Analysis
-
max time kernel
137s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08-07-2024 03:35
Static task
static1
Behavioral task
behavioral1
Sample
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe
Resource
win10v2004-20240704-en
General
-
Target
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe
-
Size
5.4MB
-
MD5
a2a9c309c5300a53d2c2fc41b71b174b
-
SHA1
f6c26eae1925425fa8966266e87a57b688fad218
-
SHA256
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224
-
SHA512
a29eec8fa98174a74e9bd93c5902cdd95ce329ff8b7a1469901a95705dc1d7fffde58afa296399febb8559d8cd73c932945e85cce8af54e7a672d8f1618e3f7c
-
SSDEEP
98304:j+ddAtuMvY00V2vtQSH7OuqeGszSQTADu0mL63KQOKvYA1ZuoyQPNf+xKi:wdOuMvc8VdbOuqePmQTAKH63NYAiGfiT
Malware Config
Signatures
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exedescription pid process target process PID 2040 created 1216 2040 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe Explorer.EXE -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepid process 7052 powershell.exe 6720 powershell.exe -
Deletes itself 1 IoCs
Processes:
dialer.exepid process 2652 dialer.exe -
Executes dropped EXE 4 IoCs
Processes:
BLueHvffhw.exeBLueHvffhw.exeFallbackBuffer.exeFallbackBuffer.exepid process 588 BLueHvffhw.exe 1756 BLueHvffhw.exe 816 FallbackBuffer.exe 4672 FallbackBuffer.exe -
Loads dropped DLL 2 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exeBLueHvffhw.exepid process 1072 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 588 BLueHvffhw.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exeBLueHvffhw.exeFallbackBuffer.exeFallbackBuffer.exeMSBuild.exedescription pid process target process PID 1072 set thread context of 2040 1072 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 588 set thread context of 1756 588 BLueHvffhw.exe BLueHvffhw.exe PID 816 set thread context of 4672 816 FallbackBuffer.exe FallbackBuffer.exe PID 4672 set thread context of 8172 4672 FallbackBuffer.exe MSBuild.exe PID 8172 set thread context of 5768 8172 MSBuild.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exedialer.exepowershell.exeFallbackBuffer.exepowershell.exepid process 2040 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 2040 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 2652 dialer.exe 2652 dialer.exe 2652 dialer.exe 2652 dialer.exe 7052 powershell.exe 4672 FallbackBuffer.exe 4672 FallbackBuffer.exe 4672 FallbackBuffer.exe 4672 FallbackBuffer.exe 6720 powershell.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exeBLueHvffhw.exeBLueHvffhw.exepowershell.exeFallbackBuffer.exeFallbackBuffer.exeMSBuild.exeMSBuild.exepowershell.exedescription pid process Token: SeDebugPrivilege 1072 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe Token: SeDebugPrivilege 588 BLueHvffhw.exe Token: SeDebugPrivilege 1072 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe Token: SeDebugPrivilege 588 BLueHvffhw.exe Token: SeDebugPrivilege 1756 BLueHvffhw.exe Token: SeDebugPrivilege 7052 powershell.exe Token: SeDebugPrivilege 816 FallbackBuffer.exe Token: SeDebugPrivilege 816 FallbackBuffer.exe Token: SeDebugPrivilege 4672 FallbackBuffer.exe Token: SeDebugPrivilege 8172 MSBuild.exe Token: SeDebugPrivilege 8172 MSBuild.exe Token: SeDebugPrivilege 5768 MSBuild.exe Token: SeDebugPrivilege 6720 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exeBLueHvffhw.exe7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exetaskeng.exetaskeng.exeFallbackBuffer.exeFallbackBuffer.exeMSBuild.exedescription pid process target process PID 1072 wrote to memory of 588 1072 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe BLueHvffhw.exe PID 1072 wrote to memory of 588 1072 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe BLueHvffhw.exe PID 1072 wrote to memory of 588 1072 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe BLueHvffhw.exe PID 1072 wrote to memory of 588 1072 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe BLueHvffhw.exe PID 1072 wrote to memory of 2040 1072 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1072 wrote to memory of 2040 1072 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1072 wrote to memory of 2040 1072 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1072 wrote to memory of 2040 1072 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1072 wrote to memory of 2040 1072 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1072 wrote to memory of 2040 1072 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1072 wrote to memory of 2040 1072 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1072 wrote to memory of 2040 1072 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 1072 wrote to memory of 2040 1072 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe PID 588 wrote to memory of 1756 588 BLueHvffhw.exe BLueHvffhw.exe PID 588 wrote to memory of 1756 588 BLueHvffhw.exe BLueHvffhw.exe PID 588 wrote to memory of 1756 588 BLueHvffhw.exe BLueHvffhw.exe PID 588 wrote to memory of 1756 588 BLueHvffhw.exe BLueHvffhw.exe PID 588 wrote to memory of 1756 588 BLueHvffhw.exe BLueHvffhw.exe PID 588 wrote to memory of 1756 588 BLueHvffhw.exe BLueHvffhw.exe PID 588 wrote to memory of 1756 588 BLueHvffhw.exe BLueHvffhw.exe PID 588 wrote to memory of 1756 588 BLueHvffhw.exe BLueHvffhw.exe PID 588 wrote to memory of 1756 588 BLueHvffhw.exe BLueHvffhw.exe PID 2040 wrote to memory of 2652 2040 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe dialer.exe PID 2040 wrote to memory of 2652 2040 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe dialer.exe PID 2040 wrote to memory of 2652 2040 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe dialer.exe PID 2040 wrote to memory of 2652 2040 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe dialer.exe PID 2040 wrote to memory of 2652 2040 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe dialer.exe PID 2040 wrote to memory of 2652 2040 7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe dialer.exe PID 7020 wrote to memory of 7052 7020 taskeng.exe powershell.exe PID 7020 wrote to memory of 7052 7020 taskeng.exe powershell.exe PID 7020 wrote to memory of 7052 7020 taskeng.exe powershell.exe PID 568 wrote to memory of 816 568 taskeng.exe FallbackBuffer.exe PID 568 wrote to memory of 816 568 taskeng.exe FallbackBuffer.exe PID 568 wrote to memory of 816 568 taskeng.exe FallbackBuffer.exe PID 568 wrote to memory of 816 568 taskeng.exe FallbackBuffer.exe PID 816 wrote to memory of 4672 816 FallbackBuffer.exe FallbackBuffer.exe PID 816 wrote to memory of 4672 816 FallbackBuffer.exe FallbackBuffer.exe PID 816 wrote to memory of 4672 816 FallbackBuffer.exe FallbackBuffer.exe PID 816 wrote to memory of 4672 816 FallbackBuffer.exe FallbackBuffer.exe PID 816 wrote to memory of 4672 816 FallbackBuffer.exe FallbackBuffer.exe PID 816 wrote to memory of 4672 816 FallbackBuffer.exe FallbackBuffer.exe PID 816 wrote to memory of 4672 816 FallbackBuffer.exe FallbackBuffer.exe PID 816 wrote to memory of 4672 816 FallbackBuffer.exe FallbackBuffer.exe PID 816 wrote to memory of 4672 816 FallbackBuffer.exe FallbackBuffer.exe PID 4672 wrote to memory of 8164 4672 FallbackBuffer.exe MSBuild.exe PID 4672 wrote to memory of 8164 4672 FallbackBuffer.exe MSBuild.exe PID 4672 wrote to memory of 8164 4672 FallbackBuffer.exe MSBuild.exe PID 4672 wrote to memory of 8164 4672 FallbackBuffer.exe MSBuild.exe PID 4672 wrote to memory of 8172 4672 FallbackBuffer.exe MSBuild.exe PID 4672 wrote to memory of 8172 4672 FallbackBuffer.exe MSBuild.exe PID 4672 wrote to memory of 8172 4672 FallbackBuffer.exe MSBuild.exe PID 4672 wrote to memory of 8172 4672 FallbackBuffer.exe MSBuild.exe PID 4672 wrote to memory of 8172 4672 FallbackBuffer.exe MSBuild.exe PID 4672 wrote to memory of 8172 4672 FallbackBuffer.exe MSBuild.exe PID 4672 wrote to memory of 8172 4672 FallbackBuffer.exe MSBuild.exe PID 4672 wrote to memory of 8172 4672 FallbackBuffer.exe MSBuild.exe PID 4672 wrote to memory of 8172 4672 FallbackBuffer.exe MSBuild.exe PID 7020 wrote to memory of 6720 7020 taskeng.exe powershell.exe PID 7020 wrote to memory of 6720 7020 taskeng.exe powershell.exe PID 7020 wrote to memory of 6720 7020 taskeng.exe powershell.exe PID 8172 wrote to memory of 5768 8172 MSBuild.exe MSBuild.exe PID 8172 wrote to memory of 5768 8172 MSBuild.exe MSBuild.exe PID 8172 wrote to memory of 5768 8172 MSBuild.exe MSBuild.exe PID 8172 wrote to memory of 5768 8172 MSBuild.exe MSBuild.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe"C:\Users\Admin\AppData\Local\Temp\7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe"C:\Users\Admin\AppData\Local\Temp\7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {B5B0AC86-35F4-4729-854A-1678CEF3F234} S-1-5-21-2212144002-1172735686-1556890956-1000:MVFYZPLM\Admin:S4U:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAARgBhAGwAbABiAGEAYwBrAEIAdQBmAGYAZQByAC4AZQB4AGUAOwA=2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAARgBhAGwAbABiAGEAYwBrAEIAdQBmAGYAZQByAC4AZQB4AGUAOwA=2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {80026AB1-0401-4D29-B987-51FDF634B2AC} S-1-5-21-2212144002-1172735686-1556890956-1000:MVFYZPLM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Current\ufnxolhs\FallbackBuffer.exeC:\Users\Admin\AppData\Local\Current\ufnxolhs\FallbackBuffer.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Current\ufnxolhs\FallbackBuffer.exe"C:\Users\Admin\AppData\Local\Current\ufnxolhs\FallbackBuffer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD58897806ad57964eb8868502efe697304
SHA184c05732fdac0d0b43ea244d2b070588cc784c50
SHA2561fcebb06e4e8da3634372d06be369139dae9918f3792a8eff6b243f9889b111c
SHA51246fb58d3169be0adc890f1993b9e3d85bede7067a59f8bcadf1461c3b0e8aa5f4cb1601d7f6939eacaa5bf4a8e6e3dda2b7ded6c35c9658c921744a9757a42cb
