Analysis
-
max time kernel
133s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 12:50
Static task
static1
Behavioral task
behavioral1
Sample
1a2ed9d7af030d031d31b5f8f0f6b9e3_JaffaCakes118.dll
Resource
win7-20240611-en
General
-
Target
1a2ed9d7af030d031d31b5f8f0f6b9e3_JaffaCakes118.dll
-
Size
166KB
-
MD5
1a2ed9d7af030d031d31b5f8f0f6b9e3
-
SHA1
50719a20b13ed790c8c3078661c986a0904f9cda
-
SHA256
1c704dd9911e951ff3dc85c249908e2cac465f5a06d706607e33b3d1b56c7d87
-
SHA512
64a82741af0086e71895ae1c44e3b5d2ac277d7d0622562969662ec2bab264f8b957e4711866445d22af7a73a5860707a7d22be5139aee22b5d97808f153e609
-
SSDEEP
3072:OTU56gVxj27NevROEuPvisOpkTv7L2GQ6uWr:l4wRj+qYvW4uWr
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 5080 regsvr32mgr.exe 1392 WaterMark.exe -
Processes:
resource yara_rule behavioral2/memory/5080-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/5080-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/5080-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/5080-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1392-24-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/5080-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/5080-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/5080-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1392-32-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1392-31-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1392-39-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
Processes:
regsvr32.exedescription ioc process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe -
Drops file in Program Files directory 3 IoCs
Processes:
regsvr32mgr.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px3B15.tmp regsvr32mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe regsvr32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe regsvr32mgr.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3056 1976 WerFault.exe svchost.exe -
Processes:
IEXPLORE.EXEiexplore.exeiexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115609" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115609" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3537050448" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426344002" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FE77DE11-354C-11EF-8383-5AE3054E25D0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115609" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FE757BAA-354C-11EF-8383-5AE3054E25D0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3537050448" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115609" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3539395051" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3537050448" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115609" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3537206958" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3539395051" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115609" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
WaterMark.exepid process 1392 WaterMark.exe 1392 WaterMark.exe 1392 WaterMark.exe 1392 WaterMark.exe 1392 WaterMark.exe 1392 WaterMark.exe 1392 WaterMark.exe 1392 WaterMark.exe 1392 WaterMark.exe 1392 WaterMark.exe 1392 WaterMark.exe 1392 WaterMark.exe 1392 WaterMark.exe 1392 WaterMark.exe 1392 WaterMark.exe 1392 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WaterMark.exedescription pid process Token: SeDebugPrivilege 1392 WaterMark.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 1464 iexplore.exe 3076 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 1464 iexplore.exe 1464 iexplore.exe 3076 iexplore.exe 3076 iexplore.exe 1648 IEXPLORE.EXE 1648 IEXPLORE.EXE 2356 IEXPLORE.EXE 2356 IEXPLORE.EXE 1648 IEXPLORE.EXE 1648 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 5080 regsvr32mgr.exe 1392 WaterMark.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32mgr.exeWaterMark.exeiexplore.exeiexplore.exedescription pid process target process PID 432 wrote to memory of 4628 432 regsvr32.exe regsvr32.exe PID 432 wrote to memory of 4628 432 regsvr32.exe regsvr32.exe PID 432 wrote to memory of 4628 432 regsvr32.exe regsvr32.exe PID 4628 wrote to memory of 5080 4628 regsvr32.exe regsvr32mgr.exe PID 4628 wrote to memory of 5080 4628 regsvr32.exe regsvr32mgr.exe PID 4628 wrote to memory of 5080 4628 regsvr32.exe regsvr32mgr.exe PID 5080 wrote to memory of 1392 5080 regsvr32mgr.exe WaterMark.exe PID 5080 wrote to memory of 1392 5080 regsvr32mgr.exe WaterMark.exe PID 5080 wrote to memory of 1392 5080 regsvr32mgr.exe WaterMark.exe PID 1392 wrote to memory of 1976 1392 WaterMark.exe svchost.exe PID 1392 wrote to memory of 1976 1392 WaterMark.exe svchost.exe PID 1392 wrote to memory of 1976 1392 WaterMark.exe svchost.exe PID 1392 wrote to memory of 1976 1392 WaterMark.exe svchost.exe PID 1392 wrote to memory of 1976 1392 WaterMark.exe svchost.exe PID 1392 wrote to memory of 1976 1392 WaterMark.exe svchost.exe PID 1392 wrote to memory of 1976 1392 WaterMark.exe svchost.exe PID 1392 wrote to memory of 1976 1392 WaterMark.exe svchost.exe PID 1392 wrote to memory of 1976 1392 WaterMark.exe svchost.exe PID 1392 wrote to memory of 1464 1392 WaterMark.exe iexplore.exe PID 1392 wrote to memory of 1464 1392 WaterMark.exe iexplore.exe PID 1392 wrote to memory of 3076 1392 WaterMark.exe iexplore.exe PID 1392 wrote to memory of 3076 1392 WaterMark.exe iexplore.exe PID 3076 wrote to memory of 2356 3076 iexplore.exe IEXPLORE.EXE PID 3076 wrote to memory of 2356 3076 iexplore.exe IEXPLORE.EXE PID 3076 wrote to memory of 2356 3076 iexplore.exe IEXPLORE.EXE PID 1464 wrote to memory of 1648 1464 iexplore.exe IEXPLORE.EXE PID 1464 wrote to memory of 1648 1464 iexplore.exe IEXPLORE.EXE PID 1464 wrote to memory of 1648 1464 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1a2ed9d7af030d031d31b5f8f0f6b9e3_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1a2ed9d7af030d031d31b5f8f0f6b9e3_JaffaCakes118.dll2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 2046⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1464 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3076 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1976 -ip 19761⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FE757BAA-354C-11EF-8383-5AE3054E25D0}.datFilesize
5KB
MD579f6d427a267e6a93f63e5bf3fbc55e5
SHA1d5685bfb51ecf23920a4c0d332bd1adcc315f853
SHA2564139949922cb99783e257c55638f19fbda170e5e0b45771f1cee1288462ba4d4
SHA512ee0665530bb320de4baed9564ac28de2de65ea93f4a907189084032faf0784ef8b6d7856fd8344f6df163a87b3afa33051df687f0249796e964ae81b20d620f2
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FE77DE11-354C-11EF-8383-5AE3054E25D0}.datFilesize
3KB
MD5e1fdadc3832e91d5c225dafa4888b176
SHA1cd265f1e5cd0e34ae8aeb48a9be47abb53ea3d61
SHA25604ea715633f2497c1d5266e501db2111dc4c7a49445d376302653977d1f147f7
SHA5125ec5aaf4036d6436a733982b8b41e646bd71de939ba01677bb0270eb38412b8ae051523b0f8856f1ee0b23c16e870c7898f8d67f67e4c1fdd467dcd450b63e4f
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verBD55.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Windows\SysWOW64\regsvr32mgr.exeFilesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
memory/1392-35-0x0000000076F92000-0x0000000076F93000-memory.dmpFilesize
4KB
-
memory/1392-31-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1392-39-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1392-24-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1392-36-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/1392-28-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/1392-29-0x0000000076F92000-0x0000000076F93000-memory.dmpFilesize
4KB
-
memory/1392-32-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1976-33-0x0000000000820000-0x0000000000821000-memory.dmpFilesize
4KB
-
memory/1976-34-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB
-
memory/4628-1-0x0000000074940000-0x000000007496C000-memory.dmpFilesize
176KB
-
memory/5080-6-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/5080-7-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/5080-11-0x00000000008B0000-0x00000000008B1000-memory.dmpFilesize
4KB
-
memory/5080-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/5080-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/5080-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/5080-10-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/5080-8-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/5080-4-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB