Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2022 04:38
Static task
static1
Behavioral task
behavioral1
Sample
208fc4b1d051034e07f3c79c813a68be.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
208fc4b1d051034e07f3c79c813a68be.exe
Resource
win10v2004-20220812-en
General
-
Target
208fc4b1d051034e07f3c79c813a68be.exe
-
Size
5.1MB
-
MD5
208fc4b1d051034e07f3c79c813a68be
-
SHA1
581c15ee8f6e0ed4d673c8e55331cf214fa38e6e
-
SHA256
37e5285ef075235abeed2a5bfbf0398cd49945e77842a8e45fba2e4dcf0c819e
-
SHA512
4fd853051a9a54dbbb539ce0a0614cb3520a582ee72f6edf99effc946e84f3d8c7d20a520f9c0dcf95c9548abf05bf424cea111e35bf28af3072a5f81b9c606a
-
SSDEEP
98304:LcOQNJyg0rU78RzjYmO/B1fiVm3crNBxNEH8gmbUzWA6ZHnWwpZ:bQDygMNzjYfBxiVm3CNM8g4ZZH
Malware Config
Extracted
warzonerat
sheet.duckdns.org:4110
Extracted
bitrat
1.38
sheet.duckdns.org:8471
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
install_dir
Install path
-
install_file
Install name
-
tor_process
tor
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Temp\explorer.exe warzonerat C:\Users\Admin\Documents\explorer.exe warzonerat C:\Users\Admin\Documents\explorer.exe warzonerat -
Executes dropped EXE 5 IoCs
Processes:
XRCCYX.exeexplorer.exeupdater.exeClient.exeexplorer.exepid process 5040 XRCCYX.exe 732 explorer.exe 4228 updater.exe 808 Client.exe 2668 explorer.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
208fc4b1d051034e07f3c79c813a68be.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 208fc4b1d051034e07f3c79c813a68be.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
updater.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Install name = "C:\\Users\\Admin\\AppData\\Local\\Install path\\Install name" updater.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Install name = "C:\\Users\\Admin\\AppData\\Local\\Install path\\Install nameȀ" updater.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\XRCCYX.exe autoit_exe C:\Users\Admin\AppData\Local\Temp\XRCCYX.exe autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
updater.exepid process 4228 updater.exe 4228 updater.exe 4228 updater.exe 4228 updater.exe 4228 updater.exe 4228 updater.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3048 808 WerFault.exe Client.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 1 IoCs
Processes:
208fc4b1d051034e07f3c79c813a68be.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings 208fc4b1d051034e07f3c79c813a68be.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2036 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeXRCCYX.exepid process 3548 powershell.exe 3548 powershell.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe 5040 XRCCYX.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
XRCCYX.exepid process 5040 XRCCYX.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
powershell.exeupdater.exepowershell.exeClient.exedescription pid process Token: SeDebugPrivilege 3548 powershell.exe Token: SeShutdownPrivilege 4228 updater.exe Token: SeDebugPrivilege 4860 powershell.exe Token: SeIncreaseQuotaPrivilege 808 Client.exe Token: SeSecurityPrivilege 808 Client.exe Token: SeTakeOwnershipPrivilege 808 Client.exe Token: SeLoadDriverPrivilege 808 Client.exe Token: SeSystemProfilePrivilege 808 Client.exe Token: SeSystemtimePrivilege 808 Client.exe Token: SeProfSingleProcessPrivilege 808 Client.exe Token: SeIncBasePriorityPrivilege 808 Client.exe Token: SeCreatePagefilePrivilege 808 Client.exe Token: SeBackupPrivilege 808 Client.exe Token: SeRestorePrivilege 808 Client.exe Token: SeShutdownPrivilege 808 Client.exe Token: SeDebugPrivilege 808 Client.exe Token: SeSystemEnvironmentPrivilege 808 Client.exe Token: SeRemoteShutdownPrivilege 808 Client.exe Token: SeUndockPrivilege 808 Client.exe Token: SeManageVolumePrivilege 808 Client.exe Token: 33 808 Client.exe Token: 34 808 Client.exe Token: 35 808 Client.exe Token: 36 808 Client.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEupdater.exepid process 2036 EXCEL.EXE 2036 EXCEL.EXE 4228 updater.exe 4228 updater.exe 2036 EXCEL.EXE 2036 EXCEL.EXE 2036 EXCEL.EXE 2036 EXCEL.EXE 2036 EXCEL.EXE 2036 EXCEL.EXE 2036 EXCEL.EXE 2036 EXCEL.EXE 2036 EXCEL.EXE 2036 EXCEL.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
208fc4b1d051034e07f3c79c813a68be.exeexplorer.exeXRCCYX.exeexplorer.exedescription pid process target process PID 2488 wrote to memory of 5040 2488 208fc4b1d051034e07f3c79c813a68be.exe XRCCYX.exe PID 2488 wrote to memory of 5040 2488 208fc4b1d051034e07f3c79c813a68be.exe XRCCYX.exe PID 2488 wrote to memory of 5040 2488 208fc4b1d051034e07f3c79c813a68be.exe XRCCYX.exe PID 2488 wrote to memory of 732 2488 208fc4b1d051034e07f3c79c813a68be.exe explorer.exe PID 2488 wrote to memory of 732 2488 208fc4b1d051034e07f3c79c813a68be.exe explorer.exe PID 2488 wrote to memory of 732 2488 208fc4b1d051034e07f3c79c813a68be.exe explorer.exe PID 2488 wrote to memory of 4228 2488 208fc4b1d051034e07f3c79c813a68be.exe updater.exe PID 2488 wrote to memory of 4228 2488 208fc4b1d051034e07f3c79c813a68be.exe updater.exe PID 2488 wrote to memory of 4228 2488 208fc4b1d051034e07f3c79c813a68be.exe updater.exe PID 2488 wrote to memory of 808 2488 208fc4b1d051034e07f3c79c813a68be.exe Client.exe PID 2488 wrote to memory of 808 2488 208fc4b1d051034e07f3c79c813a68be.exe Client.exe PID 2488 wrote to memory of 2036 2488 208fc4b1d051034e07f3c79c813a68be.exe EXCEL.EXE PID 2488 wrote to memory of 2036 2488 208fc4b1d051034e07f3c79c813a68be.exe EXCEL.EXE PID 2488 wrote to memory of 2036 2488 208fc4b1d051034e07f3c79c813a68be.exe EXCEL.EXE PID 732 wrote to memory of 3548 732 explorer.exe powershell.exe PID 732 wrote to memory of 3548 732 explorer.exe powershell.exe PID 732 wrote to memory of 3548 732 explorer.exe powershell.exe PID 732 wrote to memory of 2668 732 explorer.exe explorer.exe PID 732 wrote to memory of 2668 732 explorer.exe explorer.exe PID 732 wrote to memory of 2668 732 explorer.exe explorer.exe PID 5040 wrote to memory of 3084 5040 XRCCYX.exe WSCript.exe PID 5040 wrote to memory of 3084 5040 XRCCYX.exe WSCript.exe PID 5040 wrote to memory of 3084 5040 XRCCYX.exe WSCript.exe PID 2668 wrote to memory of 4860 2668 explorer.exe powershell.exe PID 2668 wrote to memory of 4860 2668 explorer.exe powershell.exe PID 2668 wrote to memory of 4860 2668 explorer.exe powershell.exe PID 2668 wrote to memory of 3896 2668 explorer.exe cmd.exe PID 2668 wrote to memory of 3896 2668 explorer.exe cmd.exe PID 2668 wrote to memory of 3896 2668 explorer.exe cmd.exe PID 2668 wrote to memory of 3896 2668 explorer.exe cmd.exe PID 2668 wrote to memory of 3896 2668 explorer.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\208fc4b1d051034e07f3c79c813a68be.exe"C:\Users\Admin\AppData\Local\Temp\208fc4b1d051034e07f3c79c813a68be.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XRCCYX.exe"C:\Users\Admin\AppData\Local\Temp\XRCCYX.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\CUVZTV.vbs3⤵
-
C:\Users\Admin\AppData\Local\Temp\explorer.exe"C:\Users\Admin\AppData\Local\Temp\explorer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\explorer.exe"C:\Users\Admin\Documents\explorer.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\updater.exe"C:\Users\Admin\AppData\Local\Temp\updater.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 808 -s 11243⤵
- Program crash
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Earn-BTC.xls"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 808 -ip 8081⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5f40daaaa76574a55d9a97ba3cf1c4d50
SHA1d34154e9baf3d234bb4d7c949b4ec2299615e3a2
SHA2565d309c56ce79f9353f1d584e228ca76b3176d376299924459ccb67e0e460ffc7
SHA51248ab9f415103ec5737c4170d54f3c5b789ae1ef319267bed6074a682a16b518aea8ea75c1314443fb3194f5393a6ab809744d184069e8a8f03293facd61f70ad
-
C:\Users\Admin\AppData\Local\Temp\CUVZTV.vbsFilesize
832B
MD57b88dc87f846cb86651815d1f650ddc5
SHA1a9556677d0d28d3fe13468f55b3c1352eaf0cb87
SHA256f2ac23ed9e1bd7a05bc3a41aa53637e49fb22185619dcb038479c453ac369e1f
SHA512e400d521a0025973f98137ecceede2780b0b199cc98ba9dc08291641615df3b6ce4f0a9ce4bfacf82649cbc7ccd6f8aee9816c4588924f15f6de8858cb78bb6e
-
C:\Users\Admin\AppData\Local\Temp\Client.exeFilesize
56KB
MD53893f505845ffd46a1df8553badef1d6
SHA1683c728f6b35ac1ef27daf1f2f4225568a6a9fe5
SHA25649e60ea90cc69fcb424f82db5dc51788c0d578c3cc6ba2db75323d751f4e6b03
SHA512543233493adf120e12e0e8e39d6166bde0ed84f78634a2273ad09b5f0ae69f43055a117e1708bb0528b0349d3e802ba222f6cd2dfca993ba48d16ac270d07989
-
C:\Users\Admin\AppData\Local\Temp\Client.exeFilesize
56KB
MD53893f505845ffd46a1df8553badef1d6
SHA1683c728f6b35ac1ef27daf1f2f4225568a6a9fe5
SHA25649e60ea90cc69fcb424f82db5dc51788c0d578c3cc6ba2db75323d751f4e6b03
SHA512543233493adf120e12e0e8e39d6166bde0ed84f78634a2273ad09b5f0ae69f43055a117e1708bb0528b0349d3e802ba222f6cd2dfca993ba48d16ac270d07989
-
C:\Users\Admin\AppData\Local\Temp\Earn-BTC.xlsFilesize
36KB
MD5daf929792f34ede3c3b0a195d4c26698
SHA11444b5688381e749389c1aae7c3462467e108be2
SHA2566d918879e5d5c89895bcff592151ad0214435835e81731612530a357a5aef99e
SHA512fc166da9ee699ebfefc816596f93d13d8693e0764ee49bd8490fa84b0dd0ded0e6ec70e639e5fd5cbec52b887fb4e281cd2493e06562a22cd684a0b5e155e892
-
C:\Users\Admin\AppData\Local\Temp\XRCCYX.exeFilesize
1.1MB
MD5f0f663b62326867adc306451762414b2
SHA10dd272467164856dacbdca66f5eea4b7a6100a76
SHA2562f850169f3bd43936dfc32e0cf0bfbab58ce9dd70e598d151ecfe0ef09a3e499
SHA51290f18b1a93bbbbf4b75466b6f484c811440311833fa574176ae9e6eee535aaf36c46ec420872752aba906cc271c5fa06f26f2b5fd09e33951e1ef969dc882fea
-
C:\Users\Admin\AppData\Local\Temp\XRCCYX.exeFilesize
1.1MB
MD5f0f663b62326867adc306451762414b2
SHA10dd272467164856dacbdca66f5eea4b7a6100a76
SHA2562f850169f3bd43936dfc32e0cf0bfbab58ce9dd70e598d151ecfe0ef09a3e499
SHA51290f18b1a93bbbbf4b75466b6f484c811440311833fa574176ae9e6eee535aaf36c46ec420872752aba906cc271c5fa06f26f2b5fd09e33951e1ef969dc882fea
-
C:\Users\Admin\AppData\Local\Temp\explorer.exeFilesize
132KB
MD56323c6a420ae7a3b7ace4a0a7bca4edd
SHA177b91d13642dfe93784470893111742c123c2244
SHA2562fb55700d343afcad180486bedddb4ce8a632d11cbbde696d8db7a165543ae90
SHA512bba9ad737f58366d4d34493652bdc247e5afc3884259bdf2035576ded750e3663bd946b7b0996a5e91015465ada8f162e65b2fcaaab963767395b1fbe447675c
-
C:\Users\Admin\AppData\Local\Temp\explorer.exeFilesize
132KB
MD56323c6a420ae7a3b7ace4a0a7bca4edd
SHA177b91d13642dfe93784470893111742c123c2244
SHA2562fb55700d343afcad180486bedddb4ce8a632d11cbbde696d8db7a165543ae90
SHA512bba9ad737f58366d4d34493652bdc247e5afc3884259bdf2035576ded750e3663bd946b7b0996a5e91015465ada8f162e65b2fcaaab963767395b1fbe447675c
-
C:\Users\Admin\AppData\Local\Temp\updater.exeFilesize
3.8MB
MD54ab049723f3f39517e74252409d34cc3
SHA17115fdc392fb8972c368f13c394f045ff76355fc
SHA2569a5c441ddb5578d4f3d2f0c574c6b2311793b0f6fdb25ca437390a9d3aeaf49c
SHA5127281cc6cd16f2f0174af814ba8e38f7f7fffe1503ddcc42954111371b16e61157c66667b6511a107adc853b25383978f1d531a05d2075e05deee28428e20386f
-
C:\Users\Admin\AppData\Local\Temp\updater.exeFilesize
3.8MB
MD54ab049723f3f39517e74252409d34cc3
SHA17115fdc392fb8972c368f13c394f045ff76355fc
SHA2569a5c441ddb5578d4f3d2f0c574c6b2311793b0f6fdb25ca437390a9d3aeaf49c
SHA5127281cc6cd16f2f0174af814ba8e38f7f7fffe1503ddcc42954111371b16e61157c66667b6511a107adc853b25383978f1d531a05d2075e05deee28428e20386f
-
C:\Users\Admin\Documents\explorer.exeFilesize
132KB
MD56323c6a420ae7a3b7ace4a0a7bca4edd
SHA177b91d13642dfe93784470893111742c123c2244
SHA2562fb55700d343afcad180486bedddb4ce8a632d11cbbde696d8db7a165543ae90
SHA512bba9ad737f58366d4d34493652bdc247e5afc3884259bdf2035576ded750e3663bd946b7b0996a5e91015465ada8f162e65b2fcaaab963767395b1fbe447675c
-
C:\Users\Admin\Documents\explorer.exeFilesize
132KB
MD56323c6a420ae7a3b7ace4a0a7bca4edd
SHA177b91d13642dfe93784470893111742c123c2244
SHA2562fb55700d343afcad180486bedddb4ce8a632d11cbbde696d8db7a165543ae90
SHA512bba9ad737f58366d4d34493652bdc247e5afc3884259bdf2035576ded750e3663bd946b7b0996a5e91015465ada8f162e65b2fcaaab963767395b1fbe447675c
-
memory/732-138-0x0000000000000000-mapping.dmp
-
memory/808-145-0x0000000000000000-mapping.dmp
-
memory/808-148-0x0000000000340000-0x0000000000354000-memory.dmpFilesize
80KB
-
memory/808-150-0x00007FFB3D400000-0x00007FFB3DEC1000-memory.dmpFilesize
10.8MB
-
memory/808-184-0x00007FFB3D400000-0x00007FFB3DEC1000-memory.dmpFilesize
10.8MB
-
memory/2036-195-0x00007FFB1B8F0000-0x00007FFB1B900000-memory.dmpFilesize
64KB
-
