Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21-04-2024 01:10
Static task
static1
Behavioral task
behavioral1
Sample
737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe
Resource
win7-20231129-en
General
-
Target
737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe
-
Size
2.3MB
-
MD5
2784277bd68152abf75c6c6d59fab7af
-
SHA1
e1d047c97e3bdfe273b215b42eccde32ca2ca63f
-
SHA256
737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc
-
SHA512
e05b8251c9f6c59c7901d72c58f5b8c35dc376068368e67f81ee79da4287ddfc25c6ca5893d87944ed21c592bdd62f57d40a9f78c9af56762f33b010dd10b62c
-
SSDEEP
49152:T2Q8G4mSmM8sik/AJ+/GRfzlW+oCZBNKoiYNsVjGMFWm02qG6zSo2:T2VmT8B4JAGllW+DBNdtN811
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect Umbral payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Umbral.exe family_umbral behavioral2/memory/4052-19-0x0000019379E60000-0x0000019379EA0000-memory.dmp family_umbral -
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4832-44-0x0000023349900000-0x0000023349B14000-memory.dmp family_agenttesla -
Detects executables attemping to enumerate video devices using WMI 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Umbral.exe INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice behavioral2/memory/4052-19-0x0000019379E60000-0x0000019379EA0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice -
Detects executables containing possible sandbox analysis VM names 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Umbral.exe INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames behavioral2/memory/4052-19-0x0000019379E60000-0x0000019379EA0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames -
Detects executables containing possible sandbox analysis VM usernames 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Umbral.exe INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4052-19-0x0000019379E60000-0x0000019379EA0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Detects executables containing possible sandbox system UUIDs 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Umbral.exe INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs behavioral2/memory/4052-19-0x0000019379E60000-0x0000019379EA0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs -
Drops file in Drivers directory 1 IoCs
Processes:
Umbral.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts Umbral.exe -
Modifies Windows Firewall 2 TTPs 3 IoCs
Processes:
netsh.exenetsh.exenetsh.exepid process 4260 netsh.exe 3576 netsh.exe 1100 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe -
Executes dropped EXE 3 IoCs
Processes:
Umbral.exesvchost.exeANDYzz-protected.exepid process 4052 Umbral.exe 4808 svchost.exe 4832 ANDYzz-protected.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
Processes:
flow ioc 40 discord.com 43 discord.com 48 0.tcp.eu.ngrok.io 108 0.tcp.eu.ngrok.io 156 0.tcp.eu.ngrok.io -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 24 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ANDYzz-protected.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ANDYzz-protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer ANDYzz-protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion ANDYzz-protected.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
Umbral.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 4052 Umbral.exe 3648 powershell.exe 3648 powershell.exe 3648 powershell.exe 2100 powershell.exe 2100 powershell.exe 2100 powershell.exe 4288 powershell.exe 4288 powershell.exe 4288 powershell.exe 4820 powershell.exe 4820 powershell.exe 4820 powershell.exe 4044 powershell.exe 4044 powershell.exe 4044 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
svchost.exepid process 4808 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Umbral.exeANDYzz-protected.exewmic.exepowershell.exepowershell.exepowershell.exepowershell.exewmic.exedescription pid process Token: SeDebugPrivilege 4052 Umbral.exe Token: SeDebugPrivilege 4832 ANDYzz-protected.exe Token: SeIncreaseQuotaPrivilege 4404 wmic.exe Token: SeSecurityPrivilege 4404 wmic.exe Token: SeTakeOwnershipPrivilege 4404 wmic.exe Token: SeLoadDriverPrivilege 4404 wmic.exe Token: SeSystemProfilePrivilege 4404 wmic.exe Token: SeSystemtimePrivilege 4404 wmic.exe Token: SeProfSingleProcessPrivilege 4404 wmic.exe Token: SeIncBasePriorityPrivilege 4404 wmic.exe Token: SeCreatePagefilePrivilege 4404 wmic.exe Token: SeBackupPrivilege 4404 wmic.exe Token: SeRestorePrivilege 4404 wmic.exe Token: SeShutdownPrivilege 4404 wmic.exe Token: SeDebugPrivilege 4404 wmic.exe Token: SeSystemEnvironmentPrivilege 4404 wmic.exe Token: SeRemoteShutdownPrivilege 4404 wmic.exe Token: SeUndockPrivilege 4404 wmic.exe Token: SeManageVolumePrivilege 4404 wmic.exe Token: 33 4404 wmic.exe Token: 34 4404 wmic.exe Token: 35 4404 wmic.exe Token: 36 4404 wmic.exe Token: SeIncreaseQuotaPrivilege 4404 wmic.exe Token: SeSecurityPrivilege 4404 wmic.exe Token: SeTakeOwnershipPrivilege 4404 wmic.exe Token: SeLoadDriverPrivilege 4404 wmic.exe Token: SeSystemProfilePrivilege 4404 wmic.exe Token: SeSystemtimePrivilege 4404 wmic.exe Token: SeProfSingleProcessPrivilege 4404 wmic.exe Token: SeIncBasePriorityPrivilege 4404 wmic.exe Token: SeCreatePagefilePrivilege 4404 wmic.exe Token: SeBackupPrivilege 4404 wmic.exe Token: SeRestorePrivilege 4404 wmic.exe Token: SeShutdownPrivilege 4404 wmic.exe Token: SeDebugPrivilege 4404 wmic.exe Token: SeSystemEnvironmentPrivilege 4404 wmic.exe Token: SeRemoteShutdownPrivilege 4404 wmic.exe Token: SeUndockPrivilege 4404 wmic.exe Token: SeManageVolumePrivilege 4404 wmic.exe Token: 33 4404 wmic.exe Token: 34 4404 wmic.exe Token: 35 4404 wmic.exe Token: 36 4404 wmic.exe Token: SeDebugPrivilege 3648 powershell.exe Token: SeDebugPrivilege 2100 powershell.exe Token: SeDebugPrivilege 4288 powershell.exe Token: SeDebugPrivilege 4820 powershell.exe Token: SeIncreaseQuotaPrivilege 3328 wmic.exe Token: SeSecurityPrivilege 3328 wmic.exe Token: SeTakeOwnershipPrivilege 3328 wmic.exe Token: SeLoadDriverPrivilege 3328 wmic.exe Token: SeSystemProfilePrivilege 3328 wmic.exe Token: SeSystemtimePrivilege 3328 wmic.exe Token: SeProfSingleProcessPrivilege 3328 wmic.exe Token: SeIncBasePriorityPrivilege 3328 wmic.exe Token: SeCreatePagefilePrivilege 3328 wmic.exe Token: SeBackupPrivilege 3328 wmic.exe Token: SeRestorePrivilege 3328 wmic.exe Token: SeShutdownPrivilege 3328 wmic.exe Token: SeDebugPrivilege 3328 wmic.exe Token: SeSystemEnvironmentPrivilege 3328 wmic.exe Token: SeRemoteShutdownPrivilege 3328 wmic.exe Token: SeUndockPrivilege 3328 wmic.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exeUmbral.exesvchost.exedescription pid process target process PID 3684 wrote to memory of 4052 3684 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe Umbral.exe PID 3684 wrote to memory of 4052 3684 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe Umbral.exe PID 3684 wrote to memory of 4808 3684 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe svchost.exe PID 3684 wrote to memory of 4808 3684 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe svchost.exe PID 3684 wrote to memory of 4808 3684 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe svchost.exe PID 3684 wrote to memory of 4832 3684 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe ANDYzz-protected.exe PID 3684 wrote to memory of 4832 3684 737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe ANDYzz-protected.exe PID 4052 wrote to memory of 4404 4052 Umbral.exe wmic.exe PID 4052 wrote to memory of 4404 4052 Umbral.exe wmic.exe PID 4052 wrote to memory of 3648 4052 Umbral.exe powershell.exe PID 4052 wrote to memory of 3648 4052 Umbral.exe powershell.exe PID 4052 wrote to memory of 2100 4052 Umbral.exe powershell.exe PID 4052 wrote to memory of 2100 4052 Umbral.exe powershell.exe PID 4052 wrote to memory of 4288 4052 Umbral.exe powershell.exe PID 4052 wrote to memory of 4288 4052 Umbral.exe powershell.exe PID 4808 wrote to memory of 4260 4808 svchost.exe netsh.exe PID 4808 wrote to memory of 4260 4808 svchost.exe netsh.exe PID 4808 wrote to memory of 4260 4808 svchost.exe netsh.exe PID 4052 wrote to memory of 4820 4052 Umbral.exe powershell.exe PID 4052 wrote to memory of 4820 4052 Umbral.exe powershell.exe PID 4808 wrote to memory of 1100 4808 svchost.exe netsh.exe PID 4808 wrote to memory of 1100 4808 svchost.exe netsh.exe PID 4808 wrote to memory of 1100 4808 svchost.exe netsh.exe PID 4808 wrote to memory of 3576 4808 svchost.exe netsh.exe PID 4808 wrote to memory of 3576 4808 svchost.exe netsh.exe PID 4808 wrote to memory of 3576 4808 svchost.exe netsh.exe PID 4052 wrote to memory of 3328 4052 Umbral.exe wmic.exe PID 4052 wrote to memory of 3328 4052 Umbral.exe wmic.exe PID 4052 wrote to memory of 2728 4052 Umbral.exe wmic.exe PID 4052 wrote to memory of 2728 4052 Umbral.exe wmic.exe PID 4052 wrote to memory of 4532 4052 Umbral.exe wmic.exe PID 4052 wrote to memory of 4532 4052 Umbral.exe wmic.exe PID 4052 wrote to memory of 4044 4052 Umbral.exe powershell.exe PID 4052 wrote to memory of 4044 4052 Umbral.exe powershell.exe PID 4052 wrote to memory of 2592 4052 Umbral.exe wmic.exe PID 4052 wrote to memory of 2592 4052 Umbral.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe"C:\Users\Admin\AppData\Local\Temp\737bba8d3e9ad3e1526bf5949962af3b37107c80c767c473a820999eae507fbc.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4404 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3648 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2100 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4288 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3328 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory3⤵PID:2728
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵PID:4532
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4044 -
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name3⤵
- Detects videocard installed
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:4260 -
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Modifies Windows Firewall
PID:1100 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe"C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exe"2⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
948B
MD5966914e2e771de7a4a57a95b6ecfa8a9
SHA17a32282fd51dd032967ed4d9a40cc57e265aeff2
SHA25698d3c70d7004fa807897317bd6cd3e977b9b6c72d4d2565aca0f9f8b1c315cba
SHA512dc39c7124a9c7c8d4c7e8e16290c46360b8d9a8f4e43edaacbbeb09bdcf20159a53db54d2b322372001b6a3de52b2f88e9088b5fdbc7638816ae0d122bb015f5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD502f8663a4dcbe619beca9d48cd769bc0
SHA1e17f0a4041da07f2003b3c45e1ccf89774bc15b8
SHA256e1f3a8eab40520ad75dc4c12e2b5020440d3c0c90f030ff4622faa7d50c359f5
SHA512852137d4fca911faf0c5e52991b09c30eb8baf1d219d25ae82a8c69aa27eab99683a9a63db49cc6f29baf11c089ecb956539e1135cda74a303775c4c811666c2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
C:\Users\Admin\AppData\Local\Temp\ANDYzz-protected.exeFilesize
2.5MB
MD533eb68c8c4fc521d64ed82219cdb19f2
SHA12d114152924ea141df11082d6f337bf7e9a81035
SHA25624251c6105a1f345dbb16860c2405647127b8b03e03b0d0c1c61f896a6c7b7b0
SHA5120b5090dbb977ac8b79b01a3d33c26592a7b98bd9461212f70fa3c092b359c93ad22c1c4bace3aacc22c74884b154989be2a724edf74efd20ef80dee78ac75f8a
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exeFilesize
231KB
MD5774fa31e76af56bbad395e1e3ac68721
SHA1fe65c14179b2cf0cbd44758578cf878d7dcef879
SHA256944c19f992f5301ac8936dcdbd4efb59fbc4f47dcdcc39a77b5e87b4effd27f4
SHA512529ba2a356bf4fb3d4820c0da1dca58d1583ae37188e61300190d543144140f0f73072a9faf195dc214a13ac8c365354e2ab212a24646a332085481f47de8c7e
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lar0ip4l.pfq.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
93KB
MD53071f4f7b11a6bf6c623e83eed6d2418
SHA137fd78d1296659109f2c94c9c750b5a98d158f11
SHA256508bcd1a6b7ed82e60873eb1b035647ec9f8f9facdf65d6d6a73b8ef37d5bb9e
SHA512e6bc32a3c955f80a9a54c261722f49032c1f32c50f98f0792af85769b87b4e9ef16ee4fd4f1e9e0a991e6f9311d54db99737401e6b5f32b503531e6859ad45b8
-
memory/2100-64-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmpFilesize
10.8MB
-
memory/2100-78-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmpFilesize
10.8MB
-
memory/2100-66-0x000001F13C340000-0x000001F13C350000-memory.dmpFilesize
64KB
-
memory/2100-65-0x000001F13C340000-0x000001F13C350000-memory.dmpFilesize
64KB
-
memory/3648-55-0x00000282EDC10000-0x00000282EDC32000-memory.dmpFilesize
136KB
-
memory/3648-62-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmpFilesize
10.8MB
-
memory/3648-47-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmpFilesize
10.8MB
-
memory/3648-48-0x00000282D4D30000-0x00000282D4D40000-memory.dmpFilesize
64KB
-
memory/3648-49-0x00000282D4D30000-0x00000282D4D40000-memory.dmpFilesize
64KB
-
memory/3684-1-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmpFilesize
10.8MB
-
memory/3684-37-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmpFilesize
10.8MB
-
memory/3684-0-0x00000000005C0000-0x000000000081A000-memory.dmpFilesize
2.4MB
-
memory/3684-3-0x0000000002940000-0x0000000002950000-memory.dmpFilesize
64KB
-
memory/4044-139-0x000001AAF9680000-0x000001AAF9690000-memory.dmpFilesize
64KB
-
memory/4044-138-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmpFilesize
10.8MB
-
memory/4044-152-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmpFilesize
10.8MB
-
memory/4052-133-0x000001937BC80000-0x000001937BC8A000-memory.dmpFilesize
40KB
-
memory/4052-110-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmpFilesize
10.8MB
-
memory/4052-19-0x0000019379E60000-0x0000019379EA0000-memory.dmpFilesize
256KB
-
memory/4052-40-0x000001937C500000-0x000001937C510000-memory.dmpFilesize
64KB
-
memory/4052-31-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmpFilesize
10.8MB
-
memory/4052-81-0x000001937C690000-0x000001937C706000-memory.dmpFilesize
472KB
-
memory/4052-82-0x000001937BC30000-0x000001937BC80000-memory.dmpFilesize
320KB
-
memory/4052-83-0x000001937A330000-0x000001937A34E000-memory.dmpFilesize
120KB
-
memory/4052-129-0x000001937C500000-0x000001937C510000-memory.dmpFilesize
64KB
-
memory/4052-134-0x000001937C610000-0x000001937C622000-memory.dmpFilesize
72KB
-
memory/4052-157-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmpFilesize
10.8MB
-
memory/4288-98-0x000002B4BEAD0000-0x000002B4BEAE0000-memory.dmpFilesize
64KB
-
memory/4288-94-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmpFilesize
10.8MB
-
memory/4288-99-0x000002B4BEAD0000-0x000002B4BEAE0000-memory.dmpFilesize
64KB
-
memory/4288-112-0x000002B4BEAD0000-0x000002B4BEAE0000-memory.dmpFilesize
64KB
-
memory/4288-114-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmpFilesize
10.8MB
-
memory/4808-128-0x00000000752A0000-0x0000000075851000-memory.dmpFilesize
5.7MB
-
memory/4808-39-0x00000000752A0000-0x0000000075851000-memory.dmpFilesize
5.7MB
-
memory/4808-42-0x00000000752A0000-0x0000000075851000-memory.dmpFilesize
5.7MB
-
memory/4820-117-0x0000026F76AA0000-0x0000026F76AB0000-memory.dmpFilesize
64KB
-
memory/4820-131-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmpFilesize
10.8MB
-
memory/4820-115-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmpFilesize
10.8MB
-
memory/4820-116-0x0000026F76AA0000-0x0000026F76AB0000-memory.dmpFilesize
64KB
-
memory/4832-137-0x0000023331020000-0x0000023331030000-memory.dmpFilesize
64KB
-
memory/4832-86-0x000002334AD00000-0x000002334AD3C000-memory.dmpFilesize
240KB
-
memory/4832-46-0x0000023331020000-0x0000023331030000-memory.dmpFilesize
64KB
-
memory/4832-111-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmpFilesize
10.8MB
-
memory/4832-44-0x0000023349900000-0x0000023349B14000-memory.dmpFilesize
2.1MB
-
memory/4832-140-0x0000023331020000-0x0000023331030000-memory.dmpFilesize
64KB
-
memory/4832-43-0x0000023331020000-0x0000023331030000-memory.dmpFilesize
64KB
-
memory/4832-41-0x0000023330EC0000-0x0000023330ED2000-memory.dmpFilesize
72KB
-
memory/4832-36-0x00007FFD6D2C0000-0x00007FFD6DD81000-memory.dmpFilesize
10.8MB
-
memory/4832-38-0x000002332EFB0000-0x000002332F22E000-memory.dmpFilesize
2.5MB