Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-05-2024 09:31
Static task
static1
Behavioral task
behavioral1
Sample
0e21195230325f3e3165a335af60c81c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0e21195230325f3e3165a335af60c81c_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
0e21195230325f3e3165a335af60c81c_JaffaCakes118.exe
-
Size
967KB
-
MD5
0e21195230325f3e3165a335af60c81c
-
SHA1
acfa28a60a4cc028c9ede6d19ae9f0a2b4eed658
-
SHA256
b62e2d5028a28c3a636d1ab777d9a0ecaca17c55fdc7cda34671adae93f76625
-
SHA512
78de380e02f05a7728e3a9df148a2c45ab60fc63537062a919a5545e05cf56e9e2b7868df2f93ad5cef1418ed4627a30559e7f492c8746dd5cd5ce7d90b95400
-
SSDEEP
24576:A+pbzwIxk4VdoqmRNOuf6QOEVn01QVzWLn:hpbkGtLKJf6QrVn065WLn
Malware Config
Signatures
-
Detect ZGRat V1 5 IoCs
Processes:
resource yara_rule behavioral2/memory/960-25-0x0000000000BA0000-0x0000000000C3A000-memory.dmp family_zgrat_v1 behavioral2/memory/960-21-0x0000000000400000-0x0000000000541000-memory.dmp family_zgrat_v1 behavioral2/memory/960-20-0x0000000000400000-0x0000000000541000-memory.dmp family_zgrat_v1 behavioral2/memory/960-24-0x0000000000BA0000-0x0000000000C3A000-memory.dmp family_zgrat_v1 behavioral2/memory/960-45-0x0000000000400000-0x0000000000541000-memory.dmp family_zgrat_v1 -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/960-25-0x0000000000BA0000-0x0000000000C3A000-memory.dmp family_masslogger behavioral2/memory/960-21-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger behavioral2/memory/960-20-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger behavioral2/memory/960-24-0x0000000000BA0000-0x0000000000C3A000-memory.dmp family_masslogger behavioral2/memory/960-45-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
hshkjfshsdd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation hshkjfshsdd.exe -
Drops startup file 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs notepad.exe -
Executes dropped EXE 3 IoCs
Processes:
hshkjfshsdd.exehshkjfshsdd.exehshkjfshsdd.exepid process 1404 hshkjfshsdd.exe 960 hshkjfshsdd.exe 4268 hshkjfshsdd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/960-21-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/960-20-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/960-16-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/960-19-0x0000000000400000-0x0000000000541000-memory.dmp upx -
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
Processes:
hshkjfshsdd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 19 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
hshkjfshsdd.exedescription pid process target process PID 1404 set thread context of 960 1404 hshkjfshsdd.exe hshkjfshsdd.exe -
NTFS ADS 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\appdata\hshkjfshsdd.exe:ZoneIdentifier notepad.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
hshkjfshsdd.exepid process 960 hshkjfshsdd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0e21195230325f3e3165a335af60c81c_JaffaCakes118.exehshkjfshsdd.exehshkjfshsdd.exepid process 3484 0e21195230325f3e3165a335af60c81c_JaffaCakes118.exe 3484 0e21195230325f3e3165a335af60c81c_JaffaCakes118.exe 1404 hshkjfshsdd.exe 1404 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe 4268 hshkjfshsdd.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
hshkjfshsdd.exepid process 1404 hshkjfshsdd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
hshkjfshsdd.exedescription pid process Token: SeDebugPrivilege 960 hshkjfshsdd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
hshkjfshsdd.exepid process 960 hshkjfshsdd.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
0e21195230325f3e3165a335af60c81c_JaffaCakes118.exenotepad.exehshkjfshsdd.exedescription pid process target process PID 3484 wrote to memory of 2672 3484 0e21195230325f3e3165a335af60c81c_JaffaCakes118.exe notepad.exe PID 3484 wrote to memory of 2672 3484 0e21195230325f3e3165a335af60c81c_JaffaCakes118.exe notepad.exe PID 3484 wrote to memory of 2672 3484 0e21195230325f3e3165a335af60c81c_JaffaCakes118.exe notepad.exe PID 3484 wrote to memory of 2672 3484 0e21195230325f3e3165a335af60c81c_JaffaCakes118.exe notepad.exe PID 3484 wrote to memory of 2672 3484 0e21195230325f3e3165a335af60c81c_JaffaCakes118.exe notepad.exe PID 2672 wrote to memory of 1404 2672 notepad.exe hshkjfshsdd.exe PID 2672 wrote to memory of 1404 2672 notepad.exe hshkjfshsdd.exe PID 2672 wrote to memory of 1404 2672 notepad.exe hshkjfshsdd.exe PID 1404 wrote to memory of 960 1404 hshkjfshsdd.exe hshkjfshsdd.exe PID 1404 wrote to memory of 960 1404 hshkjfshsdd.exe hshkjfshsdd.exe PID 1404 wrote to memory of 960 1404 hshkjfshsdd.exe hshkjfshsdd.exe PID 1404 wrote to memory of 4268 1404 hshkjfshsdd.exe hshkjfshsdd.exe PID 1404 wrote to memory of 4268 1404 hshkjfshsdd.exe hshkjfshsdd.exe PID 1404 wrote to memory of 4268 1404 hshkjfshsdd.exe hshkjfshsdd.exe -
outlook_office_path 1 IoCs
Processes:
hshkjfshsdd.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe -
outlook_win_path 1 IoCs
Processes:
hshkjfshsdd.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e21195230325f3e3165a335af60c81c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0e21195230325f3e3165a335af60c81c_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\appdata\hshkjfshsdd.exe"C:\Users\Admin\AppData\Roaming\appdata\hshkjfshsdd.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\appdata\hshkjfshsdd.exe"C:\Users\Admin\AppData\Roaming\appdata\hshkjfshsdd.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Roaming\appdata\hshkjfshsdd.exe"C:\Users\Admin\AppData\Roaming\appdata\hshkjfshsdd.exe" 2 960 2406585784⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4292 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\appdata\hshkjfshsdd.exeFilesize
967KB
MD50e21195230325f3e3165a335af60c81c
SHA1acfa28a60a4cc028c9ede6d19ae9f0a2b4eed658
SHA256b62e2d5028a28c3a636d1ab777d9a0ecaca17c55fdc7cda34671adae93f76625
SHA51278de380e02f05a7728e3a9df148a2c45ab60fc63537062a919a5545e05cf56e9e2b7868df2f93ad5cef1418ed4627a30559e7f492c8746dd5cd5ce7d90b95400
-
memory/960-20-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/960-44-0x0000000005660000-0x00000000056F2000-memory.dmpFilesize
584KB
-
memory/960-24-0x0000000000BA0000-0x0000000000C3A000-memory.dmpFilesize
616KB
-
memory/960-16-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/960-49-0x00000000077A0000-0x00000000077F0000-memory.dmpFilesize
320KB
-
memory/960-47-0x0000000006530000-0x000000000653A000-memory.dmpFilesize
40KB
-
memory/960-45-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/960-19-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/960-25-0x0000000000BA0000-0x0000000000C3A000-memory.dmpFilesize
616KB
-
memory/960-43-0x0000000005280000-0x00000000052E6000-memory.dmpFilesize
408KB
-
memory/960-21-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/960-42-0x0000000005200000-0x0000000005244000-memory.dmpFilesize
272KB
-
memory/960-50-0x0000000007800000-0x0000000007814000-memory.dmpFilesize
80KB
-
memory/960-41-0x0000000005160000-0x00000000051FC000-memory.dmpFilesize
624KB
-
memory/960-40-0x0000000004BB0000-0x0000000005154000-memory.dmpFilesize
5.6MB
-
memory/1404-15-0x0000000002320000-0x0000000002321000-memory.dmpFilesize
4KB
-
memory/1404-22-0x0000000000400000-0x00000000004F8000-memory.dmpFilesize
992KB
-
memory/1404-12-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/2672-4-0x00000000009C0000-0x00000000009C1000-memory.dmpFilesize
4KB
-
memory/3484-3-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/3484-0-0x00000000022A0000-0x00000000022A1000-memory.dmpFilesize
4KB
-
memory/3484-1-0x0000000002540000-0x0000000002553000-memory.dmpFilesize
76KB
-
memory/3484-2-0x0000000002540000-0x0000000002553000-memory.dmpFilesize
76KB
-
memory/3484-5-0x0000000000400000-0x00000000004F8000-memory.dmpFilesize
992KB
-
memory/4268-46-0x0000000000400000-0x00000000004F8000-memory.dmpFilesize
992KB
-
memory/4268-27-0x0000000000400000-0x00000000004F8000-memory.dmpFilesize
992KB