Overview
overview
10Static
static
3309aa62b90...18.exe
windows7-x64
10309aa62b90...18.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
325.html
windows7-x64
125.html
windows10-2004-x64
1catalog.js
windows7-x64
3catalog.js
windows10-2004-x64
3constants$...100.js
windows7-x64
3constants$...100.js
windows10-2004-x64
3cua700985938.html
windows7-x64
1cua700985938.html
windows10-2004-x64
1cua768556328.html
windows7-x64
1cua768556328.html
windows10-2004-x64
1cua811702334.html
windows7-x64
1cua811702334.html
windows10-2004-x64
1gkamus-uninst.exe
windows7-x64
7gkamus-uninst.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3navigation.js
windows7-x64
3navigation.js
windows10-2004-x64
3writing.html
windows7-x64
1writing.html
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 19:11
Static task
static1
Behavioral task
behavioral1
Sample
309aa62b90a286c54ffcae887aadbf0b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
309aa62b90a286c54ffcae887aadbf0b_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
25.html
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
25.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
catalog.js
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
catalog.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
cua700985938.html
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
cua700985938.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
cua768556328.html
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
cua768556328.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
cua811702334.html
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
cua811702334.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
gkamus-uninst.exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
gkamus-uninst.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
navigation.js
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
navigation.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
writing.html
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
writing.html
Resource
win10v2004-20240508-en
General
-
Target
309aa62b90a286c54ffcae887aadbf0b_JaffaCakes118.exe
-
Size
347KB
-
MD5
309aa62b90a286c54ffcae887aadbf0b
-
SHA1
9194f50d1c11e0bbc7e8b3697ba2f3fac42ee853
-
SHA256
692878ac81e6439a2af9d3e558b4456a5abae4c029a196b62e8b5b316fd3571b
-
SHA512
e28840eca6e3c82b5808faed56c7a332515f9fe9ddd7af25b839f6fade25f6a3319e4f8b514d66a10ff1434906bc42a9e2fb18c28acf36ce3e970787a1eea09f
-
SSDEEP
6144:YZ/qRrMhvBX9YuyY3qj8Qlb5D6WWhJAqDhUNEH09XA4pMj:YBZhvd9Yu5aj8Qld25wcv4pMj
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
mshta.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2664 2424 mshta.exe -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
regsvr32.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions regsvr32.exe -
Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
Processes:
regsvr32.exedescription ioc process File opened (read-only) C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys regsvr32.exe -
ModiLoader Second Stage 56 IoCs
Processes:
resource yara_rule behavioral1/memory/1948-22-0x0000000000400000-0x000000000043C000-memory.dmp modiloader_stage2 behavioral1/memory/1948-27-0x0000000002CB0000-0x0000000002D8A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-28-0x0000000002CB0000-0x0000000002D8A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-32-0x0000000002CB0000-0x0000000002D8A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-31-0x0000000002CB0000-0x0000000002D8A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-30-0x0000000002CB0000-0x0000000002D8A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-29-0x0000000002CB0000-0x0000000002D8A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-33-0x0000000002CB0000-0x0000000002D8A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-34-0x0000000002CB0000-0x0000000002D8A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-38-0x0000000002CB0000-0x0000000002D8A000-memory.dmp modiloader_stage2 behavioral1/memory/2560-41-0x00000000061E0000-0x00000000062BA000-memory.dmp modiloader_stage2 behavioral1/memory/2524-42-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-43-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2560-45-0x00000000061E0000-0x00000000062BA000-memory.dmp modiloader_stage2 behavioral1/memory/2524-54-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-61-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-60-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-59-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-62-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-63-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-58-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-57-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-56-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-55-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-53-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-52-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-51-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-50-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-49-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-47-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-46-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-48-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-66-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-68-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-70-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-69-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-75-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-67-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-65-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-79-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-78-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-77-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/2524-76-0x00000000001E0000-0x0000000000327000-memory.dmp modiloader_stage2 behavioral1/memory/1948-91-0x0000000002CB0000-0x0000000002D8A000-memory.dmp modiloader_stage2 behavioral1/memory/1948-89-0x0000000000400000-0x000000000043C000-memory.dmp modiloader_stage2 behavioral1/memory/1812-92-0x0000000000210000-0x0000000000357000-memory.dmp modiloader_stage2 behavioral1/memory/1812-93-0x0000000000210000-0x0000000000357000-memory.dmp modiloader_stage2 behavioral1/memory/1812-94-0x0000000000210000-0x0000000000357000-memory.dmp modiloader_stage2 behavioral1/memory/1812-102-0x0000000000210000-0x0000000000357000-memory.dmp modiloader_stage2 behavioral1/memory/1812-101-0x0000000000210000-0x0000000000357000-memory.dmp modiloader_stage2 behavioral1/memory/1812-100-0x0000000000210000-0x0000000000357000-memory.dmp modiloader_stage2 behavioral1/memory/1812-99-0x0000000000210000-0x0000000000357000-memory.dmp modiloader_stage2 behavioral1/memory/1812-98-0x0000000000210000-0x0000000000357000-memory.dmp modiloader_stage2 behavioral1/memory/1812-97-0x0000000000210000-0x0000000000357000-memory.dmp modiloader_stage2 behavioral1/memory/1812-96-0x0000000000210000-0x0000000000357000-memory.dmp modiloader_stage2 behavioral1/memory/1812-95-0x0000000000210000-0x0000000000357000-memory.dmp modiloader_stage2 -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
regsvr32.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools regsvr32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
regsvr32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion regsvr32.exe -
Deletes itself 1 IoCs
Processes:
regsvr32.exepid process 2524 regsvr32.exe -
Loads dropped DLL 1 IoCs
Processes:
309aa62b90a286c54ffcae887aadbf0b_JaffaCakes118.exepid process 1948 309aa62b90a286c54ffcae887aadbf0b_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\AppData\\Local\\a0052\\a911c.bat\"" regsvr32.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
regsvr32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 regsvr32.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
powershell.exeregsvr32.exedescription pid process target process PID 2560 set thread context of 2524 2560 powershell.exe regsvr32.exe PID 2524 set thread context of 1812 2524 regsvr32.exe regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
regsvr32.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Modifies registry class 7 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\69f74\shell\open\command regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\69f74\shell\open\command\ = "\"C:\\Windows\\system32\\mshta.exe\" \"javascript:r45NTO=\"LT9R3jPn\";E0t=new ActiveXObject(\"WScript.Shell\");Tn0w9Vz=\"T\";Felx40=E0t.RegRead(\"HKCU\\\\software\\\\kyveu\\\\vnzu\");a3lv9Yy=\"9\";eval(Felx40);U9eTss1Gg=\"Rg\";\"" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.c9c2c4 regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.c9c2c4\ = "69f74" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\69f74 regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\69f74\shell regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\69f74\shell\open regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeregsvr32.exepid process 2560 powershell.exe 2560 powershell.exe 2560 powershell.exe 2560 powershell.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe 2524 regsvr32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
powershell.exeregsvr32.exepid process 2560 powershell.exe 2524 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2560 powershell.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
309aa62b90a286c54ffcae887aadbf0b_JaffaCakes118.exepid process 1948 309aa62b90a286c54ffcae887aadbf0b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
mshta.exepowershell.exeregsvr32.exedescription pid process target process PID 2664 wrote to memory of 2560 2664 mshta.exe powershell.exe PID 2664 wrote to memory of 2560 2664 mshta.exe powershell.exe PID 2664 wrote to memory of 2560 2664 mshta.exe powershell.exe PID 2664 wrote to memory of 2560 2664 mshta.exe powershell.exe PID 2560 wrote to memory of 2524 2560 powershell.exe regsvr32.exe PID 2560 wrote to memory of 2524 2560 powershell.exe regsvr32.exe PID 2560 wrote to memory of 2524 2560 powershell.exe regsvr32.exe PID 2560 wrote to memory of 2524 2560 powershell.exe regsvr32.exe PID 2560 wrote to memory of 2524 2560 powershell.exe regsvr32.exe PID 2560 wrote to memory of 2524 2560 powershell.exe regsvr32.exe PID 2560 wrote to memory of 2524 2560 powershell.exe regsvr32.exe PID 2560 wrote to memory of 2524 2560 powershell.exe regsvr32.exe PID 2524 wrote to memory of 1812 2524 regsvr32.exe regsvr32.exe PID 2524 wrote to memory of 1812 2524 regsvr32.exe regsvr32.exe PID 2524 wrote to memory of 1812 2524 regsvr32.exe regsvr32.exe PID 2524 wrote to memory of 1812 2524 regsvr32.exe regsvr32.exe PID 2524 wrote to memory of 1812 2524 regsvr32.exe regsvr32.exe PID 2524 wrote to memory of 1812 2524 regsvr32.exe regsvr32.exe PID 2524 wrote to memory of 1812 2524 regsvr32.exe regsvr32.exe PID 2524 wrote to memory of 1812 2524 regsvr32.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\309aa62b90a286c54ffcae887aadbf0b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\309aa62b90a286c54ffcae887aadbf0b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
PID:1948
-
C:\Windows\system32\mshta.exe"C:\Windows\system32\mshta.exe" javascript:Is9cKX7qW="w";HY28=new%20ActiveXObject("WScript.Shell");BLh8YF6="lt";xa1aP=HY28.RegRead("HKCU\\software\\v97cqOOsJW\\CwDh0EXzX0");V8YjEd="I";eval(xa1aP);kRKv9sKH="ZtuMH";1⤵
- Process spawned unexpected child process
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" iex $env:xqmsgw2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VirtualBox drivers on disk
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"4⤵PID:1812
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nst2A5C.tmp\System.dllFilesize
11KB
MD5ee260c45e97b62a5e42f17460d406068
SHA1df35f6300a03c4d3d3bd69752574426296b78695
SHA256e94a1f7bcd7e0d532b660d0af468eb3321536c3efdca265e61f9ec174b1aef27
SHA512a98f350d17c9057f33e5847462a87d59cbf2aaeda7f6299b0d49bb455e484ce4660c12d2eb8c4a0d21df523e729222bbd6c820bf25b081bc7478152515b414b3
-
memory/1812-95-0x0000000000210000-0x0000000000357000-memory.dmpFilesize
1.3MB
-
memory/1812-92-0x0000000000210000-0x0000000000357000-memory.dmpFilesize
1.3MB
-
memory/1812-93-0x0000000000210000-0x0000000000357000-memory.dmpFilesize
1.3MB
-
memory/1812-94-0x0000000000210000-0x0000000000357000-memory.dmpFilesize
1.3MB
-
memory/1812-102-0x0000000000210000-0x0000000000357000-memory.dmpFilesize
1.3MB
-
memory/1812-101-0x0000000000210000-0x0000000000357000-memory.dmpFilesize
1.3MB
-
memory/1812-100-0x0000000000210000-0x0000000000357000-memory.dmpFilesize
1.3MB
-
memory/1812-99-0x0000000000210000-0x0000000000357000-memory.dmpFilesize
1.3MB
-
memory/1812-98-0x0000000000210000-0x0000000000357000-memory.dmpFilesize
1.3MB
-
memory/1812-97-0x0000000000210000-0x0000000000357000-memory.dmpFilesize
1.3MB
-
memory/1812-96-0x0000000000210000-0x0000000000357000-memory.dmpFilesize
1.3MB
-
memory/1948-31-0x0000000002CB0000-0x0000000002D8A000-memory.dmpFilesize
872KB
-
memory/1948-32-0x0000000002CB0000-0x0000000002D8A000-memory.dmpFilesize
872KB
-
memory/1948-37-0x00000000004A0000-0x00000000004DB000-memory.dmpFilesize
236KB
-
memory/1948-34-0x0000000002CB0000-0x0000000002D8A000-memory.dmpFilesize
872KB
-
memory/1948-33-0x0000000002CB0000-0x0000000002D8A000-memory.dmpFilesize
872KB
-
memory/1948-29-0x0000000002CB0000-0x0000000002D8A000-memory.dmpFilesize
872KB
-
memory/1948-30-0x0000000002CB0000-0x0000000002D8A000-memory.dmpFilesize
872KB
-
memory/1948-38-0x0000000002CB0000-0x0000000002D8A000-memory.dmpFilesize
872KB
-
memory/1948-28-0x0000000002CB0000-0x0000000002D8A000-memory.dmpFilesize
872KB
-
memory/1948-27-0x0000000002CB0000-0x0000000002D8A000-memory.dmpFilesize
872KB
-
memory/1948-22-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1948-19-0x00000000004A0000-0x00000000004DB000-memory.dmpFilesize
236KB
-
memory/1948-89-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1948-91-0x0000000002CB0000-0x0000000002D8A000-memory.dmpFilesize
872KB
-
memory/2524-52-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-78-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-55-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-51-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-50-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-49-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-47-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-46-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-48-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-66-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-68-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-70-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-69-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-75-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-67-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-65-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-79-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-53-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-77-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-76-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-56-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-57-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-58-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-63-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-62-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-59-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-60-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-61-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-54-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-42-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2524-43-0x00000000001E0000-0x0000000000327000-memory.dmpFilesize
1.3MB
-
memory/2560-45-0x00000000061E0000-0x00000000062BA000-memory.dmpFilesize
872KB
-
memory/2560-41-0x00000000061E0000-0x00000000062BA000-memory.dmpFilesize
872KB