Analysis
-
max time kernel
125s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 11:59
Static task
static1
Behavioral task
behavioral1
Sample
1a07df94b15350a6f819781c0a8ea4ad_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1a07df94b15350a6f819781c0a8ea4ad_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
1a07df94b15350a6f819781c0a8ea4ad_JaffaCakes118.exe
-
Size
682KB
-
MD5
1a07df94b15350a6f819781c0a8ea4ad
-
SHA1
66a5a27c556c4fc96abbb6875e26803a2ac19941
-
SHA256
5b7ec1fb9370aa03341d9038a277b91f59397d82653c6a86196ef0bb8f27385c
-
SHA512
d6096c051c0cb66f31761a5294bee47356bc6e0b629edf4aeef952e898861ba24322d9eb1f34935ca8b74496910fd180d082516e38d5c7cfaabb000f8cc4e6f1
-
SSDEEP
12288:givphvb0GylW733zig49ICSoQqMe82FANisxF3Z4mxxxDqVTVOC+:giHAGUyPaIrWMe82WdQmX4VTz+
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe modiloader_stage2 behavioral2/memory/5108-95-0x00000000000C0000-0x0000000000178000-memory.dmp modiloader_stage2 behavioral2/memory/3936-96-0x0000000000400000-0x00000000004B8000-memory.dmp modiloader_stage2 -
Executes dropped EXE 1 IoCs
Processes:
2.exepid process 3936 2.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1a07df94b15350a6f819781c0a8ea4ad_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1a07df94b15350a6f819781c0a8ea4ad_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2.exedescription pid process target process PID 3936 set thread context of 5108 3936 2.exe IEXPLORE.EXE -
Drops file in Windows directory 1 IoCs
Processes:
2.exedescription ioc process File created C:\Windows\FieleWay.txt 2.exe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2790155762" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2797030689" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D168E070-3545-11EF-B8C0-DAD58692AE8D} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2797030689" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115602" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426340920" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115602" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115602" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2790155762" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115602" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 5108 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 5108 IEXPLORE.EXE 5108 IEXPLORE.EXE 1516 IEXPLORE.EXE 1516 IEXPLORE.EXE 1516 IEXPLORE.EXE 1516 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
1a07df94b15350a6f819781c0a8ea4ad_JaffaCakes118.exe2.exeIEXPLORE.EXEdescription pid process target process PID 228 wrote to memory of 3936 228 1a07df94b15350a6f819781c0a8ea4ad_JaffaCakes118.exe 2.exe PID 228 wrote to memory of 3936 228 1a07df94b15350a6f819781c0a8ea4ad_JaffaCakes118.exe 2.exe PID 228 wrote to memory of 3936 228 1a07df94b15350a6f819781c0a8ea4ad_JaffaCakes118.exe 2.exe PID 3936 wrote to memory of 5108 3936 2.exe IEXPLORE.EXE PID 3936 wrote to memory of 5108 3936 2.exe IEXPLORE.EXE PID 3936 wrote to memory of 5108 3936 2.exe IEXPLORE.EXE PID 5108 wrote to memory of 1516 5108 IEXPLORE.EXE IEXPLORE.EXE PID 5108 wrote to memory of 1516 5108 IEXPLORE.EXE IEXPLORE.EXE PID 5108 wrote to memory of 1516 5108 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a07df94b15350a6f819781c0a8ea4ad_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a07df94b15350a6f819781c0a8ea4ad_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\program files\internet explorer\IEXPLORE.EXE"C:\program files\internet explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5108 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3960,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5293ea21f7d2b09f447f07d065dd542b9
SHA15d30d1d814dab60840b66cb9ee7dd8ceea05df70
SHA2562203bb67fc1d126a35d05b53e3b9c39acf5a06b6f2d792099460e8caa83f2a32
SHA5127d5ff3768b8ab54f4186a325ac433eb4a1f3dfabb30d641a0a1d6b9f2f24c5dd83cc5d05c13477cab16c5644d39e45ae991d75a1ddb7c79b76e562b4f2eb2898
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD55870076ae92a2e6f7e1af9df16cc0a6b
SHA17b1126079dc9fa21070c22dcdf3d8fc29b97d74f
SHA2562fa0f62c976a6d425867acce92c34f4a0f62281cb9af9a2394e2576db467664a
SHA512b75a2312c5641090a394032f874ddd7a8da887684abc74703dcd27bfb84be59ddba0b70ba6039f7e1fa3c4e837517912c0cb85702e104a7dc92de53288e3f243
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver6397.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\44ZGVQ6R\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2.exeFilesize
710KB
MD55061d3bf6afd495e5c21947fb00825a3
SHA1f57aa6d929d8fc997560e7e5645364048ba66298
SHA256dc350c47344645f8ac829338a5d5474599e537f140dc32c3d9c58f0405c2c2de
SHA512a16a478405611bf0cf64eadd94624c94308964df3cd467dcd256a25bb1d908a16b2cf37050c2bbb837d4fbf793907d09e1fd0a865a6dd3ae037d21564fcdc7ff
-
memory/228-48-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-71-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-99-0x0000000000530000-0x0000000000584000-memory.dmpFilesize
336KB
-
memory/228-98-0x0000000001000000-0x000000000110D000-memory.dmpFilesize
1.1MB
-
memory/228-87-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-86-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-85-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-84-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-83-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-82-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-81-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-80-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-79-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-78-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-77-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-76-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-75-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-74-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-73-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-72-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-44-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-70-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-69-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-68-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-67-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-66-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-65-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-64-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-63-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-62-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-45-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-60-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-59-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-58-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-57-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-56-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-55-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-54-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-53-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-52-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-51-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-50-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-49-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-9-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-47-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-46-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-61-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-88-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-40-0x0000000000CD0000-0x0000000000CD1000-memory.dmpFilesize
4KB
-
memory/228-42-0x0000000000CA0000-0x0000000000CA1000-memory.dmpFilesize
4KB
-
memory/228-41-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/228-43-0x0000000000D10000-0x0000000000D11000-memory.dmpFilesize
4KB
-
memory/228-39-0x0000000000D00000-0x0000000000D01000-memory.dmpFilesize
4KB
-
memory/228-38-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-37-0x0000000000C10000-0x0000000000C11000-memory.dmpFilesize
4KB
-
memory/228-36-0x0000000000C80000-0x0000000000C81000-memory.dmpFilesize
4KB
-
memory/228-35-0x0000000000C50000-0x0000000000C51000-memory.dmpFilesize
4KB
-
memory/228-34-0x0000000000C60000-0x0000000000C61000-memory.dmpFilesize
4KB
-
memory/228-33-0x0000000000BF0000-0x0000000000BF1000-memory.dmpFilesize
4KB
-
memory/228-32-0x0000000000C00000-0x0000000000C01000-memory.dmpFilesize
4KB
-
memory/228-31-0x0000000000C70000-0x0000000000C71000-memory.dmpFilesize
4KB
-
memory/228-30-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/228-29-0x0000000000C40000-0x0000000000C41000-memory.dmpFilesize
4KB
-
memory/228-28-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-27-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-26-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-25-0x0000000003100000-0x0000000003101000-memory.dmpFilesize
4KB
-
memory/228-24-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-23-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-22-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-21-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-20-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-19-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-18-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-17-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-16-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-15-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/228-14-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-13-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-12-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-11-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-10-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/228-8-0x0000000000BA0000-0x0000000000BA1000-memory.dmpFilesize
4KB
-
memory/228-7-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/228-6-0x0000000000510000-0x0000000000511000-memory.dmpFilesize
4KB
-
memory/228-5-0x0000000000520000-0x0000000000521000-memory.dmpFilesize
4KB
-
memory/228-4-0x0000000000BC0000-0x0000000000BC1000-memory.dmpFilesize
4KB
-
memory/228-1-0x0000000000530000-0x0000000000584000-memory.dmpFilesize
336KB
-
memory/228-0-0x0000000001000000-0x000000000110D000-memory.dmpFilesize
1.1MB
-
memory/228-3-0x00000000005A0000-0x00000000005A1000-memory.dmpFilesize
4KB
-
memory/228-2-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/3936-96-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/5108-95-0x00000000000C0000-0x0000000000178000-memory.dmpFilesize
736KB