Analysis
-
max time kernel
2698s -
max time network
2690s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 11:03
Static task
static1
Behavioral task
behavioral1
Sample
beren.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
beren.exe
Resource
win7-20240215-en
Behavioral task
behavioral3
Sample
beren.exe
Resource
win10v2004-20240508-en
General
-
Target
beren.exe
-
Size
5.0MB
-
MD5
b1ac2ea973651a70ea72597e13a10f0a
-
SHA1
07e7cdedc54067a46b1d42cdf8a2c9050c3d3419
-
SHA256
e2cb500c902da55ac07cbfbe30b8d1cef8781e55f0439ed601672636c3ab8c47
-
SHA512
02b0dbc8a31ca440027a6c07d618a92bb520567ccd338c28dfcb86faa5b56c866564cf1a05b1754dcfeb252d12d76da57fd2de87804454f0ef1097431764c1f0
-
SSDEEP
98304:9l68nO7ed9W+WzUU3a7G9kzPupfguX8WpWY/FwWCghYjuFRx20iZGZ1:9UdedpWzUmuPeghvY9wvonVsE
Malware Config
Signatures
-
XMRig Miner payload 12 IoCs
Processes:
resource yara_rule behavioral3/memory/896-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/896-63-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/896-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/896-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/896-70-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/896-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/896-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/896-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/896-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/896-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/896-75-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral3/memory/896-74-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2028 powershell.exe 720 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
lhhsgwktkatl.exepid process 2368 lhhsgwktkatl.exe -
Processes:
resource yara_rule behavioral3/memory/896-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/896-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/896-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/896-63-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/896-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/896-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/896-70-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/896-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/896-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/896-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/896-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/896-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/896-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/896-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/896-73-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/896-75-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral3/memory/896-74-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
Processes:
powershell.exelhhsgwktkatl.exeberen.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe lhhsgwktkatl.exe File opened for modification C:\Windows\system32\MRT.exe beren.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
lhhsgwktkatl.exedescription pid process target process PID 2368 set thread context of 4604 2368 lhhsgwktkatl.exe conhost.exe PID 2368 set thread context of 896 2368 lhhsgwktkatl.exe conhost.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 1160 sc.exe 2328 sc.exe 1552 sc.exe 1736 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
beren.exepowershell.exelhhsgwktkatl.exepowershell.execonhost.exepid process 1640 beren.exe 2028 powershell.exe 2028 powershell.exe 1640 beren.exe 1640 beren.exe 1640 beren.exe 1640 beren.exe 1640 beren.exe 1640 beren.exe 1640 beren.exe 1640 beren.exe 1640 beren.exe 2368 lhhsgwktkatl.exe 720 powershell.exe 720 powershell.exe 2368 lhhsgwktkatl.exe 2368 lhhsgwktkatl.exe 2368 lhhsgwktkatl.exe 2368 lhhsgwktkatl.exe 2368 lhhsgwktkatl.exe 2368 lhhsgwktkatl.exe 2368 lhhsgwktkatl.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe 896 conhost.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
powershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.execonhost.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 2028 powershell.exe Token: SeShutdownPrivilege 1800 powercfg.exe Token: SeCreatePagefilePrivilege 1800 powercfg.exe Token: SeShutdownPrivilege 1388 powercfg.exe Token: SeCreatePagefilePrivilege 1388 powercfg.exe Token: SeShutdownPrivilege 2172 powercfg.exe Token: SeCreatePagefilePrivilege 2172 powercfg.exe Token: SeShutdownPrivilege 4520 powercfg.exe Token: SeCreatePagefilePrivilege 4520 powercfg.exe Token: SeDebugPrivilege 720 powershell.exe Token: SeShutdownPrivilege 3496 powercfg.exe Token: SeCreatePagefilePrivilege 3496 powercfg.exe Token: SeShutdownPrivilege 5092 powercfg.exe Token: SeCreatePagefilePrivilege 5092 powercfg.exe Token: SeLockMemoryPrivilege 896 conhost.exe Token: SeShutdownPrivilege 1248 powercfg.exe Token: SeCreatePagefilePrivilege 1248 powercfg.exe Token: SeShutdownPrivilege 4956 powercfg.exe Token: SeCreatePagefilePrivilege 4956 powercfg.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
cmd.exelhhsgwktkatl.execmd.exedescription pid process target process PID 5044 wrote to memory of 4588 5044 cmd.exe wusa.exe PID 5044 wrote to memory of 4588 5044 cmd.exe wusa.exe PID 2368 wrote to memory of 4604 2368 lhhsgwktkatl.exe conhost.exe PID 2368 wrote to memory of 4604 2368 lhhsgwktkatl.exe conhost.exe PID 2368 wrote to memory of 4604 2368 lhhsgwktkatl.exe conhost.exe PID 2368 wrote to memory of 4604 2368 lhhsgwktkatl.exe conhost.exe PID 2368 wrote to memory of 4604 2368 lhhsgwktkatl.exe conhost.exe PID 2368 wrote to memory of 4604 2368 lhhsgwktkatl.exe conhost.exe PID 2368 wrote to memory of 4604 2368 lhhsgwktkatl.exe conhost.exe PID 2368 wrote to memory of 4604 2368 lhhsgwktkatl.exe conhost.exe PID 2368 wrote to memory of 4604 2368 lhhsgwktkatl.exe conhost.exe PID 2368 wrote to memory of 896 2368 lhhsgwktkatl.exe conhost.exe PID 2368 wrote to memory of 896 2368 lhhsgwktkatl.exe conhost.exe PID 2368 wrote to memory of 896 2368 lhhsgwktkatl.exe conhost.exe PID 2368 wrote to memory of 896 2368 lhhsgwktkatl.exe conhost.exe PID 2368 wrote to memory of 896 2368 lhhsgwktkatl.exe conhost.exe PID 4948 wrote to memory of 4432 4948 cmd.exe wusa.exe PID 4948 wrote to memory of 4432 4948 cmd.exe wusa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\beren.exe"C:\Users\Admin\AppData\Local\Temp\beren.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "QHRAJGDI"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "QHRAJGDI" binpath= "C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe" start= "auto"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "QHRAJGDI"2⤵
- Launches sc.exe
-
C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exeC:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\system32\conhost.execonhost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exeFilesize
5.0MB
MD5b1ac2ea973651a70ea72597e13a10f0a
SHA107e7cdedc54067a46b1d42cdf8a2c9050c3d3419
SHA256e2cb500c902da55ac07cbfbe30b8d1cef8781e55f0439ed601672636c3ab8c47
SHA51202b0dbc8a31ca440027a6c07d618a92bb520567ccd338c28dfcb86faa5b56c866564cf1a05b1754dcfeb252d12d76da57fd2de87804454f0ef1097431764c1f0
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4snpqths.34f.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/720-48-0x0000026643E60000-0x000002664407C000-memory.dmpFilesize
2.1MB
-
memory/720-43-0x0000026644770000-0x0000026644778000-memory.dmpFilesize
32KB
-
memory/720-45-0x00000266447B0000-0x00000266447BA000-memory.dmpFilesize
40KB
-
memory/720-44-0x00000266447A0000-0x00000266447A6000-memory.dmpFilesize
24KB
-
memory/720-49-0x0000026644180000-0x00000266442CE000-memory.dmpFilesize
1.3MB
-
memory/720-37-0x0000026644540000-0x000002664455C000-memory.dmpFilesize
112KB
-
memory/720-38-0x0000026644560000-0x0000026644615000-memory.dmpFilesize
724KB
-
memory/720-39-0x00000266442F0000-0x00000266442FA000-memory.dmpFilesize
40KB
-
memory/720-40-0x0000026644780000-0x000002664479C000-memory.dmpFilesize
112KB
-
memory/720-41-0x0000026644760000-0x000002664476A000-memory.dmpFilesize
40KB
-
memory/720-42-0x00000266447C0000-0x00000266447DA000-memory.dmpFilesize
104KB
-
memory/896-69-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/896-58-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/896-74-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/896-75-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/896-73-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/896-72-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/896-71-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/896-61-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/896-62-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/896-66-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/896-67-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/896-59-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/896-65-0x00000213E7D10000-0x00000213E7D30000-memory.dmpFilesize
128KB
-
memory/896-60-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/896-64-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/896-63-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/896-68-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/896-70-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2028-0-0x00007FFFB7023000-0x00007FFFB7025000-memory.dmpFilesize
8KB
-
memory/2028-15-0x00007FFFB7020000-0x00007FFFB7AE1000-memory.dmpFilesize
10.8MB
-
memory/2028-10-0x0000019249F00000-0x0000019249F22000-memory.dmpFilesize
136KB
-
memory/2028-11-0x00007FFFB7020000-0x00007FFFB7AE1000-memory.dmpFilesize
10.8MB
-
memory/2028-12-0x00007FFFB7020000-0x00007FFFB7AE1000-memory.dmpFilesize
10.8MB
-
memory/4604-57-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4604-50-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4604-51-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4604-52-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4604-53-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4604-54-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB