Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 09:52
Static task
static1
Behavioral task
behavioral1
Sample
19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118.exe
-
Size
164KB
-
MD5
19b20cdad4a0845f4159cd7e7cc07171
-
SHA1
96b5955de3c049289ad098315764cd85681191c1
-
SHA256
bd1cd66742d6a64fe01698ade6837f6a4ea8cbe73c7c8ffd2f8c512a0a490d28
-
SHA512
9ca03fb39f6c38a8446bb59b5b75fa30b25089bba4997cdfb20ec40f545d358c92e42259574b25fa59680aa572a4ac645684041dd4ba766a0ede0c4c0bdd589a
-
SSDEEP
3072:Xuug/5q6gVLypcUYNNUMT+f02kqXlgOlxuBQb3TS/1:XuTgVLycU0U1kxixuB+DG
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118mgr.exeWaterMark.exepid process 3740 19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118mgr.exe 4620 WaterMark.exe -
Processes:
resource yara_rule behavioral2/memory/3740-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3740-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3740-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3740-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3740-18-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3740-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3740-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4620-28-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4620-33-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4620-38-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118mgr.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px34BC.tmp 19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe 19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe 19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118mgr.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1084 1820 WerFault.exe svchost.exe -
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4051757848" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115584" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115584" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1D1E8778-3534-11EF-86EC-FE349C7D5183} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1D20EAA5-3534-11EF-86EC-FE349C7D5183} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426333316" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31115584" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31115584" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4053945917" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4054101768" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4051757848" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
WaterMark.exepid process 4620 WaterMark.exe 4620 WaterMark.exe 4620 WaterMark.exe 4620 WaterMark.exe 4620 WaterMark.exe 4620 WaterMark.exe 4620 WaterMark.exe 4620 WaterMark.exe 4620 WaterMark.exe 4620 WaterMark.exe 4620 WaterMark.exe 4620 WaterMark.exe 4620 WaterMark.exe 4620 WaterMark.exe 4620 WaterMark.exe 4620 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WaterMark.exedescription pid process Token: SeDebugPrivilege 4620 WaterMark.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 1456 iexplore.exe 4124 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 1456 iexplore.exe 1456 iexplore.exe 4124 iexplore.exe 4124 iexplore.exe 404 IEXPLORE.EXE 404 IEXPLORE.EXE 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE 404 IEXPLORE.EXE 404 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118mgr.exeWaterMark.exepid process 3740 19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118mgr.exe 4620 WaterMark.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118.exe19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118mgr.exeWaterMark.exeiexplore.exeiexplore.exedescription pid process target process PID 2748 wrote to memory of 3740 2748 19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118.exe 19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118mgr.exe PID 2748 wrote to memory of 3740 2748 19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118.exe 19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118mgr.exe PID 2748 wrote to memory of 3740 2748 19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118.exe 19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118mgr.exe PID 3740 wrote to memory of 4620 3740 19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118mgr.exe WaterMark.exe PID 3740 wrote to memory of 4620 3740 19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118mgr.exe WaterMark.exe PID 3740 wrote to memory of 4620 3740 19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118mgr.exe WaterMark.exe PID 4620 wrote to memory of 1820 4620 WaterMark.exe svchost.exe PID 4620 wrote to memory of 1820 4620 WaterMark.exe svchost.exe PID 4620 wrote to memory of 1820 4620 WaterMark.exe svchost.exe PID 4620 wrote to memory of 1820 4620 WaterMark.exe svchost.exe PID 4620 wrote to memory of 1820 4620 WaterMark.exe svchost.exe PID 4620 wrote to memory of 1820 4620 WaterMark.exe svchost.exe PID 4620 wrote to memory of 1820 4620 WaterMark.exe svchost.exe PID 4620 wrote to memory of 1820 4620 WaterMark.exe svchost.exe PID 4620 wrote to memory of 1820 4620 WaterMark.exe svchost.exe PID 4620 wrote to memory of 1456 4620 WaterMark.exe iexplore.exe PID 4620 wrote to memory of 1456 4620 WaterMark.exe iexplore.exe PID 4620 wrote to memory of 4124 4620 WaterMark.exe iexplore.exe PID 4620 wrote to memory of 4124 4620 WaterMark.exe iexplore.exe PID 1456 wrote to memory of 1712 1456 iexplore.exe IEXPLORE.EXE PID 1456 wrote to memory of 1712 1456 iexplore.exe IEXPLORE.EXE PID 1456 wrote to memory of 1712 1456 iexplore.exe IEXPLORE.EXE PID 4124 wrote to memory of 404 4124 iexplore.exe IEXPLORE.EXE PID 4124 wrote to memory of 404 4124 iexplore.exe IEXPLORE.EXE PID 4124 wrote to memory of 404 4124 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118mgr.exeC:\Users\Admin\AppData\Local\Temp\19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118mgr.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 2045⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1456 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4124 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1820 -ip 18201⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1D1E8778-3534-11EF-86EC-FE349C7D5183}.datFilesize
5KB
MD56b927955dcd94dab25fad2a487e1dadf
SHA17adceb0361925425d89808a7fd303db6092e41b5
SHA2564dd3c35a4568dc7d53316b8b31ce22fa9dfe468cf804477c5fa7199aa936e32c
SHA512d1afafd44a942ebca6ccee2e8dcd7c3a29b22c483377bf4e54799423feaffdb831af835fc9dc9740accb3d2d267192787cb36278b577f18eafdddb92a83994e4
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1D20EAA5-3534-11EF-86EC-FE349C7D5183}.datFilesize
3KB
MD5f0299acd8e4140556ecb07a3448a2b52
SHA18c7223a0bb72fe10529c38b831a37f7428bb9532
SHA2560fce84bcc7444e1455ee539893b1b38bf5b46c59271e9e7fe9433f8d7a36f6a3
SHA512619281e696411eb704fa449afa7930dc508125ee725d95b725f4e4a52d570696db9a70453d67ed5a630e084246892ca90c35bc7c911d6752e144de4aec8421cc
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verB73A.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GU2A83AM\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\19b20cdad4a0845f4159cd7e7cc07171_JaffaCakes118mgr.exeFilesize
92KB
MD55adaae6bfabaddea50ed5c0b957ad92e
SHA16053981e2aa05ac58fbb6dbb44f9883aff8d72d4
SHA2566762ce79f5b4746fad78ffdc7ab627fe08ef6cb6028c3ffe2c71245ba27b322f
SHA5126561dd9676f180f084eb0a00411a68cc00eef7847d74eff6e13549f788830b79a678cd5089268527393052bab511482cb9122daa035b2f96777b4e9075818441
-
memory/1820-32-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/1820-31-0x0000000000C10000-0x0000000000C11000-memory.dmpFilesize
4KB
-
memory/2748-0-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2748-13-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3740-8-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3740-7-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3740-18-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3740-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3740-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3740-11-0x00000000008B0000-0x00000000008B1000-memory.dmpFilesize
4KB
-
memory/3740-10-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3740-6-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3740-4-0x0000000000400000-0x0000000000428E39-memory.dmpFilesize
163KB
-
memory/4620-28-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4620-35-0x0000000076F62000-0x0000000076F63000-memory.dmpFilesize
4KB
-
memory/4620-34-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/4620-33-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4620-38-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4620-27-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/4620-29-0x0000000076F62000-0x0000000076F63000-memory.dmpFilesize
4KB