Overview
overview
10Static
static
10Tool/ConsoleApp1.exe
windows10-2004-x64
1Tool/Mono....db.dll
windows10-2004-x64
1Tool/Mono....ks.dll
windows10-2004-x64
1Tool/Tool.exe
windows10-2004-x64
10Tool/stub.exe
windows10-2004-x64
10Tool/x64/M...db.dll
windows10-2004-x64
1Tool/x64/M...ks.dll
windows10-2004-x64
1Tool/x64/fix.exe
windows10-2004-x64
10Tool/x64/fix1.exe
windows10-2004-x64
7Tool/x64/stub.exe
windows10-2004-x64
10Analysis
-
max time kernel
1200s -
max time network
1204s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-es -
resource tags
arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
08-07-2024 04:59
Behavioral task
behavioral1
Sample
Tool/ConsoleApp1.exe
Resource
win10v2004-20240704-es
Behavioral task
behavioral2
Sample
Tool/Mono.Cecil.Pdb.dll
Resource
win10v2004-20240704-es
Behavioral task
behavioral3
Sample
Tool/Mono.Cecil.Rocks.dll
Resource
win10v2004-20240704-es
Behavioral task
behavioral4
Sample
Tool/Tool.exe
Resource
win10v2004-20240704-es
Behavioral task
behavioral5
Sample
Tool/stub.exe
Resource
win10v2004-20240704-es
Behavioral task
behavioral6
Sample
Tool/x64/Mono.Cecil.Pdb.dll
Resource
win10v2004-20240704-es
Behavioral task
behavioral7
Sample
Tool/x64/Mono.Cecil.Rocks.dll
Resource
win10v2004-20240704-es
Behavioral task
behavioral8
Sample
Tool/x64/fix.exe
Resource
win10v2004-20240704-es
Behavioral task
behavioral9
Sample
Tool/x64/fix1.exe
Resource
win10v2004-20240704-es
Behavioral task
behavioral10
Sample
Tool/x64/stub.exe
Resource
win10v2004-20240704-es
General
-
Target
Tool/Tool.exe
-
Size
2.5MB
-
MD5
5eb488fde8ae946dbe2ee631a44e2264
-
SHA1
7a7c0b9d4dfb605bed6d6f1fe256cb2b9e8799db
-
SHA256
f4894d1b685f8b6a53bfcbc23869c806258c0b7e7def3f4f946c2d6a7019dfad
-
SHA512
29fe591da31225aeb09490ddfed86e3a48c47bc17d2110ca63a7a1b243516cc8fc7f5c3a33e364c718183a4872d145b7ab8d80a5c8b932d69229cae065318c06
-
SSDEEP
49152:QS5WRuchCqDjoexP05/h+kaFCxLli+brfU5c47RiPcCfwiUZW8XQJKDRgR:Q6Kuch/DZW5AkaY7iurM247M743M8AYm
Malware Config
Signatures
-
XMRig Miner payload 11 IoCs
Processes:
resource yara_rule behavioral4/memory/3948-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/3948-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/3948-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/3948-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/3948-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/3948-70-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/3948-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/3948-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/3948-74-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/3948-75-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral4/memory/3948-76-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2396 powershell.exe 1232 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
xqkwufftkosu.exepid process 1748 xqkwufftkosu.exe -
Processes:
resource yara_rule behavioral4/memory/3948-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/3948-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/3948-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/3948-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/3948-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/3948-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/3948-63-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/3948-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/3948-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/3948-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/3948-70-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/3948-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/3948-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/3948-74-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/3948-75-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral4/memory/3948-76-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
Processes:
Tool.exepowershell.exexqkwufftkosu.exedescription ioc process File opened for modification C:\Windows\system32\MRT.exe Tool.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe xqkwufftkosu.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
xqkwufftkosu.exedescription pid process target process PID 1748 set thread context of 3652 1748 xqkwufftkosu.exe conhost.exe PID 1748 set thread context of 3948 1748 xqkwufftkosu.exe conhost.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 5000 sc.exe 4900 sc.exe 3952 sc.exe 1792 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Tool.exepowershell.exexqkwufftkosu.exepowershell.execonhost.exepid process 1144 Tool.exe 2396 powershell.exe 2396 powershell.exe 1144 Tool.exe 1144 Tool.exe 1144 Tool.exe 1144 Tool.exe 1144 Tool.exe 1748 xqkwufftkosu.exe 1232 powershell.exe 1232 powershell.exe 1748 xqkwufftkosu.exe 1748 xqkwufftkosu.exe 1748 xqkwufftkosu.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe 3948 conhost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.execonhost.exedescription pid process Token: SeDebugPrivilege 2396 powershell.exe Token: SeDebugPrivilege 1232 powershell.exe Token: SeLockMemoryPrivilege 3948 conhost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
