Analysis
-
max time kernel
140s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2023 17:15
Static task
static1
Behavioral task
behavioral1
Sample
71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exe
-
Size
3.5MB
-
MD5
80225e6fc6a1c15d38a7c924641fdb84
-
SHA1
68fd0f6dd5cef4e94a2d745baa50d0d295b8acf9
-
SHA256
71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fc
-
SHA512
de2eb790e856a14be6905e8e0e8dd6fcf108bcd7effa5f749760272ef8fe88addcdc18336b8cb5b6eac24a9536d3559bb9f27e6bb50942840deb25e3df819952
-
SSDEEP
49152:MdqAeYMZsc+Jf+1Z1yDMj7z//DXhdDHGuYtwDNetxQmoDMBG:MQAeHZsc+Jf+1jIMjP9x9YSDNyxF
Malware Config
Extracted
nanocore
1.2.2.0
backupcraft.ddns.net:54984
127.0.0.1:54984
96156e42-3e88-498a-83b0-34f138a87549
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65541
-
build_time
2023-06-29T18:37:26.433436736Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
54984
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.0485763e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
96156e42-3e88-498a-83b0-34f138a87549
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
backupcraft.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Extracted
quasar
1.4.1
Slave
backupcraft.ddns.net:4782
fbfe67fd-8086-4852-908c-75959d17c0c7
-
encryption_key
6550C5FD133683B3330870C778B7DB73E923F472
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
warzonerat
supercraft123.serveminecraft.net:5200
Signatures
-
Quasar payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\systemq.exe family_quasar C:\Users\Admin\AppData\Local\Temp\systemq.exe family_quasar C:\Users\Admin\AppData\Local\Temp\systemq.exe family_quasar behavioral2/memory/3528-29-0x0000000000650000-0x0000000000974000-memory.dmp family_quasar -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\wz_payload.exe warzonerat C:\Users\Admin\AppData\Local\Temp\wz_payload.exe warzonerat C:\Users\Admin\AppData\Local\Temp\wz_payload.exe warzonerat C:\Users\Admin\Documents\svchost.exe warzonerat C:\Users\Admin\Documents\svchost.exe warzonerat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation 71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exe -
Drops startup file 2 IoCs
Processes:
wz_payload.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat wz_payload.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start wz_payload.exe -
Executes dropped EXE 4 IoCs
Processes:
nanocore_payload.exesystemq.exewz_payload.exesvchost.exepid process 464 nanocore_payload.exe 3528 systemq.exe 3952 wz_payload.exe 4744 svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
nanocore_payload.exewz_payload.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Subsystem = "C:\\Program Files (x86)\\UDP Subsystem\\udpss.exe" nanocore_payload.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\Users\\Admin\\Documents\\svchost.exe" wz_payload.exe -
Processes:
nanocore_payload.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA nanocore_payload.exe -
Drops file in Program Files directory 2 IoCs
Processes:
nanocore_payload.exedescription ioc process File created C:\Program Files (x86)\UDP Subsystem\udpss.exe nanocore_payload.exe File opened for modification C:\Program Files (x86)\UDP Subsystem\udpss.exe nanocore_payload.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NTFS ADS 1 IoCs
Processes:
wz_payload.exedescription ioc process File created C:\Users\Admin\Documents\Documents:ApplicationData wz_payload.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
