Analysis
-
max time kernel
125s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 06:21
Static task
static1
Behavioral task
behavioral1
Sample
19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe
-
Size
97KB
-
MD5
19183a37407083e404ae86fce8a7f6e9
-
SHA1
18d3fa080e2e91b859d7fca57ccf99754f89501f
-
SHA256
2fe47063e431776d6ab6dbda3b27959dd5632fe8d2680f414a66ff207d687fd1
-
SHA512
c122cd0c8ea71922dcbe6c748fec85dcd4ec7e3b8a7023c8d9ec2113c02c27a505cfe3a945f9eabf99c012a038f5d8f9515594d67eb98e1520110d4ad73d1a84
-
SSDEEP
3072:jgeWPCmabC3YUSlr6WzA9dLy/R5jwaaHw7Koj4rH:c4PtUSlrdydm/4
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
iaqtnchbixbkscqf.exepid process 4388 iaqtnchbixbkscqf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4712 1980 WerFault.exe svchost.exe 2808 1388 WerFault.exe svchost.exe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115555" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115555" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115555" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2296519912" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2294332391" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B45E55B1-3516-11EF-B8C0-4A7C5F4B2F01} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115555" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2494801077" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426320685" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2294332391" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 664 -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exeiaqtnchbixbkscqf.exedescription pid process Token: SeSecurityPrivilege 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe Token: SeDebugPrivilege 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe Token: SeSecurityPrivilege 4388 iaqtnchbixbkscqf.exe Token: SeLoadDriverPrivilege 4388 iaqtnchbixbkscqf.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
IEXPLORE.EXEpid process 3724 IEXPLORE.EXE 3724 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 3724 IEXPLORE.EXE 3724 IEXPLORE.EXE 3812 IEXPLORE.EXE 3812 IEXPLORE.EXE 3812 IEXPLORE.EXE 3812 IEXPLORE.EXE 3724 IEXPLORE.EXE 3724 IEXPLORE.EXE 1512 IEXPLORE.EXE 1512 IEXPLORE.EXE 1512 IEXPLORE.EXE 1512 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exeiexplore.exeIEXPLORE.EXEiexplore.exedescription pid process target process PID 3108 wrote to memory of 1980 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 3108 wrote to memory of 1980 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 3108 wrote to memory of 1980 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 3108 wrote to memory of 1980 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 3108 wrote to memory of 1980 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 3108 wrote to memory of 1980 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 3108 wrote to memory of 1980 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 3108 wrote to memory of 1980 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 3108 wrote to memory of 1980 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 3108 wrote to memory of 2320 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe iexplore.exe PID 3108 wrote to memory of 2320 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe iexplore.exe PID 3108 wrote to memory of 2320 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe iexplore.exe PID 2320 wrote to memory of 3724 2320 iexplore.exe IEXPLORE.EXE PID 2320 wrote to memory of 3724 2320 iexplore.exe IEXPLORE.EXE PID 3724 wrote to memory of 3812 3724 IEXPLORE.EXE IEXPLORE.EXE PID 3724 wrote to memory of 3812 3724 IEXPLORE.EXE IEXPLORE.EXE PID 3724 wrote to memory of 3812 3724 IEXPLORE.EXE IEXPLORE.EXE PID 3108 wrote to memory of 1388 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 3108 wrote to memory of 1388 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 3108 wrote to memory of 1388 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 3108 wrote to memory of 1388 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 3108 wrote to memory of 1388 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 3108 wrote to memory of 1388 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 3108 wrote to memory of 1388 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 