Analysis
-
max time kernel
136s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27-12-2023 00:02
Static task
static1
Behavioral task
behavioral1
Sample
97cb3fda3cff430377a866d6b437de8f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
97cb3fda3cff430377a866d6b437de8f.exe
Resource
win10v2004-20231215-en
General
-
Target
97cb3fda3cff430377a866d6b437de8f.exe
-
Size
220KB
-
MD5
97cb3fda3cff430377a866d6b437de8f
-
SHA1
2359c8459c1e1dd133c2842b51d2982e63016f92
-
SHA256
e6507f36045c13dee736bea44d61e90169ea69de61e9dc50b5743960c5b8f85a
-
SHA512
e192d3afaa093b5b11643aafefa8192cfeb79e5f284e6c757532fd3e2a4a93970f5f8d54b0e983b4c406ced46aee04a99c186f31ff321f9292c51587603c630f
-
SSDEEP
3072:alaJEgEXbfa9K4Em8wNBiXMhDJv7WehI2135eDRCyqTp0FUSVBOHfHAXTRsPCgfr:BEg4S9KqiSJvthI25ebqqBOKTRsaj2e
Malware Config
Extracted
blacknet
v3.7.0 Public
Bot
http://furyx.de/panel
BN[c1916af6f3a468e5b6f5c7f6b9c78982]
-
antivm
false
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
e162b1333458a713bc6916cc8ac4110c
-
startup
false
-
usb_spread
true
Signatures
-
BlackNET payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\furz.exe family_blacknet behavioral2/memory/1464-104-0x0000000000E90000-0x0000000000EB2000-memory.dmp family_blacknet C:\Users\Admin\AppData\Local\Temp\furz.exe family_blacknet -
Contains code to disable Windows Defender 3 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\furz.exe disable_win_def behavioral2/memory/1464-104-0x0000000000E90000-0x0000000000EB2000-memory.dmp disable_win_def C:\Users\Admin\AppData\Local\Temp\furz.exe disable_win_def -
Processes:
furz.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" furz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" furz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection furz.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" furz.exe -
Processes:
reg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
97cb3fda3cff430377a866d6b437de8f.exeUacTest.exefurz.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 97cb3fda3cff430377a866d6b437de8f.exe Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation UacTest.exe Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation furz.exe -
Executes dropped EXE 5 IoCs
Processes:
furz.exeUacTest.exeInpwdja.exeMnrjvryib.exeWindowsUpdate.exepid process 1464 furz.exe 2788 UacTest.exe 2524 Inpwdja.exe 4952 Mnrjvryib.exe 5016 WindowsUpdate.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
97cb3fda3cff430377a866d6b437de8f.exefurz.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe" 97cb3fda3cff430377a866d6b437de8f.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e162b1333458a713bc6916cc8ac4110c = "C:\\Windows\\Microsoft\\MyClient\\WindowsUpdate.exe" furz.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
97cb3fda3cff430377a866d6b437de8f.exedescription pid process target process PID 3680 set thread context of 112 3680 97cb3fda3cff430377a866d6b437de8f.exe 97cb3fda3cff430377a866d6b437de8f.exe -
Drops file in Windows directory 3 IoCs
Processes:
furz.exeWindowsUpdate.exedescription ioc process File created C:\Windows\Microsoft\MyClient\WindowsUpdate.exe furz.exe File opened for modification C:\Windows\Microsoft\MyClient\WindowsUpdate.exe furz.exe File created C:\Windows\Microsoft\MyClient\svchosts.exe WindowsUpdate.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1300 schtasks.exe 656 schtasks.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 32 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
97cb3fda3cff430377a866d6b437de8f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 97cb3fda3cff430377a866d6b437de8f.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
