Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 12:20
Static task
static1
Behavioral task
behavioral1
Sample
1b47a070106c88c4b0c2e0901d989e3c_JaffaCakes118.dll
Resource
win7-20240611-en
General
-
Target
1b47a070106c88c4b0c2e0901d989e3c_JaffaCakes118.dll
-
Size
120KB
-
MD5
1b47a070106c88c4b0c2e0901d989e3c
-
SHA1
3bb007059cca038e9266e5e08ff1711e981feccd
-
SHA256
d6585dcf190836833364f87f6a154e32def70e5cbe26f6910166851c35987a34
-
SHA512
6189ab8671e7545696bbed09d1e8611e4e1af9154e6feddc36c4963b29095b2b0417aecb7b096c46f60f37cba5a5bfeb7bf5690db5ad0ecf080c0e9a8cd83fdd
-
SSDEEP
3072:dFGPNfa6dSDHuFg3x9j2vNx4yhlo3clk21SwKzRMR:d+9+60yBZ1Sw
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
Processes:
f76193b.exef7634d6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76193b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76193b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76193b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7634d6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7634d6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7634d6.exe -
Processes:
f76193b.exef7634d6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76193b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7634d6.exe -
Processes:
f76193b.exef7634d6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76193b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76193b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7634d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7634d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7634d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76193b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76193b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76193b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76193b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7634d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7634d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7634d6.exe -
Executes dropped EXE 3 IoCs
Processes:
f76193b.exef761b4e.exef7634d6.exepid process 2996 f76193b.exe 2576 f761b4e.exe 2668 f7634d6.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe 1904 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2996-15-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-18-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-16-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-22-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-20-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-19-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-64-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-17-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-23-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-14-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-21-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-65-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-66-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-68-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-67-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-70-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-71-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-84-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-85-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-88-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-89-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-129-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2996-155-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2668-168-0x0000000000930000-0x00000000019EA000-memory.dmp upx behavioral1/memory/2668-207-0x0000000000930000-0x00000000019EA000-memory.dmp upx -
Processes:
f7634d6.exef76193b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7634d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7634d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7634d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76193b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76193b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7634d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7634d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76193b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76193b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76193b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76193b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76193b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7634d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7634d6.exe -
Processes:
f7634d6.exef76193b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7634d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76193b.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f76193b.exef7634d6.exedescription ioc process File opened (read-only) \??\K: f76193b.exe File opened (read-only) \??\P: f76193b.exe File opened (read-only) \??\S: f76193b.exe File opened (read-only) \??\H: f76193b.exe File opened (read-only) \??\E: f7634d6.exe File opened (read-only) \??\T: f76193b.exe File opened (read-only) \??\G: f76193b.exe File opened (read-only) \??\I: f76193b.exe File opened (read-only) \??\J: f76193b.exe File opened (read-only) \??\L: f76193b.exe File opened (read-only) \??\R: f76193b.exe File opened (read-only) \??\E: f76193b.exe File opened (read-only) \??\M: f76193b.exe File opened (read-only) \??\N: f76193b.exe File opened (read-only) \??\O: f76193b.exe File opened (read-only) \??\Q: f76193b.exe -
Drops file in Windows directory 3 IoCs
Processes:
f76193b.exef7634d6.exedescription ioc process File created C:\Windows\f7619a8 f76193b.exe File opened for modification C:\Windows\SYSTEM.INI f76193b.exe File created C:\Windows\f766b03 f7634d6.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
f76193b.exef7634d6.exepid process 2996 f76193b.exe 2996 f76193b.exe 2668 f7634d6.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
f76193b.exef7634d6.exedescription pid process Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2996 f76193b.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe Token: SeDebugPrivilege 2668 f7634d6.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exef76193b.exef7634d6.exedescription pid process target process PID 2540 wrote to memory of 1904 2540 rundll32.exe rundll32.exe PID 2540 wrote to memory of 1904 2540 rundll32.exe rundll32.exe PID 2540 wrote to memory of 1904 2540 rundll32.exe rundll32.exe PID 2540 wrote to memory of 1904 2540 rundll32.exe rundll32.exe PID 2540 wrote to memory of 1904 2540 rundll32.exe rundll32.exe PID 2540 wrote to memory of 1904 2540 rundll32.exe rundll32.exe PID 2540 wrote to memory of 1904 2540 rundll32.exe rundll32.exe PID 1904 wrote to memory of 2996 1904 rundll32.exe f76193b.exe PID 1904 wrote to memory of 2996 1904 rundll32.exe f76193b.exe PID 1904 wrote to memory of 2996 1904 rundll32.exe f76193b.exe PID 1904 wrote to memory of 2996 1904 rundll32.exe f76193b.exe PID 2996 wrote to memory of 1264 2996 f76193b.exe taskhost.exe PID 2996 wrote to memory of 1340 2996 f76193b.exe Dwm.exe PID 2996 wrote to memory of 1368 2996 f76193b.exe Explorer.EXE PID 2996 wrote to memory of 1764 2996 f76193b.exe DllHost.exe PID 2996 wrote to memory of 2540 2996 f76193b.exe rundll32.exe PID 2996 wrote to memory of 1904 2996 f76193b.exe rundll32.exe PID 2996 wrote to memory of 1904 2996 f76193b.exe rundll32.exe PID 1904 wrote to memory of 2576 1904 rundll32.exe f761b4e.exe PID 1904 wrote to memory of 2576 1904 rundll32.exe f761b4e.exe PID 1904 wrote to memory of 2576 1904 rundll32.exe f761b4e.exe PID 1904 wrote to memory of 2576 1904 rundll32.exe f761b4e.exe PID 1904 wrote to memory of 2668 1904 rundll32.exe f7634d6.exe PID 1904 wrote to memory of 2668 1904 rundll32.exe f7634d6.exe PID 1904 wrote to memory of 2668 1904 rundll32.exe f7634d6.exe PID 1904 wrote to memory of 2668 1904 rundll32.exe f7634d6.exe PID 2996 wrote to memory of 1264 2996 f76193b.exe taskhost.exe PID 2996 wrote to memory of 1340 2996 f76193b.exe Dwm.exe PID 2996 wrote to memory of 1368 2996 f76193b.exe Explorer.EXE PID 2996 wrote to memory of 2576 2996 f76193b.exe f761b4e.exe PID 2996 wrote to memory of 2576 2996 f76193b.exe f761b4e.exe PID 2996 wrote to memory of 2668 2996 f76193b.exe f7634d6.exe PID 2996 wrote to memory of 2668 2996 f76193b.exe f7634d6.exe PID 2668 wrote to memory of 1264 2668 f7634d6.exe taskhost.exe PID 2668 wrote to memory of 1340 2668 f7634d6.exe Dwm.exe PID 2668 wrote to memory of 1368 2668 f7634d6.exe Explorer.EXE -
System policy modification 1 TTPs 2 IoCs
Processes:
f76193b.exef7634d6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76193b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7634d6.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1b47a070106c88c4b0c2e0901d989e3c_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1b47a070106c88c4b0c2e0901d989e3c_JaffaCakes118.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f76193b.exeC:\Users\Admin\AppData\Local\Temp\f76193b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\f761b4e.exeC:\Users\Admin\AppData\Local\Temp\f761b4e.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f7634d6.exeC:\Users\Admin\AppData\Local\Temp\f7634d6.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5d0fdb9406aced5ed9ef7767c180f4a90
SHA136586ccb58481b924b7ffe60a77315eec03fa358
SHA25651ea16968e855dbc55565aee08b774f24f4b1780ad4cff973f075d8558e217b3
SHA5125ae99882d5d275b8a5a67b04b8d4cfe28723203f4f0f4bde7b75961a46c7300a95c1a25bf2565b00898a4402aae22e8b1ea9884012f2a9d3be674490f42d6385
-
\Users\Admin\AppData\Local\Temp\f76193b.exeFilesize
97KB
MD5043dc85ef6acb3e9435ab5cb10d1c9bf
SHA128f23f9b8bac07b4a2fed31bf19d7a8700ad6c08
SHA2563cff318bb1e3839bc5c14fe3772f6982048c5d492480a844db10aba0d1d16d6a
SHA51276f20ed2551eccf61e8e96a6f0437c3bde9cbb79cc23e204327b0f56ee10ca75e2960eb1bb141e358161212373f0a2c8e5a8127dec33a1b90efd086b97d921f3
-
memory/1264-29-0x00000000020F0000-0x00000000020F2000-memory.dmpFilesize
8KB
-
memory/1904-58-0x0000000000690000-0x0000000000692000-memory.dmpFilesize
8KB
-
memory/1904-8-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1904-9-0x0000000000240000-0x0000000000252000-memory.dmpFilesize
72KB
-
memory/1904-38-0x0000000000690000-0x0000000000692000-memory.dmpFilesize
8KB
-
memory/1904-61-0x0000000000690000-0x0000000000692000-memory.dmpFilesize
8KB
-
memory/1904-60-0x00000000006B0000-0x00000000006C2000-memory.dmpFilesize
72KB
-
memory/1904-10-0x0000000000240000-0x0000000000252000-memory.dmpFilesize
72KB
-
memory/1904-48-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/1904-39-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/2576-182-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2576-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2576-111-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2576-101-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2668-208-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2668-113-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB
-
memory/2668-83-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2668-112-0x0000000000360000-0x0000000000362000-memory.dmpFilesize
8KB
-
memory/2668-168-0x0000000000930000-0x00000000019EA000-memory.dmpFilesize
16.7MB
-
memory/2668-207-0x0000000000930000-0x00000000019EA000-memory.dmpFilesize
16.7MB
-
memory/2996-23-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-85-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-64-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-14-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-21-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-65-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-66-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-68-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-67-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-70-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-71-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-19-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-84-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-17-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-88-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-89-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-20-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-49-0x0000000001720000-0x0000000001721000-memory.dmpFilesize
4KB
-
memory/2996-22-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-51-0x0000000000280000-0x0000000000282000-memory.dmpFilesize
8KB
-
memory/2996-129-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-154-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2996-155-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-59-0x0000000000280000-0x0000000000282000-memory.dmpFilesize
8KB
-
memory/2996-16-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-18-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-15-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2996-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB