Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06-07-2024 07:22
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe
Resource
win10v2004-20240704-en
General
-
Target
SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe
-
Size
5.4MB
-
MD5
a2a9c309c5300a53d2c2fc41b71b174b
-
SHA1
f6c26eae1925425fa8966266e87a57b688fad218
-
SHA256
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224
-
SHA512
a29eec8fa98174a74e9bd93c5902cdd95ce329ff8b7a1469901a95705dc1d7fffde58afa296399febb8559d8cd73c932945e85cce8af54e7a672d8f1618e3f7c
-
SSDEEP
98304:j+ddAtuMvY00V2vtQSH7OuqeGszSQTADu0mL63KQOKvYA1ZuoyQPNf+xKi:wdOuMvc8VdbOuqePmQTAKH63NYAiGfiT
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exedescription pid process target process PID 1924 created 1196 1924 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe Explorer.EXE -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepid process 6352 powershell.exe 7584 powershell.exe -
Executes dropped EXE 4 IoCs
Processes:
BLueHvffhw.exeBLueHvffhw.exeFallbackBuffer.exeFallbackBuffer.exepid process 2088 BLueHvffhw.exe 3096 BLueHvffhw.exe 7836 FallbackBuffer.exe 4076 FallbackBuffer.exe -
Loads dropped DLL 2 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exeBLueHvffhw.exepid process 844 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe 2088 BLueHvffhw.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exeBLueHvffhw.exeFallbackBuffer.exeFallbackBuffer.exeInstallUtil.exedescription pid process target process PID 844 set thread context of 1924 844 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 2088 set thread context of 3096 2088 BLueHvffhw.exe BLueHvffhw.exe PID 7836 set thread context of 4076 7836 FallbackBuffer.exe FallbackBuffer.exe PID 4076 set thread context of 5512 4076 FallbackBuffer.exe InstallUtil.exe PID 5512 set thread context of 6892 5512 InstallUtil.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exedialer.exepowershell.exeFallbackBuffer.exepowershell.exepid process 1924 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe 1924 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe 3216 dialer.exe 3216 dialer.exe 3216 dialer.exe 3216 dialer.exe 7584 powershell.exe 4076 FallbackBuffer.exe 4076 FallbackBuffer.exe 6352 powershell.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exeBLueHvffhw.exeBLueHvffhw.exepowershell.exeFallbackBuffer.exeFallbackBuffer.exeInstallUtil.exeInstallUtil.exepowershell.exedescription pid process Token: SeDebugPrivilege 844 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe Token: SeDebugPrivilege 844 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe Token: SeDebugPrivilege 2088 BLueHvffhw.exe Token: SeDebugPrivilege 2088 BLueHvffhw.exe Token: SeDebugPrivilege 3096 BLueHvffhw.exe Token: SeDebugPrivilege 7584 powershell.exe Token: SeDebugPrivilege 7836 FallbackBuffer.exe Token: SeDebugPrivilege 7836 FallbackBuffer.exe Token: SeDebugPrivilege 4076 FallbackBuffer.exe Token: SeDebugPrivilege 5512 InstallUtil.exe Token: SeDebugPrivilege 5512 InstallUtil.exe Token: SeDebugPrivilege 6892 InstallUtil.exe Token: SeDebugPrivilege 6352 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exeBLueHvffhw.exeSecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exetaskeng.exetaskeng.exeFallbackBuffer.exeFallbackBuffer.exeInstallUtil.exedescription pid process target process PID 844 wrote to memory of 2088 844 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe BLueHvffhw.exe PID 844 wrote to memory of 2088 844 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe BLueHvffhw.exe PID 844 wrote to memory of 2088 844 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe BLueHvffhw.exe PID 844 wrote to memory of 2088 844 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe BLueHvffhw.exe PID 844 wrote to memory of 1924 844 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 844 wrote to memory of 1924 844 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 844 wrote to memory of 1924 844 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 844 wrote to memory of 1924 844 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 844 wrote to memory of 1924 844 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 844 wrote to memory of 1924 844 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 844 wrote to memory of 1924 844 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 844 wrote to memory of 1924 844 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 844 wrote to memory of 1924 844 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 2088 wrote to memory of 3096 2088 BLueHvffhw.exe BLueHvffhw.exe PID 2088 wrote to memory of 3096 2088 BLueHvffhw.exe BLueHvffhw.exe PID 2088 wrote to memory of 3096 2088 BLueHvffhw.exe BLueHvffhw.exe PID 2088 wrote to memory of 3096 2088 BLueHvffhw.exe BLueHvffhw.exe PID 2088 wrote to memory of 3096 2088 BLueHvffhw.exe BLueHvffhw.exe PID 2088 wrote to memory of 3096 2088 BLueHvffhw.exe BLueHvffhw.exe PID 2088 wrote to memory of 3096 2088 BLueHvffhw.exe BLueHvffhw.exe PID 2088 wrote to memory of 3096 2088 BLueHvffhw.exe BLueHvffhw.exe PID 2088 wrote to memory of 3096 2088 BLueHvffhw.exe BLueHvffhw.exe PID 1924 wrote to memory of 3216 1924 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe dialer.exe PID 1924 wrote to memory of 3216 1924 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe dialer.exe PID 1924 wrote to memory of 3216 1924 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe dialer.exe PID 1924 wrote to memory of 3216 1924 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe dialer.exe PID 1924 wrote to memory of 3216 1924 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe dialer.exe PID 1924 wrote to memory of 3216 1924 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe dialer.exe PID 7548 wrote to memory of 7584 7548 taskeng.exe powershell.exe PID 7548 wrote to memory of 7584 7548 taskeng.exe powershell.exe PID 7548 wrote to memory of 7584 7548 taskeng.exe powershell.exe PID 7800 wrote to memory of 7836 7800 taskeng.exe FallbackBuffer.exe PID 7800 wrote to memory of 7836 7800 taskeng.exe FallbackBuffer.exe PID 7800 wrote to memory of 7836 7800 taskeng.exe FallbackBuffer.exe PID 7800 wrote to memory of 7836 7800 taskeng.exe FallbackBuffer.exe PID 7836 wrote to memory of 4076 7836 FallbackBuffer.exe FallbackBuffer.exe PID 7836 wrote to memory of 4076 7836 FallbackBuffer.exe FallbackBuffer.exe PID 7836 wrote to memory of 4076 7836 FallbackBuffer.exe FallbackBuffer.exe PID 7836 wrote to memory of 4076 7836 FallbackBuffer.exe FallbackBuffer.exe PID 7836 wrote to memory of 4076 7836 FallbackBuffer.exe FallbackBuffer.exe PID 7836 wrote to memory of 4076 7836 FallbackBuffer.exe FallbackBuffer.exe PID 7836 wrote to memory of 4076 7836 FallbackBuffer.exe FallbackBuffer.exe PID 7836 wrote to memory of 4076 7836 FallbackBuffer.exe FallbackBuffer.exe PID 7836 wrote to memory of 4076 7836 FallbackBuffer.exe FallbackBuffer.exe PID 4076 wrote to memory of 5512 4076 FallbackBuffer.exe InstallUtil.exe PID 4076 wrote to memory of 5512 4076 FallbackBuffer.exe InstallUtil.exe PID 4076 wrote to memory of 5512 4076 FallbackBuffer.exe InstallUtil.exe PID 4076 wrote to memory of 5512 4076 FallbackBuffer.exe InstallUtil.exe PID 4076 wrote to memory of 5512 4076 FallbackBuffer.exe InstallUtil.exe PID 4076 wrote to memory of 5512 4076 FallbackBuffer.exe InstallUtil.exe PID 4076 wrote to memory of 5512 4076 FallbackBuffer.exe InstallUtil.exe PID 4076 wrote to memory of 5512 4076 FallbackBuffer.exe InstallUtil.exe PID 4076 wrote to memory of 5512 4076 FallbackBuffer.exe InstallUtil.exe PID 4076 wrote to memory of 5512 4076 FallbackBuffer.exe InstallUtil.exe PID 4076 wrote to memory of 5512 4076 FallbackBuffer.exe InstallUtil.exe PID 4076 wrote to memory of 5512 4076 FallbackBuffer.exe InstallUtil.exe PID 5512 wrote to memory of 6892 5512 InstallUtil.exe InstallUtil.exe PID 5512 wrote to memory of 6892 5512 InstallUtil.exe InstallUtil.exe PID 5512 wrote to memory of 6892 5512 InstallUtil.exe InstallUtil.exe PID 5512 wrote to memory of 6892 5512 InstallUtil.exe InstallUtil.exe PID 5512 wrote to memory of 6892 5512 InstallUtil.exe InstallUtil.exe PID 5512 wrote to memory of 6892 5512 InstallUtil.exe InstallUtil.exe PID 5512 wrote to memory of 6892 5512 InstallUtil.exe InstallUtil.exe PID 5512 wrote to memory of 6892 5512 InstallUtil.exe InstallUtil.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {D08A28FB-3F25-4D53-A2A0-E36EB421D471} S-1-5-21-3294248377-1418901787-4083263181-1000:FMEDFXFE\Admin:S4U:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAARgBhAGwAbABiAGEAYwBrAEIAdQBmAGYAZQByAC4AZQB4AGUAOwA=2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAARgBhAGwAbABiAGEAYwBrAEIAdQBmAGYAZQByAC4AZQB4AGUAOwA=2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {774689CD-DB61-41E8-BAE3-27E58F0896E9} S-1-5-21-3294248377-1418901787-4083263181-1000:FMEDFXFE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Current\zxsta\FallbackBuffer.exeC:\Users\Admin\AppData\Local\Current\zxsta\FallbackBuffer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Current\zxsta\FallbackBuffer.exe"C:\Users\Admin\AppData\Local\Current\zxsta\FallbackBuffer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exeFilesize
2.7MB
MD5abf2da5b3e7845f50463a72f8b6e6aaa
SHA1a5299f55950ca82134da73b9e9844c5d624114c3
SHA2562a4b1ae0ae67cd31f85680e6351bd5b92ff61e246c158decb1a43a3ef01d9f2c