97cb3fda3cff430377a866d6b437de8f.exefurz.exepowershell.exeWindowsUpdate.exepid process 112 97cb3fda3cff430377a866d6b437de8f.exe 112 97cb3fda3cff430377a866d6b437de8f.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 3824 powershell.exe 3824 powershell.exe 3824 powershell.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 1464 furz.exe 5016 WindowsUpdate.exe 5016 WindowsUpdate.exe 5016 WindowsUpdate.exe 5016 WindowsUpdate.exe 5016 WindowsUpdate.exe 5016 WindowsUpdate.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
97cb3fda3cff430377a866d6b437de8f.exetaskkill.exefurz.exepowershell.exeWindowsUpdate.exepowershell.exedescription pid process Token: SeDebugPrivilege 112 97cb3fda3cff430377a866d6b437de8f.exe Token: SeDebugPrivilege 32 taskkill.exe Token: SeDebugPrivilege 1464 furz.exe Token: SeDebugPrivilege 3824 powershell.exe Token: SeDebugPrivilege 5016 WindowsUpdate.exe Token: SeDebugPrivilege 3500 powershell.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
furz.exeWindowsUpdate.exepid process 1464 furz.exe 1464 furz.exe 1464 furz.exe 5016 WindowsUpdate.exe 5016 WindowsUpdate.exe 5016 WindowsUpdate.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
97cb3fda3cff430377a866d6b437de8f.exe97cb3fda3cff430377a866d6b437de8f.execmd.exeUacTest.exeInpwdja.exesihclient.execmd.exeMnrjvryib.execmd.exefurz.exeWindowsUpdate.exedescription pid process target process PID 3680 wrote to memory of 112 3680 97cb3fda3cff430377a866d6b437de8f.exe 97cb3fda3cff430377a866d6b437de8f.exe PID 3680 wrote to memory of 112 3680 97cb3fda3cff430377a866d6b437de8f.exe 97cb3fda3cff430377a866d6b437de8f.exe PID 3680 wrote to memory of 112 3680 97cb3fda3cff430377a866d6b437de8f.exe 97cb3fda3cff430377a866d6b437de8f.exe PID 3680 wrote to memory of 112 3680 97cb3fda3cff430377a866d6b437de8f.exe 97cb3fda3cff430377a866d6b437de8f.exe PID 3680 wrote to memory of 112 3680 97cb3fda3cff430377a866d6b437de8f.exe 97cb3fda3cff430377a866d6b437de8f.exe PID 3680 wrote to memory of 112 3680 97cb3fda3cff430377a866d6b437de8f.exe 97cb3fda3cff430377a866d6b437de8f.exe PID 3680 wrote to memory of 112 3680 97cb3fda3cff430377a866d6b437de8f.exe 97cb3fda3cff430377a866d6b437de8f.exe PID 3680 wrote to memory of 112 3680 97cb3fda3cff430377a866d6b437de8f.exe 97cb3fda3cff430377a866d6b437de8f.exe PID 112 wrote to memory of 1464 112 97cb3fda3cff430377a866d6b437de8f.exe furz.exe PID 112 wrote to memory of 1464 112 97cb3fda3cff430377a866d6b437de8f.exe furz.exe PID 112 wrote to memory of 2788 112 97cb3fda3cff430377a866d6b437de8f.exe UacTest.exe PID 112 wrote to memory of 2788 112 97cb3fda3cff430377a866d6b437de8f.exe UacTest.exe PID 112 wrote to memory of 2788 112 97cb3fda3cff430377a866d6b437de8f.exe UacTest.exe PID 112 wrote to memory of 1428 112 97cb3fda3cff430377a866d6b437de8f.exe cmd.exe PID 112 wrote to memory of 1428 112 97cb3fda3cff430377a866d6b437de8f.exe cmd.exe PID 112 wrote to memory of 1428 112 97cb3fda3cff430377a866d6b437de8f.exe cmd.exe PID 1428 wrote to memory of 4076 1428 cmd.exe PING.EXE PID 1428 wrote to memory of 4076 1428 cmd.exe PING.EXE PID 1428 wrote to memory of 4076 1428 cmd.exe PING.EXE PID 1428 wrote to memory of 1152 1428 cmd.exe PING.EXE PID 1428 wrote to memory of 1152 1428 cmd.exe PING.EXE PID 1428 wrote to memory of 1152 1428 cmd.exe PING.EXE PID 2788 wrote to memory of 2524 2788 UacTest.exe Inpwdja.exe PID 2788 wrote to memory of 2524 2788 UacTest.exe Inpwdja.exe PID 2788 wrote to memory of 2524 2788 UacTest.exe Inpwdja.exe PID 2788 wrote to memory of 4952 2788 UacTest.exe Mnrjvryib.exe PID 2788 wrote to memory of 4952 2788 UacTest.exe Mnrjvryib.exe PID 2788 wrote to memory of 4952 2788 UacTest.exe Mnrjvryib.exe PID 2524 wrote to memory of 4360 2524 Inpwdja.exe sihclient.exe PID 2524 wrote to memory of 4360 2524 Inpwdja.exe sihclient.exe PID 4360 wrote to memory of 2688 4360 sihclient.exe cmd.exe PID 4360 wrote to memory of 2688 4360 sihclient.exe cmd.exe PID 2688 wrote to memory of 4008 2688 cmd.exe reg.exe PID 2688 wrote to memory of 4008 2688 cmd.exe reg.exe PID 4952 wrote to memory of 236 4952 Mnrjvryib.exe cmd.exe PID 4952 wrote to memory of 236 4952 Mnrjvryib.exe cmd.exe PID 236 wrote to memory of 32 236 cmd.exe taskkill.exe PID 236 wrote to memory of 32 236 cmd.exe taskkill.exe PID 1464 wrote to memory of 3824 1464 furz.exe powershell.exe PID 1464 wrote to memory of 3824 1464 furz.exe powershell.exe PID 1464 wrote to memory of 4192 1464 furz.exe schtasks.exe PID 1464 wrote to memory of 4192 1464 furz.exe schtasks.exe PID 1464 wrote to memory of 5016 1464 furz.exe WindowsUpdate.exe PID 1464 wrote to memory of 5016 1464 furz.exe WindowsUpdate.exe PID 1464 wrote to memory of 1300 1464 furz.exe schtasks.exe PID 1464 wrote to memory of 1300 1464 furz.exe schtasks.exe PID 5016 wrote to memory of 3500 5016 WindowsUpdate.exe powershell.exe PID 5016 wrote to memory of 3500 5016 WindowsUpdate.exe powershell.exe PID 5016 wrote to memory of 3256 5016 WindowsUpdate.exe schtasks.exe PID 5016 wrote to memory of 3256 5016 WindowsUpdate.exe schtasks.exe PID 5016 wrote to memory of 656 5016 WindowsUpdate.exe schtasks.exe PID 5016 wrote to memory of 656 5016 WindowsUpdate.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\UacTest.exe"C:\Users\Admin\AppData\Local\Temp\UacTest.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe"C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe"C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\97cb3fda3cff430377a866d6b437de8f.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 1004⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 9004⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\furz.exe"C:\Users\Admin\AppData\Local\Temp\furz.exe"3⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "WindowsUpdate.exe" /sc ONLOGON /tr "C:\Windows\WindowsUpdate.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft\MyClient\WindowsUpdate.exe"C:\Windows\Microsoft\MyClient\WindowsUpdate.exe"4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "WindowsUpdate.exe" /sc ONLOGON /tr "C:\Windows\WindowsUpdate.exe" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /delete /tn "WindowsUpdate.exe" /f5⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /delete /tn "WindowsUpdate.exe" /f4⤵
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f1⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\545A.tmp\545B.tmp\545C.bat C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exeTaskkill /IM cmd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /k C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\53EC.tmp\53ED.tmp\53EE.bat C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv apyXpiSGQEezF0sqZFyx6g.0.21⤵
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\97cb3fda3cff430377a866d6b437de8f.exe.logFilesize
507B
MD576ffb2f33cb32ade8fc862a67599e9d8
SHA1920cc4ab75b36d2f9f6e979b74db568973c49130
SHA256f1a3724670e3379318ec9c73f6f39058cab0ab013ba3cd90c047c3d701362310
SHA512f33502c2e1bb30c05359bfc6819ca934642a1e01874e3060349127d792694d56ad22fccd6c9477b8ee50d66db35785779324273f509576b48b7f85577e001b4e
-
C:\Users\Admin\AppData\Local\Temp\UacTest.exeFilesize
140KB
MD57c011f0ea2387f0124c959e3f663cb4d
SHA112e668079661c557963236786bb821af4628ee1b
SHA2566b69a8fd83ca150642a20128f84cdd2e91aaa6852e705e55e4116caa487903c4
SHA512f5770246c943a997c96713a721d512fc0eaf530f3b7d22abe56f50d35b582af4b9f86a65113dee0f09aa7766d257ac0b29a9a56348891339399a2923b399925e
-
C:\Users\Admin\AppData\Local\Temp\furz.exeFilesize
93KB
MD543c0183e6a22dafd4446a56afcf4b89f
SHA1055684d4254c36bff5205da62dc27ec53fba3344
SHA25668cf38e2acad6363401b589facbcd39871c4e838166bc8741db6d1159825dd1f
SHA512f448b2422b5faa509da22d982625b8fa8edbf2403c458b6e27a65009f980e3e2201bb81ba9392a37496056aa5257985019dbbb2077c6a148a90322faff464750
-
C:\Users\Admin\AppData\Local\Temp\furz.exeFilesize
117KB
MD5b72d429d1d690165c7b0de4a074c4a58
SHA1f0704d227482a80f2f90dab79ed4acd9770fe565
SHA256b30eebf734354f55373978e395c912393f3c674aaa4717748ae449b09832f6ae
SHA512f3b565e67d5a15d5305982701bd5f0d37eec0bfe2d152556584fa1d01faf1def6e616d0addea91e0663be084450b49f99e2108cc06a9b50c9e1482f9290b6c5c
-
memory/112-14-0x0000000005650000-0x0000000005660000-memory.dmpFilesize
64KB
-
memory/112-109-0x00000000750A0000-0x0000000075850000-memory.dmpFilesize
7.7MB
-
memory/112-13-0x0000000005650000-0x0000000005660000-memory.dmpFilesize
64KB
-
memory/112-8-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/112-12-0x00000000750A0000-0x0000000075850000-memory.dmpFilesize
7.7MB
-
memory/1464-169-0x00007FFBCDAB0000-0x00007FFBCE571000-memory.dmpFilesize
10.8MB
-
memory/1464-106-0x00007FFBCDAB0000-0x00007FFBCE571000-memory.dmpFilesize
10.8MB
-
memory/1464-176-0x00007FFBCDAB0000-0x00007FFBCE571000-memory.dmpFilesize
10.8MB
-
memory/1464-175-0x000000001C170000-0x000000001C319000-memory.dmpFilesize
1.7MB
-
memory/1464-171-0x000000001BBE0000-0x000000001BBF0000-memory.dmpFilesize
64KB
-
memory/1464-156-0x000000001BBE0000-0x000000001BBF0000-memory.dmpFilesize
64KB
-
memory/1464-107-0x000000001BBE0000-0x000000001BBF0000-memory.dmpFilesize
64KB
-
memory/1464-153-0x000000001BBE0000-0x000000001BBF0000-memory.dmpFilesize
64KB
-
memory/1464-152-0x000000001BBE0000-0x000000001BBF0000-memory.dmpFilesize
64KB
-
memory/1464-104-0x0000000000E90000-0x0000000000EB2000-memory.dmpFilesize
136KB
-
memory/1464-113-0x000000001BBE0000-0x000000001BBF0000-memory.dmpFilesize
64KB
-
memory/2788-111-0x0000000005030000-0x0000000005040000-memory.dmpFilesize
64KB
-
memory/2788-112-0x0000000004980000-0x000000000498A000-memory.dmpFilesize
40KB
-
memory/2788-130-0x00000000750A0000-0x0000000075850000-memory.dmpFilesize
7.7MB
-
memory/2788-108-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2788-110-0x00000000750A0000-0x0000000075850000-memory.dmpFilesize
7.7MB
-
memory/3500-180-0x00007FFBCDAB0000-0x00007FFBCE571000-memory.dmpFilesize
10.8MB
-
memory/3500-189-0x0000025B8FD30000-0x0000025B8FD40000-memory.dmpFilesize
64KB
-
memory/3500-192-0x00007FFBCDAB0000-0x00007FFBCE571000-memory.dmpFilesize
10.8MB
-
memory/3500-188-0x0000025B8FD30000-0x0000025B8FD40000-memory.dmpFilesize
64KB
-
memory/3680-0-0x00000000000A0000-0x00000000000DE000-memory.dmpFilesize
248KB
-
memory/3680-5-0x0000000004C00000-0x0000000004C9C000-memory.dmpFilesize
624KB
-
memory/3680-1-0x00000000750A0000-0x0000000075850000-memory.dmpFilesize
7.7MB
-
memory/3680-3-0x00000000051B0000-0x0000000005754000-memory.dmpFilesize
5.6MB
-
memory/3680-2-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/3680-11-0x00000000750A0000-0x0000000075850000-memory.dmpFilesize
7.7MB
-
memory/3680-7-0x0000000004A70000-0x0000000004A7A000-memory.dmpFilesize
40KB
-
memory/3680-4-0x0000000004B10000-0x0000000004BA2000-memory.dmpFilesize
584KB
-
memory/3824-136-0x00007FFBCDAB0000-0x00007FFBCE571000-memory.dmpFilesize
10.8MB
-
memory/3824-138-0x000001EEBBBD0000-0x000001EEBBBE0000-memory.dmpFilesize
64KB
-
memory/3824-137-0x000001EEBBBD0000-0x000001EEBBBE0000-memory.dmpFilesize
64KB
-
memory/3824-144-0x000001EEA3670000-0x000001EEA3692000-memory.dmpFilesize
136KB
-
memory/3824-151-0x00007FFBCDAB0000-0x00007FFBCE571000-memory.dmpFilesize
10.8MB
-
memory/5016-172-0x0000000002FE0000-0x0000000002FF0000-memory.dmpFilesize
64KB
-
memory/5016-170-0x00007FFBCDAB0000-0x00007FFBCE571000-memory.dmpFilesize
10.8MB
-
memory/5016-195-0x0000000002FE0000-0x0000000002FF0000-memory.dmpFilesize
64KB
-
memory/5016-194-0x0000000002FE0000-0x0000000002FF0000-memory.dmpFilesize
64KB
-
memory/5016-193-0x0000000002FE0000-0x0000000002FF0000-memory.dmpFilesize
64KB
-
memory/5016-197-0x000000001C1B0000-0x000000001C359000-memory.dmpFilesize
1.7MB
-
memory/5016-198-0x00007FFBCDAB0000-0x00007FFBCE571000-memory.dmpFilesize
10.8MB