Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-09-2022 14:52
Static task
static1
Behavioral task
behavioral1
Sample
4e4d51350f186355c0bade0a4093847b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4e4d51350f186355c0bade0a4093847b.exe
Resource
win10v2004-20220812-en
General
-
Target
4e4d51350f186355c0bade0a4093847b.exe
-
Size
5.0MB
-
MD5
4e4d51350f186355c0bade0a4093847b
-
SHA1
6b0bb9f756eb18699f354aed4d8ecdccddf26c71
-
SHA256
b244154eb02dde8424ac1dfc45cf8b1351de4c80c35ccbc338be7425c0a382d7
-
SHA512
76b306573ca767339730d675670d8259ca02a823dfd27b1833e2fc8a4b4d9e32cbf72943f6dbec13dc83a6f173dde1ab317bcf34f50c57f1826c38a4567608ad
-
SSDEEP
98304:BdGzxEoKDl5ZLICyK5CW+AHYmK8/t1UjgX98k1Lh8Tyd1:BdGJC59yICNiYmrv98k11nd1
Malware Config
Extracted
warzonerat
sheet.duckdns.org:4110
Extracted
bitrat
1.38
sheet.duckdns.org:8471
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
install_dir
Install path
-
install_file
Install name
-
tor_process
tor
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Temp\explorer.exe warzonerat C:\Users\Admin\Documents\explorer.exe warzonerat C:\Users\Admin\Documents\explorer.exe warzonerat -
Executes dropped EXE 4 IoCs
Processes:
XRCCYX.exeexplorer.exeupdater.exeexplorer.exepid process 3532 XRCCYX.exe 4944 explorer.exe 2536 updater.exe 2688 explorer.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4e4d51350f186355c0bade0a4093847b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 4e4d51350f186355c0bade0a4093847b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
updater.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Install name = "C:\\Users\\Admin\\AppData\\Local\\Install path\\Install name" updater.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Install name = "C:\\Users\\Admin\\AppData\\Local\\Install path\\Install nameȀ" updater.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\XRCCYX.exe autoit_exe C:\Users\Admin\AppData\Local\Temp\XRCCYX.exe autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
updater.exepid process 2536 updater.exe 2536 updater.exe 2536 updater.exe 2536 updater.exe 2536 updater.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 1 IoCs
Processes:
4e4d51350f186355c0bade0a4093847b.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings 4e4d51350f186355c0bade0a4093847b.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4188 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeXRCCYX.exepowershell.exepid process 3180 powershell.exe 3180 powershell.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 4084 powershell.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 3532 XRCCYX.exe 4084 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
XRCCYX.exepid process 3532 XRCCYX.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
updater.exepowershell.exepowershell.exedescription pid process Token: SeShutdownPrivilege 2536 updater.exe Token: SeDebugPrivilege 3180 powershell.exe Token: SeDebugPrivilege 4084 powershell.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEupdater.exepid process 4188 EXCEL.EXE 2536 updater.exe 2536 updater.exe 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE 4188 EXCEL.EXE -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
4e4d51350f186355c0bade0a4093847b.exeexplorer.exeXRCCYX.exeexplorer.exedescription pid process target process PID 3972 wrote to memory of 3532 3972 4e4d51350f186355c0bade0a4093847b.exe XRCCYX.exe PID 3972 wrote to memory of 3532 3972 4e4d51350f186355c0bade0a4093847b.exe XRCCYX.exe PID 3972 wrote to memory of 3532 3972 4e4d51350f186355c0bade0a4093847b.exe XRCCYX.exe PID 3972 wrote to memory of 4944 3972 4e4d51350f186355c0bade0a4093847b.exe explorer.exe PID 3972 wrote to memory of 4944 3972 4e4d51350f186355c0bade0a4093847b.exe explorer.exe PID 3972 wrote to memory of 4944 3972 4e4d51350f186355c0bade0a4093847b.exe explorer.exe PID 3972 wrote to memory of 2536 3972 4e4d51350f186355c0bade0a4093847b.exe updater.exe PID 3972 wrote to memory of 2536 3972 4e4d51350f186355c0bade0a4093847b.exe updater.exe PID 3972 wrote to memory of 2536 3972 4e4d51350f186355c0bade0a4093847b.exe updater.exe PID 3972 wrote to memory of 4188 3972 4e4d51350f186355c0bade0a4093847b.exe EXCEL.EXE PID 3972 wrote to memory of 4188 3972 4e4d51350f186355c0bade0a4093847b.exe EXCEL.EXE PID 3972 wrote to memory of 4188 3972 4e4d51350f186355c0bade0a4093847b.exe EXCEL.EXE PID 4944 wrote to memory of 3180 4944 explorer.exe powershell.exe PID 4944 wrote to memory of 3180 4944 explorer.exe powershell.exe PID 4944 wrote to memory of 3180 4944 explorer.exe powershell.exe PID 4944 wrote to memory of 2688 4944 explorer.exe explorer.exe PID 4944 wrote to memory of 2688 4944 explorer.exe explorer.exe PID 4944 wrote to memory of 2688 4944 explorer.exe explorer.exe PID 3532 wrote to memory of 3880 3532 XRCCYX.exe WSCript.exe PID 3532 wrote to memory of 3880 3532 XRCCYX.exe WSCript.exe PID 3532 wrote to memory of 3880 3532 XRCCYX.exe WSCript.exe PID 2688 wrote to memory of 4084 2688 explorer.exe powershell.exe PID 2688 wrote to memory of 4084 2688 explorer.exe powershell.exe PID 2688 wrote to memory of 4084 2688 explorer.exe powershell.exe PID 2688 wrote to memory of 2184 2688 explorer.exe cmd.exe PID 2688 wrote to memory of 2184 2688 explorer.exe cmd.exe PID 2688 wrote to memory of 2184 2688 explorer.exe cmd.exe PID 2688 wrote to memory of 2184 2688 explorer.exe cmd.exe PID 2688 wrote to memory of 2184 2688 explorer.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e4d51350f186355c0bade0a4093847b.exe"C:\Users\Admin\AppData\Local\Temp\4e4d51350f186355c0bade0a4093847b.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XRCCYX.exe"C:\Users\Admin\AppData\Local\Temp\XRCCYX.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\CUVZTV.vbs3⤵
-
C:\Users\Admin\AppData\Local\Temp\explorer.exe"C:\Users\Admin\AppData\Local\Temp\explorer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\explorer.exe"C:\Users\Admin\Documents\explorer.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\updater.exe"C:\Users\Admin\AppData\Local\Temp\updater.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\budget.xlsx"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5a064738f142f25268df6707ec1791934
SHA1946cbb1bf607edef93b5311d3290baf344456036
SHA2561bc20313adae81708c02560209e2e66f22e7d2088b2cd33776eb63963402e0b5
SHA5125b0c5f760bc08dbf1b6ae795e1b4cba3403e94739810045b459d3c0700fa9409650c2cb0266c66bfef0e5377347dbd568556b11847e877408e67db96815eac82
-
C:\Users\Admin\AppData\Local\Temp\CUVZTV.vbsFilesize
832B
MD57b88dc87f846cb86651815d1f650ddc5
