Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-06-2024 07:42
Static task
static1
Behavioral task
behavioral1
Sample
b4e86c38b2b424b473220586c583c7da8ecb98d192581ef0ba37774911cf8351.cmd
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
b4e86c38b2b424b473220586c583c7da8ecb98d192581ef0ba37774911cf8351.cmd
Resource
win10v2004-20240226-en
General
-
Target
b4e86c38b2b424b473220586c583c7da8ecb98d192581ef0ba37774911cf8351.cmd
-
Size
3.6MB
-
MD5
af9e835fc667bc0d5623fb958c85d10e
-
SHA1
38d325758725552205de9ab138cb0828c7b632bf
-
SHA256
b4e86c38b2b424b473220586c583c7da8ecb98d192581ef0ba37774911cf8351
-
SHA512
e690c98c0f265262049624576b55b3f792e8a59ba230594f24ac740924faa27a1ee8acb7e3eac511a0c181d0554b785113e31e410746ce7c948a119689cb323f
-
SSDEEP
49152:vgk00JywMTAermhoGyBDj1kwXui5zlrT2Da0QhEQ:A
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 63 IoCs
Processes:
resource yara_rule behavioral2/memory/2760-31-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-32-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-33-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-30-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-29-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-39-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-52-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-91-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-73-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-90-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-89-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-87-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-86-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-84-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-83-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-81-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-82-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-80-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-79-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-78-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-77-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-76-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-75-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-72-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-74-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-71-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-70-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-69-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-68-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-66-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-65-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-64-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-61-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-59-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-58-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-57-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-55-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-54-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-53-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-51-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-50-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-88-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-46-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-85-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-45-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-44-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-43-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-67-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-36-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-35-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-62-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-63-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-42-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-60-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-56-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-40-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-49-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-48-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-38-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-47-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-37-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-41-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 behavioral2/memory/2760-34-0x00000000029A0000-0x00000000039A0000-memory.dmp modiloader_stage2 -
Executes dropped EXE 8 IoCs
Processes:
alpha.exealpha.exekn.exealpha.exekn.exeAudio.pifalpha.exealpha.exepid process 1544 alpha.exe 4912 alpha.exe 2620 kn.exe 456 alpha.exe 1160 kn.exe 2760 Audio.pif 3236 alpha.exe 1804 alpha.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Audio.pifdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dkftajgk = "C:\\Users\\Public\\Dkftajgk.url" Audio.pif -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Audio.pifdescription pid process target process PID 2760 set thread context of 3156 2760 Audio.pif Explorer.EXE PID 2760 set thread context of 3256 2760 Audio.pif dxdiag.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 29 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
Audio.pifdxdiag.exepid process 2760 Audio.pif 2760 Audio.pif 2760 Audio.pif 2760 Audio.pif 2760 Audio.pif 2760 Audio.pif 2760 Audio.pif 2760 Audio.pif 2760 Audio.pif 2760 Audio.pif 2760 Audio.pif 2760 Audio.pif 2760 Audio.pif 2760 Audio.pif 2760 Audio.pif 2760 Audio.pif 3256 dxdiag.exe 3256 dxdiag.exe 3256 dxdiag.exe 3256 dxdiag.exe 3256 dxdiag.exe 3256 dxdiag.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
Audio.pifExplorer.EXEpid process 2760 Audio.pif 3156 Explorer.EXE 3156 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 3156 Explorer.EXE Token: SeCreatePagefilePrivilege 3156 Explorer.EXE -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
cmd.exealpha.exealpha.exealpha.exeAudio.pifExplorer.EXEdescription pid process target process PID 380 wrote to memory of 4580 380 cmd.exe extrac32.exe PID 380 wrote to memory of 4580 380 cmd.exe extrac32.exe PID 380 wrote to memory of 1544 380 cmd.exe alpha.exe PID 380 wrote to memory of 1544 380 cmd.exe alpha.exe PID 1544 wrote to memory of 688 1544 alpha.exe extrac32.exe PID 1544 wrote to memory of 688 1544 alpha.exe extrac32.exe PID 380 wrote to memory of 4912 380 cmd.exe alpha.exe PID 380 wrote to memory of 4912 380 cmd.exe alpha.exe PID 4912 wrote to memory of 2620 4912 alpha.exe kn.exe PID 4912 wrote to memory of 2620 4912 alpha.exe kn.exe PID 380 wrote to memory of 456 380 cmd.exe alpha.exe PID 380 wrote to memory of 456 380 cmd.exe alpha.exe PID 456 wrote to memory of 1160 456 alpha.exe kn.exe PID 456 wrote to memory of 1160 456 alpha.exe kn.exe PID 380 wrote to memory of 2760 380 cmd.exe Audio.pif PID 380 wrote to memory of 2760 380 cmd.exe Audio.pif PID 380 wrote to memory of 2760 380 cmd.exe Audio.pif PID 380 wrote to memory of 3236 380 cmd.exe alpha.exe PID 380 wrote to memory of 3236 380 cmd.exe alpha.exe PID 380 wrote to memory of 1804 380 cmd.exe alpha.exe PID 380 wrote to memory of 1804 380 cmd.exe alpha.exe PID 2760 wrote to memory of 1824 2760 Audio.pif cmd.exe PID 2760 wrote to memory of 1824 2760 Audio.pif cmd.exe PID 2760 wrote to memory of 1824 2760 Audio.pif cmd.exe PID 2760 wrote to memory of 660 2760 Audio.pif cmd.exe PID 2760 wrote to memory of 660 2760 Audio.pif cmd.exe PID 2760 wrote to memory of 660 2760 Audio.pif cmd.exe PID 2760 wrote to memory of 2936 2760 Audio.pif extrac32.exe PID 2760 wrote to memory of 2936 2760 Audio.pif extrac32.exe PID 2760 wrote to memory of 2936 2760 Audio.pif extrac32.exe PID 3156 wrote to memory of 3256 3156 Explorer.EXE dxdiag.exe PID 3156 wrote to memory of 3256 3156 Explorer.EXE dxdiag.exe PID 3156 wrote to memory of 3256 3156 Explorer.EXE dxdiag.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b4e86c38b2b424b473220586c583c7da8ecb98d192581ef0ba37774911cf8351.cmd"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\extrac32.exeC:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"3⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\extrac32.exeextrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe4⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\b4e86c38b2b424b473220586c583c7da8ecb98d192581ef0ba37774911cf8351.cmd" "C:\\Users\\Public\\Audio.mp4" 93⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\b4e86c38b2b424b473220586c583c7da8ecb98d192581ef0ba37774911cf8351.cmd" "C:\\Users\\Public\\Audio.mp4" 94⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 123⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Audio.mp4" "C:\\Users\\Public\\Libraries\\Audio.pif" 124⤵
- Executes dropped EXE
-
C:\Users\Public\Libraries\Audio.pifC:\Users\Public\Libraries\Audio.pif3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir "\\?\C:\Windows "4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir "\\?\C:\Windows \System32"4⤵
-
C:\Windows\SysWOW64\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\Audio.pif C:\\Users\\Public\\Libraries\\Dkftajgk.PIF4⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S3⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Audio.mp4" / A / F / Q / S3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\dxdiag.exe"C:\Windows\SysWOW64\dxdiag.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4116 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Audio.mp4Filesize
2.5MB
MD5790bdb7907d11e3e21fd169d2bdee228
SHA1cb528c40d49fa02c2120a8c717946287cfdee9bd
SHA256c5fb2bd432c465244b7bcc770203bdbefba308c2fe71eebe2978bb4acc2e33fb
SHA51203e2da693f5c90c759a0c4cdfda62ad044dc434ffcb2837dd0661f51fa22cd8db1c0d09e571ffe6cab34fe138c099ea63c5d1bc7927a51dd839b99407627fd1f
-
C:\Users\Public\Libraries\Audio.pifFilesize
1.2MB
MD522b9dbc0fc954ce6fa18e5d330129453
SHA1aaf5407952b6b70f597e13fee275c675d7a45561
SHA2562e5fe8ee47576eb7495f08e187bcae3b5b3004b7430e2bee7b4c564b559eebed
SHA512e9eeaa21d8106780d4a2dc19b547f35acc82e67470c670745f18737f7a339c849f4e45569b6955ef6db272a19ae615d9db2fb7ce441057129c5865a10f7fc272
-
C:\Users\Public\alpha.exeFilesize
283KB
MD58a2122e8162dbef04694b9c3e0b6cdee
SHA1f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA51299e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
-
C:\Users\Public\kn.exeFilesize
1.6MB
MD5bd8d9943a9b1def98eb83e0fa48796c2
SHA170e89852f023ab7cde0173eda1208dbb580f1e4f
SHA2568de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2
SHA51295630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b
-
memory/2760-28-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/2760-31-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-32-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-33-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-30-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-29-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-39-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-52-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-91-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-73-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-90-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-89-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-87-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-86-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-84-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-83-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-81-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-82-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-80-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-79-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-78-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-77-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-76-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-75-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-72-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-74-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-71-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-70-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-69-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-68-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-66-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-65-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-64-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-61-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-59-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-58-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-57-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-55-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-54-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-53-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-51-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-50-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-88-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-46-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-85-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-45-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-44-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-43-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-67-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-36-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-35-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-62-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-63-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-42-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-60-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-56-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-40-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-49-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-48-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-38-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-47-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-37-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-41-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB
-
memory/2760-34-0x00000000029A0000-0x00000000039A0000-memory.dmpFilesize
16.0MB