Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
28-06-2024 09:05
General
-
Target
198f70778fc90d30c76ad77aa57b8ecf_JaffaCakes118.exe
-
Size
220KB
-
MD5
198f70778fc90d30c76ad77aa57b8ecf
-
SHA1
e9982939c6dfa9d6e678545b7cbc99f0beb1a500
-
SHA256
91f51fb241524ca3ce85cba6d2e0321570ccbf230f7d562f6dfaba6bf8726acc
-
SHA512
ff81f2f4900b6245a25f7559f3bf1dc44950eff6218f334ead65da00f8f0863f479c4750c296fdbcef3a62e5dba93a07ea2881700323733f6b277f3caf226ab1
-
SSDEEP
3072:lPCdrA1LiPFD7iObvHAt+hlXjNEE6q08ATl6zp1VsZVfh71x6HpuM575:lErAmF3fVZKTQ17YVfrEHpuq
Score
10/10
Malware Config
Extracted
Family
metasploit
Version
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 58 IoCs
-
Loads dropped DLL 64 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Maps connected drives based on registry 3 TTPs 60 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 64 IoCs
-
Suspicious use of SetThreadContext 30 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 59 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\198f70778fc90d30c76ad77aa57b8ecf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\198f70778fc90d30c76ad77aa57b8ecf_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\198f70778fc90d30c76ad77aa57b8ecf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\198f70778fc90d30c76ad77aa57b8ecf_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Users\Admin\AppData\Local\Temp\198F70~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Users\Admin\AppData\Local\Temp\198F70~1.EXE4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE8⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE10⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE12⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE14⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE16⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE18⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE20⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE22⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE24⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE26⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE28⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE30⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE32⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE33⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE34⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE36⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE38⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE40⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE42⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE44⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE46⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE48⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE50⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE52⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE54⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE56⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE58⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE60⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Windows\SysWOW64\intelgfx32.exeFilesize
220KB
MD5198f70778fc90d30c76ad77aa57b8ecf
SHA1e9982939c6dfa9d6e678545b7cbc99f0beb1a500
SHA25691f51fb241524ca3ce85cba6d2e0321570ccbf230f7d562f6dfaba6bf8726acc
SHA512ff81f2f4900b6245a25f7559f3bf1dc44950eff6218f334ead65da00f8f0863f479c4750c296fdbcef3a62e5dba93a07ea2881700323733f6b277f3caf226ab1
-
memory/316-98-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/316-92-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/316-93-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/316-91-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/568-296-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/568-299-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/880-451-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/896-377-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/896-374-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1092-150-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1092-156-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1116-195-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1116-189-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1344-351-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1344-348-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1420-234-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1420-231-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1536-441-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1536-438-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1584-205-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1584-208-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1668-117-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1668-110-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1668-112-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1668-111-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1704-338-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1704-335-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1712-412-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1712-415-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1780-260-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1780-256-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2228-3-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2228-4-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2228-9-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2228-0-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2228-22-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2228-7-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2228-2-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2228-8-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2312-72-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2312-74-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2312-80-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2312-73-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2324-169-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2324-176-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2504-33-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2504-36-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2504-35-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2504-34-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2504-41-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2528-61-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2528-55-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2692-389-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2700-221-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2700-218-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2712-425-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2712-428-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2740-325-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2740-321-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2776-247-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2776-244-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2788-399-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2788-402-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2820-286-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2820-283-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2912-312-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2912-309-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2924-131-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2924-137-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2952-364-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2952-361-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2968-273-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2968-269-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB