Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 17:30
Static task
static1
Behavioral task
behavioral1
Sample
e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe
-
Size
4.3MB
-
MD5
e579348f0efa5c965fa570e7da12d056
-
SHA1
70faa1e256d616121141c073b3ec6443f9de469d
-
SHA256
5d4447c12af07349b13f38c6d0dd226915a27a7bba6aa40b7b65ea6a87e3a305
-
SHA512
100e266a4a297ecee254f0398ca9c717ac972b236e3165b1a9736c6da31cb39b2127979610f070766539b14f1701fa4fcc41248f95d71f5f8a4a995d18b84644
-
SSDEEP
98304:mOcd1iEPw3V56K3U9+JYhfF5kt03XzzO6bcSiUyo2GE:mO+QE2V5++JYASDzO6biz5GE
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \??\c:\programdata\windows\vp8encoder.dll acprotect \??\c:\programdata\windows\vp8decoder.dll acprotect -
Processes:
resource yara_rule \??\c:\programdata\windows\rutserv.exe aspack_v212_v242 \??\c:\programdata\windows\rfusclient.exe aspack_v212_v242 -
Executes dropped EXE 9 IoCs
Processes:
aimware.sfx.exeaimware.exerutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exerfusclient.exerfusclient.exepid process 2512 aimware.sfx.exe 2492 aimware.exe 2736 rutserv.exe 780 rutserv.exe 2428 rutserv.exe 656 rutserv.exe 1516 rfusclient.exe 1324 rfusclient.exe 3040 rfusclient.exe -
Loads dropped DLL 6 IoCs
Processes:
cmd.exeaimware.sfx.execmd.exerutserv.exepid process 2452 cmd.exe 2512 aimware.sfx.exe 2512 aimware.sfx.exe 2512 aimware.sfx.exe 2432 cmd.exe 656 rutserv.exe -
Processes:
resource yara_rule \??\c:\programdata\windows\vp8encoder.dll upx \??\c:\programdata\windows\vp8decoder.dll upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2732 timeout.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 2012 taskkill.exe 1704 taskkill.exe -
Runs .reg file with regedit 1 IoCs
Processes:
regedit.exepid process 2708 regedit.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
rutserv.exerutserv.exerutserv.exerutserv.exerfusclient.exepid process 2736 rutserv.exe 2736 rutserv.exe 2736 rutserv.exe 2736 rutserv.exe 780 rutserv.exe 780 rutserv.exe 2428 rutserv.exe 2428 rutserv.exe 656 rutserv.exe 656 rutserv.exe 656 rutserv.exe 656 rutserv.exe 1516 rfusclient.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
rfusclient.exepid process 3040 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
taskkill.exetaskkill.exerutserv.exerutserv.exerutserv.exedescription pid process Token: SeDebugPrivilege 2012 taskkill.exe Token: SeDebugPrivilege 1704 taskkill.exe Token: SeDebugPrivilege 2736 rutserv.exe Token: SeDebugPrivilege 2428 rutserv.exe Token: SeTakeOwnershipPrivilege 656 rutserv.exe Token: SeTcbPrivilege 656 rutserv.exe Token: SeTcbPrivilege 656 rutserv.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
rutserv.exerutserv.exerutserv.exerutserv.exepid process 2736 rutserv.exe 780 rutserv.exe 2428 rutserv.exe 656 rutserv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e579348f0efa5c965fa570e7da12d056_JaffaCakes118.execmd.exeaimware.sfx.exeaimware.exeWScript.execmd.exerutserv.exerfusclient.exedescription pid process target process PID 2008 wrote to memory of 2452 2008 e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe cmd.exe PID 2008 wrote to memory of 2452 2008 e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe cmd.exe PID 2008 wrote to memory of 2452 2008 e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe cmd.exe PID 2008 wrote to memory of 2452 2008 e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe cmd.exe PID 2452 wrote to memory of 2512 2452 cmd.exe aimware.sfx.exe PID 2452 wrote to memory of 2512 2452 cmd.exe aimware.sfx.exe PID 2452 wrote to memory of 2512 2452 cmd.exe aimware.sfx.exe PID 2452 wrote to memory of 2512 2452 cmd.exe aimware.sfx.exe PID 2512 wrote to memory of 2492 2512 aimware.sfx.exe aimware.exe PID 2512 wrote to memory of 2492 2512 aimware.sfx.exe aimware.exe PID 2512 wrote to memory of 2492 2512 aimware.sfx.exe aimware.exe PID 2512 wrote to memory of 2492 2512 aimware.sfx.exe aimware.exe PID 2492 wrote to memory of 2568 2492 aimware.exe WScript.exe PID 2492 wrote to memory of 2568 2492 aimware.exe WScript.exe PID 2492 wrote to memory of 2568 2492 aimware.exe WScript.exe PID 2492 wrote to memory of 2568 2492 aimware.exe WScript.exe PID 2568 wrote to memory of 2432 2568 WScript.exe cmd.exe PID 2568 wrote to memory of 2432 2568 WScript.exe cmd.exe PID 2568 wrote to memory of 2432 2568 WScript.exe cmd.exe PID 2568 wrote to memory of 2432 2568 WScript.exe cmd.exe PID 2568 wrote to memory of 2432 2568 WScript.exe cmd.exe PID 2568 wrote to memory of 2432 2568 WScript.exe cmd.exe PID 2568 wrote to memory of 2432 2568 WScript.exe cmd.exe PID 2432 wrote to memory of 2012 2432 cmd.exe taskkill.exe PID 2432 wrote to memory of 2012 2432 cmd.exe taskkill.exe PID 2432 wrote to memory of 2012 2432 cmd.exe taskkill.exe PID 2432 wrote to memory of 2012 2432 cmd.exe taskkill.exe PID 2432 wrote to memory of 1704 2432 cmd.exe taskkill.exe PID 2432 wrote to memory of 1704 2432 cmd.exe taskkill.exe PID 2432 wrote to memory of 1704 2432 cmd.exe taskkill.exe PID 2432 wrote to memory of 1704 2432 cmd.exe taskkill.exe PID 2432 wrote to memory of 2692 2432 cmd.exe reg.exe PID 2432 wrote to memory of 2692 2432 cmd.exe reg.exe PID 2432 wrote to memory of 2692 2432 cmd.exe reg.exe PID 2432 wrote to memory of 2692 2432 cmd.exe reg.exe PID 2432 wrote to memory of 2708 2432 cmd.exe regedit.exe PID 2432 wrote to memory of 2708 2432 cmd.exe regedit.exe PID 2432 wrote to memory of 2708 2432 cmd.exe regedit.exe PID 2432 wrote to memory of 2708 2432 cmd.exe regedit.exe PID 2432 wrote to memory of 2732 2432 cmd.exe timeout.exe PID 2432 wrote to memory of 2732 2432 cmd.exe timeout.exe PID 2432 wrote to memory of 2732 2432 cmd.exe timeout.exe PID 2432 wrote to memory of 2732 2432 cmd.exe timeout.exe PID 2432 wrote to memory of 2736 2432 cmd.exe rutserv.exe PID 2432 wrote to memory of 2736 2432 cmd.exe rutserv.exe PID 2432 wrote to memory of 2736 2432 cmd.exe rutserv.exe PID 2432 wrote to memory of 2736 2432 cmd.exe rutserv.exe PID 2432 wrote to memory of 780 2432 cmd.exe rutserv.exe PID 2432 wrote to memory of 780 2432 cmd.exe rutserv.exe PID 2432 wrote to memory of 780 2432 cmd.exe rutserv.exe PID 2432 wrote to memory of 780 2432 cmd.exe rutserv.exe PID 2432 wrote to memory of 2428 2432 cmd.exe rutserv.exe PID 2432 wrote to memory of 2428 2432 cmd.exe rutserv.exe PID 2432 wrote to memory of 2428 2432 cmd.exe rutserv.exe PID 2432 wrote to memory of 2428 2432 cmd.exe rutserv.exe PID 656 wrote to memory of 1516 656 rutserv.exe rfusclient.exe PID 656 wrote to memory of 1516 656 rutserv.exe rfusclient.exe PID 656 wrote to memory of 1516 656 rutserv.exe rfusclient.exe PID 656 wrote to memory of 1516 656 rutserv.exe rfusclient.exe PID 656 wrote to memory of 1324 656 rutserv.exe rfusclient.exe PID 656 wrote to memory of 1324 656 rutserv.exe rfusclient.exe PID 656 wrote to memory of 1324 656 rutserv.exe rfusclient.exe PID 656 wrote to memory of 1324 656 rutserv.exe rfusclient.exe PID 1516 wrote to memory of 3040 1516 rfusclient.exe rfusclient.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e579348f0efa5c965fa570e7da12d056_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\programdata\1.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
\??\c:\programdata\aimware.sfx.exeaimware.sfx.exe -p123 -dc:\programdata3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\programdata\aimware.exe"C:\programdata\aimware.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\programdata\windows\install.vbs"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\ProgramData\windows\install.bat" "6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rutserv.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rfusclient.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SYSTEM\Remote Manipulator System" /f7⤵
-
C:\Windows\SysWOW64\regedit.exeregedit /s "regedit.reg"7⤵
- Runs .reg file with regedit
-
C:\Windows\SysWOW64\timeout.exetimeout 27⤵
- Delays execution with timeout.exe
-
\??\c:\programdata\windows\rutserv.exerutserv.exe /silentinstall7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
\??\c:\programdata\windows\rutserv.exerutserv.exe /firewall7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
