Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
13-05-2024 18:10
General
-
Target
02cc89bb7c64919d3c27e9b8ac637e847aca5c68c2b990f33a800445a3f0164d.exe
-
Size
2.9MB
-
MD5
60a69e78e37de9936c7d7274c67abda4
-
SHA1
7687addc4a89ced80ce7dd372422b7d91ee8d4f3
-
SHA256
02cc89bb7c64919d3c27e9b8ac637e847aca5c68c2b990f33a800445a3f0164d
-
SHA512
754ab07ea26d0512422de8b3375be68366fc7def4511b8313db08d38f424eaf9f857aea46900c1e9e6c61418d15571762bdc5adb1fa6aec5e08256f425522464
-
SSDEEP
24576:ATU7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHn:ATU7AAmw4gxeOw46fUbNecCCFbNecQ
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Detects executables packed with ASPack 45 IoCs
-
UPX dump on OEP (original entry point) 24 IoCs
-
Warzone RAT payload 3 IoCs
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
-
Drops startup file 5 IoCs
-
Executes dropped EXE 28 IoCs
-
Loads dropped DLL 40 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Suspicious use of SetThreadContext 17 IoCs
-
Drops file in Windows directory 15 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
-
Suspicious use of SetWindowsHookEx 32 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\02cc89bb7c64919d3c27e9b8ac637e847aca5c68c2b990f33a800445a3f0164d.exe"C:\Users\Admin\AppData\Local\Temp\02cc89bb7c64919d3c27e9b8ac637e847aca5c68c2b990f33a800445a3f0164d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\02cc89bb7c64919d3c27e9b8ac637e847aca5c68c2b990f33a800445a3f0164d.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\02cc89bb7c64919d3c27e9b8ac637e847aca5c68c2b990f33a800445a3f0164d.exeC:\Users\Admin\AppData\Local\Temp\02cc89bb7c64919d3c27e9b8ac637e847aca5c68c2b990f33a800445a3f0164d.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\02cc89bb7c64919d3c27e9b8ac637e847aca5c68c2b990f33a800445a3f0164d.exeC:\Users\Admin\AppData\Local\Temp\02cc89bb7c64919d3c27e9b8ac637e847aca5c68c2b990f33a800445a3f0164d.exe3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe9⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"11⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe11⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"9⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exeFilesize
2.9MB
MD560a69e78e37de9936c7d7274c67abda4
SHA17687addc4a89ced80ce7dd372422b7d91ee8d4f3
SHA25602cc89bb7c64919d3c27e9b8ac637e847aca5c68c2b990f33a800445a3f0164d
SHA512754ab07ea26d0512422de8b3375be68366fc7def4511b8313db08d38f424eaf9f857aea46900c1e9e6c61418d15571762bdc5adb1fa6aec5e08256f425522464
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbsFilesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbsFilesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
C:\Windows\system\explorer.exeFilesize
2.9MB
MD57a786eec45c9464fdb72403ca115de53
SHA1320e33acdbdfbd06e988f02a48fa6f385740c3d7
SHA2567ed1404d571d8aecbe25e6b9272d2f61816c91b00603100a36bf06b5ac38f3aa
SHA5123a675d6dc8af62d887dd693a6ac38f663396d9933d895a8dbc7cae34f60ffb4befd600df4aafca55b29ec0253bf08243419376e4057dd0a9963b1d5efd298b7f
-
\Windows\system\spoolsv.exeFilesize
2.9MB
MD5210c894b6a8c573e67be24e5060504fc
SHA1adcfa40d2da706363101a8fa482bc3cfaa5419de
SHA256233d3c009f98212a59f0a4dfd1fe8c590bd122433e3cc7308465c657304e994d
SHA5126ff458c6b74f8bd88b670b083225e0ac002fbd0a7295dfb793a7e9afe023c8f83e7ceec5b33da866f4b7762dd9e3848874dfe3f741c1804f96c8076dfc348320
-
memory/892-621-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/980-764-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/980-769-0x00000000023C0000-0x0000000002406000-memory.dmpFilesize
280KB
-
memory/1056-540-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/1056-558-0x0000000000310000-0x0000000000356000-memory.dmpFilesize
280KB
-
memory/1068-73-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1068-58-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1068-60-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1068-62-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1068-66-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1068-98-0x0000000001D50000-0x0000000001D96000-memory.dmpFilesize
280KB
-
memory/1068-152-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1068-97-0x0000000001D50000-0x0000000001D96000-memory.dmpFilesize
280KB
-
memory/1112-195-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-767-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-865-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-494-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-486-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-436-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-431-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-432-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-832-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-365-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-375-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-376-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-318-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-268-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-538-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-549-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-594-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-650-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-815-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-713-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-763-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-768-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1112-539-0x0000000002BD0000-0x0000000002C16000-memory.dmpFilesize
280KB
-
memory/1396-371-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1492-480-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/1516-866-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/1604-645-0x0000000000400000-0x0000000001990000-memory.dmpFilesize
21.6MB
-
memory/1636-144-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/1636-100-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/1816-532-0x0000000000400000-0x0000000001990000-memory.dmpFilesize
21.6MB
-
memory/1912-421-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2080-196-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2080-243-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2100-974-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2100-267-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2148-657-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2200-153-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2200-182-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2244-762-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2296-495-0x0000000000450000-0x0000000000496000-memory.dmpFilesize
280KB
-
memory/2296-488-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2324-250-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2332-378-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2352-433-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2352-439-0x0000000000350000-0x0000000000396000-memory.dmpFilesize
280KB
-
memory/2460-816-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2624-624-0x0000000000290000-0x00000000002D6000-memory.dmpFilesize
280KB
-
memory/2624-635-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2700-86-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2764-708-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2860-40-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2860-0-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2884-322-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2888-276-0x0000000000450000-0x0000000000496000-memory.dmpFilesize
280KB
-
memory/2888-269-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2916-249-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2948-17-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-4-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-24-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-39-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-41-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2948-25-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-20-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-29-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-44-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2948-43-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-47-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-50-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-15-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-85-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2948-22-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-5-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-2-0x0000000000300000-0x0000000000400000-memory.dmpFilesize
1024KB
-
memory/2948-27-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-42-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2948-14-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-32-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-46-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-54-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2948-53-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2948-49-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2948-48-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-7-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-45-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-51-0x0000000000400000-0x0000000000628000-memory.dmpFilesize
2.2MB
-
memory/2948-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2948-52-0x00000000004E7000-0x0000000000513000-memory.dmpFilesize
176KB
-
memory/2948-9-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-11-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2948-37-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/3020-716-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB