Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-03-2024 07:32
Static task
static1
Behavioral task
behavioral1
Sample
b425db5faaff29191253707b4d495278.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b425db5faaff29191253707b4d495278.exe
Resource
win10v2004-20240226-en
General
-
Target
b425db5faaff29191253707b4d495278.exe
-
Size
3.8MB
-
MD5
b425db5faaff29191253707b4d495278
-
SHA1
8c0abed7ec34769df754d0a96c36f304818a13a1
-
SHA256
7c51bf36e62d3094d2854fa3597c42c3cae7adffb3bb30bb95e6f38beff12cbc
-
SHA512
031b0a0e6f7be82792f4bbfebd9b59381317983a9efca3e601062937e67938c20935e98bbe75c35d8354055b8335959a73c87ee32102886d6e16b0dca0774b88
-
SSDEEP
98304:zmgSCO/UvjQwggy1zQjeIwMM46TVI9m6Pg:6gSCOAUw/y1zUewMxI9m6Pg
Malware Config
Extracted
revengerat
NyanCatRevenge
dontreachme.duckdns.org:3601
159ffe7d99124a92baa
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral2/memory/412-36-0x00000000064B0000-0x0000000006510000-memory.dmp family_zgrat_v1 behavioral2/memory/412-37-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-40-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-38-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-42-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-44-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-46-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-48-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-50-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-52-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-54-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-56-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-58-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-60-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-62-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-64-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-66-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-68-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-70-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-72-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-74-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-76-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-78-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-80-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-82-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-84-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-86-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-88-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-90-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-92-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-94-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-96-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-98-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 behavioral2/memory/412-100-0x00000000064B0000-0x0000000006509000-memory.dmp family_zgrat_v1 -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Oluzklgxzdhvq.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\JavaUpdate\\JavaUpdate.exe\"," Oluzklgxzdhvq.exe -
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b425db5faaff29191253707b4d495278.exeOluzklgxzdhvq.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation b425db5faaff29191253707b4d495278.exe Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation Oluzklgxzdhvq.exe Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation WScript.exe -
Executes dropped EXE 3 IoCs
Processes:
Bvgy.exeOluzklgxzdhvq.exeOluzklgxzdhvq.exepid process 3660 Bvgy.exe 412 Oluzklgxzdhvq.exe 4756 Oluzklgxzdhvq.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Oluzklgxzdhvq.exedescription pid process target process PID 412 set thread context of 4756 412 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
Oluzklgxzdhvq.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings Oluzklgxzdhvq.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Oluzklgxzdhvq.exepowershell.exepid process 412 Oluzklgxzdhvq.exe 412 Oluzklgxzdhvq.exe 3728 powershell.exe 3728 powershell.exe 3728 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Oluzklgxzdhvq.exepowershell.exedescription pid process Token: SeDebugPrivilege 412 Oluzklgxzdhvq.exe Token: SeDebugPrivilege 3728 powershell.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
b425db5faaff29191253707b4d495278.exeOluzklgxzdhvq.exeWScript.exedescription pid process target process PID 208 wrote to memory of 3660 208 b425db5faaff29191253707b4d495278.exe Bvgy.exe PID 208 wrote to memory of 3660 208 b425db5faaff29191253707b4d495278.exe Bvgy.exe PID 208 wrote to memory of 412 208 b425db5faaff29191253707b4d495278.exe Oluzklgxzdhvq.exe PID 208 wrote to memory of 412 208 b425db5faaff29191253707b4d495278.exe Oluzklgxzdhvq.exe PID 208 wrote to memory of 412 208 b425db5faaff29191253707b4d495278.exe Oluzklgxzdhvq.exe PID 412 wrote to memory of 4020 412 Oluzklgxzdhvq.exe WScript.exe PID 412 wrote to memory of 4020 412 Oluzklgxzdhvq.exe WScript.exe PID 412 wrote to memory of 4020 412 Oluzklgxzdhvq.exe WScript.exe PID 412 wrote to memory of 4756 412 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 412 wrote to memory of 4756 412 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 412 wrote to memory of 4756 412 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 412 wrote to memory of 4756 412 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 412 wrote to memory of 4756 412 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 412 wrote to memory of 4756 412 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 412 wrote to memory of 4756 412 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 412 wrote to memory of 4756 412 Oluzklgxzdhvq.exe Oluzklgxzdhvq.exe PID 4020 wrote to memory of 3728 4020 WScript.exe powershell.exe PID 4020 wrote to memory of 3728 4020 WScript.exe powershell.exe PID 4020 wrote to memory of 3728 4020 WScript.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b425db5faaff29191253707b4d495278.exe"C:\Users\Admin\AppData\Local\Temp\b425db5faaff29191253707b4d495278.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Bvgy.exe"C:\Users\Admin\AppData\Local\Temp\Bvgy.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Oluzklgxzdhvq.exe"C:\Users\Admin\AppData\Local\Temp\Oluzklgxzdhvq.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Vrexfkcar.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Local\JavaUpdate\JavaUpdate.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Oluzklgxzdhvq.exeC:\Users\Admin\AppData\Local\Temp\Oluzklgxzdhvq.exe3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Oluzklgxzdhvq.exe.logFilesize
1KB
MD5b5291f3dcf2c13784e09a057f2e43d13
SHA1fbb72f4b04269e0d35b1d9c29d02d63dbc7ad07e
SHA256ad995b51344d71019f96fc3a424de00256065daad8595ff599f6849c87ae75ce
SHA51211c89caac425bccaa24e2bb24c6f2b4e6d6863278bf8a5304a42bb44475b08ca586e09143e7d5b14db7f1cd9adacd5358769e0d999dc348073431031067bd4d4
-
C:\Users\Admin\AppData\Local\Temp\Bvgy.exeFilesize
3.5MB
MD59b32753bd0df3b550385c4afad000028
SHA126ec9e2f5d3d40dfe3bed8660cf64c7ade38297d
SHA2568a07295eb72d0a52277aaaf626115bd9121179e9d2dbf9881a665ecf49742e3d
SHA512dd35d177386da94c0ce1dc3d569b4875457acb27003b5d0b8af4fbf93b9dcbf4e8cf252aed62aff4828939cac8b2fdadf622dbb7f985e448b735538b270567b2
-
C:\Users\Admin\AppData\Local\Temp\Bvgy.exeFilesize
3.2MB
MD50cf73278c0af3198d9be1017ec3ad08d
SHA1dac7818701a7a2a04a4efc091661337f319dd089
SHA2566d946d83ecc4baadd350ec7b2dd38018e25b134a7131d11ee7e0a7b95a8807fd
SHA5124bdb832770f06c30fe191b940295dc767a398c1e436f57ba42cc255a114ffa0094a1ceb03cffa3c206c8a3a38c615f6ac12eb34281936e2dec2d3165a5817903
-
C:\Users\Admin\AppData\Local\Temp\Bvgy.exeFilesize
2.9MB
MD533396425aedc1765c8ee196baef1d667
SHA11035932555aa7fb79dc87c57d826525a7f455a7b
SHA25612d1c30be280889b3d9e9144fb208d2e015bc5daaa9ca57c7fb9ec708dbe2655
SHA5126cdd5c559a72757de706d32c5200b8d412d4897e6d86d5a378ffbe09a3e1a8ac27d4498c9edf6cf78747e8107b1603d27e835c3a86f9e7cd8e79ca0439796eee
-
C:\Users\Admin\AppData\Local\Temp\Oluzklgxzdhvq.exeFilesize
297KB
MD55618d560bdd22ec94586f13054864452
SHA1381035c90dc989bfc9786f8eff094df945b2f6fe
SHA256ade2df768c229a40f6d4d7da23593ac53ab6d5e35b7f936cbcb01bf3569065ca
SHA5128bcd0952421b770346bd149b89b70ae0120050a96491010dfe899cd961623d2328ddfde28c5edca3a2f9e9c326e6a2c35f8436a76e9820d79b9ff6490abe8dd7
-
C:\Users\Admin\AppData\Local\Temp\_Vrexfkcar.vbsFilesize
149B
MD575fda8189e60e05655aea55fe68591c0
SHA1de2177e12403c59f81d278497a387089ddd10d73
SHA256cf8322af201e7b0f5d5b2b93c0df541c8785436ebdf04a32addc46b13caf81c5
SHA5121bc581cbe6ba2f7f9a419bdb9b582ec5585d5cdfd8e245cab19c269d2bd4ecbc151cd98996b8d5f330304fda243c4a13388f1c601111dbab59fd0ad35e5ea647
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yhvwpdzo.jgv.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/208-3-0x0000000004C10000-0x0000000004CA2000-memory.dmpFilesize
584KB
-
memory/208-5-0x00000000053F0000-0x00000000053FA000-memory.dmpFilesize
40KB
-
memory/208-28-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/208-4-0x00000000052D0000-0x00000000052E0000-memory.dmpFilesize
64KB
-
memory/208-2-0x0000000004CE0000-0x0000000005284000-memory.dmpFilesize
5.6MB
-
memory/208-0-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/208-1-0x0000000000400000-0x00000000007CA000-memory.dmpFilesize
3.8MB
-
memory/412-88-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-721-0x00000000053B0000-0x00000000053C0000-memory.dmpFilesize
64KB
-
memory/412-33-0x00000000053B0000-0x00000000053C0000-memory.dmpFilesize
64KB
-
memory/412-34-0x00000000054E0000-0x000000000551C000-memory.dmpFilesize
240KB
-
memory/412-35-0x0000000006530000-0x00000000065A6000-memory.dmpFilesize
472KB
-
memory/412-36-0x00000000064B0000-0x0000000006510000-memory.dmpFilesize
384KB
-
