Overview
overview
10Static
static
1008751be484...2d.dll
windows7-x64
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows7-x64
30a9f79abd4...51.exe
windows10-2004-x64
31.bin/1.exe
windows7-x64
101.bin/1.exe
windows10-2004-x64
102019-09-02...10.exe
windows7-x64
102019-09-02...10.exe
windows10-2004-x64
102b5e50bc30...ba.dll
windows7-x64
102b5e50bc30...ba.dll
windows10-2004-x64
102c01b00772...eb.exe
windows7-x64
102c01b00772...eb.exe
windows10-2004-x64
931.exe
windows7-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows7-x64
13DMark 11 ...on.exe
windows10-2004-x64
142f9729255...61.exe
windows7-x64
1042f9729255...61.exe
windows10-2004-x64
1042f9729255...1).exe
windows7-x64
1042f9729255...1).exe
windows10-2004-x64
105da0116af4...18.exe
windows7-x64
75da0116af4...18.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows7-x64
1069c56d12ed...6b.exe
windows10-2004-x64
106a9e7107c9...91.exe
windows7-x64
106a9e7107c9...91.exe
windows10-2004-x64
10905d572f23...50.exe
windows7-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows7-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows7-x64
195560f1a46...f9.dll
windows10-2004-x64
1Resubmissions
03-07-2024 16:04
240703-thygmaycpc 1001-07-2024 18:12
240701-ws6xvswbkj 1001-07-2024 18:03
240701-wm5sls1gka 1001-07-2024 18:03
240701-wm39sa1gjf 1001-07-2024 18:03
240701-wm2e7avhkj 1001-07-2024 18:03
240701-wmzxcs1fre 1001-07-2024 18:02
240701-wmzats1frc 1001-07-2024 18:02
240701-wmvbwa1fqh 1022-11-2023 17:02
231122-vkac9adg64 10Analysis
-
max time kernel
32s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 18:03
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
1.bin/1.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
1.bin/1.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
2019-09-02_22-41-10.exe
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
2b5e50bc3077610128051bc3e657c3f0e331fb8fed2559c6596911890ea866ba.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
31.exe
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
31.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
3DMark 11 Advanced Edition.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
42f972925508a82236e8533567487761.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
42f972925508a82236e8533567487761(1).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
6a9e7107c97762eb1196a64baeadb291.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral29
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win7-20240611-en
Behavioral task
behavioral32
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20240508-en
General
-
Target
42f972925508a82236e8533567487761(1).exe
-
Size
3.7MB
-
MD5
9d2a888ca79e1ff3820882ea1d88d574
-
SHA1
112c38d80bf2c0d48256249bbabe906b834b1f66
-
SHA256
8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138
-
SHA512
17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840
-
SSDEEP
98304:Nn1CVf+y/EFc7DvOUxlpq2JdnQ+O2M7hlXKUmkbtT2TMI:A/EqaUFqItO2M7PXKUmkbtT2T
Malware Config
Extracted
warzonerat
sandyclark255.hopto.org:5200
Extracted
darkcomet
2020NOV1
sandyclark255.hopto.org:35887
DC_MUTEX-6XT818D
-
InstallPath
excelsl.exe
-
gencode
n7asq0Dbu7D2
-
install
true
-
offline_keylogger
true
-
password
hhhhhh
-
persistence
true
-
reg_key
office
Extracted
asyncrat
0.5.6A
sandyclark255.hopto.org:6606
sandyclark255.hopto.org:8808
sandyclark255.hopto.org:7707
adweqsds56332
-
delay
5
-
install
true
-
install_file
prndrvest.exe
-
install_folder
%AppData%
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral19/memory/2608-192-0x0000000000350000-0x0000000000362000-memory.dmp family_asyncrat -
Warzone RAT payload 6 IoCs
Processes:
resource yara_rule behavioral19/memory/796-92-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral19/memory/796-101-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral19/memory/796-99-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral19/memory/796-96-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral19/memory/796-94-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral19/memory/796-90-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2144 netsh.exe -
Executes dropped EXE 2 IoCs
Processes:
UTdIkqTxOUtGyauX.exeFMAvx0Q51GMAbAWG.exepid process 2316 UTdIkqTxOUtGyauX.exe 2152 FMAvx0Q51GMAbAWG.exe -
Loads dropped DLL 2 IoCs
Processes:
42f972925508a82236e8533567487761(1).exepid process 1612 42f972925508a82236e8533567487761(1).exe 1612 42f972925508a82236e8533567487761(1).exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2692 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
42f972925508a82236e8533567487761(1).exedescription pid process Token: SeDebugPrivilege 1612 42f972925508a82236e8533567487761(1).exe Token: SeDebugPrivilege 1612 42f972925508a82236e8533567487761(1).exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
42f972925508a82236e8533567487761(1).exedescription pid process target process PID 1612 wrote to memory of 2316 1612 42f972925508a82236e8533567487761(1).exe UTdIkqTxOUtGyauX.exe PID 1612 wrote to memory of 2316 1612 42f972925508a82236e8533567487761(1).exe UTdIkqTxOUtGyauX.exe PID 1612 wrote to memory of 2316 1612 42f972925508a82236e8533567487761(1).exe UTdIkqTxOUtGyauX.exe PID 1612 wrote to memory of 2316 1612 42f972925508a82236e8533567487761(1).exe UTdIkqTxOUtGyauX.exe PID 1612 wrote to memory of 2152 1612 42f972925508a82236e8533567487761(1).exe FMAvx0Q51GMAbAWG.exe PID 1612 wrote to memory of 2152 1612 42f972925508a82236e8533567487761(1).exe FMAvx0Q51GMAbAWG.exe PID 1612 wrote to memory of 2152 1612 42f972925508a82236e8533567487761(1).exe FMAvx0Q51GMAbAWG.exe PID 1612 wrote to memory of 2152 1612 42f972925508a82236e8533567487761(1).exe FMAvx0Q51GMAbAWG.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\UTdIkqTxOUtGyauX.exe"C:\Users\Admin\AppData\Local\Temp\UTdIkqTxOUtGyauX.exe"2⤵
- Executes dropped EXE
PID:2316 -
C:\Windows\svehosts.exe"C:\Windows\svehosts.exe"3⤵PID:2528
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE4⤵
- Modifies Windows Firewall
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\FMAvx0Q51GMAbAWG.exe"C:\Users\Admin\AppData\Local\Temp\FMAvx0Q51GMAbAWG.exe"2⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"3⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 12804⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"5⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\a2LLCza60A8ebUiF.exe"C:\Users\Admin\AppData\Local\Temp\a2LLCza60A8ebUiF.exe"2⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"3⤵PID:2024
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵PID:1928
-
C:\Users\Admin\Documents\excelsl.exe"C:\Users\Admin\Documents\excelsl.exe"4⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"5⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"5⤵PID:948
-
C:\Windows\SysWOW64\notepad.exenotepad6⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\yFgaBBNEg0p3Ek6x.exe"C:\Users\Admin\AppData\Local\Temp\yFgaBBNEg0p3Ek6x.exe"2⤵PID:2608
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'3⤵
- Scheduled Task/Job: Scheduled Task
PID:2552 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp416.tmp.bat""3⤵PID:620
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
PID:2692 -
C:\Users\Admin\AppData\Roaming\prndrvest.exe"C:\Users\Admin\AppData\Roaming\prndrvest.exe"4⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\LwrzPAXFfucYE3Kx.exe"C:\Users\Admin\AppData\Local\Temp\LwrzPAXFfucYE3Kx.exe"2⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"3⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"2⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"2⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"2⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"2⤵PID:1364
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FMAvx0Q51GMAbAWG.exeFilesize
801KB
MD59133c2a5ebf3e25aceae5a001ca6f279
SHA1319f911282f3cded94de3730fa0abd5dec8f14be
SHA2567c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d
SHA5121d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e
-
C:\Users\Admin\AppData\Local\Temp\LwrzPAXFfucYE3Kx.exeFilesize
366KB
MD5f07d2c33e4afe36ec6f6f14f9a56e84a
SHA13ebed0c1a265d1e17ce038dfaf1029387f0b53ee
SHA256309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca
SHA512b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2
-
C:\Users\Admin\AppData\Local\Temp\UTdIkqTxOUtGyauX.exeFilesize
472KB
MD52819e45588024ba76f248a39d3e232ba
SHA108a797b87ecfbee682ce14d872177dae1a5a46a2
SHA256b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93
SHA512a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a
-
C:\Users\Admin\AppData\Local\Temp\a2LLCza60A8ebUiF.exeFilesize
742KB
MD53e804917c454ca31c1cbd602682542b7
SHA11df3e81b9d879e21af299f5478051b98f3cb7739
SHA256f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1
SHA51228e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf
-
C:\Users\Admin\AppData\Local\Temp\tmp416.tmp.batFilesize
152B
MD5a306d7a3cc5b28cc3f6233c4a5174e82
SHA1f3de1da841de884c4662cbf53d4027d0212419f9
SHA2566b57ccdd004b524fdb99f27957162f076143aeb89cf69dfd5cc8b96cc16ee044
SHA51245787ff2739ff54919fce0ada375171fd92cf4d6fa062d1cb959578ca9aabec50c8db8d499c7e135d4245a478f4491407358619e6b2be021d0ba5a53c523f132
-
C:\Users\Admin\AppData\Local\Temp\yFgaBBNEg0p3Ek6x.exeFilesize
376KB
MD5590acb5fa6b5c3001ebce3d67242aac4
SHA15df39906dc4e60f01b95783fc55af6128402d611
SHA2567bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509
SHA5124ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba
-
C:\Users\Admin\AppData\Roaming\prndrvest.exeFilesize
14.9MB
MD5ecf7c3b40a7b751a827f71b419bac122
SHA146ef4944f8608c1e8af77c3728e5b4aecc8b0b1a
SHA256282bb18ed3ab5b4e98dba96432a5f6a51e88c41fd199185e7281f6e6dd2511fa
SHA512d7fb8e0adf8bca19efcd2a25c9feea9618347fa9bda71f95675d503f28fbc5be88f71257c14c5c7d001289585d19e2a5f111759dcce7c40e9bf3deb2fb3d5d74
-
C:\Users\Admin\AppData\Roaming\prndrvest.exeFilesize
13.9MB
MD5d22ffb464c54d36ab31fd7d142e601c5
SHA1e14c446058182e127231f9317d129f21a9986c2e
SHA256b11d54a8881a29bd20420308610b5585f5ab8d11b240c2df57d84dad306a47b6
SHA5129a8ee9b5ae21faf787d6a1aa0c16a1cb068ebab896684eaab034b7589d85288ac15e9c033435ab6bd92678eb03636e2c533757b5b122f8e6e37872e349494fdd
-
C:\Users\Admin\AppData\Roaming\prndrvest.exeFilesize
14.6MB
MD561ad3e6f0eb24082a6601611b5f96b4c
SHA1c15fa5e88886eeb13e7ddccc575b60a27c2fe3ce
SHA25602167726ddc7c45607742a8b9ef93c75ee94adebe957522df74e781ccf5e7431
SHA51233f54b36b777bed0948f43ae0fc888edfac26ce8c4265d9ad01c32a62208f80e4a1bc5cf04fc0f2d83069a3beb8b185cc32b3a5f36590a346a6d75c409424b87
-
\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exeFilesize
3.7MB
MD59d2a888ca79e1ff3820882ea1d88d574
SHA1112c38d80bf2c0d48256249bbabe906b834b1f66
SHA2568b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138
SHA51217a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840
-
\Users\Admin\AppData\Roaming\prndrvest.exeFilesize
13.9MB
MD5ff4d0b13940493494c71b5b6cfe06a81
SHA1963c030039103f5e9aedcf9c3a666e51ae0e0107
SHA25624b06cf74829155530e8ffbd18a55dbb49dc10c5c0c4f0bfed901ed7aba8723a
SHA512fee9b97bdf685a98e7e265fdfa04f4d9890e9d430db393b2db9598d925676ad1e8dd4af0604be36504d7d70e6785506e51aa25fd902ae4d28017260e3181a2b4
-
memory/796-84-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/796-88-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/796-90-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/796-94-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/796-96-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/796-98-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/796-99-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/796-101-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/796-92-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/796-86-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1364-71-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1364-69-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1364-76-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1364-75-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1364-59-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1364-61-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1364-63-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1364-65-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1364-67-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1364-73-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1608-287-0x0000000000310000-0x0000000000374000-memory.dmpFilesize
400KB
-
memory/1608-288-0x0000000001D40000-0x0000000001D64000-memory.dmpFilesize
144KB
-
memory/1612-0-0x0000000074411000-0x0000000074412000-memory.dmpFilesize
4KB
-
memory/1612-78-0x0000000074410000-0x00000000749BB000-memory.dmpFilesize
5.7MB
-
memory/1612-1-0x0000000074410000-0x00000000749BB000-memory.dmpFilesize
5.7MB
-
memory/1612-2-0x0000000074410000-0x00000000749BB000-memory.dmpFilesize
5.7MB
-
memory/1612-3-0x0000000074410000-0x00000000749BB000-memory.dmpFilesize
5.7MB
-
memory/1928-132-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2024-125-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2024-124-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2024-122-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2024-120-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2024-118-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2024-116-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2024-114-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2024-112-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2024-110-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2024-127-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2152-41-0x0000000074410000-0x00000000749BB000-memory.dmpFilesize
5.7MB
-
memory/2152-283-0x0000000074410000-0x00000000749BB000-memory.dmpFilesize
5.7MB
-
memory/2316-21-0x0000000074410000-0x00000000749BB000-memory.dmpFilesize
5.7MB
-
memory/2316-264-0x0000000074410000-0x00000000749BB000-memory.dmpFilesize
5.7MB
-
memory/2316-20-0x0000000074410000-0x00000000749BB000-memory.dmpFilesize
5.7MB
-
memory/2316-35-0x0000000074410000-0x00000000749BB000-memory.dmpFilesize
5.7MB
-
memory/2608-161-0x0000000000650000-0x0000000000674000-memory.dmpFilesize
144KB
-
memory/2608-192-0x0000000000350000-0x0000000000362000-memory.dmpFilesize
72KB
-
memory/2608-104-0x0000000000520000-0x0000000000544000-memory.dmpFilesize
144KB
-
memory/2608-79-0x0000000001090000-0x00000000010F4000-memory.dmpFilesize
400KB