\??\c:\programdata\windows\rutserv.exerutserv.exe /start7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
\??\c:\programdata\windows\rutserv.exec:\programdata\windows\rutserv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\programdata\windows\rfusclient.exec:\programdata\windows\rfusclient.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
\??\c:\programdata\windows\rfusclient.exec:\programdata\windows\rfusclient.exe /tray3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
-
\??\c:\programdata\windows\rfusclient.exec:\programdata\windows\rfusclient.exe /tray2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\1.batFilesize
38B
MD510b10fec28fbccb28922b7ad20536150
SHA174a2327ebba2f695da13095a70f5161450b915aa
SHA25607420e294de66019f7fbaa4f87da9ee9dc7389cda09af38f7040f3cacda21dfb
SHA512d215c21000a213aa41a1599e269f704e31d96f7c4713962cac6a8bb8ef21f92b70aa257cd98d63496ffb220008b22d36d9ee52a66fa939f7fe59697b8a9c3729
-
C:\ProgramData\aimware.exeFilesize
4.0MB
MD58f5f1e00b524b066e052836fd9504aaa
SHA14dafcee2a6743385ec72240146eeeb884a2d47fe
SHA25679e13b0d4703411069ba6794fdc60eba0edad50e2fe0a1afe25e029a87617a28
SHA5126aa3bd4ab3d05652980da22ce2c88c9452f379dd78173c3827806256e0474f14654b20b72d4b910390a40d84ee9afa676c6ffc98fb23945f7f91475948f67373
-
C:\ProgramData\windows\install.batFilesize
480B
MD599db27d776e103cad354b531ee1f20b9
SHA10b82d146df8528f66d1d14756f211fd3a8b1b91a
SHA256240020a1a1941d1455135b5cb134e502a13b148be16cbb1552482aa03c29f8f3
SHA512bc2ed33495c0a752397b2f1b9b7ba65f94ea5be82dde74c618342c83b68f1b92a4783b672cd427843533799e1af0875e0fd000b12236852e9e2fa93005d7ac69
-
C:\programdata\windows\install.vbsFilesize
117B
MD565fc32766a238ff3e95984e325357dbb
SHA13ac16a2648410be8aa75f3e2817fbf69bb0e8922
SHA256a7b067e9e4d44efe579c7cdb1e847d61af2323d3d73c6fffb22e178ae476f420
SHA512621e81fc2d0f9dd92413481864638a140bee94c7dbd31f944826b21bd6ad6b8a59e63de9f7f0025cffc0efb7f9975dde77f523510ee23ada62c152a63a22f608
-
\??\c:\programdata\windows\regedit.regFilesize
11KB
MD509ab259233e0f0880f2e2446f93cd88a
SHA103b9c6469c90023569f1884494504e2d3d6bbbc6
SHA2567f6e5d028aed528ad7af7672b53526a88a10846c5cf1e49bac3aeff5849a20cb
SHA512babc9e8d611476452026f60d61ee2a5bc2fc3d6303cfee60e894e7f0a4a8e2bd6195d52674cffb96b38c546296ed2c19eebd7aea98ffd5292f328d0f3e9da090
-
\??\c:\programdata\windows\rfusclient.exeFilesize
1.5MB
MD5b8667a1e84567fcf7821bcefb6a444af
SHA19c1f91fe77ad357c8f81205d65c9067a270d61f0
SHA256dc9d875e659421a51addd8e8a362c926369e84320ab0c5d8bbb1e4d12d372fc9
SHA512ec6af663a3b41719d684f04504746f91196105ef6f8baa013b4bd02df6684eca49049d5517691f8e3a4ba6351fe35545a27f728b1d29d949e950d574a012f852
-
\??\c:\programdata\windows\rutserv.exeFilesize
1.7MB
MD537a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
\??\c:\programdata\windows\vp8decoder.dllFilesize
155KB
MD588318158527985702f61d169434a4940
SHA13cc751ba256b5727eb0713aad6f554ff1e7bca57
SHA2564c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74
SHA5125d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff
-
\??\c:\programdata\windows\vp8encoder.dllFilesize
593KB
MD56298c0af3d1d563834a218a9cc9f54bd
SHA10185cd591e454ed072e5a5077b25c612f6849dc9
SHA25681af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172
SHA512389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe
-
\ProgramData\aimware.sfx.exeFilesize
4.2MB
MD537726e188c9973ba3a0a4de57f96acc2
SHA10668e13cb10947603afccb75b8389d0571199c05
SHA25644f4edd71d129500693ed4f14d1977527b23cb5b3139b0f4e26ae8dd7c9ff19c
SHA512e24935dc1ab74decc2b18ebba8e4b4cfb0564b2735c9a275c5a679eeb8dbaee9cbfbaa551d734cffd252a61088f25ad217ffa00b7e0cebcbd53605af4d5e22ec
-
memory/656-149-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/656-90-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/656-128-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/656-127-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/656-84-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/656-97-0x0000000002BD0000-0x0000000003186000-memory.dmpFilesize
5.7MB
-
