Analysis
-
max time kernel
26s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31-03-2024 19:34
Static task
static1
Behavioral task
behavioral1
Sample
5c375467509255e045544819c517aa26_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
5c375467509255e045544819c517aa26_JaffaCakes118.exe
-
Size
1.6MB
-
MD5
5c375467509255e045544819c517aa26
-
SHA1
910e1c81b5403997747d8e97ecdf140f619359bf
-
SHA256
4906dabe18713cfb2c7e2920efef762579ef0ef285eed98098639b7f22fe32fc
-
SHA512
ce8233ad76e1cc8f962a6810fa9d1b4a2657b1ce1b32ca3cb386a8450cbe43e115308aafb693b9db7ae109b07b182ef1cf381e869360a040a0097d2c09dec320
-
SSDEEP
6144:cTkbhEh9DbFZdCsKg8SVAKtVSVeB/yN7ARppUc:h9qhWg8SO0SVG/9ppUc
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exesystem32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" system32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" system32.exe -
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exesystem32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe -
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exesystem32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" system32.exe -
Deletes itself 1 IoCs
Processes:
system32.exepid process 2668 system32.exe -
Executes dropped EXE 1 IoCs
Processes:
system32.exepid process 2668 system32.exe -
Loads dropped DLL 2 IoCs
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exepid process 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/3044-2-0x0000000002630000-0x00000000036BE000-memory.dmp upx behavioral1/memory/3044-5-0x0000000002630000-0x00000000036BE000-memory.dmp upx behavioral1/memory/3044-6-0x0000000002630000-0x00000000036BE000-memory.dmp upx behavioral1/memory/3044-9-0x0000000002630000-0x00000000036BE000-memory.dmp upx behavioral1/memory/3044-12-0x0000000002630000-0x00000000036BE000-memory.dmp upx behavioral1/memory/3044-16-0x0000000002630000-0x00000000036BE000-memory.dmp upx behavioral1/memory/3044-22-0x0000000002630000-0x00000000036BE000-memory.dmp upx behavioral1/memory/3044-24-0x0000000002630000-0x00000000036BE000-memory.dmp upx behavioral1/memory/3044-25-0x0000000002630000-0x00000000036BE000-memory.dmp upx behavioral1/memory/3044-26-0x0000000002630000-0x00000000036BE000-memory.dmp upx behavioral1/memory/3044-27-0x0000000002630000-0x00000000036BE000-memory.dmp upx behavioral1/memory/3044-44-0x0000000002630000-0x00000000036BE000-memory.dmp upx behavioral1/memory/3044-45-0x0000000002630000-0x00000000036BE000-memory.dmp upx behavioral1/memory/2668-63-0x0000000003110000-0x000000000419E000-memory.dmp upx behavioral1/memory/2668-61-0x0000000003110000-0x000000000419E000-memory.dmp upx behavioral1/memory/2668-64-0x0000000003110000-0x000000000419E000-memory.dmp upx behavioral1/memory/2668-66-0x0000000003110000-0x000000000419E000-memory.dmp upx behavioral1/memory/2668-71-0x0000000003110000-0x000000000419E000-memory.dmp upx behavioral1/memory/2668-77-0x0000000003110000-0x000000000419E000-memory.dmp upx behavioral1/memory/2668-73-0x0000000003110000-0x000000000419E000-memory.dmp upx behavioral1/memory/2668-81-0x0000000003110000-0x000000000419E000-memory.dmp upx behavioral1/memory/2668-82-0x0000000003110000-0x000000000419E000-memory.dmp upx behavioral1/memory/2668-83-0x0000000003110000-0x000000000419E000-memory.dmp upx behavioral1/memory/2668-84-0x0000000003110000-0x000000000419E000-memory.dmp upx behavioral1/memory/2668-85-0x0000000003110000-0x000000000419E000-memory.dmp upx behavioral1/memory/2668-86-0x0000000003110000-0x000000000419E000-memory.dmp upx behavioral1/memory/2668-87-0x0000000003110000-0x000000000419E000-memory.dmp upx behavioral1/memory/2668-120-0x0000000003110000-0x000000000419E000-memory.dmp upx -
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exesystem32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" system32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" system32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 5c375467509255e045544819c517aa26_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
system32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\System32 = "C:\\Users\\Admin\\system32.exe" system32.exe -
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exesystem32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe -
Drops file in Windows directory 1 IoCs
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 5c375467509255e045544819c517aa26_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exesystem32.exepid process 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe 2668 system32.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exesystem32.exedescription pid process Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe Token: SeDebugPrivilege 2668 system32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exesystem32.exepid process 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe 2668 system32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exesystem32.exedescription pid process target process PID 3044 wrote to memory of 1108 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe taskhost.exe PID 3044 wrote to memory of 1168 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Dwm.exe PID 3044 wrote to memory of 1196 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe Explorer.EXE PID 3044 wrote to memory of 1660 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe DllHost.exe PID 3044 wrote to memory of 2668 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe system32.exe PID 3044 wrote to memory of 2668 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe system32.exe PID 3044 wrote to memory of 2668 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe system32.exe PID 3044 wrote to memory of 2668 3044 5c375467509255e045544819c517aa26_JaffaCakes118.exe system32.exe PID 2668 wrote to memory of 1108 2668 system32.exe taskhost.exe PID 2668 wrote to memory of 1168 2668 system32.exe Dwm.exe PID 2668 wrote to memory of 1196 2668 system32.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
5c375467509255e045544819c517aa26_JaffaCakes118.exesystem32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 5c375467509255e045544819c517aa26_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system32.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\5c375467509255e045544819c517aa26_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5c375467509255e045544819c517aa26_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\system32.exeC:\Users\Admin\system32.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5f0c915c8e90157ae9bcd25be3f27f39b
SHA13d5a73dfc19e7e4bc9c4a929100632cf3ae5885a
SHA25677cce9d585d1539dc72dd6a58445bcb209210f318c3eded2a8834856aeb76e3e
SHA512603ec8cc5bd4b68d03cd804028b5fea092247baedc35677ea95e5b3c6ed1f48c9a48d277561c573f5d2ec0a5192dc8a233bff335fc63ae2e93ee24af90e705c5
-
C:\cylk.pifFilesize
100KB
MD50c9f1035427a9871a48a21405ff3355e
SHA13690fcf69bc812b0697861924cd0e1fb0f35295c
SHA2562db3d5aa38d874e991fb50391a293b269d07804dda7637362503abafb387408d
SHA5124fb2d0b21452d71c30a7f1f8de09154ce020cf6f5040baac32efd3e94acc8255a0eae51ba502542f6c89882772f0ee73997a377e5174e4267090a6f30ad82276
-
\Users\Admin\System32.exeFilesize
1.6MB
MD55c375467509255e045544819c517aa26
SHA1910e1c81b5403997747d8e97ecdf140f619359bf
SHA2564906dabe18713cfb2c7e2920efef762579ef0ef285eed98098639b7f22fe32fc
SHA512ce8233ad76e1cc8f962a6810fa9d1b4a2657b1ce1b32ca3cb386a8450cbe43e115308aafb693b9db7ae109b07b182ef1cf381e869360a040a0097d2c09dec320
-
memory/1108-7-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/2668-105-0x0000000005A00000-0x0000000005A8B000-memory.dmpFilesize
556KB
-
memory/2668-131-0x0000000001DB0000-0x0000000001DB2000-memory.dmpFilesize
8KB
-
memory/2668-285-0x0000000005DC0000-0x0000000005E4B000-memory.dmpFilesize
556KB
-
memory/2668-276-0x0000000005DC0000-0x0000000005E4B000-memory.dmpFilesize
556KB
-
memory/2668-80-0x00000000024E0000-0x00000000024E1000-memory.dmpFilesize
4KB
-
memory/2668-249-0x0000000005DC0000-0x0000000005E4B000-memory.dmpFilesize
