Analysis
-
max time kernel
2s -
max time network
45s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2023 16:53
Static task
static1
Behavioral task
behavioral1
Sample
4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exe
-
Size
4.1MB
-
MD5
88b17e26ef2c53627314448b4894bb9a
-
SHA1
e444ca1f1c3a1bc003e9e03f5dbcc3e88400e7fd
-
SHA256
4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0b
-
SHA512
f113b2fc5f68a86c94931140c22e3557ee15c75ad21734015bd93ddc9553169a926374d721b083161995573ab34651ea6fec5d7330704f0bb432f0f0aa81c6c9
-
SSDEEP
98304:F/PnaasivP4Af1rumiBWgd5m+Qfr7fBZiVIrB6:FHnPgAf1r2WgbAtd
Malware Config
Extracted
nanocore
1.2.2.0
backupcraft.ddns.net:54984
127.0.0.1:54984
96156e42-3e88-498a-83b0-34f138a87549
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65541
-
build_time
2023-06-29T18:37:26.433436736Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
54984
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.0485763e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
96156e42-3e88-498a-83b0-34f138a87549
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
backupcraft.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Extracted
quasar
1.4.1
Slave
backupcraft.ddns.net:4782
fbfe67fd-8086-4852-908c-75959d17c0c7
-
encryption_key
6550C5FD133683B3330870C778B7DB73E923F472
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
warzonerat
supercraft123.serveminecraft.net:5200
Signatures
-
Quasar payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\systemq.exe family_quasar C:\Users\Admin\AppData\Local\Temp\systemq.exe family_quasar behavioral2/memory/2556-38-0x0000000000A10000-0x0000000000D34000-memory.dmp family_quasar C:\Users\Admin\AppData\Local\Temp\systemq.exe family_quasar -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\wz_payload.exe warzonerat C:\Users\Admin\AppData\Local\Temp\wz_payload.exe warzonerat C:\Users\Admin\AppData\Local\Temp\wz_payload.exe warzonerat C:\Users\Admin\Documents\svchost.exe warzonerat C:\Users\Admin\Documents\svchost.exe warzonerat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation 4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exe -
Executes dropped EXE 2 IoCs
Processes:
nanocore_payload.exesystemq.exepid process 4536 nanocore_payload.exe 2556 systemq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exedescription pid process target process PID 408 wrote to memory of 5084 408 4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exe powershell.exe PID 408 wrote to memory of 5084 408 4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exe powershell.exe PID 408 wrote to memory of 5084 408 4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exe powershell.exe PID 408 wrote to memory of 4536 408 4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exe nanocore_payload.exe PID 408 wrote to memory of 4536 408 4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exe nanocore_payload.exe PID 408 wrote to memory of 4536 408 4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exe nanocore_payload.exe PID 408 wrote to memory of 2556 408 4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exe systemq.exe PID 408 wrote to memory of 2556 408 4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exe systemq.exe PID 408 wrote to memory of 404 408 4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exe wz_payload.exe PID 408 wrote to memory of 404 408 4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exe wz_payload.exe PID 408 wrote to memory of 404 408 4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exe wz_payload.