memory/656-134-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/656-142-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/656-115-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/656-156-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/656-138-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/656-89-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/656-87-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/656-88-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/656-86-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/656-85-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/780-71-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/780-74-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/780-67-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/780-68-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/780-69-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/780-70-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/780-72-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/780-73-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1324-112-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1324-104-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/1324-151-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/1324-144-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/1324-136-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/1324-133-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1324-130-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/1324-117-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/1324-110-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/1324-109-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/1324-106-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/1324-107-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/1516-105-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/1516-129-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/1516-131-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1516-108-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/1516-103-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/1516-100-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/1516-96-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/1516-111-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1516-116-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/2428-102-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/2428-78-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/2428-77-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/2428-79-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/2428-82-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2428-80-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/2428-76-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/2428-81-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/2432-57-0x00000000020E0000-0x0000000002799000-memory.dmpFilesize
6.7MB
-
memory/2736-64-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2736-61-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/2736-62-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/2736-63-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/2736-65-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/2736-58-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/2736-59-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/2736-60-0x0000000000400000-0x0000000000AB9000-memory.dmpFilesize
6.7MB
-
memory/3040-122-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/3040-125-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/3040-137-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/3040-120-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/3040-123-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/3040-121-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/3040-124-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/3040-119-0x0000000000400000-0x00000000009B6000-memory.dmpFilesize
5.7MB
-
memory/3040-126-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB