Analysis
-
max time kernel
600s -
max time network
601s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
06-06-2024 15:14
Static task
static1
Behavioral task
behavioral1
Sample
payload.exe
Resource
win11-20240508-en
General
-
Target
payload.exe
-
Size
1.2MB
-
MD5
4d817a69110373bdddd38cc48e0dea99
-
SHA1
1d6b94e10e0e505385cb4c11eb35b9cb125e733b
-
SHA256
9c2258154d012c1b3672fa4a393277f19bed2a6e953991a1100691ee4860c2e8
-
SHA512
05562e254dea7d350a0fabdca31257f7145f00524a79bd88173825f7cc8ecedb618e3f5c66294e07461dafa48c29b6f9c3a879ad186a1dd251c10e524f09cb56
-
SSDEEP
24576:QpFb3Jd89aZ6djkQgnFvyDKJmw3LoP/aYniKTi6iBRcqVXLv6h:Qp/mCFqWJmML/Z76h
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 63 IoCs
Processes:
resource yara_rule behavioral1/memory/3020-1-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-4-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-5-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-3-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-2-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-7-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-6-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-9-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-8-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-12-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-13-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-16-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-17-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-20-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-45-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-19-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-68-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-65-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-67-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-66-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-64-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-63-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-62-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-60-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-61-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-59-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-53-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-50-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-49-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-48-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-46-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-47-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-44-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-43-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-39-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-41-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-15-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-34-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-14-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-32-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-30-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-31-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-58-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-25-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-56-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-57-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-27-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-21-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-18-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-40-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-38-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-35-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-37-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-36-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-33-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-11-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-29-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-26-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-28-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-22-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-23-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-10-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 behavioral1/memory/3020-24-0x0000000002A40000-0x0000000003A40000-memory.dmp modiloader_stage2 -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE 1 IoCs
Processes:
cmd.pifpid process 2744 cmd.pif -
Loads dropped DLL 1 IoCs
Processes:
cmd.pifpid process 2744 cmd.pif -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
payload.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bhvdpblh = "C:\\Users\\Public\\Bhvdpblh.url" payload.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
payload.exeNETSTAT.EXEdescription pid process target process PID 3020 set thread context of 3292 3020 payload.exe Explorer.EXE PID 2300 set thread context of 3292 2300 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 2300 NETSTAT.EXE -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 23 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 24 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepayload.exeNETSTAT.EXEpid process 3068 powershell.exe 3068 powershell.exe 3020 payload.exe 3020 payload.exe 3020 payload.exe 3020 payload.exe 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE 2300 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3292 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
payload.exeNETSTAT.EXEpid process 3020 payload.exe 3020 payload.exe 3020 payload.exe 2300 NETSTAT.EXE 2300 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepayload.exeExplorer.EXENETSTAT.EXEdescription pid process Token: SeDebugPrivilege 3068 powershell.exe Token: SeDebugPrivilege 3020 payload.exe Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeDebugPrivilege 2300 NETSTAT.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE Token: SeCreatePagefilePrivilege 3292 Explorer.EXE Token: SeShutdownPrivilege 3292 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
payload.execmd.execmd.pifcmd.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 3020 wrote to memory of 2684 3020 payload.exe cmd.exe PID 3020 wrote to memory of 2684 3020 payload.exe cmd.exe PID 3020 wrote to memory of 2684 3020 payload.exe cmd.exe PID 3020 wrote to memory of 3164 3020 payload.exe cmd.exe PID 3020 wrote to memory of 3164 3020 payload.exe cmd.exe PID 3020 wrote to memory of 3164 3020 payload.exe cmd.exe PID 3020 wrote to memory of 3988 3020 payload.exe cmd.exe PID 3020 wrote to memory of 3988 3020 payload.exe cmd.exe PID 3020 wrote to memory of 3988 3020 payload.exe cmd.exe PID 3988 wrote to memory of 2744 3988 cmd.exe cmd.pif PID 3988 wrote to memory of 2744 3988 cmd.exe cmd.pif PID 2744 wrote to memory of 4648 2744 cmd.pif cmd.exe PID 2744 wrote to memory of 4648 2744 cmd.pif cmd.exe PID 4648 wrote to memory of 3068 4648 cmd.exe powershell.exe PID 4648 wrote to memory of 3068 4648 cmd.exe powershell.exe PID 3020 wrote to memory of 1532 3020 payload.exe extrac32.exe PID 3020 wrote to memory of 1532 3020 payload.exe extrac32.exe PID 3020 wrote to memory of 1532 3020 payload.exe extrac32.exe PID 3292 wrote to memory of 2300 3292 Explorer.EXE NETSTAT.EXE PID 3292 wrote to memory of 2300 3292 Explorer.EXE NETSTAT.EXE PID 3292 wrote to memory of 2300 3292 Explorer.EXE NETSTAT.EXE PID 2300 wrote to memory of 3980 2300 NETSTAT.EXE cmd.exe PID 2300 wrote to memory of 3980 2300 NETSTAT.EXE cmd.exe PID 2300 wrote to memory of 3980 2300 NETSTAT.EXE cmd.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payload.exe"C:\Users\Admin\AppData\Local\Temp\payload.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir "\\?\C:\Windows "3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir "\\?\C:\Windows \System32"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\\Windows \\System32\\cmd.pif"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows \System32\cmd.pif"C:\\Windows \\System32\\cmd.pif"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c start /min powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:'5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\payload.exe C:\\Users\\Public\\Libraries\\Bhvdpblh.PIF3⤵
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\payload.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pdtyapnl.nfy.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows \System32\cmd.pifFilesize
94KB
MD5869640d0a3f838694ab4dfea9e2f544d
SHA1bdc42b280446ba53624ff23f314aadb861566832
SHA2560db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323
SHA5126e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7
-
C:\Windows \System32\netutils.dllFilesize
109KB
MD53ef9e89c8bf16295c84b8c82bf5e1b50
SHA145fb8e0cd06da23564712614481265679369fee3
SHA256e0d3d0cf79d7969da536946de8a7395cab39ddfaca7ba7353aa6544d04209b2e
SHA5120d27d4fe85117003830b69575ea02b7ee67601db7d8b2e422f5f9b72735b9b3d15ab8b81b7a9f4f2b14caf1365d0137d9d437932c4640f97c883d3c7bf24a1c1
-
memory/3020-0-0x0000000000810000-0x0000000000811000-memory.dmpFilesize
4KB
-
memory/3020-1-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-4-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-5-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-3-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-2-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-7-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-6-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-9-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-8-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-12-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-13-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-16-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-17-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-20-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-45-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-19-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-89-0x0000000000400000-0x0000000000546000-memory.dmpFilesize
1.3MB
-
memory/3020-68-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-65-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-67-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-66-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-64-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-63-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-62-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-60-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-61-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-59-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-53-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-50-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-49-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-48-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-46-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-47-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-44-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-43-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-39-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-41-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-15-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-34-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-14-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-32-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-30-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-31-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-58-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-25-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-56-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-57-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-27-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-21-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-18-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-40-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-38-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-35-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-37-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-36-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-33-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-11-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-29-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-26-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-28-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-22-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-23-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-10-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3020-24-0x0000000002A40000-0x0000000003A40000-memory.dmpFilesize
16.0MB
-
memory/3068-301-0x000002ABE6300000-0x000002ABE6322000-memory.dmpFilesize
136KB