff87a86f700f3dc931b2327cf18c1c9e871541
SHA256682305e5bfac26405b065a2d4c1e2564198df1eb86f8a4fbd454edc7bbb56f34
SHA512bca4540e7882d53cb7bb10393cb35586ff63949f2b977aca1b59a79665a81cfa7a2a1ea096d20e93a67ac0fdf2c8f282b111171f630dcff034019b41f18bb455
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_is1gwi31.d1n.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpD4FE.tmpFilesize
1KB
MD51101e7fdaf9ab33b164151dd8d16409b
SHA1a420c9bc8b48c106886e257aefcd148cd28c9435
SHA2567ee5d02eef8c9f362a70ed334f7dd87707dd15b848217992a62520cb471d578d
SHA51227f5ec609bb54b5fcc020785cab9eba226951ac98ef9a320441486b74ce4a4c533e3f3b5f506794dec2212c96d06ee6b18145bce574a8653147283cf69fba7bb
-
memory/1604-128-0x0000000007000000-0x000000000700E000-memory.dmpFilesize
56KB
-
memory/1604-31-0x0000000004710000-0x0000000004720000-memory.dmpFilesize
64KB
-
memory/1604-141-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/1604-132-0x0000000004710000-0x0000000004720000-memory.dmpFilesize
64KB
-
memory/1604-129-0x0000000007010000-0x0000000007024000-memory.dmpFilesize
80KB
-
memory/1604-127-0x0000000004810000-0x0000000004821000-memory.dmpFilesize
68KB
-
memory/1604-113-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/1604-110-0x0000000006E40000-0x0000000006E4A000-memory.dmpFilesize
40KB
-
memory/1604-82-0x0000000006A80000-0x0000000006AB2000-memory.dmpFilesize
200KB
-
memory/1604-107-0x0000000006CC0000-0x0000000006D63000-memory.dmpFilesize
652KB
-
memory/1604-84-0x000000006FD10000-0x000000006FD5C000-memory.dmpFilesize
304KB
-
memory/1604-30-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/1604-72-0x0000000004710000-0x0000000004720000-memory.dmpFilesize
64KB
-
memory/1604-58-0x0000000005E00000-0x0000000005E4C000-memory.dmpFilesize
304KB
-
memory/2656-81-0x0000000004680000-0x0000000004690000-memory.dmpFilesize
64KB
-
memory/2656-17-0x0000000004680000-0x0000000004690000-memory.dmpFilesize
64KB
-
memory/2656-142-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/2656-83-0x0000000004680000-0x0000000004690000-memory.dmpFilesize
64KB
-
memory/2656-23-0x0000000004A80000-0x0000000004AA2000-memory.dmpFilesize
136KB
-
memory/2656-36-0x0000000005440000-0x0000000005794000-memory.dmpFilesize
3.3MB
-
memory/2656-131-0x00000000070C0000-0x00000000070C8000-memory.dmpFilesize
32KB
-
memory/2656-123-0x0000000007020000-0x00000000070B6000-memory.dmpFilesize
600KB
-
memory/2656-109-0x0000000006B90000-0x0000000006BAA000-memory.dmpFilesize
104KB
-
memory/2656-108-0x00000000074A0000-0x0000000007B1A000-memory.dmpFilesize
6.5MB
-
memory/2656-24-0x00000000052F0000-0x0000000005356000-memory.dmpFilesize
408KB
-
memory/2656-14-0x00000000044B0000-0x00000000044E6000-memory.dmpFilesize
216KB
-
memory/2656-15-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/2656-85-0x000000006FD10000-0x000000006FD5C000-memory.dmpFilesize
304KB
-
memory/2656-18-0x0000000004CC0000-0x00000000052E8000-memory.dmpFilesize
6.2MB
-
memory/2656-105-0x000000007F930000-0x000000007F940000-memory.dmpFilesize
64KB
-
memory/2656-97-0x0000000006050000-0x000000000606E000-memory.dmpFilesize
120KB
-
memory/2656-16-0x0000000004680000-0x0000000004690000-memory.dmpFilesize
64KB
-
memory/2656-55-0x0000000005A70000-0x0000000005A8E000-memory.dmpFilesize
120KB
-
memory/2656-70-0x0000000004680000-0x0000000004690000-memory.dmpFilesize
64KB
-
memory/2656-71-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/3432-13-0x0000000008960000-0x00000000089C6000-memory.dmpFilesize
408KB
-
memory/3432-12-0x0000000008770000-0x00000000088E8000-memory.dmpFilesize
1.5MB
-
memory/3432-7-0x00000000056C0000-0x0000000005716000-memory.dmpFilesize
344KB
-
memory/3432-5-0x0000000005750000-0x0000000005760000-memory.dmpFilesize
64KB
-
memory/3432-1-0x0000000000740000-0x00000000009DA000-memory.dmpFilesize
2.6MB
-
memory/3432-2-0x0000000005390000-0x000000000542C000-memory.dmpFilesize
624KB
-
memory/3432-3-0x00000000059E0000-0x0000000005F84000-memory.dmpFilesize
5.6MB
-
memory/3432-6-0x0000000005470000-0x000000000547A000-memory.dmpFilesize
40KB
-
memory/3432-8-0x0000000005740000-0x0000000005752000-memory.dmpFilesize
72KB
-
memory/3432-53-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/3432-4-0x00000000054D0000-0x0000000005562000-memory.dmpFilesize
584KB
-
memory/3432-9-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/3432-0-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/3432-10-0x0000000005750000-0x0000000005760000-memory.dmpFilesize
64KB
-
memory/3432-11-0x0000000007340000-0x0000000007500000-memory.dmpFilesize
1.8MB
-
memory/4084-80-0x0000000071360000-0x0000000071399000-memory.dmpFilesize
228KB
-
memory/4084-76-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-79-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-49-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-48-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-157-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-156-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-73-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-154-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-47-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-124-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-125-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-126-0x0000000071140000-0x0000000071179000-memory.dmpFilesize
228KB
-
memory/4084-57-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-153-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-151-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-150-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-148-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-69-0x00000000713C0000-0x00000000713F9000-memory.dmpFilesize
228KB
-
memory/4084-51-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-78-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-77-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-75-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-74-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-147-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-143-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-144-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-145-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4084-146-0x0000000075790000-0x00000000757C9000-memory.dmpFilesize
228KB
-
memory/4528-140-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB
-
memory/4528-86-0x0000000002FF0000-0x0000000003000000-memory.dmpFilesize
64KB
-
memory/4528-130-0x0000000007F60000-0x0000000007F7A000-memory.dmpFilesize
104KB
-
memory/4528-54-0x0000000002FF0000-0x0000000003000000-memory.dmpFilesize
64KB
-
memory/4528-56-0x0000000002FF0000-0x0000000003000000-memory.dmpFilesize
64KB
-
memory/4528-122-0x000000007F010000-0x000000007F020000-memory.dmpFilesize
64KB
-
memory/4528-111-0x000000006FD10000-0x000000006FD5C000-memory.dmpFilesize
304KB
-
memory/4528-52-0x0000000074ED0000-0x0000000075680000-memory.dmpFilesize
7.7MB