3108 wrote to memory of 1388 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 3108 wrote to memory of 1388 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe svchost.exe PID 3108 wrote to memory of 2024 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe iexplore.exe PID 3108 wrote to memory of 2024 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe iexplore.exe PID 3108 wrote to memory of 2024 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe iexplore.exe PID 2024 wrote to memory of 5072 2024 iexplore.exe IEXPLORE.EXE PID 2024 wrote to memory of 5072 2024 iexplore.exe IEXPLORE.EXE PID 3724 wrote to memory of 1512 3724 IEXPLORE.EXE IEXPLORE.EXE PID 3724 wrote to memory of 1512 3724 IEXPLORE.EXE IEXPLORE.EXE PID 3724 wrote to memory of 1512 3724 IEXPLORE.EXE IEXPLORE.EXE PID 3108 wrote to memory of 4388 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe iaqtnchbixbkscqf.exe PID 3108 wrote to memory of 4388 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe iaqtnchbixbkscqf.exe PID 3108 wrote to memory of 4388 3108 19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe iaqtnchbixbkscqf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\19183a37407083e404ae86fce8a7f6e9_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 2043⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3724 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3724 CREDAT:17416 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 2083⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Local\Temp\iaqtnchbixbkscqf.exe"C:\Users\Admin\AppData\Local\Temp\iaqtnchbixbkscqf.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1980 -ip 19801⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3812,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1388 -ip 13881⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5fa34ecb8815a2d98849888cb1cdbf38b
SHA184fd0e04586009efb3683c98da8d9aa41487cd42
SHA2565077a54924f80491a74ed78bbd73ff7bf85a27caddb80ceaa9ccb86f8b9a11be
SHA512ccfdb76ccedd0076601e17272d346229e2b9c0dd884c09bb7701b32c5dc177da8a91bb539ce751297d8ea44716fc497e8a337a9499c93a474ba85915f28f1053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD56a1349f446a4236c8f5ed0dfdf8fe5fd
SHA14c0da676760ddc4c41c29ffdcb37640f0532aa17
SHA2566bc1568b88168a8fad6849e669a8d349d628e830d4660d39e72260019a5d8673
SHA512ffdf1c739e934617b6c3575eee3a936e00a1311384abb17824990fce12dcbdd9a613734d757740260fcddb766a43720c69640bb84dee7293fa4d03b572a7f050
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\44ZGVQ6R\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\iaqtnchbixbkscqf.exeFilesize
97KB
MD519183a37407083e404ae86fce8a7f6e9
SHA118d3fa080e2e91b859d7fca57ccf99754f89501f
SHA2562fe47063e431776d6ab6dbda3b27959dd5632fe8d2680f414a66ff207d687fd1
SHA512c122cd0c8ea71922dcbe6c748fec85dcd4ec7e3b8a7023c8d9ec2113c02c27a505cfe3a945f9eabf99c012a038f5d8f9515594d67eb98e1520110d4ad73d1a84
-
memory/1980-9-0x00000000004D0000-0x00000000004D1000-memory.dmpFilesize
4KB
-
memory/1980-8-0x00000000004F0000-0x00000000004F1000-memory.dmpFilesize
4KB
-
memory/3108-4-0x00000000006C0000-0x00000000006C1000-memory.dmpFilesize
4KB
-
memory/3108-15-0x0000000000400000-0x0000000000439054-memory.dmpFilesize
228KB
-
memory/3108-5-0x00000000006D0000-0x00000000006D1000-memory.dmpFilesize
4KB
-
memory/3108-16-0x0000000077182000-0x0000000077183000-memory.dmpFilesize
4KB
-
memory/3108-1-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3108-18-0x0000000000400000-0x0000000000439054-memory.dmpFilesize
228KB
-
memory/3108-19-0x0000000077182000-0x0000000077183000-memory.dmpFilesize
4KB
-
memory/3108-37-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3108-11-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3108-7-0x0000000000400000-0x0000000000439054-memory.dmpFilesize
228KB
-
memory/3108-0-0x0000000000400000-0x0000000000439054-memory.dmpFilesize
228KB
-
memory/3108-2-0x0000000000400000-0x0000000000439054-memory.dmpFilesize
228KB
-
memory/4388-39-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4388-38-0x0000000000400000-0x0000000000439054-memory.dmpFilesize
228KB
-
memory/4388-44-0x0000000000400000-0x0000000000439054-memory.dmpFilesize
228KB
-
memory/4388-45-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4388-40-0x0000000000400000-0x0000000000439054-memory.dmpFilesize
228KB