memory/412-37-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-40-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-38-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-42-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-44-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-46-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-48-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-50-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-52-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-54-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-56-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-58-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-60-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-62-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-64-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-66-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-68-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-70-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-72-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-74-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-76-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-78-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-80-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-82-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-84-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-86-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-31-0x00000000053B0000-0x00000000053C0000-memory.dmpFilesize
64KB
-
memory/412-90-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-92-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-94-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-96-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-98-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-100-0x00000000064B0000-0x0000000006509000-memory.dmpFilesize
356KB
-
memory/412-32-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/412-1614-0x0000000006A20000-0x0000000006A3E000-memory.dmpFilesize
120KB
-
memory/412-30-0x00000000053B0000-0x00000000053C0000-memory.dmpFilesize
64KB
-
memory/412-27-0x0000000000910000-0x0000000000960000-memory.dmpFilesize
320KB
-
memory/412-1624-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/412-26-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/3660-23-0x00007FF7221E0000-0x00007FF722BE7000-memory.dmpFilesize
10.0MB
-
memory/3728-1649-0x000000007F8B0000-0x000000007F8C0000-memory.dmpFilesize
64KB
-
memory/3728-1674-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/3728-1628-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/3728-1629-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB
-
memory/3728-1630-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB
-
memory/3728-1631-0x0000000005540000-0x0000000005B68000-memory.dmpFilesize
6.2MB
-
memory/3728-1650-0x0000000006A20000-0x0000000006A52000-memory.dmpFilesize
200KB
-
memory/3728-1648-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB
-
memory/3728-1633-0x0000000005D40000-0x0000000005DA6000-memory.dmpFilesize
408KB
-
memory/3728-1640-0x0000000005E20000-0x0000000005E86000-memory.dmpFilesize
408KB
-
memory/3728-1644-0x00000000060B0000-0x0000000006404000-memory.dmpFilesize
3.3MB
-
memory/3728-1671-0x0000000007AA0000-0x0000000007AA8000-memory.dmpFilesize
32KB
-
memory/3728-1646-0x0000000006450000-0x000000000646E000-memory.dmpFilesize
120KB
-
memory/3728-1647-0x0000000006500000-0x000000000654C000-memory.dmpFilesize
304KB
-
memory/3728-1670-0x0000000007AB0000-0x0000000007ACA000-memory.dmpFilesize
104KB
-
memory/3728-1627-0x0000000004E60000-0x0000000004E96000-memory.dmpFilesize
216KB
-
memory/3728-1632-0x0000000005CA0000-0x0000000005CC2000-memory.dmpFilesize
136KB
-
memory/3728-1651-0x0000000070460000-0x00000000704AC000-memory.dmpFilesize
304KB
-
memory/3728-1661-0x00000000069E0000-0x00000000069FE000-memory.dmpFilesize
120KB
-
memory/3728-1662-0x00000000076D0000-0x0000000007773000-memory.dmpFilesize
652KB
-
memory/3728-1663-0x0000000007E00000-0x000000000847A000-memory.dmpFilesize
6.5MB
-
memory/3728-1664-0x0000000006B10000-0x0000000006B2A000-memory.dmpFilesize
104KB
-
memory/3728-1665-0x00000000077D0000-0x00000000077DA000-memory.dmpFilesize
40KB
-
memory/3728-1666-0x00000000079E0000-0x0000000007A76000-memory.dmpFilesize
600KB
-
memory/3728-1667-0x0000000007960000-0x0000000007971000-memory.dmpFilesize
68KB
-
memory/3728-1668-0x00000000079B0000-0x00000000079BE000-memory.dmpFilesize
56KB
-
memory/3728-1669-0x00000000079C0000-0x00000000079D4000-memory.dmpFilesize
80KB
-
memory/4756-1676-0x00000000050B0000-0x00000000050C0000-memory.dmpFilesize
64KB
-
memory/4756-1645-0x00000000050B0000-0x00000000050C0000-memory.dmpFilesize
64KB
-
memory/4756-1625-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/4756-1675-0x00000000747F0000-0x0000000074FA0000-memory.dmpFilesize
7.7MB
-
memory/4756-1626-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB