Analysis
-
max time kernel
2698s -
max time network
2690s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-05-2024 11:03
Static task
static1
Behavioral task
behavioral1
Sample
beren.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
beren.exe
Resource
win7-20240215-en
Behavioral task
behavioral3
Sample
beren.exe
Resource
win10v2004-20240508-en
General
-
Target
beren.exe
-
Size
5.0MB
-
MD5
b1ac2ea973651a70ea72597e13a10f0a
-
SHA1
07e7cdedc54067a46b1d42cdf8a2c9050c3d3419
-
SHA256
e2cb500c902da55ac07cbfbe30b8d1cef8781e55f0439ed601672636c3ab8c47
-
SHA512
02b0dbc8a31ca440027a6c07d618a92bb520567ccd338c28dfcb86faa5b56c866564cf1a05b1754dcfeb252d12d76da57fd2de87804454f0ef1097431764c1f0
-
SSDEEP
98304:9l68nO7ed9W+WzUU3a7G9kzPupfguX8WpWY/FwWCghYjuFRx20iZGZ1:9UdedpWzUmuPeghvY9wvonVsE
Malware Config
Signatures
-
XMRig Miner payload 18 IoCs
Processes:
resource yara_rule behavioral4/memory/2576-60-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/2576-61-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/2576-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/2576-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/2576-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/2576-63-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/2576-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/2576-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/2576-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/2576-70-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/2576-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/2576-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/2576-74-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/2576-76-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/2576-77-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/2576-78-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/2576-80-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/2576-79-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 4440 powershell.exe 1868 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
lhhsgwktkatl.exepid process 240 lhhsgwktkatl.exe -
Processes:
resource yara_rule behavioral4/memory/2576-55-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-63-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-56-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-70-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-74-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-76-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-77-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-78-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-80-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/2576-79-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
Processes:
beren.exepowershell.exelhhsgwktkatl.exedescription ioc process File opened for modification C:\Windows\system32\MRT.exe beren.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe lhhsgwktkatl.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
lhhsgwktkatl.exedescription pid process target process PID 240 set thread context of 4040 240 lhhsgwktkatl.exe conhost.exe PID 240 set thread context of 2576 240 lhhsgwktkatl.exe conhost.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 1708 sc.exe 4932 sc.exe 3068 sc.exe 4012 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
powershell.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
beren.exepowershell.exelhhsgwktkatl.exepowershell.execonhost.exepid process 2468 beren.exe 4440 powershell.exe 4440 powershell.exe 2468 beren.exe 2468 beren.exe 2468 beren.exe 2468 beren.exe 2468 beren.exe 2468 beren.exe 2468 beren.exe 2468 beren.exe 2468 beren.exe 240 lhhsgwktkatl.exe 1868 powershell.exe 1868 powershell.exe 240 lhhsgwktkatl.exe 240 lhhsgwktkatl.exe 240 lhhsgwktkatl.exe 240 lhhsgwktkatl.exe 240 lhhsgwktkatl.exe 240 lhhsgwktkatl.exe 240 lhhsgwktkatl.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe 2576 conhost.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
powershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.execonhost.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 4440 powershell.exe Token: SeShutdownPrivilege 4964 powercfg.exe Token: SeCreatePagefilePrivilege 4964 powercfg.exe Token: SeShutdownPrivilege 3644 powercfg.exe Token: SeCreatePagefilePrivilege 3644 powercfg.exe Token: SeShutdownPrivilege 1016 powercfg.exe Token: SeCreatePagefilePrivilege 1016 powercfg.exe Token: SeShutdownPrivilege 2868 powercfg.exe Token: SeCreatePagefilePrivilege 2868 powercfg.exe Token: SeDebugPrivilege 1868 powershell.exe Token: SeShutdownPrivilege 4980 powercfg.exe Token: SeCreatePagefilePrivilege 4980 powercfg.exe Token: SeLockMemoryPrivilege 2576 conhost.exe Token: SeShutdownPrivilege 1028 powercfg.exe Token: SeCreatePagefilePrivilege 1028 powercfg.exe Token: SeShutdownPrivilege 2224 powercfg.exe Token: SeCreatePagefilePrivilege 2224 powercfg.exe Token: SeShutdownPrivilege 800 powercfg.exe Token: SeCreatePagefilePrivilege 800 powercfg.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
cmd.exelhhsgwktkatl.execmd.exedescription pid process target process PID 3584 wrote to memory of 2212 3584 cmd.exe wusa.exe PID 3584 wrote to memory of 2212 3584 cmd.exe wusa.exe PID 240 wrote to memory of 4040 240 lhhsgwktkatl.exe conhost.exe PID 240 wrote to memory of 4040 240 lhhsgwktkatl.exe conhost.exe PID 240 wrote to memory of 4040 240 lhhsgwktkatl.exe conhost.exe PID 240 wrote to memory of 4040 240 lhhsgwktkatl.exe conhost.exe PID 240 wrote to memory of 4040 240 lhhsgwktkatl.exe conhost.exe PID 240 wrote to memory of 4040 240 lhhsgwktkatl.exe conhost.exe PID 240 wrote to memory of 4040 240 lhhsgwktkatl.exe conhost.exe PID 240 wrote to memory of 4040 240 lhhsgwktkatl.exe conhost.exe PID 240 wrote to memory of 4040 240 lhhsgwktkatl.exe conhost.exe PID 240 wrote to memory of 2576 240 lhhsgwktkatl.exe conhost.exe PID 240 wrote to memory of 2576 240 lhhsgwktkatl.exe conhost.exe PID 240 wrote to memory of 2576 240 lhhsgwktkatl.exe conhost.exe PID 240 wrote to memory of 2576 240 lhhsgwktkatl.exe conhost.exe PID 240 wrote to memory of 2576 240 lhhsgwktkatl.exe conhost.exe PID 4624 wrote to memory of 3012 4624 cmd.exe wusa.exe PID 4624 wrote to memory of 3012 4624 cmd.exe wusa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\beren.exe"C:\Users\Admin\AppData\Local\Temp\beren.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "QHRAJGDI"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "QHRAJGDI" binpath= "C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe" start= "auto"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "QHRAJGDI"2⤵
- Launches sc.exe
-
C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exeC:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\system32\conhost.execonhost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exeFilesize
5.0MB
MD5b1ac2ea973651a70ea72597e13a10f0a
SHA107e7cdedc54067a46b1d42cdf8a2c9050c3d3419
SHA256e2cb500c902da55ac07cbfbe30b8d1cef8781e55f0439ed601672636c3ab8c47
SHA51202b0dbc8a31ca440027a6c07d618a92bb520567ccd338c28dfcb86faa5b56c866564cf1a05b1754dcfeb252d12d76da57fd2de87804454f0ef1097431764c1f0
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h3ie5lft.gt5.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1868-38-0x000001986F990000-0x000001986F99A000-memory.dmpFilesize
40KB
-
memory/1868-44-0x000001986FF10000-0x000001986FF1A000-memory.dmpFilesize
40KB
-
memory/1868-43-0x000001986F9C0000-0x000001986F9C6000-memory.dmpFilesize
24KB
-
memory/1868-42-0x000001986F9B0000-0x000001986F9B8000-memory.dmpFilesize
32KB
-
memory/1868-41-0x000001986FAF0000-0x000001986FB0A000-memory.dmpFilesize
104KB
-
memory/1868-40-0x000001986F9A0000-0x000001986F9AA000-memory.dmpFilesize
40KB
-
memory/1868-39-0x000001986FAD0000-0x000001986FAEC000-memory.dmpFilesize
112KB
-
memory/1868-36-0x000001986F8B0000-0x000001986F8CC000-memory.dmpFilesize
112KB
-
memory/1868-37-0x000001986F8D0000-0x000001986F983000-memory.dmpFilesize
716KB
-
memory/2576-60-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-70-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-79-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-80-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-78-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-77-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-76-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-74-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-71-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-72-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-69-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-68-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-55-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-56-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-62-0x0000018450250000-0x0000018450270000-memory.dmpFilesize
128KB
-
memory/2576-61-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-66-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-67-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-65-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-63-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-64-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-59-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-58-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2576-57-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4040-50-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4040-54-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4040-47-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4040-48-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4040-49-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4040-51-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4440-16-0x00007FFEDA370000-0x00007FFEDAE32000-memory.dmpFilesize
10.8MB
-
memory/4440-0-0x00007FFEDA373000-0x00007FFEDA375000-memory.dmpFilesize
8KB
-
memory/4440-3-0x0000016A5AE10000-0x0000016A5AE32000-memory.dmpFilesize
136KB
-
memory/4440-10-0x00007FFEDA370000-0x00007FFEDAE32000-memory.dmpFilesize
10.8MB
-
memory/4440-11-0x00007FFEDA370000-0x00007FFEDAE32000-memory.dmpFilesize
10.8MB
-
memory/4440-12-0x00007FFEDA370000-0x00007FFEDAE32000-memory.dmpFilesize
10.8MB
-
memory/4440-13-0x00007FFEDA370000-0x00007FFEDAE32000-memory.dmpFilesize
10.8MB