SHA512570e8becd18b36d66a2ac295518c8ba3c0bc83d8a6175e601b509efd9237462d1d0826dbeb9e52465e7cdcd57cb4ae7fd859ddc4a5aad895cef6ef7fa981e8a4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD593f0ab87f807dbe06db051feb7c7afa0
SHA1f1de4446c97e3437b0b63813d05a518a8f0f7334
SHA256440c0c4d11a47e6ea0b271e388a9ac7e1a473f4f68a05e39066c6e361d6b79a5
SHA5125e33af71f639570f7a9c29e825c6830b881006854364df76c8d563d48c96eb269d49c5126b23c608220ec34b906862fcad12c12264dd8c70fb9cd9e61f15d866
-
memory/844-66-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-1-0x0000000001360000-0x00000000018D8000-memory.dmpFilesize
5.5MB
-
memory/844-4-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-8-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-12-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-18-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-22-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-24-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-26-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-20-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-16-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-14-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-10-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-60-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-30-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-34-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-56-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-54-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-52-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-50-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-48-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-46-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-44-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-42-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-40-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-38-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-36-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-32-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-28-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-62-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-0-0x000000007456E000-0x000000007456F000-memory.dmpFilesize
4KB
-
memory/844-3-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-6-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-58-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-4890-0x0000000000A20000-0x0000000000A6C000-memory.dmpFilesize
304KB
-
memory/844-4889-0x0000000005AF0000-0x0000000005EA0000-memory.dmpFilesize
3.7MB
-
memory/844-4892-0x0000000074560000-0x0000000074C4E000-memory.dmpFilesize
6.9MB
-
memory/844-4891-0x0000000074560000-0x0000000074C4E000-memory.dmpFilesize
6.9MB
-
memory/844-2-0x0000000006050000-0x00000000065C4000-memory.dmpFilesize
5.5MB
-
memory/844-64-0x0000000006050000-0x00000000065BE000-memory.dmpFilesize
5.4MB
-
memory/844-4919-0x0000000074560000-0x0000000074C4E000-memory.dmpFilesize
6.9MB
-
memory/844-4899-0x0000000005800000-0x0000000005854000-memory.dmpFilesize
336KB
-
memory/1924-4918-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1924-9827-0x0000000000550000-0x0000000000558000-memory.dmpFilesize
32KB
-
memory/2088-4901-0x0000000000930000-0x0000000000BEC000-memory.dmpFilesize
2.7MB
-
memory/2088-4920-0x0000000004A00000-0x0000000004CB8000-memory.dmpFilesize
2.7MB
-
memory/2088-4902-0x0000000074560000-0x0000000074C4E000-memory.dmpFilesize
6.9MB
-
memory/2088-9826-0x0000000074560000-0x0000000074C4E000-memory.dmpFilesize
6.9MB
-
memory/2088-9809-0x0000000004820000-0x0000000004874000-memory.dmpFilesize
336KB
-
memory/2088-9808-0x0000000005570000-0x0000000005664000-memory.dmpFilesize
976KB
-
memory/2088-9807-0x0000000074560000-0x0000000074C4E000-memory.dmpFilesize
6.9MB
-
memory/3096-12036-0x00000000003D0000-0x00000000003D8000-memory.dmpFilesize
32KB
-
memory/3096-9825-0x0000000004CB0000-0x0000000004D98000-memory.dmpFilesize
928KB
-
memory/3096-9824-0x0000000000400000-0x00000000004AC000-memory.dmpFilesize
688KB
-
memory/3096-12037-0x0000000002460000-0x00000000024B6000-memory.dmpFilesize
344KB
-
memory/4076-16947-0x0000000000400000-0x00000000004AC000-memory.dmpFilesize
688KB
-
memory/5512-19156-0x0000000000400000-0x00000000006BC000-memory.dmpFilesize
2.7MB
-
memory/6352-26263-0x00000000013D0000-0x00000000013D8000-memory.dmpFilesize
32KB
-
memory/6352-26262-0x000000001A1E0000-0x000000001A4C2000-memory.dmpFilesize
2.9MB
-
memory/6892-24060-0x0000000000090000-0x000000000013C000-memory.dmpFilesize
688KB
-
memory/7584-12042-0x000000001A130000-0x000000001A412000-memory.dmpFilesize
2.9MB
-
memory/7584-12043-0x0000000000B20000-0x0000000000B28000-memory.dmpFilesize
32KB
-
memory/7836-12047-0x0000000000E90000-0x000000000114C000-memory.dmpFilesize
2.7MB