Analysis
-
max time kernel
145s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 14:48
Behavioral task
behavioral1
Sample
f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe
-
Size
4.2MB
-
MD5
f83a20f718d2b719452e9554e7bfd047
-
SHA1
2980fb923fe8609924194a6eacd701b7f9bcb373
-
SHA256
a6d2459e454472e4005e2ef23b943d90ab64e46ab0ca6e1735617059c60bfe00
-
SHA512
2ea6802430ff3c0de84556ad43e9f6a9062b9c9bd254e75efa1a547fb56807e0333a5fec7892d884206045c9db9880cd9df91ead4be373157ef153d03cd80745
-
SSDEEP
98304:/7zvc7Vd6JvVzBPeZH7V2dp03aGOSic+uDbysEhWNR+Yi9xOnBN9xrAHEn16zoCR:/7w7EreSNSPyAnBN9xl16zoCHOo
Malware Config
Signatures
-
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/2412-62-0x0000000000400000-0x000000000041D000-memory.dmp MailPassView behavioral1/memory/2412-64-0x0000000000400000-0x000000000041D000-memory.dmp MailPassView behavioral1/memory/2972-100-0x0000000003EE0000-0x0000000003F05000-memory.dmp MailPassView -
Nirsoft 13 IoCs
Processes:
resource yara_rule behavioral1/memory/3008-24-0x0000000000400000-0x0000000000416000-memory.dmp Nirsoft behavioral1/memory/3008-23-0x0000000000400000-0x0000000000416000-memory.dmp Nirsoft behavioral1/memory/2688-34-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/2688-37-0x0000000000400000-0x0000000000418000-memory.dmp Nirsoft behavioral1/memory/2556-52-0x0000000000400000-0x000000000041A000-memory.dmp Nirsoft behavioral1/memory/2972-61-0x0000000003EE0000-0x0000000003EF8000-memory.dmp Nirsoft behavioral1/memory/2412-62-0x0000000000400000-0x000000000041D000-memory.dmp Nirsoft behavioral1/memory/2412-64-0x0000000000400000-0x000000000041D000-memory.dmp Nirsoft behavioral1/memory/2128-74-0x0000000000400000-0x0000000000425000-memory.dmp Nirsoft behavioral1/memory/2128-76-0x0000000000400000-0x0000000000425000-memory.dmp Nirsoft behavioral1/memory/2576-86-0x0000000000400000-0x0000000000419000-memory.dmp Nirsoft \Windows\res\outlook.exe Nirsoft behavioral1/memory/2972-100-0x0000000003EE0000-0x0000000003F05000-memory.dmp Nirsoft -
Executes dropped EXE 7 IoCs
Processes:
desktop.exefox.exeie.exemail.exemsn.exenet.exeoutlook.exepid process 3008 desktop.exe 2688 fox.exe 2556 ie.exe 2412 mail.exe 2128 msn.exe 2576 net.exe 2764 outlook.exe -
Loads dropped DLL 14 IoCs
Processes:
f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exepid process 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2972-0-0x0000000000400000-0x0000000000CBA000-memory.dmp upx \Windows\res\desktop.exe upx behavioral1/memory/2972-15-0x0000000003EE0000-0x0000000003EF6000-memory.dmp upx behavioral1/memory/3008-24-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/3008-23-0x0000000000400000-0x0000000000416000-memory.dmp upx \Windows\res\fox.exe upx behavioral1/memory/2688-34-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2972-27-0x0000000003EE0000-0x0000000003EF8000-memory.dmp upx behavioral1/memory/2972-35-0x0000000000400000-0x0000000000CBA000-memory.dmp upx behavioral1/memory/2688-37-0x0000000000400000-0x0000000000418000-memory.dmp upx \Windows\res\ie.exe upx behavioral1/memory/2972-40-0x0000000003EE0000-0x0000000003EFA000-memory.dmp upx behavioral1/memory/2556-47-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/2556-52-0x0000000000400000-0x000000000041A000-memory.dmp upx \Windows\res\mail.exe upx behavioral1/memory/2412-62-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2412-64-0x0000000000400000-0x000000000041D000-memory.dmp upx \Windows\res\msn.exe upx behavioral1/memory/2972-72-0x0000000003EE0000-0x0000000003EF8000-memory.dmp upx behavioral1/memory/2972-67-0x0000000003EE0000-0x0000000003F05000-memory.dmp upx behavioral1/memory/2128-74-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/2128-76-0x0000000000400000-0x0000000000425000-memory.dmp upx \Windows\res\net.exe upx behavioral1/memory/2972-87-0x0000000003EE0000-0x0000000003EFA000-memory.dmp upx behavioral1/memory/2576-86-0x0000000000400000-0x0000000000419000-memory.dmp upx behavioral1/memory/2972-98-0x0000000000400000-0x0000000000CBA000-memory.dmp upx behavioral1/memory/2972-99-0x0000000003EE0000-0x0000000003EFD000-memory.dmp upx behavioral1/memory/2972-101-0x0000000000400000-0x0000000000CBA000-memory.dmp upx behavioral1/memory/2972-102-0x0000000003EE0000-0x0000000003F05000-memory.dmp upx behavioral1/memory/2972-103-0x0000000003EE0000-0x0000000003EF9000-memory.dmp upx behavioral1/memory/2972-104-0x0000000000400000-0x0000000000CBA000-memory.dmp upx behavioral1/memory/2972-105-0x0000000000400000-0x0000000000CBA000-memory.dmp upx behavioral1/memory/2972-106-0x0000000000400000-0x0000000000CBA000-memory.dmp upx behavioral1/memory/2972-108-0x0000000000400000-0x0000000000CBA000-memory.dmp upx behavioral1/memory/2972-109-0x0000000000400000-0x0000000000CBA000-memory.dmp upx behavioral1/memory/2972-110-0x0000000000400000-0x0000000000CBA000-memory.dmp upx behavioral1/memory/2972-111-0x0000000000400000-0x0000000000CBA000-memory.dmp upx behavioral1/memory/2972-112-0x0000000000400000-0x0000000000CBA000-memory.dmp upx behavioral1/memory/2972-113-0x0000000000400000-0x0000000000CBA000-memory.dmp upx behavioral1/memory/2972-114-0x0000000000400000-0x0000000000CBA000-memory.dmp upx -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
mail.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts mail.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\WINDOWS\\msnmsgr.exe" f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe -
Drops file in Windows directory 17 IoCs
Processes:
f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exenet.exeoutlook.exemail.exemsn.exefox.exedesktop.exeie.exedescription ioc process File created C:\WINDOWS\res\desktop.exe f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe File created C:\WINDOWS\res\fox.exe f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe File created C:\WINDOWS\res\mail.exe f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe File created C:\WINDOWS\res\net.exe f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe File created C:\WINDOWS\res\net.html net.exe File created C:\WINDOWS\msnmsgr.exe f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe File opened for modification C:\WINDOWS\msnmsgr.exe f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe File created C:\WINDOWS\res\ie.exe f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe File created C:\WINDOWS\res\outlook.html outlook.exe File created C:\WINDOWS\res\mail.html mail.exe File created C:\WINDOWS\res\msn.html msn.exe File created C:\WINDOWS\usbb.txt f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe File created C:\WINDOWS\res\fox.html fox.exe File created C:\WINDOWS\res\desktop.html desktop.exe File created C:\WINDOWS\res\ie.html ie.exe File created C:\WINDOWS\res\msn.exe f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe File created C:\WINDOWS\res\outlook.exe f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe -
Runs net.exe
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exepid process 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
ie.exemsn.exenet.exedescription pid process Token: SeDebugPrivilege 2556 ie.exe Token: SeRestorePrivilege 2556 ie.exe Token: SeBackupPrivilege 2556 ie.exe Token: SeDebugPrivilege 2128 msn.exe Token: SeDebugPrivilege 2576 net.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exedescription pid process target process PID 2972 wrote to memory of 3008 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe desktop.exe PID 2972 wrote to memory of 3008 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe desktop.exe PID 2972 wrote to memory of 3008 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe desktop.exe PID 2972 wrote to memory of 3008 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe desktop.exe PID 2972 wrote to memory of 2688 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe fox.exe PID 2972 wrote to memory of 2688 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe fox.exe PID 2972 wrote to memory of 2688 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe fox.exe PID 2972 wrote to memory of 2688 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe fox.exe PID 2972 wrote to memory of 2556 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe ie.exe PID 2972 wrote to memory of 2556 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe ie.exe PID 2972 wrote to memory of 2556 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe ie.exe PID 2972 wrote to memory of 2556 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe ie.exe PID 2972 wrote to memory of 2412 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe mail.exe PID 2972 wrote to memory of 2412 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe mail.exe PID 2972 wrote to memory of 2412 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe mail.exe PID 2972 wrote to memory of 2412 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe mail.exe PID 2972 wrote to memory of 2128 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe msn.exe PID 2972 wrote to memory of 2128 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe msn.exe PID 2972 wrote to memory of 2128 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe msn.exe PID 2972 wrote to memory of 2128 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe msn.exe PID 2972 wrote to memory of 2576 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe net.exe PID 2972 wrote to memory of 2576 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe net.exe PID 2972 wrote to memory of 2576 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe net.exe PID 2972 wrote to memory of 2576 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe net.exe PID 2972 wrote to memory of 2764 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe outlook.exe PID 2972 wrote to memory of 2764 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe outlook.exe PID 2972 wrote to memory of 2764 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe outlook.exe PID 2972 wrote to memory of 2764 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe outlook.exe PID 2972 wrote to memory of 2764 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe outlook.exe PID 2972 wrote to memory of 2764 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe outlook.exe PID 2972 wrote to memory of 2764 2972 f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe outlook.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f83a20f718d2b719452e9554e7bfd047_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\res\desktop.exeC:\WINDOWS\res\desktop.exe /shtml C:\WINDOWS\res\desktop.html2⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\WINDOWS\res\fox.exeC:\WINDOWS\res\fox.exe /shtml C:\WINDOWS\res\fox.html2⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\WINDOWS\res\ie.exeC:\WINDOWS\res\ie.exe /shtml C:\WINDOWS\res\ie.html2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\WINDOWS\res\mail.exeC:\WINDOWS\res\mail.exe /shtml C:\WINDOWS\res\mail.html2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Drops file in Windows directory
-
C:\WINDOWS\res\msn.exeC:\WINDOWS\res\msn.exe /shtml C:\WINDOWS\res\msn.html2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\WINDOWS\res\net.exeC:\WINDOWS\res\net.exe /shtml C:\WINDOWS\res\net.html2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\WINDOWS\res\outlook.exeC:\WINDOWS\res\outlook.exe /shtml C:\WINDOWS\res\outlook.html2⤵
- Executes dropped EXE
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Windows\res\desktop.exeFilesize
32KB
MD5f3ca95a762a4101a2cd5789190681a78
SHA1cac61068382b93ee63dc06324e501ddc71ac65ef
SHA256460fc0ae9b29b61d7a147b599eb02b70ea6a830df0f5cd16a317a95e466513c0
SHA512d33d62c0f5b65bbfd55c6a4281bff60980f3e335c3a4ff802dd8ac92cc417785f3a3d82607dbfd542222ce40ff1a45c8c3c9ac46e3543cd4f5af94527dace2b5
-
\Windows\res\fox.exeFilesize
36KB
MD5824461ef7a4428414e80cf6a190f7da8
SHA164620436a853011f3d5c435c09a30e98a421861e
SHA2564a21cfc6ac4924eb04ed112f3dc7dd20aac69c31c6765c541753b1088a490792
SHA51247cc0cbbe6c2fe6518837dfa6bd6b783edc50744115976187c664741ca78ff3ded14cc492b8b4e0580b9adfb150fe92e8860334d579cf230cf133ee613275ebe
-
\Windows\res\ie.exeFilesize
41KB
MD549333f7d3b73e3a1da1d78705cdcabaf
SHA10732866cfc27067d6b9cb396d56ee45f2415c5b6
SHA256d524a4c880ef7e8bc294bd76e7c561fcc26728d0f6dab3d14c3d4e1f9e935688
SHA5125a7bd6302667f88a098be298f96fb3b58df9f36387f0d6187e20df1c0fd28dadd03a61def7228fd37af17e03442d35431f9b887af2ca8ecc1bd42c554d464773
-
\Windows\res\mail.exeFilesize
46KB
MD5e2943d11cb273e988919319522c3ad50
SHA19eab03f451b5b83ae91d0c052cbb5c19e8976129
SHA25603c620c30deea40eaff3f2a5e1905531640179202faecaa3e1e4095dfb14cfbf
SHA512975b87c66df13e203ef4a22d772f59f1cc0191609aad503ddaaa0b18039e614592a0c36d7b90573ec6bf34e1bfdf840db81ba506d86a9cc997f3b2bf65016cda
-
\Windows\res\msn.exeFilesize
62KB
MD5cd5a98ad3d2890a9fc45c15b4f2cec01
SHA1bc384b29bc644e6b1a63bb0c98b9920275143b09
SHA256587998e0097719672cc20a6db12d71fc2b79f2aa7ac1e52089e3d9850e38e53b
SHA5127d99bbcc4471cbebbf117f49f2b575a33c1f1d292e353e01d3441dc83c817cc240ec68821e5d4c8b4f37f782be11eeeec39dd2510951a1852776c557f6cb8e60
-
\Windows\res\net.exeFilesize
39KB
MD5634faad6c5f06dbb88a40cbe91f9cd10
SHA1e41d2e0cc3f5b7dbea61c1c741db5fdf28443db7
SHA2569767b5309b3c602797585c0c7b32560c1682114b2bc502ddfe0b4530cc67d110
SHA51218863145afca6c140e8399109f43d0eb05e49a0ea705b6af6b8f4e6976d17cccc58672ffb6243dc9505782d8be5931db0ed55548774f910c368a9e850cb6eabe
-
\Windows\res\outlook.exeFilesize
51KB
MD535861f4ea9a8ecb6c357bdb91b7df804
SHA1836cb49c8d08d5e305ab8976f653b97f1edba245
SHA25664788b6f74875aed53ca80669b06f407e132d7be49586925dbb3dcde56cbca9c
SHA5120fdfe62c86c8601bb98991149eea51ddf91b812ad2c2d45e53aaf1f36a09d00aaf02fc3d183179cf5367fda09d6f62d36c0187da2dfa5e08df4c07cf634690be
-
memory/2128-74-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2128-76-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2412-64-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/2412-62-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/2556-52-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/2556-47-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/2576-86-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2688-37-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2688-34-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2972-2-0x0000000003910000-0x0000000003911000-memory.dmpFilesize
4KB
-
memory/2972-105-0x0000000000400000-0x0000000000CBA000-memory.dmpFilesize
8.7MB
-
memory/2972-48-0x0000000003910000-0x0000000003911000-memory.dmpFilesize
4KB
-
memory/2972-88-0x0000000003EE0000-0x0000000003EF9000-memory.dmpFilesize
100KB
-
memory/2972-35-0x0000000000400000-0x0000000000CBA000-memory.dmpFilesize
8.7MB
-
memory/2972-27-0x0000000003EE0000-0x0000000003EF8000-memory.dmpFilesize
96KB
-
memory/2972-61-0x0000000003EE0000-0x0000000003EF8000-memory.dmpFilesize
96KB
-
memory/2972-60-0x0000000003EE0000-0x0000000003EFD000-memory.dmpFilesize
116KB
-
memory/2972-45-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2972-33-0x0000000003EE0000-0x0000000003EF8000-memory.dmpFilesize
96KB
-
memory/2972-114-0x0000000000400000-0x0000000000CBA000-memory.dmpFilesize
8.7MB
-
memory/2972-72-0x0000000003EE0000-0x0000000003EF8000-memory.dmpFilesize
96KB
-
memory/2972-67-0x0000000003EE0000-0x0000000003F05000-memory.dmpFilesize
148KB
-
memory/2972-84-0x0000000003EE0000-0x0000000003EF9000-memory.dmpFilesize
100KB
-
memory/2972-15-0x0000000003EE0000-0x0000000003EF6000-memory.dmpFilesize
88KB
-
memory/2972-20-0x0000000003EE0000-0x0000000003EF6000-memory.dmpFilesize
88KB
-
memory/2972-87-0x0000000003EE0000-0x0000000003EFA000-memory.dmpFilesize
104KB
-
memory/2972-40-0x0000000003EE0000-0x0000000003EFA000-memory.dmpFilesize
104KB
-
memory/2972-49-0x0000000003EE0000-0x0000000003EF6000-memory.dmpFilesize
88KB
-
memory/2972-113-0x0000000000400000-0x0000000000CBA000-memory.dmpFilesize
8.7MB
-
memory/2972-98-0x0000000000400000-0x0000000000CBA000-memory.dmpFilesize
8.7MB
-
memory/2972-1-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2972-99-0x0000000003EE0000-0x0000000003EFD000-memory.dmpFilesize
116KB
-
memory/2972-100-0x0000000003EE0000-0x0000000003F05000-memory.dmpFilesize
148KB
-
memory/2972-101-0x0000000000400000-0x0000000000CBA000-memory.dmpFilesize
8.7MB
-
memory/2972-102-0x0000000003EE0000-0x0000000003F05000-memory.dmpFilesize
148KB
-
memory/2972-103-0x0000000003EE0000-0x0000000003EF9000-memory.dmpFilesize
100KB
-
memory/2972-104-0x0000000000400000-0x0000000000CBA000-memory.dmpFilesize
8.7MB
-
memory/2972-0-0x0000000000400000-0x0000000000CBA000-memory.dmpFilesize
8.7MB
-
memory/2972-106-0x0000000000400000-0x0000000000CBA000-memory.dmpFilesize
8.7MB
-
memory/2972-108-0x0000000000400000-0x0000000000CBA000-memory.dmpFilesize
8.7MB
-
memory/2972-109-0x0000000000400000-0x0000000000CBA000-memory.dmpFilesize
8.7MB
-
memory/2972-110-0x0000000000400000-0x0000000000CBA000-memory.dmpFilesize
8.7MB
-
memory/2972-111-0x0000000000400000-0x0000000000CBA000-memory.dmpFilesize
8.7MB
-
memory/2972-112-0x0000000000400000-0x0000000000CBA000-memory.dmpFilesize
8.7MB
-
memory/3008-24-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/3008-23-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB