Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
05-12-2022 19:42
Static task
static1
Behavioral task
behavioral1
Sample
3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe
Resource
win10-20220812-en
General
-
Target
3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe
-
Size
604KB
-
MD5
35f3f9e4d43cd037feadf2d7c81f9d90
-
SHA1
41ac8250a318fcbe930b5f19a8191a24b7bfd1fa
-
SHA256
3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c
-
SHA512
809b0fb50cd3ed5a844bbd19f7e5bb1ad110164bee31f7852c7c0ad0f052b0c5b8f4ea399d0c6fd9d8253ad087783aded06f4d9e3d33b134dd489d4eb162ddb3
-
SSDEEP
12288:KPuYd+V6b1momPZeft0UA6aX9h8ktLNxH6EldpAlus6rjv8hcpJePuYd+V6b:KPuYd+V6bIomxit0b9JNxVAyrT8ipJeJ
Malware Config
Extracted
warzonerat
51.178.11.185:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/384-186-0x0000000000400000-0x000000000055A000-memory.dmp warzonerat behavioral1/memory/384-187-0x0000000000406DA4-mapping.dmp warzonerat behavioral1/memory/384-247-0x0000000000400000-0x000000000055A000-memory.dmp warzonerat behavioral1/memory/384-334-0x0000000000400000-0x000000000055A000-memory.dmp warzonerat behavioral1/memory/2656-640-0x0000000000406DA4-mapping.dmp warzonerat behavioral1/memory/2656-701-0x0000000000400000-0x000000000055A000-memory.dmp warzonerat behavioral1/memory/2656-1037-0x0000000000400000-0x000000000055A000-memory.dmp warzonerat -
Executes dropped EXE 2 IoCs
Processes:
1mages.exe1mages.exepid process 3744 1mages.exe 2656 1mages.exe -
Drops startup file 2 IoCs
Processes:
3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1mages = "C:\\Users\\Admin\\Documents\\1mages.exe" 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe -
Modifies WinLogon 2 TTPs 3 IoCs
Processes:
1mages.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList 1mages.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts 1mages.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\pCbFBjz = "0" 1mages.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe1mages.exedescription pid process target process PID 2584 set thread context of 384 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe PID 3744 set thread context of 2656 3744 1mages.exe 1mages.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 1 IoCs
Processes:
3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exedescription ioc process File created C:\Users\Admin\Documents\Documents:ApplicationData 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exepowershell.exe1mages.exepowershell.exepid process 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 1324 powershell.exe 1324 powershell.exe 1324 powershell.exe 3744 1mages.exe 3744 1mages.exe 3744 1mages.exe 3744 1mages.exe 3744 1mages.exe 3744 1mages.exe 5092 powershell.exe 5092 powershell.exe 5092 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exepowershell.exe1mages.exepowershell.exedescription pid process Token: SeDebugPrivilege 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe Token: SeDebugPrivilege 1324 powershell.exe Token: SeDebugPrivilege 3744 1mages.exe Token: SeDebugPrivilege 5092 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1mages.exepid process 2656 1mages.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe1mages.exe1mages.exedescription pid process target process PID 2584 wrote to memory of 1468 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe PID 2584 wrote to memory of 1468 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe PID 2584 wrote to memory of 1468 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe PID 2584 wrote to memory of 384 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe PID 2584 wrote to memory of 384 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe PID 2584 wrote to memory of 384 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe PID 2584 wrote to memory of 384 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe PID 2584 wrote to memory of 384 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe PID 2584 wrote to memory of 384 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe PID 2584 wrote to memory of 384 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe PID 2584 wrote to memory of 384 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe PID 2584 wrote to memory of 384 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe PID 2584 wrote to memory of 384 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe PID 2584 wrote to memory of 384 2584 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe PID 384 wrote to memory of 1324 384 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe powershell.exe PID 384 wrote to memory of 1324 384 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe powershell.exe PID 384 wrote to memory of 1324 384 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe powershell.exe PID 384 wrote to memory of 3744 384 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 1mages.exe PID 384 wrote to memory of 3744 384 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 1mages.exe PID 384 wrote to memory of 3744 384 3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe 1mages.exe PID 3744 wrote to memory of 2656 3744 1mages.exe 1mages.exe PID 3744 wrote to memory of 2656 3744 1mages.exe 1mages.exe PID 3744 wrote to memory of 2656 3744 1mages.exe 1mages.exe PID 3744 wrote to memory of 2656 3744 1mages.exe 1mages.exe PID 3744 wrote to memory of 2656 3744 1mages.exe 1mages.exe PID 3744 wrote to memory of 2656 3744 1mages.exe 1mages.exe PID 3744 wrote to memory of 2656 3744 1mages.exe 1mages.exe PID 3744 wrote to memory of 2656 3744 1mages.exe 1mages.exe PID 3744 wrote to memory of 2656 3744 1mages.exe 1mages.exe PID 3744 wrote to memory of 2656 3744 1mages.exe 1mages.exe PID 3744 wrote to memory of 2656 3744 1mages.exe 1mages.exe PID 2656 wrote to memory of 5092 2656 1mages.exe powershell.exe PID 2656 wrote to memory of 5092 2656 1mages.exe powershell.exe PID 2656 wrote to memory of 5092 2656 1mages.exe powershell.exe PID 2656 wrote to memory of 4660 2656 1mages.exe cmd.exe PID 2656 wrote to memory of 4660 2656 1mages.exe cmd.exe PID 2656 wrote to memory of 4660 2656 1mages.exe cmd.exe PID 2656 wrote to memory of 4660 2656 1mages.exe cmd.exe PID 2656 wrote to memory of 4660 2656 1mages.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe"C:\Users\Admin\AppData\Local\Temp\3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe"C:\Users\Admin\AppData\Local\Temp\3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe"C:\Users\Admin\AppData\Local\Temp\3677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c.exe"2⤵
- Drops startup file
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\1mages.exe"C:\Users\Admin\Documents\1mages.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\1mages.exe"C:\Users\Admin\Documents\1mages.exe"4⤵
- Executes dropped EXE
- Modifies WinLogon
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD575a59eecf0735a6894fac9bb31540509
SHA16b076070cf0662be8328d70ce612f02d58f37f62
SHA256dd6ae1a360e3948408f83b2ff9ced9ee7ef98de371c999a0d79c2eab1be46250
SHA5125d4ccab255d2bb19021343c9fd7402bd847d951add97a4540d6b9501b880518ded5e8089b0dd0c14b159743ed1f863f04e7ecbc910d8dbb0542118053d0b711a
-
C:\Users\Admin\Documents\1mages.exeFilesize
604KB
MD535f3f9e4d43cd037feadf2d7c81f9d90
SHA141ac8250a318fcbe930b5f19a8191a24b7bfd1fa
SHA2563677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c
SHA512809b0fb50cd3ed5a844bbd19f7e5bb1ad110164bee31f7852c7c0ad0f052b0c5b8f4ea399d0c6fd9d8253ad087783aded06f4d9e3d33b134dd489d4eb162ddb3
-
C:\Users\Admin\Documents\1mages.exeFilesize
604KB
MD535f3f9e4d43cd037feadf2d7c81f9d90
SHA141ac8250a318fcbe930b5f19a8191a24b7bfd1fa
SHA2563677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c
SHA512809b0fb50cd3ed5a844bbd19f7e5bb1ad110164bee31f7852c7c0ad0f052b0c5b8f4ea399d0c6fd9d8253ad087783aded06f4d9e3d33b134dd489d4eb162ddb3
-
C:\Users\Admin\Documents\1mages.exeFilesize
604KB
MD535f3f9e4d43cd037feadf2d7c81f9d90
SHA141ac8250a318fcbe930b5f19a8191a24b7bfd1fa
SHA2563677ddb0cda755e0cca757a2ea20c794b836877b1ed6bd14e0bcd4dfd721751c
SHA512809b0fb50cd3ed5a844bbd19f7e5bb1ad110164bee31f7852c7c0ad0f052b0c5b8f4ea399d0c6fd9d8253ad087783aded06f4d9e3d33b134dd489d4eb162ddb3
-
memory/384-186-0x0000000000400000-0x000000000055A000-memory.dmpFilesize
1.4MB
-
memory/384-187-0x0000000000406DA4-mapping.dmp
-
memory/384-188-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/384-189-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/384-190-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/384-247-0x0000000000400000-0x000000000055A000-memory.dmpFilesize
1.4MB
-
memory/384-334-0x0000000000400000-0x000000000055A000-memory.dmpFilesize
1.4MB
-
memory/1324-375-0x0000000007540000-0x00000000075A6000-memory.dmpFilesize
408KB
-
memory/1324-397-0x0000000008D50000-0x0000000008D83000-memory.dmpFilesize
204KB
-
memory/1324-379-0x0000000006C80000-0x0000000006C9C000-memory.dmpFilesize
112KB
-
memory/1324-374-0x00000000074D0000-0x0000000007536000-memory.dmpFilesize
408KB
-
memory/1324-372-0x0000000007430000-0x0000000007452000-memory.dmpFilesize
136KB
-
memory/1324-380-0x0000000007470000-0x00000000074BB000-memory.dmpFilesize
300KB
-
memory/1324-384-0x0000000007CD0000-0x0000000007D46000-memory.dmpFilesize
472KB
-
memory/1324-376-0x0000000007600000-0x0000000007950000-memory.dmpFilesize
3.3MB
-
memory/1324-289-0x0000000006E00000-0x0000000007428000-memory.dmpFilesize
6.2MB
-
memory/1324-284-0x0000000000C70000-0x0000000000CA6000-memory.dmpFilesize
216KB
-
memory/1324-248-0x0000000000000000-mapping.dmp
-
memory/1324-398-0x0000000008D30000-0x0000000008D4E000-memory.dmpFilesize
120KB
-
memory/1324-407-0x0000000008E80000-0x0000000008F25000-memory.dmpFilesize
660KB
-
memory/1324-411-0x00000000090A0000-0x0000000009134000-memory.dmpFilesize
592KB
-
memory/1324-614-0x0000000008F60000-0x0000000008F7A000-memory.dmpFilesize
104KB
-
memory/1324-619-0x0000000008F50000-0x0000000008F58000-memory.dmpFilesize
32KB
-
memory/2584-143-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-184-0x00000000058D0000-0x00000000058F8000-memory.dmpFilesize
160KB
-
memory/2584-147-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-148-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-149-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-150-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-151-0x0000000000360000-0x00000000003FC000-memory.dmpFilesize
624KB
-
memory/2584-152-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-153-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-154-0x00000000050B0000-0x00000000055AE000-memory.dmpFilesize
5.0MB
-
memory/2584-155-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-156-0x0000000004C50000-0x0000000004CE2000-memory.dmpFilesize
584KB
-
memory/2584-157-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-158-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-159-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-160-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-161-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-162-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-163-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-164-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-165-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-166-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-167-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-168-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-169-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-170-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-171-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-172-0x0000000004C20000-0x0000000004C2A000-memory.dmpFilesize
40KB
-
memory/2584-173-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-174-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-175-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-176-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-177-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-178-0x0000000004C30000-0x0000000004C4A000-memory.dmpFilesize
104KB
-
memory/2584-179-0x0000000004DB0000-0x0000000004DBE000-memory.dmpFilesize
56KB
-
memory/2584-180-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-181-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-182-0x0000000005860000-0x00000000058C2000-memory.dmpFilesize
392KB
-
memory/2584-183-0x0000000005970000-0x0000000005A0C000-memory.dmpFilesize
624KB
-
memory/2584-146-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-185-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-145-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-144-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-117-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-142-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-141-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-140-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-139-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-138-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-137-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-118-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-136-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-135-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-134-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-133-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-132-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-131-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-130-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-129-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-128-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-127-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-126-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-125-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-124-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-123-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-122-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-121-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-119-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-120-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2656-701-0x0000000000400000-0x000000000055A000-memory.dmpFilesize
1.4MB
-
memory/2656-640-0x0000000000406DA4-mapping.dmp
-
memory/2656-1037-0x0000000000400000-0x000000000055A000-memory.dmpFilesize
1.4MB
-
memory/2656-1039-0x000000000AD80000-0x000000000AEBC000-memory.dmpFilesize
1.2MB
-
memory/3744-293-0x0000000000000000-mapping.dmp
-
memory/4660-793-0x0000000000000000-mapping.dmp
-
memory/5092-702-0x0000000000000000-mapping.dmp
-
memory/5092-761-0x00000000077F0000-0x0000000007B40000-memory.dmpFilesize
3.3MB
-
memory/5092-765-0x0000000007D60000-0x0000000007DAB000-memory.dmpFilesize
300KB
-
memory/5092-789-0x00000000090D0000-0x0000000009175000-memory.dmpFilesize
660KB