Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
07-07-2024 01:12
Static task
static1
Behavioral task
behavioral1
Sample
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe
Resource
win10v2004-20240704-en
General
-
Target
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe
-
Size
5.4MB
-
MD5
a2a9c309c5300a53d2c2fc41b71b174b
-
SHA1
f6c26eae1925425fa8966266e87a57b688fad218
-
SHA256
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224
-
SHA512
a29eec8fa98174a74e9bd93c5902cdd95ce329ff8b7a1469901a95705dc1d7fffde58afa296399febb8559d8cd73c932945e85cce8af54e7a672d8f1618e3f7c
-
SSDEEP
98304:j+ddAtuMvY00V2vtQSH7OuqeGszSQTADu0mL63KQOKvYA1ZuoyQPNf+xKi:wdOuMvc8VdbOuqePmQTAKH63NYAiGfiT
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exedescription pid process target process PID 1340 created 1196 1340 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe Explorer.EXE -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepid process 7868 powershell.exe 2564 powershell.exe -
Executes dropped EXE 4 IoCs
Processes:
BLueHvffhw.exeBLueHvffhw.exeFallbackBuffer.exeFallbackBuffer.exepid process 1372 BLueHvffhw.exe 1824 BLueHvffhw.exe 8184 FallbackBuffer.exe 5444 FallbackBuffer.exe -
Loads dropped DLL 2 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exeBLueHvffhw.exepid process 1088 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 1372 BLueHvffhw.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exeBLueHvffhw.exeFallbackBuffer.exeFallbackBuffer.exeMSBuild.exedescription pid process target process PID 1088 set thread context of 1340 1088 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1372 set thread context of 1824 1372 BLueHvffhw.exe BLueHvffhw.exe PID 8184 set thread context of 5444 8184 FallbackBuffer.exe FallbackBuffer.exe PID 5444 set thread context of 5224 5444 FallbackBuffer.exe MSBuild.exe PID 5224 set thread context of 4704 5224 MSBuild.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exedialer.exepowershell.exeFallbackBuffer.exepowershell.exepid process 1340 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 1340 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7584 dialer.exe 7584 dialer.exe 7584 dialer.exe 7584 dialer.exe 7868 powershell.exe 5444 FallbackBuffer.exe 5444 FallbackBuffer.exe 2564 powershell.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exeBLueHvffhw.exeBLueHvffhw.exepowershell.exeFallbackBuffer.exeFallbackBuffer.exeMSBuild.exeMSBuild.exepowershell.exedescription pid process Token: SeDebugPrivilege 1088 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe Token: SeDebugPrivilege 1088 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe Token: SeDebugPrivilege 1372 BLueHvffhw.exe Token: SeDebugPrivilege 1372 BLueHvffhw.exe Token: SeDebugPrivilege 1824 BLueHvffhw.exe Token: SeDebugPrivilege 7868 powershell.exe Token: SeDebugPrivilege 8184 FallbackBuffer.exe Token: SeDebugPrivilege 8184 FallbackBuffer.exe Token: SeDebugPrivilege 5444 FallbackBuffer.exe Token: SeDebugPrivilege 5224 MSBuild.exe Token: SeDebugPrivilege 5224 MSBuild.exe Token: SeDebugPrivilege 4704 MSBuild.exe Token: SeDebugPrivilege 2564 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exeBLueHvffhw.exe7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exetaskeng.exetaskeng.exeFallbackBuffer.exeFallbackBuffer.exeMSBuild.exedescription pid process target process PID 1088 wrote to memory of 1372 1088 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe BLueHvffhw.exe PID 1088 wrote to memory of 1372 1088 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe BLueHvffhw.exe PID 1088 wrote to memory of 1372 1088 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe BLueHvffhw.exe PID 1088 wrote to memory of 1372 1088 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe BLueHvffhw.exe PID 1088 wrote to memory of 1340 1088 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1088 wrote to memory of 1340 1088 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1088 wrote to memory of 1340 1088 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1088 wrote to memory of 1340 1088 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1088 wrote to memory of 1340 1088 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1088 wrote to memory of 1340 1088 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1088 wrote to memory of 1340 1088 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1088 wrote to memory of 1340 1088 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1088 wrote to memory of 1340 1088 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1372 wrote to memory of 1824 1372 BLueHvffhw.exe BLueHvffhw.exe PID 1372 wrote to memory of 1824 1372 BLueHvffhw.exe BLueHvffhw.exe PID 1372 wrote to memory of 1824 1372 BLueHvffhw.exe BLueHvffhw.exe PID 1372 wrote to memory of 1824 1372 BLueHvffhw.exe BLueHvffhw.exe PID 1372 wrote to memory of 1824 1372 BLueHvffhw.exe BLueHvffhw.exe PID 1372 wrote to memory of 1824 1372 BLueHvffhw.exe BLueHvffhw.exe PID 1372 wrote to memory of 1824 1372 BLueHvffhw.exe BLueHvffhw.exe PID 1372 wrote to memory of 1824 1372 BLueHvffhw.exe BLueHvffhw.exe PID 1372 wrote to memory of 1824 1372 BLueHvffhw.exe BLueHvffhw.exe PID 1340 wrote to memory of 7584 1340 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe dialer.exe PID 1340 wrote to memory of 7584 1340 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe dialer.exe PID 1340 wrote to memory of 7584 1340 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe dialer.exe PID 1340 wrote to memory of 7584 1340 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe dialer.exe PID 1340 wrote to memory of 7584 1340 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe dialer.exe PID 1340 wrote to memory of 7584 1340 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe dialer.exe PID 7836 wrote to memory of 7868 7836 taskeng.exe powershell.exe PID 7836 wrote to memory of 7868 7836 taskeng.exe powershell.exe PID 7836 wrote to memory of 7868 7836 taskeng.exe powershell.exe PID 8152 wrote to memory of 8184 8152 taskeng.exe FallbackBuffer.exe PID 8152 wrote to memory of 8184 8152 taskeng.exe FallbackBuffer.exe PID 8152 wrote to memory of 8184 8152 taskeng.exe FallbackBuffer.exe PID 8152 wrote to memory of 8184 8152 taskeng.exe FallbackBuffer.exe PID 8184 wrote to memory of 5444 8184 FallbackBuffer.exe FallbackBuffer.exe PID 8184 wrote to memory of 5444 8184 FallbackBuffer.exe FallbackBuffer.exe PID 8184 wrote to memory of 5444 8184 FallbackBuffer.exe FallbackBuffer.exe PID 8184 wrote to memory of 5444 8184 FallbackBuffer.exe FallbackBuffer.exe PID 8184 wrote to memory of 5444 8184 FallbackBuffer.exe FallbackBuffer.exe PID 8184 wrote to memory of 5444 8184 FallbackBuffer.exe FallbackBuffer.exe PID 8184 wrote to memory of 5444 8184 FallbackBuffer.exe FallbackBuffer.exe PID 8184 wrote to memory of 5444 8184 FallbackBuffer.exe FallbackBuffer.exe PID 8184 wrote to memory of 5444 8184 FallbackBuffer.exe FallbackBuffer.exe PID 5444 wrote to memory of 5224 5444 FallbackBuffer.exe MSBuild.exe PID 5444 wrote to memory of 5224 5444 FallbackBuffer.exe MSBuild.exe PID 5444 wrote to memory of 5224 5444 FallbackBuffer.exe MSBuild.exe PID 5444 wrote to memory of 5224 5444 FallbackBuffer.exe MSBuild.exe PID 5444 wrote to memory of 5224 5444 FallbackBuffer.exe MSBuild.exe PID 5444 wrote to memory of 5224 5444 FallbackBuffer.exe MSBuild.exe PID 5444 wrote to memory of 5224 5444 FallbackBuffer.exe MSBuild.exe PID 5444 wrote to memory of 5224 5444 FallbackBuffer.exe MSBuild.exe PID 5444 wrote to memory of 5224 5444 FallbackBuffer.exe MSBuild.exe PID 5224 wrote to memory of 4704 5224 MSBuild.exe MSBuild.exe PID 5224 wrote to memory of 4704 5224 MSBuild.exe MSBuild.exe PID 5224 wrote to memory of 4704 5224 MSBuild.exe MSBuild.exe PID 5224 wrote to memory of 4704 5224 MSBuild.exe MSBuild.exe PID 5224 wrote to memory of 4704 5224 MSBuild.exe MSBuild.exe PID 5224 wrote to memory of 4704 5224 MSBuild.exe MSBuild.exe PID 5224 wrote to memory of 4704 5224 MSBuild.exe MSBuild.exe PID 5224 wrote to memory of 4704 5224 MSBuild.exe MSBuild.exe PID 5224 wrote to memory of 4704 5224 MSBuild.exe MSBuild.exe PID 7836 wrote to memory of 2564 7836 taskeng.exe powershell.exe PID 7836 wrote to memory of 2564 7836 taskeng.exe powershell.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe"C:\Users\Admin\AppData\Local\Temp\7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe"C:\Users\Admin\AppData\Local\Temp\7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {C7971066-7619-4275-BECE-A15472A4514A} S-1-5-21-2737914667-933161113-3798636211-1000:PUMARTNR\Admin:S4U:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAARgBhAGwAbABiAGEAYwBrAEIAdQBmAGYAZQByAC4AZQB4AGUAOwA=2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAARgBhAGwAbABiAGEAYwBrAEIAdQBmAGYAZQByAC4AZQB4AGUAOwA=2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {7AB9B41D-C2DF-4DD8-AD33-095055DA19BF} S-1-5-21-2737914667-933161113-3798636211-1000:PUMARTNR\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Current\mmyorpl\FallbackBuffer.exeC:\Users\Admin\AppData\Local\Current\mmyorpl\FallbackBuffer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Current\mmyorpl\FallbackBuffer.exe"C:\Users\Admin\AppData\Local\Current\mmyorpl\FallbackBuffer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exeFilesize
2.7MB
MD5abf2da5b3e7845f50463a72f8b6e6aaa
SHA1a5299f55950ca82134da73b9e9844c5d624114c3
SHA2562a4b1ae0ae67cd31f85680e6351bd5b92ff61e246c158decb1a43a3ef01d9f2c
SHA512570e8becd18b36d66a2ac295518c8ba3c0bc83d8a6175e601b509efd9237462d1d0826dbeb9e52465e7cdcd57cb4ae7fd859ddc4a5aad895cef6ef7fa981e8a4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5c6eb9b1e7a102281b5b46e9cd6cd73df
SHA12f12d87edbb96b175d34650032dc6d3f3691b8c8
SHA256b8db0a2e633fad78a42812c7dfebd8f6b1725b2226935ac6d332fc54e7fe83c5
SHA512f2ae6b278b469f6b06f7241fd86a10389d737950c79c5350bc75e74bdf0507de153115163df0729dcb5306b4b2cf29f1d310973ff8b620ccf0eb822fd45ce88b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HMY2O29L1273RQU8QCS5.tempFilesize
7KB
MD504bb345f7cb9d86813c684b5b80845ad
SHA1252a779b2dc3b058ddee1c2f7efd1d2db782a46d
SHA2562b9e4c383b91285551b2fd659a5d53330c13dd21d88e617b2af8a976209c273a
SHA512133be940bfd80c572afe623cc86f5df873062bd8952040a8a52df1429cb377f03799adb2fd3570c988a8ed85376f515aff35e4ada8a43c856a47ca69cd0a9456
-
memory/1088-50-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-13-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-6-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-14-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-42-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-16-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-18-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-22-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-24-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-26-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-28-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-20-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-30-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-32-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-34-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-40-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-38-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-44-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-48-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-52-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-54-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-58-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-62-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-66-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-64-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-60-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-56-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-0-0x000000007448E000-0x000000007448F000-memory.dmpFilesize
4KB
-
memory/1088-1-0x0000000000E10000-0x0000000001388000-memory.dmpFilesize
5.5MB
-
memory/1088-8-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-36-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-10-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-4-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-4891-0x0000000074480000-0x0000000074B6E000-memory.dmpFilesize
6.9MB
-
memory/1088-4892-0x0000000074480000-0x0000000074B6E000-memory.dmpFilesize
6.9MB
-
memory/1088-4890-0x0000000000B10000-0x0000000000B5C000-memory.dmpFilesize
304KB
-
memory/1088-4889-0x00000000059C0000-0x0000000005D70000-memory.dmpFilesize
3.7MB
-
memory/1088-46-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-2-0x0000000005F30000-0x00000000064A4000-memory.dmpFilesize
5.5MB
-
memory/1088-4918-0x0000000074480000-0x0000000074B6E000-memory.dmpFilesize
6.9MB
-
memory/1088-3-0x0000000005F30000-0x000000000649E000-memory.dmpFilesize
5.4MB
-
memory/1088-4900-0x0000000004810000-0x0000000004864000-memory.dmpFilesize
336KB
-
memory/1340-12024-0x00000000003F0000-0x00000000003F8000-memory.dmpFilesize
32KB
-
memory/1340-4917-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1372-4911-0x0000000074480000-0x0000000074B6E000-memory.dmpFilesize
6.9MB
-
memory/1372-9805-0x00000000048B0000-0x00000000049A4000-memory.dmpFilesize
976KB
-
memory/1372-9827-0x0000000074480000-0x0000000074B6E000-memory.dmpFilesize
6.9MB
-
memory/1372-4916-0x0000000004B90000-0x0000000004E48000-memory.dmpFilesize
2.7MB
-
memory/1372-4901-0x0000000000840000-0x0000000000AFC000-memory.dmpFilesize
2.7MB
-
memory/1824-12037-0x0000000000510000-0x0000000000518000-memory.dmpFilesize
32KB
-
memory/1824-9826-0x00000000023B0000-0x0000000002498000-memory.dmpFilesize
928KB
-
memory/1824-9825-0x0000000000080000-0x000000000012C000-memory.dmpFilesize
688KB
-
memory/1824-12038-0x00000000024A0000-0x00000000024F6000-memory.dmpFilesize
344KB
-
memory/2564-26258-0x0000000000AA0000-0x0000000000AA8000-memory.dmpFilesize
32KB
-
memory/2564-26257-0x000000001A1F0000-0x000000001A4D2000-memory.dmpFilesize
2.9MB
-
memory/5224-19157-0x0000000000400000-0x00000000006BC000-memory.dmpFilesize
2.7MB
-
memory/5444-16948-0x0000000000400000-0x00000000004AC000-memory.dmpFilesize
688KB
-
memory/7868-12043-0x000000001A150000-0x000000001A432000-memory.dmpFilesize
2.9MB
-
memory/7868-12044-0x00000000014D0000-0x00000000014D8000-memory.dmpFilesize
32KB
-
memory/8184-12048-0x0000000000EC0000-0x000000000117C000-memory.dmpFilesize
2.7MB