Overview
overview
10Static
static
1008751be484...2d.dll
windows7-x64
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows7-x64
30a9f79abd4...51.exe
windows10-2004-x64
31.bin/1.exe
windows7-x64
101.bin/1.exe
windows10-2004-x64
102019-09-02...10.exe
windows7-x64
102019-09-02...10.exe
windows10-2004-x64
102b5e50bc30...ba.dll
windows7-x64
102b5e50bc30...ba.dll
windows10-2004-x64
102c01b00772...eb.exe
windows7-x64
102c01b00772...eb.exe
windows10-2004-x64
931.exe
windows7-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows7-x64
13DMark 11 ...on.exe
windows10-2004-x64
142f9729255...61.exe
windows7-x64
1042f9729255...61.exe
windows10-2004-x64
1042f9729255...1).exe
windows7-x64
1042f9729255...1).exe
windows10-2004-x64
105da0116af4...18.exe
windows7-x64
75da0116af4...18.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows7-x64
1069c56d12ed...6b.exe
windows10-2004-x64
106a9e7107c9...91.exe
windows7-x64
106a9e7107c9...91.exe
windows10-2004-x64
10905d572f23...50.exe
windows7-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows7-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows7-x64
195560f1a46...f9.dll
windows10-2004-x64
1Resubmissions
03-07-2024 16:04
240703-thygmaycpc 1001-07-2024 18:12
240701-ws6xvswbkj 1001-07-2024 18:03
240701-wm5sls1gka 1001-07-2024 18:03
240701-wm39sa1gjf 1001-07-2024 18:03
240701-wm2e7avhkj 1001-07-2024 18:03
240701-wmzxcs1fre 1001-07-2024 18:02
240701-wmzats1frc 1001-07-2024 18:02
240701-wmvbwa1fqh 1022-11-2023 17:02
231122-vkac9adg64 10Analysis
-
max time kernel
35s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 18:03
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
1.bin/1.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
1.bin/1.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
2019-09-02_22-41-10.exe
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
31.exe
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
31.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
3DMark 11 Advanced Edition.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
42f972925508a82236e8533567487761.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win7-20240611-en
Behavioral task
behavioral32
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20240508-en
General
-
Target
42f972925508a82236e8533567487761.exe
-
Size
3.7MB
-
MD5
9d2a888ca79e1ff3820882ea1d88d574
-
SHA1
112c38d80bf2c0d48256249bbabe906b834b1f66
-
SHA256
8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138
-
SHA512
17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840
-
SSDEEP
98304:Nn1CVf+y/EFc7DvOUxlpq2JdnQ+O2M7hlXKUmkbtT2TMI:A/EqaUFqItO2M7PXKUmkbtT2T
Malware Config
Extracted
babylonrat
sandyclark255.hopto.org
Extracted
warzonerat
sandyclark255.hopto.org:5200
Extracted
darkcomet
2020NOV1
sandyclark255.hopto.org:35887
DC_MUTEX-6XT818D
-
InstallPath
excelsl.exe
-
gencode
n7asq0Dbu7D2
-
install
true
-
offline_keylogger
true
-
password
hhhhhh
-
persistence
true
-
reg_key
office
Extracted
asyncrat
0.5.6A
sandyclark255.hopto.org:6606
sandyclark255.hopto.org:8808
sandyclark255.hopto.org:7707
adweqsds56332
-
delay
5
-
install
true
-
install_file
prndrvest.exe
-
install_folder
%AppData%
Signatures
-
Babylon RAT
Babylon RAT is remote access trojan written in C++.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral18/memory/1720-135-0x0000000005AD0000-0x0000000005AE2000-memory.dmp family_asyncrat behavioral18/memory/1720-130-0x0000000005AB0000-0x0000000005AC2000-memory.dmp family_asyncrat behavioral18/memory/4212-248-0x0000000004450000-0x0000000004462000-memory.dmp family_asyncrat -
Warzone RAT payload 2 IoCs
Processes:
resource yara_rule behavioral18/memory/216-103-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral18/memory/216-107-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 3700 netsh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2136 4968 WerFault.exe 42f972925508a82236e8533567487761.exe 4540 232 WerFault.exe ggdDps0NjCFmG0Z6.exe 3960 1188 WerFault.exe aBfeHwFyWQexZmfS.exe 1136 5032 WerFault.exe IUJyqhFH3KYNdkBO.exe 3040 2984 WerFault.exe excelsl.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2684 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
42f972925508a82236e8533567487761.exedescription pid process Token: SeDebugPrivilege 4968 42f972925508a82236e8533567487761.exe Token: SeDebugPrivilege 4968 42f972925508a82236e8533567487761.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\oDPUBZw4SlWV0WBh.exe"C:\Users\Admin\AppData\Local\Temp\oDPUBZw4SlWV0WBh.exe"2⤵PID:2160
-
C:\Windows\svehosts.exe"C:\Windows\svehosts.exe"3⤵PID:1820