powershell.exenanocore_payload.exepowershell.exepowershell.exepid process 580 powershell.exe 464 nanocore_payload.exe 464 nanocore_payload.exe 464 nanocore_payload.exe 580 powershell.exe 464 nanocore_payload.exe 464 nanocore_payload.exe 464 nanocore_payload.exe 4400 powershell.exe 4400 powershell.exe 4512 powershell.exe 4512 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
nanocore_payload.exepid process 464 nanocore_payload.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
svchost.exepid process 4744 svchost.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
systemq.exepowershell.exenanocore_payload.exepowershell.exepowershell.exeAUDIODG.EXEdescription pid process Token: SeDebugPrivilege 3528 systemq.exe Token: SeDebugPrivilege 580 powershell.exe Token: SeDebugPrivilege 464 nanocore_payload.exe Token: SeDebugPrivilege 4400 powershell.exe Token: SeDebugPrivilege 4512 powershell.exe Token: 33 1400 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1400 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
systemq.exepid process 3528 systemq.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exewz_payload.exesvchost.exedescription pid process target process PID 4160 wrote to memory of 580 4160 71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exe powershell.exe PID 4160 wrote to memory of 580 4160 71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exe powershell.exe PID 4160 wrote to memory of 580 4160 71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exe powershell.exe PID 4160 wrote to memory of 464 4160 71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exe nanocore_payload.exe PID 4160 wrote to memory of 464 4160 71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exe nanocore_payload.exe PID 4160 wrote to memory of 464 4160 71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exe nanocore_payload.exe PID 4160 wrote to memory of 3528 4160 71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exe systemq.exe PID 4160 wrote to memory of 3528 4160 71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exe systemq.exe PID 4160 wrote to memory of 3952 4160 71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exe wz_payload.exe PID 4160 wrote to memory of 3952 4160 71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exe wz_payload.exe PID 4160 wrote to memory of 3952 4160 71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exe wz_payload.exe PID 3952 wrote to memory of 4400 3952 wz_payload.exe powershell.exe PID 3952 wrote to memory of 4400 3952 wz_payload.exe powershell.exe PID 3952 wrote to memory of 4400 3952 wz_payload.exe powershell.exe PID 3952 wrote to memory of 4744 3952 wz_payload.exe svchost.exe PID 3952 wrote to memory of 4744 3952 wz_payload.exe svchost.exe PID 3952 wrote to memory of 4744 3952 wz_payload.exe svchost.exe PID 4744 wrote to memory of 4512 4744 svchost.exe powershell.exe PID 4744 wrote to memory of 4512 4744 svchost.exe powershell.exe PID 4744 wrote to memory of 4512 4744 svchost.exe powershell.exe PID 4744 wrote to memory of 3480 4744 svchost.exe cmd.exe PID 4744 wrote to memory of 3480 4744 svchost.exe cmd.exe PID 4744 wrote to memory of 3480 4744 svchost.exe cmd.exe PID 4744 wrote to memory of 3480 4744 svchost.exe cmd.exe PID 4744 wrote to memory of 3480 4744 svchost.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fcexe_JC.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAagB6ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGMAcgB6ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGcAYwB0ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGYAegBxACMAPgA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\nanocore_payload.exe"C:\Users\Admin\AppData\Local\Temp\nanocore_payload.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\systemq.exe"C:\Users\Admin\AppData\Local\Temp\systemq.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\wz_payload.exe"C:\Users\Admin\AppData\Local\Temp\wz_payload.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\svchost.exe"C:\Users\Admin\Documents\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x300 0x3fc1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD54d1c42b3be97ab0b389f1d7abcde5625
SHA1cdf534c8180272fa93c8fb1c245cbd3ad4e531ad
SHA256947151624541eacbd91206fff759d175c8ffef0f90a99ab5212e26b04c538a81
SHA5124eb00ca9ea0e5916a27832019b85fa2e6826e1ebf17a04498f90aa5d8c8ce9c7f97ff88db778996f5aaeac07a1d0796cfc9cd10d3a932ca1a203b24493852433
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD54d1c42b3be97ab0b389f1d7abcde5625
SHA1cdf534c8180272fa93c8fb1c245cbd3ad4e531ad
SHA256947151624541eacbd91206fff759d175c8ffef0f90a99ab5212e26b04c538a81
SHA5124eb00ca9ea0e5916a27832019b85fa2e6826e1ebf17a04498f90aa5d8c8ce9c7f97ff88db778996f5aaeac07a1d0796cfc9cd10d3a932ca1a203b24493852433
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3cb1xmd2.zjw.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\nanocore_payload.exeFilesize
202KB
MD5453bdc5af90ce17385bc4e0ca1cbe15d
SHA14047e7aea50df01ea1adf1d3c1354e3335e56429
SHA25689e3d9bdab44323f4e95c7ed14859e36e87e39332b2c28c2038465eb1abbc602
SHA512368c8374f7e1cbe351c952625ca43b541230edc14e8b9e3c3751fc126dc7507fd7260c523233ef8e82f2d7562ed0e03068d9158551069d8e70156610b60d58ba
-
C:\Users\Admin\AppData\Local\Temp\nanocore_payload.exeFilesize
202KB
MD5453bdc5af90ce17385bc4e0ca1cbe15d
SHA14047e7aea50df01ea1adf1d3c1354e3335e56429
SHA25689e3d9bdab44323f4e95c7ed14859e36e87e39332b2c28c2038465eb1abbc602
SHA512368c8374f7e1cbe351c952625ca43b541230edc14e8b9e3c3751fc126dc7507fd7260c523233ef8e82f2d7562ed0e03068d9158551069d8e70156610b60d58ba
-
C:\Users\Admin\AppData\Local\Temp\nanocore_payload.exeFilesize
202KB
MD5453bdc5af90ce17385bc4e0ca1cbe15d
SHA14047e7aea50df01ea1adf1d3c1354e3335e56429
SHA25689e3d9bdab44323f4e95c7ed14859e36e87e39332b2c28c2038465eb1abbc602
SHA512368c8374f7e1cbe351c952625ca43b541230edc14e8b9e3c3751fc126dc7507fd7260c523233ef8e82f2d7562ed0e03068d9158551069d8e70156610b60d58ba
-
C:\Users\Admin\AppData\Local\Temp\systemq.exeFilesize
3.1MB
MD529853d6de2a6ea760788dbdbe601a4ab
SHA1038ee578dca716ebb46d4a96105838d39122d7a0
SHA256ad306c945a71d25faffefb7330f1563ceb100513a4c50fa29fb60b2d46fbd732
SHA512a6c5822ac7899582b6f7b09670a4e8f0f7867d468aa0b321967ed25a8cea0c27e8357b81e3909b61f8ae70f69d4e50f2b68c31f64110c0e6a258efc39f2f9bf8
-
C:\Users\Admin\AppData\Local\Temp\systemq.exeFilesize
3.1MB
MD529853d6de2a6ea760788dbdbe601a4ab
SHA1038ee578dca716ebb46d4a96105838d39122d7a0
SHA256ad306c945a71d25faffefb7330f1563ceb100513a4c50fa29fb60b2d46fbd732
SHA512a6c5822ac7899582b6f7b09670a4e8f0f7867d468aa0b321967ed25a8cea0c27e8357b81e3909b61f8ae70f69d4e50f2b68c31f64110c0e6a258efc39f2f9bf8
-
C:\Users\Admin\AppData\Local\Temp\systemq.exeFilesize
3.1MB
MD529853d6de2a6ea760788dbdbe601a4ab
SHA1038ee578dca716ebb46d4a96105838d39122d7a0
SHA256ad306c945a71d25faffefb7330f1563ceb100513a4c50fa29fb60b2d46fbd732
SHA512a6c5822ac7899582b6f7b09670a4e8f0f7867d468aa0b321967ed25a8cea0c27e8357b81e3909b61f8ae70f69d4e50f2b68c31f64110c0e6a258efc39f2f9bf8
-
C:\Users\Admin\AppData\Local\Temp\wz_payload.exeFilesize
141KB
MD56dcd690c1dfe99f5ca7d7919dbc38295
SHA1945aa4ef16fcddf718f06ef03fa00e1489f73d04
SHA256ede6cba917445c8673017c2154e370a24fbc6a29c2c8e2d90e5a45d8624d837d
SHA5121f2bbb98f2e439e4b09ba8e32053c212a747b58dac1eff4f2583d6a649d6974f5196876d7e8521717ab7932a84fe3882ac68c4d7ad7d193dc11022ecada584ba
-
C:\Users\Admin\AppData\Local\Temp\wz_payload.exeFilesize
141KB
MD56dcd690c1dfe99f5ca7d7919dbc38295
SHA1945aa4ef16fcddf718f06ef03fa00e1489f73d04
SHA256ede6cba917445c8673017c2154e370a24fbc6a29c2c8e2d90e5a45d8624d837d
SHA5121f2bbb98f2e439e4b09ba8e32053c212a747b58dac1eff4f2583d6a649d6974f5196876d7e8521717ab7932a84fe3882ac68c4d7ad7d193dc11022ecada584ba
-
C:\Users\Admin\AppData\Local\Temp\wz_payload.exeFilesize
141KB
MD56dcd690c1dfe99f5ca7d7919dbc38295
SHA1945aa4ef16fcddf718f06ef03fa00e1489f73d04
SHA256ede6cba917445c8673017c2154e370a24fbc6a29c2c8e2d90e5a45d8624d837d
SHA5121f2bbb98f2e439e4b09ba8e32053c212a747b58dac1eff4f2583d6a649d6974f5196876d7e8521717ab7932a84fe3882ac68c4d7ad7d193dc11022ecada584ba
-
C:\Users\Admin\Documents\svchost.exeFilesize
141KB
MD56dcd690c1dfe99f5ca7d7919dbc38295
SHA1945aa4ef16fcddf718f06ef03fa00e1489f73d04
SHA256ede6cba917445c8673017c2154e370a24fbc6a29c2c8e2d90e5a45d8624d837d
SHA5121f2bbb98f2e439e4b09ba8e32053c212a747b58dac1eff4f2583d6a649d6974f5196876d7e8521717ab7932a84fe3882ac68c4d7ad7d193dc11022ecada584ba
-
C:\Users\Admin\Documents\svchost.exeFilesize
141KB
MD56dcd690c1dfe99f5ca7d7919dbc38295
SHA1945aa4ef16fcddf718f06ef03fa00e1489f73d04
SHA256ede6cba917445c8673017c2154e370a24fbc6a29c2c8e2d90e5a45d8624d837d
SHA5121f2bbb98f2e439e4b09ba8e32053c212a747b58dac1eff4f2583d6a649d6974f5196876d7e8521717ab7932a84fe3882ac68c4d7ad7d193dc11022ecada584ba
-
memory/464-109-0x0000000073720000-0x0000000073CD1000-memory.dmpFilesize
5.7MB
-
memory/464-32-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/464-41-0x0000000073720000-0x0000000073CD1000-memory.dmpFilesize
5.7MB
-
memory/464-99-0x0000000073720000-0x0000000073CD1000-memory.dmpFilesize
5.7MB
-
memory/464-97-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/464-53-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/464-50-0x0000000073720000-0x0000000073CD1000-memory.dmpFilesize
5.7MB
-
memory/580-89-0x000000007F170000-0x000000007F180000-memory.dmpFilesize
64KB
-
memory/580-47-0x0000000005680000-0x00000000056E6000-memory.dmpFilesize
408KB
-
memory/580-48-0x0000000005610000-0x0000000005676000-memory.dmpFilesize
408KB
-
memory/580-52-0x00000000056F0000-0x0000000005A44000-memory.dmpFilesize
3.3MB
-
memory/580-54-0x0000000005BC0000-0x0000000005BDE000-memory.dmpFilesize
120KB
-
memory/580-56-0x0000000005F40000-0x0000000005F8C000-memory.dmpFilesize
304KB
-
memory/580-27-0x00000000025C0000-0x00000000025F6000-memory.dmpFilesize
216KB
-
memory/580-28-0x0000000073DB0000-0x0000000074560000-memory.dmpFilesize
7.7MB
-
memory/580-128-0x0000000073DB0000-0x0000000074560000-memory.dmpFilesize
7.7MB
-
memory/580-125-0x0000000007210000-0x0000000007218000-memory.dmpFilesize
32KB
-
memory/580-124-0x0000000007220000-0x000000000723A000-memory.dmpFilesize
104KB
-
memory/580-72-0x0000000002710000-0x0000000002720000-memory.dmpFilesize
64KB
-
memory/580-75-0x0000000073DB0000-0x0000000074560000-memory.dmpFilesize
7.7MB
-
memory/580-123-0x0000000007140000-0x0000000007154000-memory.dmpFilesize
80KB
-
memory/580-77-0x000000006EAE0000-0x000000006EB2C000-memory.dmpFilesize
304KB
-
memory/580-76-0x0000000006B70000-0x0000000006BA2000-memory.dmpFilesize
200KB
-
memory/580-49-0x0000000002710000-0x0000000002720000-memory.dmpFilesize
64KB
-
memory/580-88-0x0000000006180000-0x000000000619E000-memory.dmpFilesize
120KB
-
memory/580-90-0x0000000006DB0000-0x0000000006E53000-memory.dmpFilesize
652KB
-
memory/580-122-0x0000000007130000-0x000000000713E000-memory.dmpFilesize
56KB
-
memory/580-92-0x0000000007510000-0x0000000007B8A000-memory.dmpFilesize
6.5MB
-
memory/580-111-0x00000000070D0000-0x00000000070E1000-memory.dmpFilesize
68KB
-
memory/580-94-0x0000000006ED0000-0x0000000006EEA000-memory.dmpFilesize
104KB
-
memory/580-95-0x0000000006F40000-0x0000000006F4A000-memory.dmpFilesize
40KB
-
memory/580-46-0x0000000002710000-0x0000000002720000-memory.dmpFilesize
64KB
-
memory/580-98-0x0000000007160000-0x00000000071F6000-memory.dmpFilesize
600KB
-
memory/580-100-0x0000000002710000-0x0000000002720000-memory.dmpFilesize
64KB
-
memory/580-30-0x0000000004DA0000-0x00000000053C8000-memory.dmpFilesize
6.2MB
-
memory/580-34-0x0000000005450000-0x0000000005472000-memory.dmpFilesize
136KB
-
memory/580-101-0x0000000002710000-0x0000000002720000-memory.dmpFilesize
64KB
-
memory/3480-164-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/3528-58-0x000000001BB30000-0x000000001BBE2000-memory.dmpFilesize
712KB
-
memory/3528-51-0x000000001B4C0000-0x000000001B4D0000-memory.dmpFilesize
64KB
-
memory/3528-93-0x000000001C830000-0x000000001C86C000-memory.dmpFilesize
240KB
-
memory/3528-57-0x000000001BA20000-0x000000001BA70000-memory.dmpFilesize
320KB
-
memory/3528-91-0x000000001BAA0000-0x000000001BAB2000-memory.dmpFilesize
72KB
-
memory/3528-78-0x00007FFA69270000-0x00007FFA69D31000-memory.dmpFilesize
10.8MB
-
memory/3528-31-0x00007FFA69270000-0x00007FFA69D31000-memory.dmpFilesize
10.8MB
-
memory/3528-29-0x0000000000650000-0x0000000000974000-memory.dmpFilesize
3.1MB
-
memory/4400-132-0x0000000073DB0000-0x0000000074560000-memory.dmpFilesize
7.7MB
-
memory/4400-112-0x000000006EAE0000-0x000000006EB2C000-memory.dmpFilesize
304KB
-
memory/4400-61-0x00000000047D0000-0x00000000047E0000-memory.dmpFilesize
64KB
-
memory/4400-62-0x00000000047D0000-0x00000000047E0000-memory.dmpFilesize
64KB
-
memory/4400-110-0x00000000047D0000-0x00000000047E0000-memory.dmpFilesize
64KB
-
memory/4400-60-0x0000000073DB0000-0x0000000074560000-memory.dmpFilesize
7.7MB
-
memory/4512-147-0x0000000006720000-0x000000000676C000-memory.dmpFilesize
304KB
-
memory/4512-135-0x0000000004D80000-0x0000000004D90000-memory.dmpFilesize
64KB
-
memory/4512-146-0x0000000005E10000-0x0000000006164000-memory.dmpFilesize
3.3MB
-
memory/4512-134-0x0000000004D80000-0x0000000004D90000-memory.dmpFilesize
64KB
-
memory/4512-148-0x0000000004D80000-0x0000000004D90000-memory.dmpFilesize
64KB
-
memory/4512-149-0x000000006EEF0000-0x000000006EF3C000-memory.dmpFilesize
304KB
-
memory/4512-159-0x0000000007410000-0x00000000074B3000-memory.dmpFilesize
652KB
-
memory/4512-160-0x00000000076E0000-0x00000000076F1000-memory.dmpFilesize
68KB
-
memory/4512-161-0x0000000007720000-0x0000000007734000-memory.dmpFilesize
80KB
-
memory/4512-163-0x0000000073DB0000-0x0000000074560000-memory.dmpFilesize
7.7MB
-
memory/4512-133-0x0000000073DB0000-0x0000000074560000-memory.dmpFilesize
7.7MB