memory/2036-152-0x00007FFB1B8F0000-0x00007FFB1B900000-memory.dmpFilesize
64KB
-
memory/2036-153-0x00007FFB1B8F0000-0x00007FFB1B900000-memory.dmpFilesize
64KB
-
memory/2036-194-0x00007FFB1B8F0000-0x00007FFB1B900000-memory.dmpFilesize
64KB
-
memory/2036-155-0x00007FFB1B8F0000-0x00007FFB1B900000-memory.dmpFilesize
64KB
-
memory/2036-159-0x00007FFB19520000-0x00007FFB19530000-memory.dmpFilesize
64KB
-
memory/2036-156-0x00007FFB1B8F0000-0x00007FFB1B900000-memory.dmpFilesize
64KB
-
memory/2036-154-0x00007FFB1B8F0000-0x00007FFB1B900000-memory.dmpFilesize
64KB
-
memory/2036-149-0x0000000000000000-mapping.dmp
-
memory/2036-163-0x00007FFB19520000-0x00007FFB19530000-memory.dmpFilesize
64KB
-
memory/2036-196-0x00007FFB1B8F0000-0x00007FFB1B900000-memory.dmpFilesize
64KB
-
memory/2036-197-0x00007FFB1B8F0000-0x00007FFB1B900000-memory.dmpFilesize
64KB
-
memory/2668-167-0x0000000000000000-mapping.dmp
-
memory/3084-176-0x0000000000000000-mapping.dmp
-
memory/3548-179-0x0000000007E40000-0x0000000007E4E000-memory.dmpFilesize
56KB
-
memory/3548-164-0x0000000006910000-0x000000000692E000-memory.dmpFilesize
120KB
-
memory/3548-171-0x000000006FDF0000-0x000000006FE3C000-memory.dmpFilesize
304KB
-
memory/3548-151-0x0000000000000000-mapping.dmp
-
memory/3548-172-0x0000000006EB0000-0x0000000006ECE000-memory.dmpFilesize
120KB
-
memory/3548-173-0x0000000008250000-0x00000000088CA000-memory.dmpFilesize
6.5MB
-
memory/3548-174-0x0000000007C10000-0x0000000007C2A000-memory.dmpFilesize
104KB
-
memory/3548-175-0x0000000007C80000-0x0000000007C8A000-memory.dmpFilesize
40KB
-
memory/3548-170-0x0000000006ED0000-0x0000000006F02000-memory.dmpFilesize
200KB
-
memory/3548-160-0x0000000005960000-0x0000000005982000-memory.dmpFilesize
136KB
-
memory/3548-178-0x0000000007E90000-0x0000000007F26000-memory.dmpFilesize
600KB
-
memory/3548-157-0x0000000002FD0000-0x0000000003006000-memory.dmpFilesize
216KB
-
memory/3548-162-0x0000000006310000-0x0000000006376000-memory.dmpFilesize
408KB
-
memory/3548-158-0x0000000005A10000-0x0000000006038000-memory.dmpFilesize
6.2MB
-
memory/3548-182-0x0000000007F50000-0x0000000007F6A000-memory.dmpFilesize
104KB
-
memory/3548-183-0x0000000007F30000-0x0000000007F38000-memory.dmpFilesize
32KB
-
memory/3548-161-0x0000000006230000-0x0000000006296000-memory.dmpFilesize
408KB
-
memory/3896-189-0x0000000000EB0000-0x0000000000EB1000-memory.dmpFilesize
4KB
-
memory/3896-186-0x0000000000000000-mapping.dmp
-
memory/4228-166-0x000000006FB10000-0x000000006FB49000-memory.dmpFilesize
228KB
-
memory/4228-190-0x0000000074E10000-0x0000000074E49000-memory.dmpFilesize
228KB
-
memory/4228-191-0x00000000742A0000-0x00000000742D9000-memory.dmpFilesize
228KB
-
memory/4228-192-0x000000006FB10000-0x000000006FB49000-memory.dmpFilesize
228KB
-
memory/4228-165-0x00000000742A0000-0x00000000742D9000-memory.dmpFilesize
228KB
-
memory/4228-144-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4228-141-0x0000000000000000-mapping.dmp
-
memory/4860-185-0x000000006FDF0000-0x000000006FE3C000-memory.dmpFilesize
304KB
-
memory/4860-181-0x0000000000000000-mapping.dmp
-
memory/5040-135-0x0000000000000000-mapping.dmp