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\Z6v8OjtD5WyOd6mP.exe"C:\Users\Admin\AppData\Local\Temp\Z6v8OjtD5WyOd6mP.exe"2⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"3⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 22724⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"5⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"5⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\IUJyqhFH3KYNdkBO.exe"C:\Users\Admin\AppData\Local\Temp\IUJyqhFH3KYNdkBO.exe"2⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"3⤵PID:4500
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵PID:4292
-
C:\Users\Admin\Documents\excelsl.exe"C:\Users\Admin\Documents\excelsl.exe"4⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"5⤵PID:4956
-
C:\Windows\SysWOW64\notepad.exenotepad6⤵PID:3712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 11285⤵
- Program crash
PID:3040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 11563⤵
- Program crash
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\KzSnbtqLkIRIGgN6.exe"C:\Users\Admin\AppData\Local\Temp\KzSnbtqLkIRIGgN6.exe"2⤵PID:1720
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF75B.tmp.bat""3⤵PID:3204
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
PID:2684 -
C:\Users\Admin\AppData\Roaming\prndrvest.exe"C:\Users\Admin\AppData\Roaming\prndrvest.exe"4⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\ggdDps0NjCFmG0Z6.exe"C:\Users\Admin\AppData\Local\Temp\ggdDps0NjCFmG0Z6.exe"2⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"3⤵PID:216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 11603⤵
- Program crash
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\aBfeHwFyWQexZmfS.exe"C:\Users\Admin\AppData\Local\Temp\aBfeHwFyWQexZmfS.exe"2⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"3⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"3⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"3⤵PID:3312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 11643⤵
- Program crash
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"2⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"2⤵PID:3300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 16362⤵
- Program crash
PID:2136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4968 -ip 49681⤵PID:1276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 232 -ip 2321⤵PID:2468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1188 -ip 11881⤵PID:2456
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5032 -ip 50321⤵PID:1276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2984 -ip 29841⤵PID:4324
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exeFilesize
3.7MB
MD59d2a888ca79e1ff3820882ea1d88d574
SHA1112c38d80bf2c0d48256249bbabe906b834b1f66
SHA2568b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138
SHA51217a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840
-
C:\Users\Admin\AppData\Local\Temp\IUJyqhFH3KYNdkBO.exeFilesize
742KB
MD53e804917c454ca31c1cbd602682542b7
SHA11df3e81b9d879e21af299f5478051b98f3cb7739
SHA256f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA51228e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf
-
C:\Users\Admin\AppData\Local\Temp\KzSnbtqLkIRIGgN6.exeFilesize
376KB
MD5590acb5fa6b5c3001ebce3d67242aac4
SHA15df39906dc4e60f01b95783fc55af6128402d611
SHA2567bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509
SHA5124ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba
-
C:\Users\Admin\AppData\Local\Temp\Z6v8OjtD5WyOd6mP.exeFilesize
801KB
MD59133c2a5ebf3e25aceae5a001ca6f279
SHA1319f911282f3cded94de3730fa0abd5dec8f14be
SHA2567c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d
SHA5121d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e
-
C:\Users\Admin\AppData\Local\Temp\aBfeHwFyWQexZmfS.exeFilesize
336KB
MD5e87459f61fd1f017d4bd6b0a1a1fc86a
SHA130838d010aad8c9f3fd0fc302e71b4cbe6f138c0
SHA256ec1b56551036963a425f6a0564d75980054e01d251c88eb29c81c1b2182f5727
SHA512dd13993174d234d60ec98124b71bfefcf556c069e482a2e1f127f81f6738b71cd37cee95bf0119d3a61513c01438055767d480e26d6ed260ee16a96533d0cfa2
-
C:\Users\Admin\AppData\Local\Temp\ggdDps0NjCFmG0Z6.exeFilesize
366KB
MD5f07d2c33e4afe36ec6f6f14f9a56e84a
SHA13ebed0c1a265d1e17ce038dfaf1029387f0b53ee
SHA256309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca
SHA512b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2
-
C:\Users\Admin\AppData\Local\Temp\oDPUBZw4SlWV0WBh.exeFilesize
472KB
MD52819e45588024ba76f248a39d3e232ba
SHA108a797b87ecfbee682ce14d872177dae1a5a46a2
SHA256b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93
SHA512a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a