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\4635920e78112660335f3ee1a05290b0fc174787a0e4532a029983e02179ad0bexe_JC.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHMAaQByACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAYgB0ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHAAegB6ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHIAZwBrACMAPgA="2⤵
-
C:\Users\Admin\AppData\Local\Temp\nanocore_payload.exe"C:\Users\Admin\AppData\Local\Temp\nanocore_payload.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\systemq.exe"C:\Users\Admin\AppData\Local\Temp\systemq.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\wz_payload.exe"C:\Users\Admin\AppData\Local\Temp\wz_payload.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
-
C:\Users\Admin\Documents\svchost.exe"C:\Users\Admin\Documents\svchost.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\pm_payload.exe"C:\Users\Admin\AppData\Local\Temp\pm_payload.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcACoALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACAALQBGAG8AcgBjAGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlAA==1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x470 0x33c1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5495f093248ef358b8771f6e0757bf786
SHA10db654feb85d0ba71392e0610461bb803d1630f4
SHA256ed91c40a55c0e6a5108dbddb88cea27a16c85b2696feafd566cba904c671f7de
SHA512270d942c8867637af7748e1e2f3ae3dc3f0a9a057eada5b24c057b192b9cb83de3291a0e9135690b03292fa2df2c018c1a3f6279655c41c122baf3f31493195b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD55da3a5915abdf06da6ade7fc4c4aa44a
SHA1e34d5a0653d696e269073a6180bfe642be59f563
SHA2560c3158b032a80ef5aad821f9513652ce83d561cd5b0b4ad2b75e8c78c6bcd6e9
SHA51207346b1e3c61c1f79042bf027c626740cde375190505ee865738dd7b6d666ad90686816b0ba998dc88e258ec408a635e15086036e5175ba290465d0abb32a7c9
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z1fatq1k.cmi.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\nanocore_payload.exeFilesize
202KB
MD5453bdc5af90ce17385bc4e0ca1cbe15d
SHA14047e7aea50df01ea1adf1d3c1354e3335e56429
SHA25689e3d9bdab44323f4e95c7ed14859e36e87e39332b2c28c2038465eb1abbc602
SHA512368c8374f7e1cbe351c952625ca43b541230edc14e8b9e3c3751fc126dc7507fd7260c523233ef8e82f2d7562ed0e03068d9158551069d8e70156610b60d58ba
-
C:\Users\Admin\AppData\Local\Temp\nanocore_payload.exeFilesize
202KB
MD5453bdc5af90ce17385bc4e0ca1cbe15d
SHA14047e7aea50df01ea1adf1d3c1354e3335e56429
SHA25689e3d9bdab44323f4e95c7ed14859e36e87e39332b2c28c2038465eb1abbc602
SHA512368c8374f7e1cbe351c952625ca43b541230edc14e8b9e3c3751fc126dc7507fd7260c523233ef8e82f2d7562ed0e03068d9158551069d8e70156610b60d58ba
-
C:\Users\Admin\AppData\Local\Temp\nanocore_payload.exeFilesize
202KB
MD5453bdc5af90ce17385bc4e0ca1cbe15d
SHA14047e7aea50df01ea1adf1d3c1354e3335e56429
SHA25689e3d9bdab44323f4e95c7ed14859e36e87e39332b2c28c2038465eb1abbc602
SHA512368c8374f7e1cbe351c952625ca43b541230edc14e8b9e3c3751fc126dc7507fd7260c523233ef8e82f2d7562ed0e03068d9158551069d8e70156610b60d58ba
-
C:\Users\Admin\AppData\Local\Temp\pm_payload.exeFilesize
630KB
MD5854ba5549b621ef7c140df6e5bb0617e
SHA101f9799ca06a249653bf49ec5a63188ce4f09fd7
SHA25693388acca3dcc7f881169f858a3c90bf26b38502bd0635c0caebbd4102db7ba3
SHA51211892a24a7695f40602f02581aa05e08e6e37e156594c453d92f14df75713cdb4897f3a44eadb4d3f54cfa99ff12afc39c06e894cd8995ff578e8d1dd1ca3ba6
-
C:\Users\Admin\AppData\Local\Temp\pm_payload.exeFilesize
630KB
MD5854ba5549b621ef7c140df6e5bb0617e
SHA101f9799ca06a249653bf49ec5a63188ce4f09fd7
SHA25693388acca3dcc7f881169f858a3c90bf26b38502bd0635c0caebbd4102db7ba3
SHA51211892a24a7695f40602f02581aa05e08e6e37e156594c453d92f14df75713cdb4897f3a44eadb4d3f54cfa99ff12afc39c06e894cd8995ff578e8d1dd1ca3ba6
-
C:\Users\Admin\AppData\Local\Temp\pm_payload.exeFilesize
630KB
MD5854ba5549b621ef7c140df6e5bb0617e
SHA101f9799ca06a249653bf49ec5a63188ce4f09fd7
SHA25693388acca3dcc7f881169f858a3c90bf26b38502bd0635c0caebbd4102db7ba3
SHA51211892a24a7695f40602f02581aa05e08e6e37e156594c453d92f14df75713cdb4897f3a44eadb4d3f54cfa99ff12afc39c06e894cd8995ff578e8d1dd1ca3ba6
-
C:\Users\Admin\AppData\Local\Temp\systemq.exeFilesize
3.1MB
MD529853d6de2a6ea760788dbdbe601a4ab
SHA1038ee578dca716ebb46d4a96105838d39122d7a0
SHA256ad306c945a71d25faffefb7330f1563ceb100513a4c50fa29fb60b2d46fbd732
SHA512a6c5822ac7899582b6f7b09670a4e8f0f7867d468aa0b321967ed25a8cea0c27e8357b81e3909b61f8ae70f69d4e50f2b68c31f64110c0e6a258efc39f2f9bf8
-
C:\Users\Admin\AppData\Local\Temp\systemq.exeFilesize
3.1MB
MD529853d6de2a6ea760788dbdbe601a4ab
SHA1038ee578dca716ebb46d4a96105838d39122d7a0
SHA256ad306c945a71d25faffefb7330f1563ceb100513a4c50fa29fb60b2d46fbd732
SHA512a6c5822ac7899582b6f7b09670a4e8f0f7867d468aa0b321967ed25a8cea0c27e8357b81e3909b61f8ae70f69d4e50f2b68c31f64110c0e6a258efc39f2f9bf8
-
C:\Users\Admin\AppData\Local\Temp\systemq.exeFilesize
3.1MB
MD529853d6de2a6ea760788dbdbe601a4ab
SHA1038ee578dca716ebb46d4a96105838d39122d7a0
SHA256ad306c945a71d25faffefb7330f1563ceb100513a4c50fa29fb60b2d46fbd732
SHA512a6c5822ac7899582b6f7b09670a4e8f0f7867d468aa0b321967ed25a8cea0c27e8357b81e3909b61f8ae70f69d4e50f2b68c31f64110c0e6a258efc39f2f9bf8
-
C:\Users\Admin\AppData\Local\Temp\wz_payload.exeFilesize
141KB
MD56dcd690c1dfe99f5ca7d7919dbc38295
SHA1945aa4ef16fcddf718f06ef03fa00e1489f73d04
SHA256ede6cba917445c8673017c2154e370a24fbc6a29c2c8e2d90e5a45d8624d837d
SHA5121f2bbb98f2e439e4b09ba8e32053c212a747b58dac1eff4f2583d6a649d6974f5196876d7e8521717ab7932a84fe3882ac68c4d7ad7d193dc11022ecada584ba
-
C:\Users\Admin\AppData\Local\Temp\wz_payload.exeFilesize
141KB
MD56dcd690c1dfe99f5ca7d7919dbc38295
SHA1945aa4ef16fcddf718f06ef03fa00e1489f73d04
SHA256ede6cba917445c8673017c2154e370a24fbc6a29c2c8e2d90e5a45d8624d837d
