Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 08:31
Behavioral task
behavioral1
Sample
1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe
-
Size
90KB
-
MD5
1a9beb8cee1091bed1d0408fa7eba4f0
-
SHA1
5f7eaba361137c81f9b9f8feeaa84f23ca47b05f
-
SHA256
9b203111380859513cd79a5dd8a67f11f533997127279cf87b18bb5bff2bdff1
-
SHA512
f4bd3c51ffc95bfe2a09ba6f241db28fdd99491bee42d4965169dcc341ed3161dc5361aee1329037c83096b83098ead32cb06bb68b8d0c758d14a7f9db25acc7
-
SSDEEP
1536:LOJ4sGbcsgNwdawhXh3gM/keIyim5pkTsjWU1DlI4vXsXSeNhj5sDoudV4xRXaJJ:LY0cCaoOeIy3pkTsj1OMYNhNsDtdixQ
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\drivers\pcidump.sys 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
259408274.exepid process 2540 259408274.exe -
Loads dropped DLL 11 IoCs
Processes:
rundll32.exe1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe259408274.exeWerFault.exepid process 2744 rundll32.exe 2744 rundll32.exe 2744 rundll32.exe 2744 rundll32.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 2540 259408274.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe 2668 WerFault.exe -
Processes:
resource yara_rule behavioral1/memory/1752-0-0x0000000000400000-0x000000000043F000-memory.dmp vmprotect behavioral1/memory/1752-39-0x0000000000400000-0x000000000043F000-memory.dmp vmprotect -
Drops file in System32 directory 1 IoCs
Processes:
1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\259408274.exe 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\fonts\pci.sys rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2668 2540 WerFault.exe 259408274.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exerundll32.exepid process 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 2744 rundll32.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 480 480 -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exepid process 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exerundll32.exedescription pid process Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe Token: SeDebugPrivilege 2744 rundll32.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe259408274.exedescription pid process target process PID 1752 wrote to memory of 2744 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe rundll32.exe PID 1752 wrote to memory of 2744 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe rundll32.exe PID 1752 wrote to memory of 2744 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe rundll32.exe PID 1752 wrote to memory of 2744 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe rundll32.exe PID 1752 wrote to memory of 2744 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe rundll32.exe PID 1752 wrote to memory of 2744 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe rundll32.exe PID 1752 wrote to memory of 2744 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe rundll32.exe PID 1752 wrote to memory of 2540 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 259408274.exe PID 1752 wrote to memory of 2540 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 259408274.exe PID 1752 wrote to memory of 2540 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 259408274.exe PID 1752 wrote to memory of 2540 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe 259408274.exe PID 2540 wrote to memory of 2668 2540 259408274.exe WerFault.exe PID 2540 wrote to memory of 2668 2540 259408274.exe WerFault.exe PID 2540 wrote to memory of 2668 2540 259408274.exe WerFault.exe PID 2540 wrote to memory of 2668 2540 259408274.exe WerFault.exe PID 1752 wrote to memory of 2468 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe cmd.exe PID 1752 wrote to memory of 2468 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe cmd.exe PID 1752 wrote to memory of 2468 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe cmd.exe PID 1752 wrote to memory of 2468 1752 1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a9beb8cee1091bed1d0408fa7eba4f0_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\259403719.dll testall2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\259408274.exe"C:\Windows\system32\259408274.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 2123⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\kl78a.bat" "2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\259403719.dllFilesize
14KB
MD5962cab8783e4346bf2fd5ac1530a820e
SHA1e5fa0795fafc737f13746ef09b63549bf965a627
SHA256d443d789343c7509885062da36ca881c436bb4a0ff2e1facde138727b5c5699a
SHA5125047c747925f6fc792b6929d19706fed5517a002a8bbf5a7c69d3142e5614b80b53c02b585846002a17e8433cf7c415852bda4abeaa77745c4048c376c6301af
-
C:\Users\Admin\AppData\Local\Temp\kl78a.batFilesize
2KB
MD5a5e19ba10e666cf1ba7e2d0683f26d90
SHA17926e638b05dc24a21afe0186a62944ba569a356
SHA256c717e542c82837805f10fff24d0da892e377be0b7cc0fabe292e95b2d40632bb
SHA512a66b3e53f4cb7735ad3ecfaf2a561d1f1f5315a6dd020c56f7ad70cb626c976016be3633e1306484ad1d11c13d04bc96412457e4dbb96139a5be72e24b9de197
-
\Users\Admin\AppData\Local\Temp\ope4200.tmpFilesize
1.7MB
MD5b5eb5bd3066959611e1f7a80fd6cc172
SHA16fb1532059212c840737b3f923a9c0b152c0887a
SHA2561ffb68a66f28f604adcae9c135f8dcf301316ab7fda8ebd294583c56dd26f7cc
SHA5126c0743e0ff4922e859ba66b68040ab994dbae33e80c63ce8c993ad31a0c7aad6c6467484da1550063214953cd641dbf597438dd0c02f24164505d88ca80ea1b6
-
\Windows\SysWOW64\259408274.exeFilesize
12KB
MD57f365c4ed3156a1766a12ef5f56b267e
SHA17183afdb03678548b8c7d4840b41f1ea06dd1b72
SHA256639fc1c21d22b81f32404ca30ead2d3f9aaf31308fb21a14540ac9adc101b7de
SHA512dd439dbfdaf2b22222650de3b3f30c509645a6ea46c1a815dee1edf8d6e40464ded4b81d9278403a7a179bd3e5cfa204d4fde4a0b62394a246b72182e9ec9a57
-
memory/1752-0-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/1752-39-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2744-8-0x0000000010001000-0x0000000010002000-memory.dmpFilesize
4KB
-
memory/2744-7-0x0000000010000000-0x0000000010006000-memory.dmpFilesize
24KB