Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows7_x64 -
resource
win7 -
submitted
30-06-2020 13:21
General
-
Target
Update on Stamp Duty Charges on Paga.pdf.scr
-
Size
474KB
-
MD5
931d6095b12f270ab926dd037d3b8430
-
SHA1
ae8832bcefff293fd6d4c29d00362e3ed5a2202c
-
SHA256
65603c7a88beb93205d2012ca8d63dba310fc0f7f91fc81300734ee3b2eb3f10
-
SHA512
c69971083b4fbbb7b3c8098f1fdc7edc8b66642d04ac0f2fe795eae4f1a5cd0dac08658e2814ee2a31e3b3472f4def59056c1142d4d63eece3ad7368e8aa67d2
Score
10/10
Malware Config
Extracted
Family
nanocore
Version
1.2.2.0
C2
grace532.sytes.net:1919
Mutex
02171e57-d8c6-4512-9969-2622471b4b14
Attributes
-
activate_away_mode
true
-
backup_connection_host
grace532.sytes.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-04-10T08:21:11.593844436Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1919
-
default_group
New House New Grace
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
02171e57-d8c6-4512-9969-2622471b4b14
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
grace532.sytes.net
-
primary_dns_server
8.8.8.8
-
request_elevation
false
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Adds Run entry to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 27 IoCs
-
Suspicious behavior: EnumeratesProcesses 11603 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Drops startup file 2 IoCs
-
Suspicious use of WriteProcessMemory 440 IoCs
-
Suspicious behavior: MapViewOfSection 30 IoCs
-
Suspicious use of AdjustPrivilegeToken 28 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Drops startup file
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Adds Run entry to start application
- Suspicious behavior: GetForegroundWindowSpam
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3F31.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WAN Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp405A.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S2⤵
- Suspicious use of SetThreadContext
- Drops startup file
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S4⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S8⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S9⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S10⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S13⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S14⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S15⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S16⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S17⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S18⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S19⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S20⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S21⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S22⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S23⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S24⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S25⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S26⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S27⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr"C:\Users\Admin\AppData\Local\Temp\Update on Stamp Duty Charges on Paga.pdf.scr" /S28⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3F31.tmp
-
C:\Users\Admin\AppData\Local\Temp\tmp405A.tmp
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe
-
memory/272-5-0x0000000000000000-mapping.dmp
-
memory/280-39-0x0000000000000000-mapping.dmp
-
memory/288-74-0x0000000000000000-mapping.dmp
-
memory/316-4-0x0000000000000000-mapping.dmp
-
memory/548-136-0x000000000041E792-mapping.dmp
-
memory/648-36-0x000000000041E792-mapping.dmp
-
memory/684-61-0x000000000041E792-mapping.dmp
-
memory/684-29-0x0000000000000000-mapping.dmp
-
memory/768-7-0x0000000000000000-mapping.dmp
-
memory/844-2-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/844-1-0x000000000041E792-mapping.dmp
-
memory/844-0-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/844-3-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/852-104-0x0000000000000000-mapping.dmp
-
memory/932-59-0x0000000000000000-mapping.dmp
-
memory/1020-89-0x0000000000000000-mapping.dmp
-
memory/1040-84-0x0000000000000000-mapping.dmp
-
memory/1072-124-0x0000000000000000-mapping.dmp
-
memory/1076-34-0x0000000000000000-mapping.dmp
-
memory/1140-131-0x000000000041E792-mapping.dmp
-
memory/1140-13-0x0000000000000000-mapping.dmp
-
memory/1144-99-0x0000000000000000-mapping.dmp
-
memory/1144-139-0x0000000000000000-mapping.dmp
-
memory/1152-31-0x000000000041E792-mapping.dmp
-
memory/1332-81-0x000000000041E792-mapping.dmp
-
memory/1352-79-0x0000000000000000-mapping.dmp
-
memory/1428-66-0x000000000041E792-mapping.dmp
-
memory/1468-121-0x000000000041E792-mapping.dmp
-
memory/1492-41-0x000000000041E792-mapping.dmp
-
memory/1532-46-0x000000000041E792-mapping.dmp
-
memory/1540-91-0x000000000041E792-mapping.dmp
-
memory/1548-10-0x000000000041E792-mapping.dmp
-
memory/1576-71-0x000000000041E792-mapping.dmp
-
memory/1584-54-0x0000000000000000-mapping.dmp
-
memory/1612-19-0x0000000000000000-mapping.dmp
-
memory/1628-119-0x0000000000000000-mapping.dmp
-
memory/1656-69-0x0000000000000000-mapping.dmp
-
memory/1660-101-0x000000000041E792-mapping.dmp
-
memory/1676-94-0x0000000000000000-mapping.dmp
-
memory/1704-64-0x0000000000000000-mapping.dmp
-
memory/1752-51-0x000000000041E792-mapping.dmp
-
memory/1768-129-0x0000000000000000-mapping.dmp
-
memory/1776-126-0x000000000041E792-mapping.dmp
-
memory/1792-86-0x000000000041E792-mapping.dmp
-
memory/1796-16-0x000000000041E792-mapping.dmp
-
memory/1804-76-0x000000000041E792-mapping.dmp
-
memory/1808-109-0x0000000000000000-mapping.dmp
-
memory/1840-116-0x000000000041E792-mapping.dmp
-
memory/1844-134-0x0000000000000000-mapping.dmp
-
memory/1856-44-0x0000000000000000-mapping.dmp
-
memory/1868-21-0x000000000041E792-mapping.dmp
-
memory/1892-111-0x000000000041E792-mapping.dmp
-
memory/1920-106-0x000000000041E792-mapping.dmp
-
memory/1936-49-0x0000000000000000-mapping.dmp
-
memory/1940-96-0x000000000041E792-mapping.dmp
-
memory/1944-56-0x000000000041E792-mapping.dmp
-
memory/1944-24-0x0000000000000000-mapping.dmp
-
memory/2036-26-0x000000000041E792-mapping.dmp
-
memory/2044-114-0x0000000000000000-mapping.dmp