Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06-07-2024 07:22
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe
Resource
win10v2004-20240704-en
General
-
Target
SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe
-
Size
5.4MB
-
MD5
a2a9c309c5300a53d2c2fc41b71b174b
-
SHA1
f6c26eae1925425fa8966266e87a57b688fad218
-
SHA256
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224
-
SHA512
a29eec8fa98174a74e9bd93c5902cdd95ce329ff8b7a1469901a95705dc1d7fffde58afa296399febb8559d8cd73c932945e85cce8af54e7a672d8f1618e3f7c
-
SSDEEP
98304:j+ddAtuMvY00V2vtQSH7OuqeGszSQTADu0mL63KQOKvYA1ZuoyQPNf+xKi:wdOuMvc8VdbOuqePmQTAKH63NYAiGfiT
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exedescription pid process target process PID 3732 created 2944 3732 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe sihost.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepid process 5340 powershell.exe 4764 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1015551233-1106003478-1645743776-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe -
Executes dropped EXE 4 IoCs
Processes:
BLueHvffhw.exeBLueHvffhw.exeFallbackBuffer.exeFallbackBuffer.exepid process 4996 BLueHvffhw.exe 3036 BLueHvffhw.exe 5880 FallbackBuffer.exe 2312 FallbackBuffer.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exeBLueHvffhw.exeFallbackBuffer.exeFallbackBuffer.exedescription pid process target process PID 1724 set thread context of 3732 1724 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 4996 set thread context of 3036 4996 BLueHvffhw.exe BLueHvffhw.exe PID 5880 set thread context of 2312 5880 FallbackBuffer.exe FallbackBuffer.exe PID 2312 set thread context of 5228 2312 FallbackBuffer.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exeopenwith.exepowershell.exeFallbackBuffer.exepowershell.exepid process 3732 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe 3732 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe 4408 openwith.exe 4408 openwith.exe 4408 openwith.exe 4408 openwith.exe 5340 powershell.exe 5340 powershell.exe 2312 FallbackBuffer.exe 2312 FallbackBuffer.exe 4764 powershell.exe 4764 powershell.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exeBLueHvffhw.exeBLueHvffhw.exepowershell.exeFallbackBuffer.exeFallbackBuffer.exeInstallUtil.exepowershell.exedescription pid process Token: SeDebugPrivilege 1724 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe Token: SeDebugPrivilege 1724 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe Token: SeDebugPrivilege 4996 BLueHvffhw.exe Token: SeDebugPrivilege 4996 BLueHvffhw.exe Token: SeDebugPrivilege 3036 BLueHvffhw.exe Token: SeDebugPrivilege 5340 powershell.exe Token: SeDebugPrivilege 5880 FallbackBuffer.exe Token: SeDebugPrivilege 5880 FallbackBuffer.exe Token: SeDebugPrivilege 2312 FallbackBuffer.exe Token: SeDebugPrivilege 5228 InstallUtil.exe Token: SeDebugPrivilege 4764 powershell.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exeSecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exeBLueHvffhw.exeFallbackBuffer.exeFallbackBuffer.exedescription pid process target process PID 1724 wrote to memory of 4996 1724 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe BLueHvffhw.exe PID 1724 wrote to memory of 4996 1724 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe BLueHvffhw.exe PID 1724 wrote to memory of 4996 1724 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe BLueHvffhw.exe PID 1724 wrote to memory of 3732 1724 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 1724 wrote to memory of 3732 1724 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 1724 wrote to memory of 3732 1724 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 1724 wrote to memory of 3732 1724 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 1724 wrote to memory of 3732 1724 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 1724 wrote to memory of 3732 1724 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 1724 wrote to memory of 3732 1724 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 1724 wrote to memory of 3732 1724 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe PID 3732 wrote to memory of 4408 3732 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe openwith.exe PID 3732 wrote to memory of 4408 3732 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe openwith.exe PID 3732 wrote to memory of 4408 3732 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe openwith.exe PID 3732 wrote to memory of 4408 3732 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe openwith.exe PID 3732 wrote to memory of 4408 3732 SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe openwith.exe PID 4996 wrote to memory of 3036 4996 BLueHvffhw.exe BLueHvffhw.exe PID 4996 wrote to memory of 3036 4996 BLueHvffhw.exe BLueHvffhw.exe PID 4996 wrote to memory of 3036 4996 BLueHvffhw.exe BLueHvffhw.exe PID 4996 wrote to memory of 3036 4996 BLueHvffhw.exe BLueHvffhw.exe PID 4996 wrote to memory of 3036 4996 BLueHvffhw.exe BLueHvffhw.exe PID 4996 wrote to memory of 3036 4996 BLueHvffhw.exe BLueHvffhw.exe PID 4996 wrote to memory of 3036 4996 BLueHvffhw.exe BLueHvffhw.exe PID 4996 wrote to memory of 3036 4996 BLueHvffhw.exe BLueHvffhw.exe PID 5880 wrote to memory of 2312 5880 FallbackBuffer.exe FallbackBuffer.exe PID 5880 wrote to memory of 2312 5880 FallbackBuffer.exe FallbackBuffer.exe PID 5880 wrote to memory of 2312 5880 FallbackBuffer.exe FallbackBuffer.exe PID 5880 wrote to memory of 2312 5880 FallbackBuffer.exe FallbackBuffer.exe PID 5880 wrote to memory of 2312 5880 FallbackBuffer.exe FallbackBuffer.exe PID 5880 wrote to memory of 2312 5880 FallbackBuffer.exe FallbackBuffer.exe PID 5880 wrote to memory of 2312 5880 FallbackBuffer.exe FallbackBuffer.exe PID 5880 wrote to memory of 2312 5880 FallbackBuffer.exe FallbackBuffer.exe PID 2312 wrote to memory of 5228 2312 FallbackBuffer.exe InstallUtil.exe PID 2312 wrote to memory of 5228 2312 FallbackBuffer.exe InstallUtil.exe PID 2312 wrote to memory of 5228 2312 FallbackBuffer.exe InstallUtil.exe PID 2312 wrote to memory of 5228 2312 FallbackBuffer.exe InstallUtil.exe PID 2312 wrote to memory of 5228 2312 FallbackBuffer.exe InstallUtil.exe PID 2312 wrote to memory of 5228 2312 FallbackBuffer.exe InstallUtil.exe PID 2312 wrote to memory of 5228 2312 FallbackBuffer.exe InstallUtil.exe PID 2312 wrote to memory of 5228 2312 FallbackBuffer.exe InstallUtil.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAARgBhAGwAbABiAGEAYwBrAEIAdQBmAGYAZQByAC4AZQB4AGUAOwA=1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Current\hlajoo\FallbackBuffer.exeC:\Users\Admin\AppData\Local\Current\hlajoo\FallbackBuffer.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Current\hlajoo\FallbackBuffer.exe"C:\Users\Admin\AppData\Local\Current\hlajoo\FallbackBuffer.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAARgBhAGwAbABiAGEAYwBrAEIAdQBmAGYAZQByAC4AZQB4AGUAOwA=1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.PackedNET.2939.26166.7469.exe.logFilesize
805B
MD558a9108e39c2ea50e65c23be3a9407cf
SHA1fb21f7b9330aa1a77080a3243b81b49035102d7b
SHA2566049be83020702896a539b5c8c13270add224d7b91b3ee0bebc328791b74a84b
SHA51293804ee8a4560503e47c07f5fa4a959e23355a01aba406c103d339debc9b2b1d20a345cdbb8d8069dac97b9151f228cf559ac3dde1500e3484fba1a4126842bf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exeFilesize
2.7MB
MD5abf2da5b3e7845f50463a72f8b6e6aaa
SHA1a5299f55950ca82134da73b9e9844c5d624114c3
SHA2562a4b1ae0ae67cd31f85680e6351bd5b92ff61e246c158decb1a43a3ef01d9f2c
SHA512570e8becd18b36d66a2ac295518c8ba3c0bc83d8a6175e601b509efd9237462d1d0826dbeb9e52465e7cdcd57cb4ae7fd859ddc4a5aad895cef6ef7fa981e8a4
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hxqngo2v.4sn.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1724-66-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-48-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-12-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-20-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-14-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-10-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-6-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-8-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-5-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-18-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-32-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-52-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-50-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-58-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-46-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-44-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-42-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-40-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-38-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-36-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-34-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-30-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-28-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-24-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-16-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-26-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-22-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-64-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-68-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-3-0x0000000005870000-0x0000000005E14000-memory.dmpFilesize
5.6MB
-
memory/1724-62-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-0-0x0000000074C8E000-0x0000000074C8F000-memory.dmpFilesize
4KB
-
memory/1724-4-0x00000000052C0000-0x0000000005352000-memory.dmpFilesize
584KB
-
memory/1724-56-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-54-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-4891-0x0000000074C80000-0x0000000075430000-memory.dmpFilesize
7.7MB
-
memory/1724-4892-0x0000000074C80000-0x0000000075430000-memory.dmpFilesize
7.7MB
-
memory/1724-4893-0x0000000007960000-0x0000000007D10000-memory.dmpFilesize
3.7MB
-
memory/1724-4894-0x00000000055C0000-0x000000000560C000-memory.dmpFilesize
304KB
-
memory/1724-4906-0x0000000006220000-0x0000000006274000-memory.dmpFilesize
336KB
-
memory/1724-4913-0x0000000074C80000-0x0000000075430000-memory.dmpFilesize
7.7MB
-
memory/1724-1-0x00000000001F0000-0x0000000000768000-memory.dmpFilesize
5.5MB
-
memory/1724-60-0x00000000063F0000-0x000000000695E000-memory.dmpFilesize
5.4MB
-
memory/1724-2-0x00000000063F0000-0x0000000006964000-memory.dmpFilesize
5.5MB
-
memory/3036-9826-0x00000000057C0000-0x00000000058A8000-memory.dmpFilesize
928KB
-
memory/3036-9824-0x0000000000400000-0x00000000004AC000-memory.dmpFilesize
688KB
-
memory/3036-12025-0x0000000005C30000-0x0000000005C96000-memory.dmpFilesize
408KB
-
memory/3036-12024-0x0000000005AA0000-0x0000000005AF6000-memory.dmpFilesize
344KB
-
memory/3036-12023-0x00000000058F0000-0x00000000058F8000-memory.dmpFilesize
32KB
-
memory/3732-4912-0x0000000074C80000-0x0000000075430000-memory.dmpFilesize
7.7MB
-
memory/3732-5809-0x0000000074C80000-0x0000000075430000-memory.dmpFilesize
7.7MB
-
memory/3732-4914-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/3732-5222-0x0000000005990000-0x0000000005998000-memory.dmpFilesize
32KB
-
memory/3732-5311-0x0000000074C80000-0x0000000075430000-memory.dmpFilesize
7.7MB
-
memory/3732-4915-0x0000000074C80000-0x0000000075430000-memory.dmpFilesize
7.7MB
-
memory/4996-4908-0x0000000074C80000-0x0000000075430000-memory.dmpFilesize
7.7MB
-
memory/4996-4911-0x0000000005680000-0x0000000005938000-memory.dmpFilesize
2.7MB
-
memory/4996-4907-0x0000000000A30000-0x0000000000CEC000-memory.dmpFilesize
2.7MB
-
memory/4996-9825-0x0000000074C80000-0x0000000075430000-memory.dmpFilesize
7.7MB
-
memory/4996-9818-0x0000000074C80000-0x0000000075430000-memory.dmpFilesize
7.7MB
-
memory/4996-9819-0x0000000005BE0000-0x0000000005CD4000-memory.dmpFilesize
976KB
-
memory/5340-12031-0x0000020F7A2A0000-0x0000020F7A2C2000-memory.dmpFilesize
136KB
-
memory/5880-16927-0x0000000006880000-0x0000000006974000-memory.dmpFilesize
976KB