SHA1a9556677d0d28d3fe13468f55b3c1352eaf0cb87
SHA256f2ac23ed9e1bd7a05bc3a41aa53637e49fb22185619dcb038479c453ac369e1f
SHA512e400d521a0025973f98137ecceede2780b0b199cc98ba9dc08291641615df3b6ce4f0a9ce4bfacf82649cbc7ccd6f8aee9816c4588924f15f6de8858cb78bb6e
-
C:\Users\Admin\AppData\Local\Temp\XRCCYX.exeFilesize
1.1MB
MD5f0f663b62326867adc306451762414b2
SHA10dd272467164856dacbdca66f5eea4b7a6100a76
SHA2562f850169f3bd43936dfc32e0cf0bfbab58ce9dd70e598d151ecfe0ef09a3e499
SHA51290f18b1a93bbbbf4b75466b6f484c811440311833fa574176ae9e6eee535aaf36c46ec420872752aba906cc271c5fa06f26f2b5fd09e33951e1ef969dc882fea
-
C:\Users\Admin\AppData\Local\Temp\XRCCYX.exeFilesize
1.1MB
MD5f0f663b62326867adc306451762414b2
SHA10dd272467164856dacbdca66f5eea4b7a6100a76
SHA2562f850169f3bd43936dfc32e0cf0bfbab58ce9dd70e598d151ecfe0ef09a3e499
SHA51290f18b1a93bbbbf4b75466b6f484c811440311833fa574176ae9e6eee535aaf36c46ec420872752aba906cc271c5fa06f26f2b5fd09e33951e1ef969dc882fea
-
C:\Users\Admin\AppData\Local\Temp\budget.xlsxFilesize
20KB
MD5f73ebdb3d2562351e70c5476172ff4c4
SHA149bf5e4428855a9b9f311e7127fd4ce0d5f89eb3
SHA2564454f6250448bb08bbde2c54ac7308323bd60814461009cedba512781bc4d226
SHA5123b3223841b40aa623edd68aed7e572c9703f55a10731f9077435e262813db3de2947880632f60f590d02a8f7248df30b93a8d1f9fef89b125031749c8c5ef5db
-
C:\Users\Admin\AppData\Local\Temp\explorer.exeFilesize
132KB
MD56323c6a420ae7a3b7ace4a0a7bca4edd
SHA177b91d13642dfe93784470893111742c123c2244
SHA2562fb55700d343afcad180486bedddb4ce8a632d11cbbde696d8db7a165543ae90
SHA512bba9ad737f58366d4d34493652bdc247e5afc3884259bdf2035576ded750e3663bd946b7b0996a5e91015465ada8f162e65b2fcaaab963767395b1fbe447675c
-
C:\Users\Admin\AppData\Local\Temp\explorer.exeFilesize
132KB
MD56323c6a420ae7a3b7ace4a0a7bca4edd
SHA177b91d13642dfe93784470893111742c123c2244
SHA2562fb55700d343afcad180486bedddb4ce8a632d11cbbde696d8db7a165543ae90
SHA512bba9ad737f58366d4d34493652bdc247e5afc3884259bdf2035576ded750e3663bd946b7b0996a5e91015465ada8f162e65b2fcaaab963767395b1fbe447675c
-
C:\Users\Admin\AppData\Local\Temp\updater.exeFilesize
3.8MB
MD54ab049723f3f39517e74252409d34cc3
SHA17115fdc392fb8972c368f13c394f045ff76355fc
SHA2569a5c441ddb5578d4f3d2f0c574c6b2311793b0f6fdb25ca437390a9d3aeaf49c
SHA5127281cc6cd16f2f0174af814ba8e38f7f7fffe1503ddcc42954111371b16e61157c66667b6511a107adc853b25383978f1d531a05d2075e05deee28428e20386f
-
C:\Users\Admin\AppData\Local\Temp\updater.exeFilesize
3.8MB
MD54ab049723f3f39517e74252409d34cc3
SHA17115fdc392fb8972c368f13c394f045ff76355fc
SHA2569a5c441ddb5578d4f3d2f0c574c6b2311793b0f6fdb25ca437390a9d3aeaf49c
SHA5127281cc6cd16f2f0174af814ba8e38f7f7fffe1503ddcc42954111371b16e61157c66667b6511a107adc853b25383978f1d531a05d2075e05deee28428e20386f
-
C:\Users\Admin\Documents\explorer.exeFilesize
132KB
MD56323c6a420ae7a3b7ace4a0a7bca4edd
SHA177b91d13642dfe93784470893111742c123c2244
SHA2562fb55700d343afcad180486bedddb4ce8a632d11cbbde696d8db7a165543ae90
SHA512bba9ad737f58366d4d34493652bdc247e5afc3884259bdf2035576ded750e3663bd946b7b0996a5e91015465ada8f162e65b2fcaaab963767395b1fbe447675c
-
C:\Users\Admin\Documents\explorer.exeFilesize
132KB
MD56323c6a420ae7a3b7ace4a0a7bca4edd
SHA177b91d13642dfe93784470893111742c123c2244
SHA2562fb55700d343afcad180486bedddb4ce8a632d11cbbde696d8db7a165543ae90
SHA512bba9ad737f58366d4d34493652bdc247e5afc3884259bdf2035576ded750e3663bd946b7b0996a5e91015465ada8f162e65b2fcaaab963767395b1fbe447675c
-
memory/2184-180-0x0000000000FC0000-0x0000000000FC1000-memory.dmpFilesize
4KB
-
memory/2184-177-0x0000000000000000-mapping.dmp
-
memory/2536-138-0x0000000000000000-mapping.dmp
-
memory/2536-157-0x0000000073D30000-0x0000000073D69000-memory.dmpFilesize
228KB
-
memory/2536-182-0x0000000073D30000-0x0000000073D69000-memory.dmpFilesize
228KB
-
memory/2536-141-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2536-181-0x0000000073E20000-0x0000000073E59000-memory.dmpFilesize
228KB
-
memory/2536-152-0x0000000073E20000-0x0000000073E59000-memory.dmpFilesize
228KB
-
memory/2688-159-0x0000000000000000-mapping.dmp
-
memory/3180-172-0x0000000007B00000-0x0000000007B96000-memory.dmpFilesize
600KB
-
memory/3180-155-0x0000000005EB0000-0x0000000005F16000-memory.dmpFilesize
408KB
-
memory/3180-175-0x0000000007BA0000-0x0000000007BA8000-memory.dmpFilesize
32KB
-
memory/3180-156-0x0000000005F20000-0x0000000005F86000-memory.dmpFilesize
408KB
-
memory/3180-153-0x00000000055B0000-0x00000000055D2000-memory.dmpFilesize
136KB
-
memory/3180-158-0x0000000006580000-0x000000000659E000-memory.dmpFilesize
120KB
-
memory/3180-151-0x0000000005650000-0x0000000005C78000-memory.dmpFilesize
6.2MB
-
memory/3180-174-0x0000000007BC0000-0x0000000007BDA000-memory.dmpFilesize
104KB
-
memory/3180-150-0x0000000002C60000-0x0000000002C96000-memory.dmpFilesize
216KB
-
memory/3180-170-0x00000000078F0000-0x00000000078FA000-memory.dmpFilesize
40KB
-
memory/3180-148-0x0000000000000000-mapping.dmp
-
memory/3180-173-0x0000000007AB0000-0x0000000007ABE000-memory.dmpFilesize
56KB
-
memory/3180-164-0x0000000007540000-0x0000000007572000-memory.dmpFilesize
200KB
-
memory/3180-166-0x000000006EF40000-0x000000006EF8C000-memory.dmpFilesize
304KB
-
memory/3180-167-0x0000000006AE0000-0x0000000006AFE000-memory.dmpFilesize
120KB
-
memory/3180-168-0x0000000007ED0000-0x000000000854A000-memory.dmpFilesize
6.5MB
-
memory/3180-169-0x0000000007880000-0x000000000789A000-memory.dmpFilesize
104KB
-
memory/3532-132-0x0000000000000000-mapping.dmp
-
memory/3880-162-0x0000000000000000-mapping.dmp
-
memory/4084-176-0x000000006EF40000-0x000000006EF8C000-memory.dmpFilesize
304KB
-
memory/4084-171-0x0000000000000000-mapping.dmp
-
memory/4188-144-0x00007FF8AE4F0000-0x00007FF8AE500000-memory.dmpFilesize
64KB
-
memory/4188-154-0x00007FF8ABD50000-0x00007FF8ABD60000-memory.dmpFilesize
64KB
-
memory/4188-149-0x00007FF8ABD50000-0x00007FF8ABD60000-memory.dmpFilesize
64KB
-
memory/4188-146-0x00007FF8AE4F0000-0x00007FF8AE500000-memory.dmpFilesize
64KB
-
memory/4188-147-0x00007FF8AE4F0000-0x00007FF8AE500000-memory.dmpFilesize
64KB
-
memory/4188-145-0x00007FF8AE4F0000-0x00007FF8AE500000-memory.dmpFilesize
64KB
-
memory/4188-143-0x00007FF8AE4F0000-0x00007FF8AE500000-memory.dmpFilesize
64KB
-
memory/4188-142-0x0000000000000000-mapping.dmp
-
memory/4188-184-0x00007FF8AE4F0000-0x00007FF8AE500000-memory.dmpFilesize
64KB
-
memory/4188-185-0x00007FF8AE4F0000-0x00007FF8AE500000-memory.dmpFilesize
64KB
-
memory/4188-186-0x00007FF8AE4F0000-0x00007FF8AE500000-memory.dmpFilesize
64KB
-
memory/4188-187-0x00007FF8AE4F0000-0x00007FF8AE500000-memory.dmpFilesize
64KB
-
memory/4944-135-0x0000000000000000-mapping.dmp