Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 21:32
Static task
static1
Behavioral task
behavioral1
Sample
9f9983a3e4730756e3879ef7cc39efc9_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9f9983a3e4730756e3879ef7cc39efc9_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
9f9983a3e4730756e3879ef7cc39efc9_JaffaCakes118.exe
-
Size
969KB
-
MD5
9f9983a3e4730756e3879ef7cc39efc9
-
SHA1
c93f02b1fda92d4a4fda842714bc61745527946e
-
SHA256
8d9935cd8f8d2e5f305b229f6992fbee9e4b5c4e6063568c5e150f51fa0f91b1
-
SHA512
cd291bf33e70177384b6bdbde469011b5f149fb4740c684d4d638694e9146ea00da24c173bb597a721597444325213a6b434a511d2fbe7edc9a0e65ec153e381
-
SSDEEP
12288:v9+UFSbzwd6xyFjH8H1NDNCqovrO43qQh2coPlMWfA+LQ3RfZIxuXE7g2+W7V:F+pbzwIxk4VdoqmTOHLL4RmjFR
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/4320-21-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger behavioral2/memory/4320-20-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger behavioral2/memory/4320-24-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger behavioral2/memory/4320-23-0x0000000000AA0000-0x0000000000B3A000-memory.dmp family_masslogger behavioral2/memory/4320-22-0x0000000000AA0000-0x0000000000B3A000-memory.dmp family_masslogger behavioral2/memory/4320-37-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger behavioral2/memory/4320-38-0x0000000000400000-0x0000000000541000-memory.dmp family_masslogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
hshkjfshsdd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation hshkjfshsdd.exe -
Drops startup file 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs notepad.exe -
Executes dropped EXE 3 IoCs
Processes:
hshkjfshsdd.exehshkjfshsdd.exehshkjfshsdd.exepid process 3524 hshkjfshsdd.exe 4320 hshkjfshsdd.exe 224 hshkjfshsdd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/4320-21-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4320-20-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4320-24-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4320-19-0x0000000000400000-0x0000000000541000-memory.dmp upx behavioral2/memory/4320-16-0x0000000000400000-0x0000000000541000-memory.dmp upx -
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
Processes:
hshkjfshsdd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
hshkjfshsdd.exedescription pid process target process PID 3524 set thread context of 4320 3524 hshkjfshsdd.exe hshkjfshsdd.exe -
NTFS ADS 1 IoCs
Processes:
notepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\appdata\hshkjfshsdd.exe:ZoneIdentifier notepad.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
hshkjfshsdd.exepid process 4320 hshkjfshsdd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9f9983a3e4730756e3879ef7cc39efc9_JaffaCakes118.exehshkjfshsdd.exehshkjfshsdd.exepid process 4388 9f9983a3e4730756e3879ef7cc39efc9_JaffaCakes118.exe 4388 9f9983a3e4730756e3879ef7cc39efc9_JaffaCakes118.exe 3524 hshkjfshsdd.exe 3524 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe 224 hshkjfshsdd.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
hshkjfshsdd.exepid process 3524 hshkjfshsdd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
hshkjfshsdd.exedescription pid process Token: SeDebugPrivilege 4320 hshkjfshsdd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
hshkjfshsdd.exepid process 4320 hshkjfshsdd.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
9f9983a3e4730756e3879ef7cc39efc9_JaffaCakes118.exenotepad.exehshkjfshsdd.exedescription pid process target process PID 4388 wrote to memory of 2916 4388 9f9983a3e4730756e3879ef7cc39efc9_JaffaCakes118.exe notepad.exe PID 4388 wrote to memory of 2916 4388 9f9983a3e4730756e3879ef7cc39efc9_JaffaCakes118.exe notepad.exe PID 4388 wrote to memory of 2916 4388 9f9983a3e4730756e3879ef7cc39efc9_JaffaCakes118.exe notepad.exe PID 4388 wrote to memory of 2916 4388 9f9983a3e4730756e3879ef7cc39efc9_JaffaCakes118.exe notepad.exe PID 4388 wrote to memory of 2916 4388 9f9983a3e4730756e3879ef7cc39efc9_JaffaCakes118.exe notepad.exe PID 2916 wrote to memory of 3524 2916 notepad.exe hshkjfshsdd.exe PID 2916 wrote to memory of 3524 2916 notepad.exe hshkjfshsdd.exe PID 2916 wrote to memory of 3524 2916 notepad.exe hshkjfshsdd.exe PID 3524 wrote to memory of 4320 3524 hshkjfshsdd.exe hshkjfshsdd.exe PID 3524 wrote to memory of 4320 3524 hshkjfshsdd.exe hshkjfshsdd.exe PID 3524 wrote to memory of 4320 3524 hshkjfshsdd.exe hshkjfshsdd.exe PID 3524 wrote to memory of 224 3524 hshkjfshsdd.exe hshkjfshsdd.exe PID 3524 wrote to memory of 224 3524 hshkjfshsdd.exe hshkjfshsdd.exe PID 3524 wrote to memory of 224 3524 hshkjfshsdd.exe hshkjfshsdd.exe -
outlook_office_path 1 IoCs
Processes:
hshkjfshsdd.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe -
outlook_win_path 1 IoCs
Processes:
hshkjfshsdd.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 hshkjfshsdd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f9983a3e4730756e3879ef7cc39efc9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9f9983a3e4730756e3879ef7cc39efc9_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Drops startup file
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\appdata\hshkjfshsdd.exe"C:\Users\Admin\AppData\Roaming\appdata\hshkjfshsdd.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\appdata\hshkjfshsdd.exe"C:\Users\Admin\AppData\Roaming\appdata\hshkjfshsdd.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Roaming\appdata\hshkjfshsdd.exe"C:\Users\Admin\AppData\Roaming\appdata\hshkjfshsdd.exe" 2 4320 2406029214⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\appdata\hshkjfshsdd.exeFilesize
969KB
MD59f9983a3e4730756e3879ef7cc39efc9
SHA1c93f02b1fda92d4a4fda842714bc61745527946e
SHA2568d9935cd8f8d2e5f305b229f6992fbee9e4b5c4e6063568c5e150f51fa0f91b1
SHA512cd291bf33e70177384b6bdbde469011b5f149fb4740c684d4d638694e9146ea00da24c173bb597a721597444325213a6b434a511d2fbe7edc9a0e65ec153e381
-
memory/224-47-0x0000000000400000-0x00000000004F9000-memory.dmpFilesize
996KB
-
memory/2916-5-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/3524-36-0x0000000000400000-0x00000000004F9000-memory.dmpFilesize
996KB
-
memory/3524-15-0x0000000002350000-0x0000000002351000-memory.dmpFilesize
4KB
-
memory/3524-12-0x0000000002050000-0x0000000002051000-memory.dmpFilesize
4KB
-
memory/4320-22-0x0000000000AA0000-0x0000000000B3A000-memory.dmpFilesize
616KB
-
memory/4320-38-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/4320-51-0x0000000006A00000-0x0000000006A14000-memory.dmpFilesize
80KB
-
memory/4320-21-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/4320-20-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/4320-24-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/4320-23-0x0000000000AA0000-0x0000000000B3A000-memory.dmpFilesize
616KB
-
memory/4320-19-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/4320-50-0x0000000007850000-0x00000000078A0000-memory.dmpFilesize
320KB
-
memory/4320-16-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/4320-37-0x0000000000400000-0x0000000000541000-memory.dmpFilesize
1.3MB
-
memory/4320-48-0x0000000006980000-0x000000000698A000-memory.dmpFilesize
40KB
-
memory/4320-45-0x0000000005460000-0x00000000054F2000-memory.dmpFilesize
584KB
-
memory/4320-39-0x0000000004C30000-0x00000000051D4000-memory.dmpFilesize
5.6MB
-
memory/4320-40-0x0000000004B70000-0x0000000004C0C000-memory.dmpFilesize
624KB
-
memory/4320-41-0x0000000005200000-0x0000000005244000-memory.dmpFilesize
272KB
-
memory/4320-42-0x0000000005280000-0x00000000052E6000-memory.dmpFilesize
408KB
-
memory/4388-3-0x0000000003E50000-0x0000000003E51000-memory.dmpFilesize
4KB
-
memory/4388-2-0x00000000022B0000-0x00000000022C3000-memory.dmpFilesize
76KB
-
memory/4388-4-0x0000000000400000-0x00000000004F9000-memory.dmpFilesize
996KB
-
memory/4388-0-0x0000000002260000-0x0000000002261000-memory.dmpFilesize
4KB
-
memory/4388-1-0x00000000022B0000-0x00000000022C3000-memory.dmpFilesize
76KB