556KB
-
memory/2668-248-0x0000000005DC0000-0x0000000005E4B000-memory.dmpFilesize
556KB
-
memory/2668-247-0x0000000005DC0000-0x0000000005E4B000-memory.dmpFilesize
556KB
-
memory/2668-229-0x00000000058C0000-0x000000000594B000-memory.dmpFilesize
556KB
-
memory/2668-228-0x00000000058C0000-0x000000000594B000-memory.dmpFilesize
556KB
-
memory/2668-203-0x0000000005780000-0x000000000580B000-memory.dmpFilesize
556KB
-
memory/2668-200-0x0000000005780000-0x000000000580B000-memory.dmpFilesize
556KB
-
memory/2668-192-0x0000000005780000-0x000000000580B000-memory.dmpFilesize
556KB
-
memory/2668-162-0x0000000005DC0000-0x0000000005E4B000-memory.dmpFilesize
556KB
-
memory/2668-147-0x0000000005A00000-0x0000000005A8B000-memory.dmpFilesize
556KB
-
memory/2668-120-0x0000000003110000-0x000000000419E000-memory.dmpFilesize
16.6MB
-
memory/2668-77-0x0000000003110000-0x000000000419E000-memory.dmpFilesize
16.6MB
-
memory/2668-87-0x0000000003110000-0x000000000419E000-memory.dmpFilesize
16.6MB
-
memory/2668-86-0x0000000003110000-0x000000000419E000-memory.dmpFilesize
16.6MB
-
memory/2668-85-0x0000000003110000-0x000000000419E000-memory.dmpFilesize
16.6MB
-
memory/2668-84-0x0000000003110000-0x000000000419E000-memory.dmpFilesize
16.6MB
-
memory/2668-63-0x0000000003110000-0x000000000419E000-memory.dmpFilesize
16.6MB
-
memory/2668-79-0x0000000001DB0000-0x0000000001DB2000-memory.dmpFilesize
8KB
-
memory/2668-64-0x0000000003110000-0x000000000419E000-memory.dmpFilesize
16.6MB
-
memory/2668-66-0x0000000003110000-0x000000000419E000-memory.dmpFilesize
16.6MB
-
memory/2668-71-0x0000000003110000-0x000000000419E000-memory.dmpFilesize
16.6MB
-
memory/2668-61-0x0000000003110000-0x000000000419E000-memory.dmpFilesize
16.6MB
-
memory/2668-250-0x0000000005DC0000-0x0000000005E4B000-memory.dmpFilesize
556KB
-
memory/2668-104-0x0000000005A00000-0x0000000005A8B000-memory.dmpFilesize
556KB
-
memory/2668-73-0x0000000003110000-0x000000000419E000-memory.dmpFilesize
16.6MB
-
memory/2668-81-0x0000000003110000-0x000000000419E000-memory.dmpFilesize
16.6MB
-
memory/2668-82-0x0000000003110000-0x000000000419E000-memory.dmpFilesize
16.6MB
-
memory/2668-83-0x0000000003110000-0x000000000419E000-memory.dmpFilesize
16.6MB
-
memory/3044-12-0x0000000002630000-0x00000000036BE000-memory.dmpFilesize
16.6MB
-
memory/3044-50-0x0000000000330000-0x0000000000332000-memory.dmpFilesize
8KB
-
memory/3044-41-0x0000000005510000-0x000000000559B000-memory.dmpFilesize
556KB
-
memory/3044-45-0x0000000002630000-0x00000000036BE000-memory.dmpFilesize
16.6MB
-
memory/3044-44-0x0000000002630000-0x00000000036BE000-memory.dmpFilesize
16.6MB
-
memory/3044-0-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/3044-39-0x0000000005510000-0x000000000559B000-memory.dmpFilesize
556KB
-
memory/3044-9-0x0000000002630000-0x00000000036BE000-memory.dmpFilesize
16.6MB
-
memory/3044-25-0x0000000002630000-0x00000000036BE000-memory.dmpFilesize
16.6MB
-
memory/3044-59-0x0000000000400000-0x000000000048B000-memory.dmpFilesize
556KB
-
memory/3044-27-0x0000000002630000-0x00000000036BE000-memory.dmpFilesize
16.6MB
-
memory/3044-6-0x0000000002630000-0x00000000036BE000-memory.dmpFilesize
16.6MB
-
memory/3044-26-0x0000000002630000-0x00000000036BE000-memory.dmpFilesize
16.6MB
-
memory/3044-24-0x0000000002630000-0x00000000036BE000-memory.dmpFilesize
16.6MB
-
memory/3044-22-0x0000000002630000-0x00000000036BE000-memory.dmpFilesize
16.6MB
-
memory/3044-2-0x0000000002630000-0x00000000036BE000-memory.dmpFilesize
16.6MB
-
memory/3044-23-0x0000000000360000-0x0000000000361000-memory.dmpFilesize
4KB
-
memory/3044-20-0x0000000000330000-0x0000000000332000-memory.dmpFilesize
8KB
-
memory/3044-16-0x0000000002630000-0x00000000036BE000-memory.dmpFilesize
16.6MB
-
memory/3044-18-0x0000000000360000-0x0000000000361000-memory.dmpFilesize
4KB
-
memory/3044-17-0x0000000000330000-0x0000000000332000-memory.dmpFilesize
8KB
-
memory/3044-5-0x0000000002630000-0x00000000036BE000-memory.dmpFilesize
16.6MB