cmd.exexqkwufftkosu.execmd.exedescription pid process target process PID 3056 wrote to memory of 4816 3056 cmd.exe wusa.exe PID 3056 wrote to memory of 4816 3056 cmd.exe wusa.exe PID 1748 wrote to memory of 3652 1748 xqkwufftkosu.exe conhost.exe PID 1748 wrote to memory of 3652 1748 xqkwufftkosu.exe conhost.exe PID 1748 wrote to memory of 3652 1748 xqkwufftkosu.exe conhost.exe PID 1748 wrote to memory of 3652 1748 xqkwufftkosu.exe conhost.exe PID 1748 wrote to memory of 3652 1748 xqkwufftkosu.exe conhost.exe PID 1748 wrote to memory of 3652 1748 xqkwufftkosu.exe conhost.exe PID 1748 wrote to memory of 3652 1748 xqkwufftkosu.exe conhost.exe PID 1748 wrote to memory of 3652 1748 xqkwufftkosu.exe conhost.exe PID 1748 wrote to memory of 3652 1748 xqkwufftkosu.exe conhost.exe PID 4600 wrote to memory of 3140 4600 cmd.exe wusa.exe PID 4600 wrote to memory of 3140 4600 cmd.exe wusa.exe PID 1748 wrote to memory of 3948 1748 xqkwufftkosu.exe conhost.exe PID 1748 wrote to memory of 3948 1748 xqkwufftkosu.exe conhost.exe PID 1748 wrote to memory of 3948 1748 xqkwufftkosu.exe conhost.exe PID 1748 wrote to memory of 3948 1748 xqkwufftkosu.exe conhost.exe PID 1748 wrote to memory of 3948 1748 xqkwufftkosu.exe conhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tool\Tool.exe"C:\Users\Admin\AppData\Local\Temp\Tool\Tool.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "BAZVYEGL"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "BAZVYEGL" binpath= "C:\ProgramData\disoegcocrwp\xqkwufftkosu.exe" start= "auto"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "BAZVYEGL"2⤵
- Launches sc.exe
-
C:\ProgramData\disoegcocrwp\xqkwufftkosu.exeC:\ProgramData\disoegcocrwp\xqkwufftkosu.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\system32\conhost.execonhost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\disoegcocrwp\xqkwufftkosu.exeFilesize
2.5MB
MD55eb488fde8ae946dbe2ee631a44e2264
SHA17a7c0b9d4dfb605bed6d6f1fe256cb2b9e8799db
SHA256f4894d1b685f8b6a53bfcbc23869c806258c0b7e7def3f4f946c2d6a7019dfad
SHA51229fe591da31225aeb09490ddfed86e3a48c47bc17d2110ca63a7a1b243516cc8fc7f5c3a33e364c718183a4872d145b7ab8d80a5c8b932d69229cae065318c06
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5eigiyuo.rep.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1232-41-0x000002D7D78F0000-0x000002D7D79A5000-memory.dmpFilesize
724KB
-
memory/1232-48-0x000002D7D7B50000-0x000002D7D7B5A000-memory.dmpFilesize
40KB
-
memory/1232-47-0x000002D7D7B40000-0x000002D7D7B46000-memory.dmpFilesize
24KB
-
memory/1232-46-0x000002D7D7B10000-0x000002D7D7B18000-memory.dmpFilesize
32KB
-
memory/1232-45-0x000002D7D7B60000-0x000002D7D7B7A000-memory.dmpFilesize
104KB
-
memory/1232-44-0x000002D7D7B00000-0x000002D7D7B0A000-memory.dmpFilesize
40KB
-
memory/1232-43-0x000002D7D7B20000-0x000002D7D7B3C000-memory.dmpFilesize
112KB
-
memory/1232-42-0x000002D7D79B0000-0x000002D7D79BA000-memory.dmpFilesize
40KB
-
memory/1232-40-0x000002D7D78D0000-0x000002D7D78EC000-memory.dmpFilesize
112KB
-
memory/2396-12-0x000002339BBC0000-0x000002339BBD0000-memory.dmpFilesize
64KB
-
memory/2396-18-0x00007FFD63DE0000-0x00007FFD648A1000-memory.dmpFilesize
10.8MB
-
memory/2396-15-0x00007FFD63DE0000-0x00007FFD648A1000-memory.dmpFilesize
10.8MB
-
memory/2396-14-0x00007FFD63DE0000-0x00007FFD648A1000-memory.dmpFilesize
10.8MB
-
memory/2396-13-0x00000233B47E0000-0x00000233B48E2000-memory.dmpFilesize
1.0MB
-
memory/2396-0-0x00007FFD63DE3000-0x00007FFD63DE5000-memory.dmpFilesize
8KB
-
memory/2396-1-0x00000233B41D0000-0x00000233B4252000-memory.dmpFilesize
520KB
-
memory/2396-2-0x000002339BB90000-0x000002339BBB2000-memory.dmpFilesize
136KB
-
memory/3652-58-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/3652-55-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/3652-54-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/3652-53-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/3652-52-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/3652-51-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/3948-66-0x00000199F64D0000-0x00000199F64F0000-memory.dmpFilesize
128KB
-
memory/3948-68-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3948-59-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3948-62-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3948-65-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3948-60-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3948-64-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3948-63-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3948-71-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3948-61-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3948-67-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3948-70-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3948-69-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3948-72-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3948-74-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3948-75-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/3948-76-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB