Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23-04-2024 17:25
Static task
static1
Behavioral task
behavioral1
Sample
qrehadfoimfm_mal.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
qrehadfoimfm_mal.exe
Resource
win10v2004-20240412-en
General
-
Target
qrehadfoimfm_mal.exe
-
Size
5.4MB
-
MD5
5cafa46103ed17c0ba864f5d7c5c1cdd
-
SHA1
ab1a1ce8553774c82f0b2de57500baef74d223c5
-
SHA256
4ac45e3ec2140badf92ca9034666474504cad8615efc90fbd406360a71be6723
-
SHA512
5239b03c325ff9c825600f5c85d6bde492be95ef564a6e343441371af7ddbc871d9ebb401b3327b3be15ad8cb1d336f8fe3c4f954b3afb37443d24a0797a3930
-
SSDEEP
98304:5LRQhMkUoS3e9PRkWi1p2bw+tEBV4XbtDLAFCLecWIAZS2HdhmC7KODkk6Qow:JS2bBkpkL2bw+tEBVMDLAFCChInihn+g
Malware Config
Signatures
-
XMRig Miner payload 16 IoCs
Processes:
resource yara_rule behavioral2/memory/1756-98-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1756-99-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1756-100-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1756-101-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1756-102-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1756-103-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1756-104-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1756-105-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1756-108-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1756-114-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1756-115-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1756-116-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1756-117-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1756-118-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1756-120-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1756-121-0x0000000140000000-0x0000000140840000-memory.dmp xmrig -
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
qrehadfoimfm.exepid process 4656 qrehadfoimfm.exe -
Drops file in System32 directory 6 IoCs
Processes:
qrehadfoimfm_mal.exeqrehadfoimfm.exepowershell.exedescription ioc process File opened for modification C:\Windows\system32\MRT.exe qrehadfoimfm_mal.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Obsidium\{3D20819C-5D02B5C8-D5AE7FCB-C4F5C439} qrehadfoimfm.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Obsidium\{3D20819C-5D02B5C8-D5AE7FCB-C4F5C439}\4656.obs qrehadfoimfm.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe qrehadfoimfm.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
qrehadfoimfm_mal.exeqrehadfoimfm.exepid process 2596 qrehadfoimfm_mal.exe 4656 qrehadfoimfm.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
qrehadfoimfm.exedescription pid process target process PID 4656 set thread context of 736 4656 qrehadfoimfm.exe conhost.exe PID 4656 set thread context of 1756 4656 qrehadfoimfm.exe explorer.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 4324 sc.exe 1892 sc.exe 4424 sc.exe 4100 sc.exe 4320 sc.exe 5060 sc.exe 1216 sc.exe 4604 sc.exe 1372 sc.exe 4364 sc.exe 3100 sc.exe 1044 sc.exe 2936 sc.exe 1068 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
qrehadfoimfm_mal.exepowershell.exeqrehadfoimfm.exepowershell.exeexplorer.exepid process 2596 qrehadfoimfm_mal.exe 2596 qrehadfoimfm_mal.exe 2596 qrehadfoimfm_mal.exe 4008 powershell.exe 4008 powershell.exe 4008 powershell.exe 2596 qrehadfoimfm_mal.exe 2596 qrehadfoimfm_mal.exe 2596 qrehadfoimfm_mal.exe 2596 qrehadfoimfm_mal.exe 2596 qrehadfoimfm_mal.exe 2596 qrehadfoimfm_mal.exe 2596 qrehadfoimfm_mal.exe 2596 qrehadfoimfm_mal.exe 2596 qrehadfoimfm_mal.exe 2596 qrehadfoimfm_mal.exe 2596 qrehadfoimfm_mal.exe 4656 qrehadfoimfm.exe 4656 qrehadfoimfm.exe 4656 qrehadfoimfm.exe 3944 powershell.exe 3944 powershell.exe 3944 powershell.exe 4656 qrehadfoimfm.exe 4656 qrehadfoimfm.exe 4656 qrehadfoimfm.exe 4656 qrehadfoimfm.exe 4656 qrehadfoimfm.exe 4656 qrehadfoimfm.exe 4656 qrehadfoimfm.exe 4656 qrehadfoimfm.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exeexplorer.exedescription pid process Token: SeDebugPrivilege 4008 powershell.exe Token: SeDebugPrivilege 3944 powershell.exe Token: SeLockMemoryPrivilege 1756 explorer.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
cmd.execmd.execmd.exeqrehadfoimfm.exedescription pid process target process PID 4980 wrote to memory of 5072 4980 cmd.exe wusa.exe PID 4980 wrote to memory of 5072 4980 cmd.exe wusa.exe PID 1308 wrote to memory of 2232 1308 cmd.exe choice.exe PID 1308 wrote to memory of 2232 1308 cmd.exe choice.exe PID 5076 wrote to memory of 4384 5076 cmd.exe wusa.exe PID 5076 wrote to memory of 4384 5076 cmd.exe wusa.exe PID 4656 wrote to memory of 736 4656 qrehadfoimfm.exe conhost.exe PID 4656 wrote to memory of 736 4656 qrehadfoimfm.exe conhost.exe PID 4656 wrote to memory of 736 4656 qrehadfoimfm.exe conhost.exe PID 4656 wrote to memory of 736 4656 qrehadfoimfm.exe conhost.exe PID 4656 wrote to memory of 736 4656 qrehadfoimfm.exe conhost.exe PID 4656 wrote to memory of 736 4656 qrehadfoimfm.exe conhost.exe PID 4656 wrote to memory of 736 4656 qrehadfoimfm.exe conhost.exe PID 4656 wrote to memory of 736 4656 qrehadfoimfm.exe conhost.exe PID 4656 wrote to memory of 736 4656 qrehadfoimfm.exe conhost.exe PID 4656 wrote to memory of 1756 4656 qrehadfoimfm.exe explorer.exe PID 4656 wrote to memory of 1756 4656 qrehadfoimfm.exe explorer.exe PID 4656 wrote to memory of 1756 4656 qrehadfoimfm.exe explorer.exe PID 4656 wrote to memory of 1756 4656 qrehadfoimfm.exe explorer.exe PID 4656 wrote to memory of 1756 4656 qrehadfoimfm.exe explorer.exe PID 4656 wrote to memory of 1756 4656 qrehadfoimfm.exe explorer.exe PID 4656 wrote to memory of 1756 4656 qrehadfoimfm.exe explorer.exe PID 4656 wrote to memory of 1756 4656 qrehadfoimfm.exe explorer.exe PID 4656 wrote to memory of 1756 4656 qrehadfoimfm.exe explorer.exe PID 4656 wrote to memory of 1756 4656 qrehadfoimfm.exe explorer.exe PID 4656 wrote to memory of 1756 4656 qrehadfoimfm.exe explorer.exe PID 4656 wrote to memory of 1756 4656 qrehadfoimfm.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\qrehadfoimfm_mal.exe"C:\Users\Admin\AppData\Local\Temp\qrehadfoimfm_mal.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "PDWIFJZS"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "PDWIFJZS" binpath= "C:\ProgramData\yofgvjmxzlhk\qrehadfoimfm.exe" start= "auto"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "PDWIFJZS"2⤵
- Launches sc.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\qrehadfoimfm_mal.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\ProgramData\yofgvjmxzlhk\qrehadfoimfm.exeC:\ProgramData\yofgvjmxzlhk\qrehadfoimfm.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\yofgvjmxzlhk\qrehadfoimfm.exeFilesize
5.4MB
MD55cafa46103ed17c0ba864f5d7c5c1cdd
SHA1ab1a1ce8553774c82f0b2de57500baef74d223c5
SHA2564ac45e3ec2140badf92ca9034666474504cad8615efc90fbd406360a71be6723
SHA5125239b03c325ff9c825600f5c85d6bde492be95ef564a6e343441371af7ddbc871d9ebb401b3327b3be15ad8cb1d336f8fe3c4f954b3afb37443d24a0797a3930
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qy1ibmyb.bmn.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/736-90-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/736-96-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/736-93-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/736-92-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/736-91-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/736-89-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/1756-105-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/1756-100-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/1756-114-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/1756-110-0x0000000000BC0000-0x0000000000BE0000-memory.dmpFilesize
128KB
-
memory/1756-108-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/1756-116-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/1756-117-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/1756-104-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/1756-103-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/1756-102-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/1756-101-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/1756-115-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/1756-99-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/1756-98-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/1756-97-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/1756-118-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/1756-119-0x0000000011600000-0x0000000011620000-memory.dmpFilesize
128KB
-