-
\Users\Admin\AppData\Local\Temp\BLueHvffhw.exeFilesize
2.7MB
MD5abf2da5b3e7845f50463a72f8b6e6aaa
SHA1a5299f55950ca82134da73b9e9844c5d624114c3
SHA2562a4b1ae0ae67cd31f85680e6351bd5b92ff61e246c158decb1a43a3ef01d9f2c
SHA512570e8becd18b36d66a2ac295518c8ba3c0bc83d8a6175e601b509efd9237462d1d0826dbeb9e52465e7cdcd57cb4ae7fd859ddc4a5aad895cef6ef7fa981e8a4
-
memory/588-9805-0x0000000004E30000-0x0000000004F24000-memory.dmpFilesize
976KB
-
memory/588-9828-0x0000000073B30000-0x000000007421E000-memory.dmpFilesize
6.9MB
-
memory/588-4902-0x0000000004B70000-0x0000000004E28000-memory.dmpFilesize
2.7MB
-
memory/588-4901-0x0000000073B30000-0x000000007421E000-memory.dmpFilesize
6.9MB
-
memory/588-4900-0x00000000000A0000-0x000000000035C000-memory.dmpFilesize
2.7MB
-
memory/816-12050-0x0000000000830000-0x0000000000AEC000-memory.dmpFilesize
2.7MB
-
memory/1072-82-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-89-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-32-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-35-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-37-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-40-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-44-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-48-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-56-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-60-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-62-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-64-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-66-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-80-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-13-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-20-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-8-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-43-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-47-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-50-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-70-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-76-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-78-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-74-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-72-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-84-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-0-0x0000000073B3E000-0x0000000073B3F000-memory.dmpFilesize
4KB
-
memory/1072-86-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-68-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-59-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-55-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-28-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-90-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-22-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-52-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-4889-0x0000000073B30000-0x000000007421E000-memory.dmpFilesize
6.9MB
-
memory/1072-4891-0x0000000000C80000-0x0000000000CCC000-memory.dmpFilesize
304KB
-
memory/1072-4890-0x00000000057C0000-0x0000000005B70000-memory.dmpFilesize
3.7MB
-
memory/1072-19-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-15-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-4899-0x0000000002760000-0x00000000027B4000-memory.dmpFilesize
336KB
-
memory/1072-10-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-5-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-1-0x0000000000200000-0x0000000000778000-memory.dmpFilesize
5.5MB
-
memory/1072-2-0x0000000006100000-0x0000000006674000-memory.dmpFilesize
5.5MB
-
memory/1072-6-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-3-0x0000000006100000-0x000000000666E000-memory.dmpFilesize
5.4MB
-
memory/1072-9829-0x0000000073B30000-0x000000007421E000-memory.dmpFilesize
6.9MB
-
memory/1756-9826-0x00000000004E0000-0x000000000058C000-memory.dmpFilesize
688KB
-
memory/1756-12036-0x0000000004EC0000-0x0000000004F16000-memory.dmpFilesize
344KB
-
memory/1756-12035-0x00000000007E0000-0x00000000007E8000-memory.dmpFilesize
32KB
-
memory/1756-9827-0x00000000047B0000-0x0000000004898000-memory.dmpFilesize
928KB
-
memory/2040-10212-0x0000000000920000-0x0000000000928000-memory.dmpFilesize
32KB
-
memory/2040-4989-0x00000000000C0000-0x0000000000170000-memory.dmpFilesize
704KB
-
memory/4672-16950-0x0000000000400000-0x00000000004AC000-memory.dmpFilesize
688KB
-
memory/4672-19147-0x00000000022C0000-0x0000000002314000-memory.dmpFilesize
336KB
-
memory/6720-26260-0x0000000019F30000-0x000000001A212000-memory.dmpFilesize
2.9MB
-
memory/6720-26261-0x0000000000F40000-0x0000000000F48000-memory.dmpFilesize
32KB
-
memory/7052-12045-0x0000000019E00000-0x000000001A0E2000-memory.dmpFilesize
2.9MB
-
memory/7052-12046-0x0000000000F90000-0x0000000000F98000-memory.dmpFilesize
32KB
-
memory/8172-19160-0x0000000000400000-0x00000000006BC000-memory.dmpFilesize
2.7MB