Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 13:50
Static task
static1
Behavioral task
behavioral1
Sample
163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe
-
Size
332KB
-
MD5
163b14745b63876196be7dd7e91c1be2
-
SHA1
c7c6940cf4f05ad67b5cb141d98c7c208b2e6885
-
SHA256
083e6e89198bd3088d2798d4e22e72e577666cbc16884e464766504c70ef4276
-
SHA512
795cfb77ef725c34aa62757cf6c321cf671c10825d832325c687b96bebbd9ccaf4db90df917d58d0a0d4ab50985dce174dee47836ea62eb916312bce2cfc9da6
-
SSDEEP
6144:sYLtU7Ixhnhz5qLZWBRyve1+HxhV+baign+kuERMEnBa:7sI3lQK71870baign+kRXnI
Malware Config
Extracted
darkcomet
One-Dz
fucksuck.myftp.org:100
DC_MUTEX-BV4T666
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
isDoctiQ3i8k
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe -
Modifies firewall policy service 3 TTPs 6 IoCs
Processes:
msdcsc.exeiexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" iexplore.exe -
Modifies security service 2 TTPs 2 IoCs
Processes:
msdcsc.exeiexplore.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" iexplore.exe -
Processes:
msdcsc.exeiexplore.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iexplore.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2816 attrib.exe 2632 attrib.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 2960 notepad.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 2740 msdcsc.exe -
Loads dropped DLL 2 IoCs
Processes:
163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exepid process 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe -
Drops file in System32 directory 3 IoCs
Processes:
163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SysWOW64\MSDCSC\ 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
msdcsc.exedescription pid process target process PID 2740 set thread context of 2736 2740 msdcsc.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 2736 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exemsdcsc.exeiexplore.exedescription pid process Token: SeIncreaseQuotaPrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeSecurityPrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeSystemtimePrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeBackupPrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeRestorePrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeShutdownPrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeDebugPrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeUndockPrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeManageVolumePrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeImpersonatePrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: 33 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: 34 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: 35 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2740 msdcsc.exe Token: SeSecurityPrivilege 2740 msdcsc.exe Token: SeTakeOwnershipPrivilege 2740 msdcsc.exe Token: SeLoadDriverPrivilege 2740 msdcsc.exe Token: SeSystemProfilePrivilege 2740 msdcsc.exe Token: SeSystemtimePrivilege 2740 msdcsc.exe Token: SeProfSingleProcessPrivilege 2740 msdcsc.exe Token: SeIncBasePriorityPrivilege 2740 msdcsc.exe Token: SeCreatePagefilePrivilege 2740 msdcsc.exe Token: SeBackupPrivilege 2740 msdcsc.exe Token: SeRestorePrivilege 2740 msdcsc.exe Token: SeShutdownPrivilege 2740 msdcsc.exe Token: SeDebugPrivilege 2740 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2740 msdcsc.exe Token: SeChangeNotifyPrivilege 2740 msdcsc.exe Token: SeRemoteShutdownPrivilege 2740 msdcsc.exe Token: SeUndockPrivilege 2740 msdcsc.exe Token: SeManageVolumePrivilege 2740 msdcsc.exe Token: SeImpersonatePrivilege 2740 msdcsc.exe Token: SeCreateGlobalPrivilege 2740 msdcsc.exe Token: 33 2740 msdcsc.exe Token: 34 2740 msdcsc.exe Token: 35 2740 msdcsc.exe Token: SeIncreaseQuotaPrivilege 2736 iexplore.exe Token: SeSecurityPrivilege 2736 iexplore.exe Token: SeTakeOwnershipPrivilege 2736 iexplore.exe Token: SeLoadDriverPrivilege 2736 iexplore.exe Token: SeSystemProfilePrivilege 2736 iexplore.exe Token: SeSystemtimePrivilege 2736 iexplore.exe Token: SeProfSingleProcessPrivilege 2736 iexplore.exe Token: SeIncBasePriorityPrivilege 2736 iexplore.exe Token: SeCreatePagefilePrivilege 2736 iexplore.exe Token: SeBackupPrivilege 2736 iexplore.exe Token: SeRestorePrivilege 2736 iexplore.exe Token: SeShutdownPrivilege 2736 iexplore.exe Token: SeDebugPrivilege 2736 iexplore.exe Token: SeSystemEnvironmentPrivilege 2736 iexplore.exe Token: SeChangeNotifyPrivilege 2736 iexplore.exe Token: SeRemoteShutdownPrivilege 2736 iexplore.exe Token: SeUndockPrivilege 2736 iexplore.exe Token: SeManageVolumePrivilege 2736 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid process 2736 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
163b14745b63876196be7dd7e91c1be2_JaffaCakes118.execmd.execmd.exemsdcsc.exeiexplore.exedescription pid process target process PID 2796 wrote to memory of 2176 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe cmd.exe PID 2796 wrote to memory of 2176 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe cmd.exe PID 2796 wrote to memory of 2176 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe cmd.exe PID 2796 wrote to memory of 2176 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe cmd.exe PID 2796 wrote to memory of 2800 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe cmd.exe PID 2796 wrote to memory of 2800 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe cmd.exe PID 2796 wrote to memory of 2800 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe cmd.exe PID 2796 wrote to memory of 2800 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe cmd.exe PID 2796 wrote to memory of 2960 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe notepad.exe PID 2796 wrote to memory of 2960 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe notepad.exe PID 2796 wrote to memory of 2960 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe notepad.exe PID 2796 wrote to memory of 2960 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe notepad.exe PID 2796 wrote to memory of 2960 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe notepad.exe PID 2796 wrote to memory of 2960 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe notepad.exe PID 2796 wrote to memory of 2960 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe notepad.exe PID 2796 wrote to memory of 2960 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe notepad.exe PID 2796 wrote to memory of 2960 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe notepad.exe PID 2796 wrote to memory of 2960 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe notepad.exe PID 2796 wrote to memory of 2960 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe notepad.exe PID 2796 wrote to memory of 2960 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe notepad.exe PID 2796 wrote to memory of 2960 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe notepad.exe PID 2796 wrote to memory of 2960 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe notepad.exe PID 2796 wrote to memory of 2960 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe notepad.exe PID 2796 wrote to memory of 2960 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe notepad.exe PID 2796 wrote to memory of 2960 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe notepad.exe PID 2796 wrote to memory of 2960 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe notepad.exe PID 2176 wrote to memory of 2632 2176 cmd.exe attrib.exe PID 2176 wrote to memory of 2632 2176 cmd.exe attrib.exe PID 2176 wrote to memory of 2632 2176 cmd.exe attrib.exe PID 2176 wrote to memory of 2632 2176 cmd.exe attrib.exe PID 2800 wrote to memory of 2816 2800 cmd.exe attrib.exe PID 2800 wrote to memory of 2816 2800 cmd.exe attrib.exe PID 2800 wrote to memory of 2816 2800 cmd.exe attrib.exe PID 2800 wrote to memory of 2816 2800 cmd.exe attrib.exe PID 2796 wrote to memory of 2740 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe msdcsc.exe PID 2796 wrote to memory of 2740 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe msdcsc.exe PID 2796 wrote to memory of 2740 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe msdcsc.exe PID 2796 wrote to memory of 2740 2796 163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe msdcsc.exe PID 2740 wrote to memory of 2736 2740 msdcsc.exe iexplore.exe PID 2740 wrote to memory of 2736 2740 msdcsc.exe iexplore.exe PID 2740 wrote to memory of 2736 2740 msdcsc.exe iexplore.exe PID 2740 wrote to memory of 2736 2740 msdcsc.exe iexplore.exe PID 2740 wrote to memory of 2736 2740 msdcsc.exe iexplore.exe PID 2740 wrote to memory of 2736 2740 msdcsc.exe iexplore.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe PID 2736 wrote to memory of 2624 2736 iexplore.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2816 attrib.exe 2632 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\163b14745b63876196be7dd7e91c1be2_JaffaCakes118.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
332KB
MD5163b14745b63876196be7dd7e91c1be2
SHA1c7c6940cf4f05ad67b5cb141d98c7c208b2e6885
SHA256083e6e89198bd3088d2798d4e22e72e577666cbc16884e464766504c70ef4276
SHA512795cfb77ef725c34aa62757cf6c321cf671c10825d832325c687b96bebbd9ccaf4db90df917d58d0a0d4ab50985dce174dee47836ea62eb916312bce2cfc9da6
-
memory/2624-72-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2740-33-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB
-
memory/2796-0-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB
-
memory/2796-1-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2796-28-0x0000000004240000-0x0000000004326000-memory.dmpFilesize
920KB
-
memory/2796-27-0x0000000004240000-0x0000000004326000-memory.dmpFilesize
920KB
-
memory/2796-73-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB
-
memory/2960-5-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2960-19-0x0000000000150000-0x0000000000151000-memory.dmpFilesize
4KB