Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 09:01
Static task
static1
Behavioral task
behavioral1
Sample
1ab1804575d60caf806435699834ee6b_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
1ab1804575d60caf806435699834ee6b_JaffaCakes118.exe
-
Size
99KB
-
MD5
1ab1804575d60caf806435699834ee6b
-
SHA1
4e7ee6602b428dd52fc21f9610860d88c951dc56
-
SHA256
6c5692e30c0e147626a051cc055157ccd20edeaa00204dac69624bceafdf4069
-
SHA512
542516ad6a1e3bed61bc5e8b1f59bf81144154270f8212b44b58a80a76569eab019688ab45cbfe765147ca1dd07ae941d9c1b30838251ca7abaf663c10c61079
-
SSDEEP
768:706R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9Y:JR0vxn3Pc0LCH9MtbvabUDzJYWu3B
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
WaterMark.exepid process 3952 WaterMark.exe -
Processes:
resource yara_rule behavioral2/memory/3436-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3436-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3436-4-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3436-9-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3436-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3952-21-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/3436-3-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3436-2-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3952-25-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/3952-35-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
1ab1804575d60caf806435699834ee6b_JaffaCakes118.exedescription ioc process File created C:\Program Files (x86)\Microsoft\WaterMark.exe 1ab1804575d60caf806435699834ee6b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe 1ab1804575d60caf806435699834ee6b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\px33C2.tmp 1ab1804575d60caf806435699834ee6b_JaffaCakes118.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 220 4276 WerFault.exe svchost.exe -
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426589466" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116181" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{82718886-3788-11EF-B1BC-FA8F9E8C279D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{826F2698-3788-11EF-B1BC-FA8F9E8C279D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1456729279" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116181" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116181" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31116181" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1458760568" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1456729279" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1456729279" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1458604910" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1458604910" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31116181" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1458760568" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31116181" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1456729279" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31116181" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31116181" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
WaterMark.exepid process 3952 WaterMark.exe 3952 WaterMark.exe 3952 WaterMark.exe 3952 WaterMark.exe 3952 WaterMark.exe 3952 WaterMark.exe 3952 WaterMark.exe 3952 WaterMark.exe 3952 WaterMark.exe 3952 WaterMark.exe 3952 WaterMark.exe 3952 WaterMark.exe 3952 WaterMark.exe 3952 WaterMark.exe 3952 WaterMark.exe 3952 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WaterMark.exedescription pid process Token: SeDebugPrivilege 3952 WaterMark.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 4820 iexplore.exe 2532 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 4820 iexplore.exe 2532 iexplore.exe 4820 iexplore.exe 2532 iexplore.exe 4924 IEXPLORE.EXE 4924 IEXPLORE.EXE 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
1ab1804575d60caf806435699834ee6b_JaffaCakes118.exeWaterMark.exepid process 3436 1ab1804575d60caf806435699834ee6b_JaffaCakes118.exe 3952 WaterMark.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