-
C:\Users\Admin\AppData\Local\Temp\tmpF75B.tmp.batFilesize
153B
MD5ce30b65b2e171da01319f17fec45c4dc
SHA1993d16733411ad8367cd43a44a9173cb00be3add
SHA256c9a81361fd838ffd4ec6ed795bacf90d4f01902d129ab41588c6816be402be31
SHA5128b9b35ef3ca8f38a8bee4d41b6bc4ec1b284a61fdd59271ebad38741e2d696fc797e85a714d3a5fe3a138599a238899c890ac9c512ee2514fdc3c3be17830b96
-
C:\Users\Admin\AppData\Roaming\prndrvest.exeFilesize
5.1MB
MD57055873b38227fb96c25d8d5c94d5931
SHA199908c321b07717c07eb596281fcce6fe253270d
SHA2562041fcbe46a10a3391901c6f66d653ad6d54c67132114282f7dfc37b18788257
SHA512448ed610c10bef0e8f5e2168f9857707062db6ab437816e1176a1c2504b62a5ef1fc3e52fdeb5bc6012828463268e68e2dfb6c9d127989615ed16d2a56c472fb
-
C:\Users\Admin\AppData\Roaming\prndrvest.exeFilesize
4.6MB
MD5b60cd441e3f25fac395cacdcc06ac4d7
SHA18c59d8a2926886903b1d9a46c98605219b0994a1
SHA256bea7dbe66cd6dc6daedd484da1b2b41b687ceaaef4989a499e393f4b707dbe5b
SHA5123e95d8b30223131358197e40cff9abb861734e418a91222bb494ab1da38d39d559c398a00755ad6922c2497192efeb5e9cc3d976a1ded6716ceeb586fc433fea
-
memory/216-107-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/216-103-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1720-222-0x000000000ADA0000-0x000000000AE06000-memory.dmpFilesize
408KB
-
memory/1720-78-0x0000000000E20000-0x0000000000E84000-memory.dmpFilesize
400KB
-
memory/1720-130-0x0000000005AB0000-0x0000000005AC2000-memory.dmpFilesize
72KB
-
memory/1720-85-0x00000000057A0000-0x00000000057AA000-memory.dmpFilesize
40KB
-
memory/1720-83-0x00000000056E0000-0x0000000005772000-memory.dmpFilesize
584KB
-
memory/1720-82-0x0000000005D70000-0x0000000006314000-memory.dmpFilesize
5.6MB
-
memory/1720-223-0x000000000B110000-0x000000000B1AC000-memory.dmpFilesize
624KB
-
memory/1720-88-0x0000000009910000-0x0000000009934000-memory.dmpFilesize
144KB
-
memory/1720-135-0x0000000005AD0000-0x0000000005AE2000-memory.dmpFilesize
72KB
-
memory/2160-35-0x0000000074620000-0x0000000074BD1000-memory.dmpFilesize
5.7MB
-
memory/2160-56-0x0000000074620000-0x0000000074BD1000-memory.dmpFilesize
5.7MB
-
memory/2160-68-0x0000000074620000-0x0000000074BD1000-memory.dmpFilesize
5.7MB
-
memory/2160-207-0x0000000074620000-0x0000000074BD1000-memory.dmpFilesize
5.7MB
-
memory/2272-108-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2272-124-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2272-220-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2272-111-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2272-102-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2272-98-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2272-106-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2272-96-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2272-93-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2272-110-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/2304-201-0x0000000000400000-0x00000000004C2000-memory.dmpFilesize
776KB
-
memory/3272-76-0x0000000074620000-0x0000000074BD1000-memory.dmpFilesize
5.7MB
-
memory/3272-245-0x0000000074620000-0x0000000074BD1000-memory.dmpFilesize
5.7MB
-
memory/3300-80-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/3312-119-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3312-121-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/3712-227-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB
-
memory/4212-248-0x0000000004450000-0x0000000004462000-memory.dmpFilesize
72KB
-
memory/4292-139-0x0000000000540000-0x0000000000541000-memory.dmpFilesize
4KB
-
memory/4500-132-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4500-134-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4500-128-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4956-229-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4956-228-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4956-226-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4956-224-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4968-3-0x0000000074622000-0x0000000074623000-memory.dmpFilesize
4KB
-
memory/4968-4-0x0000000074620000-0x0000000074BD1000-memory.dmpFilesize
5.7MB
-
memory/4968-2-0x0000000074620000-0x0000000074BD1000-memory.dmpFilesize
5.7MB
-
memory/4968-1-0x0000000074620000-0x0000000074BD1000-memory.dmpFilesize
5.7MB
-
memory/4968-87-0x0000000074620000-0x0000000074BD1000-memory.dmpFilesize
5.7MB
-
memory/4968-0-0x0000000074622000-0x0000000074623000-memory.dmpFilesize
4KB
-
memory/5032-84-0x0000000074620000-0x0000000074BD1000-memory.dmpFilesize
5.7MB
-
memory/5032-209-0x0000000074620000-0x0000000074BD1000-memory.dmpFilesize
5.7MB