memory/1756-120-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/1756-121-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/1756-122-0x0000000011720000-0x0000000011740000-memory.dmpFilesize
128KB
-
memory/1756-123-0x0000000011720000-0x0000000011740000-memory.dmpFilesize
128KB
-
memory/2596-36-0x00007FFAD3CF0000-0x00007FFAD3EE5000-memory.dmpFilesize
2.0MB
-
memory/2596-42-0x0000022322D30000-0x0000022322D75000-memory.dmpFilesize
276KB
-
memory/2596-3-0x00007FF6AD020000-0x00007FF6ADC64000-memory.dmpFilesize
12.3MB
-
memory/2596-5-0x0000022322D30000-0x0000022322D75000-memory.dmpFilesize
276KB
-
memory/2596-4-0x00007FF6AD020000-0x00007FF6ADC64000-memory.dmpFilesize
12.3MB
-
memory/2596-6-0x00007FF6AD020000-0x00007FF6ADC64000-memory.dmpFilesize
12.3MB
-
memory/2596-7-0x0000022322D30000-0x0000022322D75000-memory.dmpFilesize
276KB
-
memory/2596-11-0x00007FFAD3780000-0x00007FFAD381E000-memory.dmpFilesize
632KB
-
memory/2596-12-0x0000022321570000-0x0000022321571000-memory.dmpFilesize
4KB
-
memory/2596-13-0x00007FF6AD020000-0x00007FF6ADC64000-memory.dmpFilesize
12.3MB
-
memory/2596-14-0x00007FFAD3CF0000-0x00007FFAD3EE5000-memory.dmpFilesize
2.0MB
-
memory/2596-15-0x00007FFAD1410000-0x00007FFAD16D9000-memory.dmpFilesize
2.8MB
-
memory/2596-16-0x00007FFAD3780000-0x00007FFAD381E000-memory.dmpFilesize
632KB
-
memory/2596-30-0x00007FF6AD020000-0x00007FF6ADC64000-memory.dmpFilesize
12.3MB
-
memory/2596-35-0x00007FF6AD020000-0x00007FF6ADC64000-memory.dmpFilesize
12.3MB
-
memory/2596-1-0x00007FF6AD020000-0x00007FF6ADC64000-memory.dmpFilesize
12.3MB
-
memory/2596-37-0x00007FFAD1410000-0x00007FFAD16D9000-memory.dmpFilesize
2.8MB
-
memory/2596-38-0x00007FFAD3780000-0x00007FFAD381E000-memory.dmpFilesize
632KB
-
memory/3944-81-0x000002D060A40000-0x000002D060A5A000-memory.dmpFilesize
104KB
-
memory/3944-80-0x000002D0609E0000-0x000002D0609EA000-memory.dmpFilesize
40KB
-
memory/3944-54-0x00007FFAB3C70000-0x00007FFAB4731000-memory.dmpFilesize
10.8MB
-
memory/3944-60-0x000002D047680000-0x000002D047690000-memory.dmpFilesize
64KB
-
memory/3944-67-0x00007FF448730000-0x00007FF448740000-memory.dmpFilesize
64KB
-
memory/3944-76-0x000002D047680000-0x000002D047690000-memory.dmpFilesize
64KB
-
memory/3944-88-0x00007FFAB3C70000-0x00007FFAB4731000-memory.dmpFilesize
10.8MB
-
memory/3944-85-0x000002D047680000-0x000002D047690000-memory.dmpFilesize
64KB
-
memory/3944-84-0x000002D060A30000-0x000002D060A3A000-memory.dmpFilesize
40KB
-
memory/3944-83-0x000002D060A20000-0x000002D060A26000-memory.dmpFilesize
24KB
-
memory/3944-75-0x000002D0607C0000-0x000002D0607DC000-memory.dmpFilesize
112KB
-
memory/3944-77-0x000002D0607E0000-0x000002D060895000-memory.dmpFilesize
724KB
-
memory/3944-78-0x000002D0476A0000-0x000002D0476AA000-memory.dmpFilesize
40KB
-
memory/3944-79-0x000002D060A00000-0x000002D060A1C000-memory.dmpFilesize
112KB
-
memory/3944-82-0x000002D0609F0000-0x000002D0609F8000-memory.dmpFilesize
32KB
-
memory/4008-28-0x000001A4B3220000-0x000001A4B3230000-memory.dmpFilesize
64KB
-
memory/4008-33-0x00007FFAB3C70000-0x00007FFAB4731000-memory.dmpFilesize
10.8MB
-
memory/4008-29-0x000001A4B3220000-0x000001A4B3230000-memory.dmpFilesize
64KB
-
memory/4008-27-0x00007FFAB3C70000-0x00007FFAB4731000-memory.dmpFilesize
10.8MB
-
memory/4008-17-0x000001A49AD20000-0x000001A49AD42000-memory.dmpFilesize
136KB
-
memory/4656-111-0x00007FFAD1410000-0x00007FFAD16D9000-memory.dmpFilesize
2.8MB
-
memory/4656-113-0x000001B9B24D0000-0x000001B9B2515000-memory.dmpFilesize
276KB
-
memory/4656-46-0x00007FF6821C0000-0x00007FF682E04000-memory.dmpFilesize
12.3MB
-
memory/4656-112-0x00007FFAD3780000-0x00007FFAD381E000-memory.dmpFilesize
632KB
-
memory/4656-107-0x00007FF6821C0000-0x00007FF682E04000-memory.dmpFilesize
12.3MB
-
memory/4656-48-0x000001B9B24D0000-0x000001B9B2515000-memory.dmpFilesize
276KB
-
memory/4656-109-0x00007FFAD3CF0000-0x00007FFAD3EE5000-memory.dmpFilesize
2.0MB
-
memory/4656-41-0x00007FF6821C0000-0x00007FF682E04000-memory.dmpFilesize
12.3MB
-
memory/4656-44-0x000001B9B24D0000-0x000001B9B2515000-memory.dmpFilesize
276KB
-
memory/4656-47-0x00007FF6821C0000-0x00007FF682E04000-memory.dmpFilesize
12.3MB
-
memory/4656-45-0x00007FF6821C0000-0x00007FF682E04000-memory.dmpFilesize
12.3MB
-
memory/4656-52-0x00007FFAD3780000-0x00007FFAD381E000-memory.dmpFilesize
632KB