SHA5121f2bbb98f2e439e4b09ba8e32053c212a747b58dac1eff4f2583d6a649d6974f5196876d7e8521717ab7932a84fe3882ac68c4d7ad7d193dc11022ecada584ba
-
C:\Users\Admin\AppData\Local\Temp\wz_payload.exeFilesize
141KB
MD56dcd690c1dfe99f5ca7d7919dbc38295
SHA1945aa4ef16fcddf718f06ef03fa00e1489f73d04
SHA256ede6cba917445c8673017c2154e370a24fbc6a29c2c8e2d90e5a45d8624d837d
SHA5121f2bbb98f2e439e4b09ba8e32053c212a747b58dac1eff4f2583d6a649d6974f5196876d7e8521717ab7932a84fe3882ac68c4d7ad7d193dc11022ecada584ba
-
C:\Users\Admin\Documents\svchost.exeFilesize
141KB
MD56dcd690c1dfe99f5ca7d7919dbc38295
SHA1945aa4ef16fcddf718f06ef03fa00e1489f73d04
SHA256ede6cba917445c8673017c2154e370a24fbc6a29c2c8e2d90e5a45d8624d837d
SHA5121f2bbb98f2e439e4b09ba8e32053c212a747b58dac1eff4f2583d6a649d6974f5196876d7e8521717ab7932a84fe3882ac68c4d7ad7d193dc11022ecada584ba
-
C:\Users\Admin\Documents\svchost.exeFilesize
141KB
MD56dcd690c1dfe99f5ca7d7919dbc38295
SHA1945aa4ef16fcddf718f06ef03fa00e1489f73d04
SHA256ede6cba917445c8673017c2154e370a24fbc6a29c2c8e2d90e5a45d8624d837d
SHA5121f2bbb98f2e439e4b09ba8e32053c212a747b58dac1eff4f2583d6a649d6974f5196876d7e8521717ab7932a84fe3882ac68c4d7ad7d193dc11022ecada584ba
-
memory/712-39-0x000002273D080000-0x000002273D122000-memory.dmpFilesize
648KB
-
memory/712-52-0x000002273ED20000-0x000002273ED76000-memory.dmpFilesize
344KB
-
memory/712-42-0x0000022757650000-0x0000022757752000-memory.dmpFilesize
1.0MB
-
memory/712-50-0x0000022757810000-0x0000022757820000-memory.dmpFilesize
64KB
-
memory/712-49-0x00007FFEB4E80000-0x00007FFEB5941000-memory.dmpFilesize
10.8MB
-
memory/712-58-0x000002273EDF0000-0x000002273EE44000-memory.dmpFilesize
336KB
-
memory/712-136-0x00007FFEB4E80000-0x00007FFEB5941000-memory.dmpFilesize
10.8MB
-
memory/712-137-0x0000022757810000-0x0000022757820000-memory.dmpFilesize
64KB
-
memory/712-54-0x000002273ED80000-0x000002273EDCC000-memory.dmpFilesize
304KB
-
memory/2556-51-0x000000001BA20000-0x000000001BA30000-memory.dmpFilesize
64KB
-
memory/2556-109-0x000000001B960000-0x000000001B972000-memory.dmpFilesize
72KB
-
memory/2556-44-0x00007FFEB4E80000-0x00007FFEB5941000-memory.dmpFilesize
10.8MB
-
memory/2556-114-0x00007FFEB4E80000-0x00007FFEB5941000-memory.dmpFilesize
10.8MB
-
memory/2556-76-0x000000001C270000-0x000000001C322000-memory.dmpFilesize
712KB
-
memory/2556-75-0x0000000002ED0000-0x0000000002F20000-memory.dmpFilesize
320KB
-
memory/2556-38-0x0000000000A10000-0x0000000000D34000-memory.dmpFilesize
3.1MB
-
memory/2556-110-0x000000001B9C0000-0x000000001B9FC000-memory.dmpFilesize
240KB
-
memory/3828-125-0x000000006E410000-0x000000006E45C000-memory.dmpFilesize
304KB
-
memory/3828-115-0x0000000000C50000-0x0000000000C60000-memory.dmpFilesize
64KB
-
memory/3828-85-0x0000000000C50000-0x0000000000C60000-memory.dmpFilesize
64KB
-
memory/3828-164-0x00000000736E0000-0x0000000073E90000-memory.dmpFilesize
7.7MB
-
memory/3828-140-0x000000007F770000-0x000000007F780000-memory.dmpFilesize
64KB
-
memory/3828-81-0x00000000736E0000-0x0000000073E90000-memory.dmpFilesize
7.7MB
-
memory/3828-82-0x0000000000C50000-0x0000000000C60000-memory.dmpFilesize
64KB
-
memory/4536-45-0x00000000006B0000-0x00000000006C0000-memory.dmpFilesize
64KB
-
memory/4536-124-0x00000000006B0000-0x00000000006C0000-memory.dmpFilesize
64KB
-
memory/4536-46-0x0000000073050000-0x0000000073601000-memory.dmpFilesize
5.7MB
-
memory/4536-146-0x00000000006B0000-0x00000000006C0000-memory.dmpFilesize
64KB
-
memory/4536-53-0x0000000073050000-0x0000000073601000-memory.dmpFilesize
5.7MB
-
memory/4536-139-0x0000000073050000-0x0000000073601000-memory.dmpFilesize
5.7MB
-
memory/4536-57-0x00000000006B0000-0x00000000006C0000-memory.dmpFilesize
64KB
-
memory/4536-135-0x0000000073050000-0x0000000073601000-memory.dmpFilesize
5.7MB
-
memory/4648-165-0x0000000002370000-0x0000000002380000-memory.dmpFilesize
64KB
-
memory/4648-147-0x00000000736E0000-0x0000000073E90000-memory.dmpFilesize
7.7MB
-
memory/4648-148-0x0000000002370000-0x0000000002380000-memory.dmpFilesize
64KB
-
memory/5084-56-0x0000000005700000-0x0000000005722000-memory.dmpFilesize
136KB
-
memory/5084-141-0x0000000007CE0000-0x0000000007CEE000-memory.dmpFilesize
56KB
-
memory/5084-70-0x0000000006160000-0x00000000064B4000-memory.dmpFilesize
3.3MB
-
memory/5084-113-0x0000000007D30000-0x0000000007DC6000-memory.dmpFilesize
600KB
-
memory/5084-116-0x0000000007CA0000-0x0000000007CB1000-memory.dmpFilesize
68KB
-
memory/5084-60-0x00000000060F0000-0x0000000006156000-memory.dmpFilesize
408KB
-
memory/5084-59-0x0000000006080000-0x00000000060E6000-memory.dmpFilesize
408KB
-
memory/5084-112-0x00000000736E0000-0x0000000073E90000-memory.dmpFilesize
7.7MB
-
memory/5084-80-0x0000000006D30000-0x0000000006D62000-memory.dmpFilesize
200KB
-
memory/5084-111-0x0000000007B10000-0x0000000007B1A000-memory.dmpFilesize
40KB
-
memory/5084-72-0x0000000006770000-0x000000000678E000-memory.dmpFilesize
120KB
-
memory/5084-55-0x00000000053A0000-0x00000000053B0000-memory.dmpFilesize
64KB
-
memory/5084-138-0x00000000053A0000-0x00000000053B0000-memory.dmpFilesize
64KB
-
memory/5084-77-0x00000000053A0000-0x00000000053B0000-memory.dmpFilesize
64KB
-
memory/5084-108-0x0000000007AA0000-0x0000000007ABA000-memory.dmpFilesize
104KB
-
memory/5084-73-0x00000000067C0000-0x000000000680C000-memory.dmpFilesize
304KB
-
memory/5084-142-0x0000000007CF0000-0x0000000007D04000-memory.dmpFilesize
80KB
-
memory/5084-144-0x0000000007DD0000-0x0000000007DEA000-memory.dmpFilesize
104KB
-
memory/5084-143-0x00000000053A0000-0x00000000053B0000-memory.dmpFilesize
64KB
-
memory/5084-145-0x0000000007D20000-0x0000000007D28000-memory.dmpFilesize
32KB
-
memory/5084-107-0x00000000080E0000-0x000000000875A000-memory.dmpFilesize
6.5MB
-
memory/5084-97-0x0000000007740000-0x00000000077E3000-memory.dmpFilesize
652KB
-
memory/5084-96-0x000000007EFC0000-0x000000007EFD0000-memory.dmpFilesize
64KB
-
memory/5084-160-0x00000000736E0000-0x0000000073E90000-memory.dmpFilesize
7.7MB
-
memory/5084-83-0x000000006E410000-0x000000006E45C000-memory.dmpFilesize
304KB
-
memory/5084-43-0x00000000059E0000-0x0000000006008000-memory.dmpFilesize
6.2MB
-
memory/5084-41-0x0000000003180000-0x00000000031B6000-memory.dmpFilesize
216KB
-
memory/5084-95-0x0000000006D10000-0x0000000006D2E000-memory.dmpFilesize
120KB
-
memory/5084-40-0x00000000736E0000-0x0000000073E90000-memory.dmpFilesize
7.7MB