1ab1804575d60caf806435699834ee6b_JaffaCakes118.exeWaterMark.exeiexplore.exeiexplore.exedescription pid process target process PID 3436 wrote to memory of 3952 3436 1ab1804575d60caf806435699834ee6b_JaffaCakes118.exe WaterMark.exe PID 3436 wrote to memory of 3952 3436 1ab1804575d60caf806435699834ee6b_JaffaCakes118.exe WaterMark.exe PID 3436 wrote to memory of 3952 3436 1ab1804575d60caf806435699834ee6b_JaffaCakes118.exe WaterMark.exe PID 3952 wrote to memory of 4276 3952 WaterMark.exe svchost.exe PID 3952 wrote to memory of 4276 3952 WaterMark.exe svchost.exe PID 3952 wrote to memory of 4276 3952 WaterMark.exe svchost.exe PID 3952 wrote to memory of 4276 3952 WaterMark.exe svchost.exe PID 3952 wrote to memory of 4276 3952 WaterMark.exe svchost.exe PID 3952 wrote to memory of 4276 3952 WaterMark.exe svchost.exe PID 3952 wrote to memory of 4276 3952 WaterMark.exe svchost.exe PID 3952 wrote to memory of 4276 3952 WaterMark.exe svchost.exe PID 3952 wrote to memory of 4276 3952 WaterMark.exe svchost.exe PID 3952 wrote to memory of 4820 3952 WaterMark.exe iexplore.exe PID 3952 wrote to memory of 4820 3952 WaterMark.exe iexplore.exe PID 3952 wrote to memory of 2532 3952 WaterMark.exe iexplore.exe PID 3952 wrote to memory of 2532 3952 WaterMark.exe iexplore.exe PID 4820 wrote to memory of 4924 4820 iexplore.exe IEXPLORE.EXE PID 4820 wrote to memory of 4924 4820 iexplore.exe IEXPLORE.EXE PID 4820 wrote to memory of 4924 4820 iexplore.exe IEXPLORE.EXE PID 2532 wrote to memory of 1836 2532 iexplore.exe IEXPLORE.EXE PID 2532 wrote to memory of 1836 2532 iexplore.exe IEXPLORE.EXE PID 2532 wrote to memory of 1836 2532 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ab1804575d60caf806435699834ee6b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1ab1804575d60caf806435699834ee6b_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 2044⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4820 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2532 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4276 -ip 42761⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
99KB
MD51ab1804575d60caf806435699834ee6b
SHA14e7ee6602b428dd52fc21f9610860d88c951dc56
SHA2566c5692e30c0e147626a051cc055157ccd20edeaa00204dac69624bceafdf4069
SHA512542516ad6a1e3bed61bc5e8b1f59bf81144154270f8212b44b58a80a76569eab019688ab45cbfe765147ca1dd07ae941d9c1b30838251ca7abaf663c10c61079
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{826F2698-3788-11EF-B1BC-FA8F9E8C279D}.datFilesize
5KB
MD5489121f095fd85cdecce7a2b056e6774
SHA13d113f984c91058bea935e86eb664509ec1d1a5b
SHA256edb6068ef283cdbcb05b6ccd07ee5c3eeb94089cb67694f3ff9a202d90c82b82
SHA5121bb4e34925116405384f492b3f4be846fac3b3c636128f9a9f02e7f292b56ddbd71b1119e460f8565553484e2c000e2d34a73b0e34f65430ae68d396f51c7fd4
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{82718886-3788-11EF-B1BC-FA8F9E8C279D}.datFilesize
4KB
MD568f5a16843142679245abbd1f7e50490
SHA147f41dfefaf1fafbc57faa485bc5d81f12d74320
SHA2566e08d63d85b9194bb8df8b49df6fa34cd7556c39c0f0569304afee1cc867fec4
SHA5123f2c9f7a1cd5fb98fd1ee672c0439afcf12f07f4ec30f0f8ae5fb6610003e2fd228eea02c774693a0b90e66511a195532ddb4534e3d3c03cc360a3c5731dd004
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verB630.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0K2PF59Z\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
memory/3436-8-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3436-9-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3436-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3436-4-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3436-7-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/3436-3-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3436-2-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3436-0-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/3436-6-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3436-1-0x0000000000401000-0x0000000000402000-memory.dmpFilesize
4KB
-
memory/3952-26-0x0000000000910000-0x0000000000911000-memory.dmpFilesize
4KB
-
memory/3952-28-0x00000000775D2000-0x00000000775D3000-memory.dmpFilesize
4KB
-
memory/3952-31-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/3952-32-0x00000000775D2000-0x00000000775D3000-memory.dmpFilesize
4KB
-
memory/3952-35-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3952-25-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3952-21-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/4276-29-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/4276-30-0x0000000000E70000-0x0000000000E71000-memory.dmpFilesize
4KB