Analysis
-
max time kernel
182s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 22:16
Static task
static1
Behavioral task
behavioral1
Sample
7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe
Resource
win10v2004-20221111-en
General
-
Target
7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe
-
Size
552KB
-
MD5
fd49a17b3d4bfe10a79a8f6c25f72f50
-
SHA1
a25885590c16d80d46846d75f1f7646bfc26c005
-
SHA256
7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
-
SHA512
3049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
SSDEEP
12288:GPqfpmguB1C6MgG4WymunsifuHqDoCu9l9jq:IqfpmguvC6zG46u+HqDoL9j
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1308-69-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1308-70-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1308-72-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1308-74-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1308-75-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1308-76-0x000000000040B556-mapping.dmp warzonerat behavioral1/memory/1308-79-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1308-81-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1308-87-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat -
Executes dropped EXE 6 IoCs
Processes:
internetexploer.exeinternetexploer.exeinternetexploer.exeinternetexploer.exeinternetexploer.exeinternetexploer.exepid process 2032 internetexploer.exe 772 internetexploer.exe 2016 internetexploer.exe 2008 internetexploer.exe 1676 internetexploer.exe 1552 internetexploer.exe -
Loads dropped DLL 1 IoCs
Processes:
7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exepid process 1308 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\internetexploer.exe = "C:\\Users\\Admin\\Documents\\internetexploer.exe" 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exedescription pid process target process PID 960 set thread context of 1308 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1580 schtasks.exe 1404 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
powershell.exepowershell.exeinternetexploer.exepid process 112 powershell.exe 1336 powershell.exe 2032 internetexploer.exe 2032 internetexploer.exe 2032 internetexploer.exe 2032 internetexploer.exe 2032 internetexploer.exe 2032 internetexploer.exe 2032 internetexploer.exe 2032 internetexploer.exe 2032 internetexploer.exe 2032 internetexploer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exeinternetexploer.exedescription pid process Token: SeDebugPrivilege 112 powershell.exe Token: SeDebugPrivilege 1336 powershell.exe Token: SeDebugPrivilege 2032 internetexploer.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exeinternetexploer.exedescription pid process target process PID 960 wrote to memory of 112 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe powershell.exe PID 960 wrote to memory of 112 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe powershell.exe PID 960 wrote to memory of 112 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe powershell.exe PID 960 wrote to memory of 112 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe powershell.exe PID 960 wrote to memory of 1580 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe schtasks.exe PID 960 wrote to memory of 1580 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe schtasks.exe PID 960 wrote to memory of 1580 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe schtasks.exe PID 960 wrote to memory of 1580 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe schtasks.exe PID 960 wrote to memory of 1308 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe PID 960 wrote to memory of 1308 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe PID 960 wrote to memory of 1308 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe PID 960 wrote to memory of 1308 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe PID 960 wrote to memory of 1308 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe PID 960 wrote to memory of 1308 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe PID 960 wrote to memory of 1308 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe PID 960 wrote to memory of 1308 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe PID 960 wrote to memory of 1308 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe PID 960 wrote to memory of 1308 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe PID 960 wrote to memory of 1308 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe PID 960 wrote to memory of 1308 960 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe PID 1308 wrote to memory of 2032 1308 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe internetexploer.exe PID 1308 wrote to memory of 2032 1308 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe internetexploer.exe PID 1308 wrote to memory of 2032 1308 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe internetexploer.exe PID 1308 wrote to memory of 2032 1308 7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe internetexploer.exe PID 2032 wrote to memory of 1336 2032 internetexploer.exe powershell.exe PID 2032 wrote to memory of 1336 2032 internetexploer.exe powershell.exe PID 2032 wrote to memory of 1336 2032 internetexploer.exe powershell.exe PID 2032 wrote to memory of 1336 2032 internetexploer.exe powershell.exe PID 2032 wrote to memory of 1404 2032 internetexploer.exe schtasks.exe PID 2032 wrote to memory of 1404 2032 internetexploer.exe schtasks.exe PID 2032 wrote to memory of 1404 2032 internetexploer.exe schtasks.exe PID 2032 wrote to memory of 1404 2032 internetexploer.exe schtasks.exe PID 2032 wrote to memory of 772 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 772 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 772 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 772 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 2016 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 2016 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 2016 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 2016 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 2008 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 2008 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 2008 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 2008 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 1676 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 1676 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 1676 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 1676 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 1552 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 1552 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 1552 2032 internetexploer.exe internetexploer.exe PID 2032 wrote to memory of 1552 2032 internetexploer.exe internetexploer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe"C:\Users\Admin\AppData\Local\Temp\7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oyGqcapvIL.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oyGqcapvIL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF9F9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe"C:\Users\Admin\AppData\Local\Temp\7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\internetexploer.exe"C:\Users\Admin\Documents\internetexploer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oyGqcapvIL.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oyGqcapvIL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp516B.tmp"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\internetexploer.exe"C:\Users\Admin\Documents\internetexploer.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\internetexploer.exe"C:\Users\Admin\Documents\internetexploer.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\internetexploer.exe"C:\Users\Admin\Documents\internetexploer.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\internetexploer.exe"C:\Users\Admin\Documents\internetexploer.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\internetexploer.exe"C:\Users\Admin\Documents\internetexploer.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp516B.tmpFilesize
1KB
MD5dbf89fc50a024e6784adb04fe36d5f1e
SHA11c9b740e56c0b7a32c7389b16bfe1693343cc385
SHA256168cd1fe7796ff942a0068be38199bffa5c69927ffce7c193e099aa049a69ad2
SHA51273aed2c8e9a016ae806c2c882d11f17072feab574bba853417805c7ba843c4168b37dc4f146f1b4e5b70f210712d001abff2d14e65cba32344f512db151cabe2
-
C:\Users\Admin\AppData\Local\Temp\tmpF9F9.tmpFilesize
1KB
MD5dbf89fc50a024e6784adb04fe36d5f1e
SHA11c9b740e56c0b7a32c7389b16bfe1693343cc385
SHA256168cd1fe7796ff942a0068be38199bffa5c69927ffce7c193e099aa049a69ad2
SHA51273aed2c8e9a016ae806c2c882d11f17072feab574bba853417805c7ba843c4168b37dc4f146f1b4e5b70f210712d001abff2d14e65cba32344f512db151cabe2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5639ebc436b1474381585201f5b4f2b4c
SHA1d3fbffd79b4b5a155a2a50297118886af25e6c36
SHA2564239263e405b096fa434e0e8734f5615d2935b7fce7f2aa8a99b0ee01f26e8cd
SHA512c953f6dd521167ff2587d69e329884c827b80e8508597c70618fafea746e7fc00f002b55f2ac2f789a02e23647296b4bd9d6b943e0656154dd00cd01507ef1eb
-
C:\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
C:\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
C:\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
C:\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
C:\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
C:\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
C:\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
memory/112-82-0x000000006E1B0000-0x000000006E75B000-memory.dmpFilesize
5.7MB
-
memory/112-59-0x0000000000000000-mapping.dmp
-
memory/112-80-0x000000006E1B0000-0x000000006E75B000-memory.dmpFilesize
5.7MB
-
memory/960-63-0x00000000043F0000-0x0000000004426000-memory.dmpFilesize
216KB
-
memory/960-54-0x00000000008B0000-0x000000000093A000-memory.dmpFilesize
552KB
-
memory/960-58-0x0000000005300000-0x0000000005370000-memory.dmpFilesize
448KB
-
memory/960-57-0x0000000000460000-0x000000000046E000-memory.dmpFilesize
56KB
-
memory/960-56-0x0000000000340000-0x0000000000356000-memory.dmpFilesize
88KB
-
memory/960-55-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB
-
memory/1308-64-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1308-70-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1308-79-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1308-65-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1308-67-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1308-87-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1308-76-0x000000000040B556-mapping.dmp
-
memory/1308-75-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1308-69-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1308-81-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1308-74-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1308-72-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1336-95-0x000000006E920000-0x000000006EECB000-memory.dmpFilesize
5.7MB
-
memory/1336-90-0x0000000000000000-mapping.dmp
-
memory/1336-101-0x000000006E920000-0x000000006EECB000-memory.dmpFilesize
5.7MB
-
memory/1404-91-0x0000000000000000-mapping.dmp
-
memory/1580-60-0x0000000000000000-mapping.dmp
-
memory/2032-88-0x00000000003A0000-0x000000000042A000-memory.dmpFilesize
552KB
-
memory/2032-84-0x0000000000000000-mapping.dmp