Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 09:01
Static task
static1
Behavioral task
behavioral1
Sample
198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe
Resource
win7-20231129-en
General
-
Target
198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe
-
Size
91KB
-
MD5
198c3d7beef8f5107eb884dd35a6bf07
-
SHA1
fedc3200cac20e80ec712b9a72346540cff454ef
-
SHA256
cef6fb469154c9805fa9ca778a7919840695f9bc074e1d2e484d0c8dcb70cfe3
-
SHA512
3a8a1123d8b7b0ddad271191985858be23591976887a54a7215e3ad78fcdd9e9d8ba0041d31e873c1231b42a58d83f867040cb96171e12b21f09ccd1435fde2a
-
SSDEEP
1536:duteSLtAYHRNGu2+NICv3DU3ei1tE7jwaaHw7Koj4rL/OpNGiY:IY8tHHRNGV+eCfkLgjwaaHw7Koj4rK
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
ualoqdwkrfmtustk.exepid process 1228 ualoqdwkrfmtustk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1628 3068 WerFault.exe svchost.exe 2136 4568 WerFault.exe svchost.exe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3924618660" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3725555597" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115577" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426330277" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3725555597" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3730243118" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115577" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{09A38BF6-352D-11EF-9519-66D3FDB32ECD} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115577" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115577" IEXPLORE.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 676 -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exeualoqdwkrfmtustk.exedescription pid process Token: SeSecurityPrivilege 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe Token: SeDebugPrivilege 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe Token: SeSecurityPrivilege 1228 ualoqdwkrfmtustk.exe Token: SeLoadDriverPrivilege 1228 ualoqdwkrfmtustk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
IEXPLORE.EXEpid process 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE 940 IEXPLORE.EXE 940 IEXPLORE.EXE 940 IEXPLORE.EXE 940 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exeiexplore.exeIEXPLORE.EXEiexplore.exedescription pid process target process PID 64 wrote to memory of 3068 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 64 wrote to memory of 3068 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 64 wrote to memory of 3068 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 64 wrote to memory of 3068 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 64 wrote to memory of 3068 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 64 wrote to memory of 3068 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 64 wrote to memory of 3068 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 64 wrote to memory of 3068 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 64 wrote to memory of 3068 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 64 wrote to memory of 4584 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe iexplore.exe PID 64 wrote to memory of 4584 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe iexplore.exe PID 64 wrote to memory of 4584 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe iexplore.exe PID 4584 wrote to memory of 2352 4584 iexplore.exe IEXPLORE.EXE PID 4584 wrote to memory of 2352 4584 iexplore.exe IEXPLORE.EXE PID 2352 wrote to memory of 2184 2352 IEXPLORE.EXE IEXPLORE.EXE PID 2352 wrote to memory of 2184 2352 IEXPLORE.EXE IEXPLORE.EXE PID 2352 wrote to memory of 2184 2352 IEXPLORE.EXE IEXPLORE.EXE PID 64 wrote to memory of 4568 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 64 wrote to memory of 4568 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 64 wrote to memory of 4568 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 64 wrote to memory of 4568 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 64 wrote to memory of 4568 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 64 wrote to memory of 4568 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 64 wrote to memory of 4568 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 64 wrote to memory of 4568 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 64 wrote to memory of 4568 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe svchost.exe PID 64 wrote to memory of 3816 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe iexplore.exe PID 64 wrote to memory of 3816 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe iexplore.exe PID 64 wrote to memory of 3816 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe iexplore.exe PID 3816 wrote to memory of 2836 3816 iexplore.exe IEXPLORE.EXE PID 3816 wrote to memory of 2836 3816 iexplore.exe IEXPLORE.EXE PID 2352 wrote to memory of 940 2352 IEXPLORE.EXE IEXPLORE.EXE PID 2352 wrote to memory of 940 2352 IEXPLORE.EXE IEXPLORE.EXE PID 2352 wrote to memory of 940 2352 IEXPLORE.EXE IEXPLORE.EXE PID 64 wrote to memory of 1228 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe ualoqdwkrfmtustk.exe PID 64 wrote to memory of 1228 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe ualoqdwkrfmtustk.exe PID 64 wrote to memory of 1228 64 198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe ualoqdwkrfmtustk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\198c3d7beef8f5107eb884dd35a6bf07_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 2043⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:17416 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 2083⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Local\Temp\ualoqdwkrfmtustk.exe"C:\Users\Admin\AppData\Local\Temp\ualoqdwkrfmtustk.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3068 -ip 30681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4568 -ip 45681⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5fa34ecb8815a2d98849888cb1cdbf38b
SHA184fd0e04586009efb3683c98da8d9aa41487cd42
SHA2565077a54924f80491a74ed78bbd73ff7bf85a27caddb80ceaa9ccb86f8b9a11be
SHA512ccfdb76ccedd0076601e17272d346229e2b9c0dd884c09bb7701b32c5dc177da8a91bb539ce751297d8ea44716fc497e8a337a9499c93a474ba85915f28f1053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD58fd3c80ff01ed4fd261588f69f728b91
SHA1bb46fa86743687184339f1112d0d74eee87c4cd9
SHA256c3268f75d152d2aa62ab8ee988ac4357182a7de8cecbe8ee87e8315c0110c4ef
SHA512615d16cd8ce9eee58c4c02f099ca3116106aa16c7abac39771653b90bc2fc2f93ab286905a4eb768d40ab02587089a5f4e5d1f4f7d80ab8f8be829ba6cf12ac2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VLW1SL5J\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\ualoqdwkrfmtustk.exeFilesize
91KB
MD5198c3d7beef8f5107eb884dd35a6bf07
SHA1fedc3200cac20e80ec712b9a72346540cff454ef
SHA256cef6fb469154c9805fa9ca778a7919840695f9bc074e1d2e484d0c8dcb70cfe3
SHA5123a8a1123d8b7b0ddad271191985858be23591976887a54a7215e3ad78fcdd9e9d8ba0041d31e873c1231b42a58d83f867040cb96171e12b21f09ccd1435fde2a
-
memory/64-16-0x0000000077052000-0x0000000077053000-memory.dmpFilesize
4KB
-
memory/64-4-0x0000000000570000-0x0000000000571000-memory.dmpFilesize
4KB
-
memory/64-0-0x0000000000400000-0x000000000043907C-memory.dmpFilesize
228KB
-
memory/64-7-0x0000000000400000-0x000000000043907C-memory.dmpFilesize
228KB
-
memory/64-11-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/64-15-0x0000000000400000-0x000000000043907C-memory.dmpFilesize
228KB
-
memory/64-2-0x0000000000400000-0x000000000043907C-memory.dmpFilesize
228KB
-
memory/64-18-0x0000000000400000-0x000000000043907C-memory.dmpFilesize
228KB
-
memory/64-19-0x0000000077052000-0x0000000077053000-memory.dmpFilesize
4KB
-
memory/64-37-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/64-5-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/64-1-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1228-40-0x0000000000400000-0x000000000043907C-memory.dmpFilesize
228KB
-
memory/1228-39-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1228-38-0x0000000000400000-0x000000000043907C-memory.dmpFilesize
228KB
-
memory/1228-45-0x0000000000400000-0x000000000043907C-memory.dmpFilesize
228KB
-
memory/1228-44-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3068-9-0x00000000004F0000-0x00000000004F1000-memory.dmpFilesize
4KB
-
memory/3068-8-0x0000000000510000-0x0000000000511000-memory.dmpFilesize
4KB