Analysis
-
max time kernel
143s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 02:01
Static task
static1
Behavioral task
behavioral1
Sample
01e08124e97858a044f7be04467118fb_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
01e08124e97858a044f7be04467118fb_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
01e08124e97858a044f7be04467118fb_JaffaCakes118.exe
-
Size
710KB
-
MD5
01e08124e97858a044f7be04467118fb
-
SHA1
525c2206e9ccbc69f33e219852268ed0a89df020
-
SHA256
e1045ae27e2cecf73c60f452c047a6a991974dc8cd9e1312c6fced78f27e3499
-
SHA512
d575d0828b7c8d6bc7220c687d655dbf0e95ad2f2251901533f366d2b9381d467c326683e2fc9de90bfb1d80b83a2ed6e6a0da52247d3a4549771b00fcb9b463
-
SSDEEP
12288:BNnhEXReigHdYA0mApYc9eH9i3zoDFmujec1ZF3Z4mxxFhsV4AOwf7DGj7Xzs:BNnhEXDAnkL94yzC9egZQmXzYtfujE
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\IXP000.TMP\SaveFile.exe modiloader_stage2 C:\Temp\5.exe modiloader_stage2 behavioral1/memory/2732-90-0x0000000000400000-0x00000000004C6000-memory.dmp modiloader_stage2 -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
Processes:
SaveFile.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVXP.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\katmain.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscntfy.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvMonXP.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\katmain.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscntfy.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavmonD.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmon.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe\debugger = "IFEOFILE" SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavmonD.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvMonXP.exe\debugger = "IFEOFILE" SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe SaveFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe SaveFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmon.exe\debugger = "IFEOFILE" SaveFile.exe -
Executes dropped EXE 2 IoCs
Processes:
SaveFile.exe5.exepid process 2580 SaveFile.exe 2732 5.exe -
Loads dropped DLL 7 IoCs
Processes:
01e08124e97858a044f7be04467118fb_JaffaCakes118.exeSaveFile.exeWerFault.exepid process 2216 01e08124e97858a044f7be04467118fb_JaffaCakes118.exe 2216 01e08124e97858a044f7be04467118fb_JaffaCakes118.exe 2580 SaveFile.exe 2580 SaveFile.exe 2600 WerFault.exe 2600 WerFault.exe 2600 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
01e08124e97858a044f7be04467118fb_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 01e08124e97858a044f7be04467118fb_JaffaCakes118.exe -
Drops file in Program Files directory 1 IoCs
Processes:
5.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\MSINFO\FieleWay.txt 5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process 2600 2732 WerFault.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
SaveFile.exepid process 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe 2580 SaveFile.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SaveFile.exedescription pid process Token: SeDebugPrivilege 2580 SaveFile.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
SaveFile.exepid process 2580 SaveFile.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
01e08124e97858a044f7be04467118fb_JaffaCakes118.exeSaveFile.exe5.exedescription pid process target process PID 2216 wrote to memory of 2580 2216 01e08124e97858a044f7be04467118fb_JaffaCakes118.exe SaveFile.exe PID 2216 wrote to memory of 2580 2216 01e08124e97858a044f7be04467118fb_JaffaCakes118.exe SaveFile.exe PID 2216 wrote to memory of 2580 2216 01e08124e97858a044f7be04467118fb_JaffaCakes118.exe SaveFile.exe PID 2216 wrote to memory of 2580 2216 01e08124e97858a044f7be04467118fb_JaffaCakes118.exe SaveFile.exe PID 2580 wrote to memory of 2732 2580 SaveFile.exe 5.exe PID 2580 wrote to memory of 2732 2580 SaveFile.exe 5.exe PID 2580 wrote to memory of 2732 2580 SaveFile.exe 5.exe PID 2580 wrote to memory of 2732 2580 SaveFile.exe 5.exe PID 2732 wrote to memory of 2600 2732 5.exe WerFault.exe PID 2732 wrote to memory of 2600 2732 5.exe WerFault.exe PID 2732 wrote to memory of 2600 2732 5.exe WerFault.exe PID 2732 wrote to memory of 2600 2732 5.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\01e08124e97858a044f7be04467118fb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\01e08124e97858a044f7be04467118fb_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SaveFile.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SaveFile.exe2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Temp\5.exe"C:\Temp\5.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 2924⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Event Triggered Execution
1Image File Execution Options Injection
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Temp\5.exeFilesize
752KB
MD5330549ac67e34581e39c2c6d72e2ed86
SHA1ce835896e5d0fbba8940faff0f66708c2da5b858
SHA256f322a69361a7d3bbf49afa46ce317f6c2cee8c0d07aa8fd83ed9abc80969a4e9
SHA51264ff1eed562decdeaa69babec11bf955664b76d28a013ddef083d021c5ba4fa869fc5d3ba548b15a774b9fa77f49c3ca6afc80a40d876a1089447a27322b1fc4
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\SaveFile.exeFilesize
780KB
MD5685552f9a515aaa0868396b967ac9226
SHA1e9d3049ccd0d9b5aab2fe85c9391fed6cd1d3d07
SHA25651ac9cd1ee309e003c60829239357891ffd0cebc95bdff5644c3b14de3de27ad
SHA5127176b7f3dde3162ccf6916227cff0421332040619c28cfea29fc80c14a1d34916859a3e60a0047d08d5eae4fd80e47c0d3d9026a4a4c13f215782326b63135b1
-
memory/2216-0-0x0000000001000000-0x000000000111E000-memory.dmpFilesize
1.1MB
-
memory/2216-1-0x00000000001C0000-0x0000000000214000-memory.dmpFilesize
336KB
-
memory/2216-9-0x0000000003180000-0x0000000003181000-memory.dmpFilesize
4KB
-
memory/2216-8-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/2216-7-0x0000000000310000-0x0000000000311000-memory.dmpFilesize
4KB
-
memory/2216-6-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2216-5-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2216-4-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/2216-3-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/2216-2-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/2216-22-0x0000000000CF0000-0x0000000000CF1000-memory.dmpFilesize
4KB
-
memory/2216-44-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-43-0x0000000003180000-0x0000000003181000-memory.dmpFilesize
4KB
-
memory/2216-56-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-55-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-61-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-60-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-59-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-58-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-57-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-54-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-53-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-52-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-51-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-50-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-49-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-48-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-47-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-46-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-45-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-42-0x0000000003180000-0x0000000003181000-memory.dmpFilesize
4KB
-
memory/2216-41-0x0000000003180000-0x0000000003181000-memory.dmpFilesize
4KB
-
memory/2216-40-0x0000000003180000-0x0000000003181000-memory.dmpFilesize
4KB
-
memory/2216-39-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/2216-38-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-37-0x0000000003180000-0x0000000003181000-memory.dmpFilesize
4KB
-
memory/2216-36-0x0000000003180000-0x0000000003181000-memory.dmpFilesize
4KB
-
memory/2216-35-0x0000000000D80000-0x0000000000D81000-memory.dmpFilesize
4KB
-
memory/2216-34-0x0000000000D90000-0x0000000000D91000-memory.dmpFilesize
4KB
-
memory/2216-33-0x0000000000D20000-0x0000000000D21000-memory.dmpFilesize
4KB
-
memory/2216-32-0x0000000000D30000-0x0000000000D31000-memory.dmpFilesize
4KB
-
memory/2216-31-0x0000000000D50000-0x0000000000D51000-memory.dmpFilesize
4KB
-
memory/2216-30-0x0000000000D70000-0x0000000000D71000-memory.dmpFilesize
4KB
-
memory/2216-29-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-28-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/2216-27-0x0000000000D00000-0x0000000000D01000-memory.dmpFilesize
4KB
-
memory/2216-26-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2216-25-0x00000000008F0000-0x00000000008F1000-memory.dmpFilesize
4KB
-
memory/2216-24-0x0000000000350000-0x0000000000351000-memory.dmpFilesize
4KB
-
memory/2216-23-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB
-
memory/2216-21-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/2216-20-0x0000000003180000-0x0000000003181000-memory.dmpFilesize
4KB
-
memory/2216-19-0x0000000003180000-0x0000000003181000-memory.dmpFilesize
4KB
-
memory/2216-18-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-17-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-16-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/2216-15-0x0000000003180000-0x0000000003181000-memory.dmpFilesize
4KB
-
memory/2216-14-0x0000000003180000-0x0000000003181000-memory.dmpFilesize
4KB
-
memory/2216-13-0x0000000003180000-0x0000000003181000-memory.dmpFilesize
4KB
-
memory/2216-12-0x0000000003180000-0x0000000003181000-memory.dmpFilesize
4KB
-
memory/2216-11-0x0000000003180000-0x0000000003181000-memory.dmpFilesize
4KB
-
memory/2216-85-0x00000000001C0000-0x0000000000214000-memory.dmpFilesize
336KB
-
memory/2216-84-0x0000000001000000-0x000000000111E000-memory.dmpFilesize
1.1MB
-
memory/2216-10-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/2732-90-0x0000000000400000-0x00000000004C6000-memory.dmpFilesize
792KB