Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2024, 19:02

General

  • Target

    a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    a414244ecb89d5bdc1a0ece12bb2c2a9

  • SHA1

    fb2c07209b248f612f48a898f449da88b2624fd9

  • SHA256

    59822012b04406a3df0f5893619e6129398134fc922d53ff1f1c9a6daf803f5b

  • SHA512

    f0468ac67445f92a55d1f1511a169f8cada6235209dea67b133c9010201f220d4165e16d8bc50a5385f098d8733bac3ea91f4f270ea605e5768d20e40cc927e9

  • SSDEEP

    24576:8uPmLDUMihIXCE5y8FyDgy7dml+i2rYNapO:8u+LIIX7Y8t+iiYN2O

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 36 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 20 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5020
    • C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4352
    • C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2564
      • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
        3⤵
        • Checks computer location settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2324
        • C:\Users\Public\Microsoft Build\Isass.exe
          "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3108
          • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
            5⤵
            • Checks computer location settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3292
            • C:\Users\Public\Microsoft Build\Isass.exe
              "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4544
              • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
                7⤵
                • Checks computer location settings
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5080
                • C:\Users\Public\Microsoft Build\Isass.exe
                  "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:4064
                  • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                    "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
                    9⤵
                    • Checks computer location settings
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4476
                    • C:\Users\Public\Microsoft Build\Isass.exe
                      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:4408
                      • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                        "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
                        11⤵
                        • Checks computer location settings
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:4692
                        • C:\Users\Public\Microsoft Build\Isass.exe
                          "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:824
                          • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                            "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
                            13⤵
                            • Checks computer location settings
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of WriteProcessMemory
                            PID:4932
                            • C:\Users\Public\Microsoft Build\Isass.exe
                              "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:5048
                              • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
                                15⤵
                                • Checks computer location settings
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:4576
                                • C:\Users\Public\Microsoft Build\Isass.exe
                                  "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                  16⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:4368
                                  • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                    "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
                                    17⤵
                                    • Checks computer location settings
                                    • Suspicious use of WriteProcessMemory
                                    PID:4676
                                    • C:\Users\Public\Microsoft Build\Isass.exe
                                      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                      18⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Suspicious use of WriteProcessMemory
                                      PID:2344
                                      • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                        "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
                                        19⤵
                                        • Checks computer location settings
                                        • Suspicious use of WriteProcessMemory
                                        PID:4600
                                        • C:\Users\Public\Microsoft Build\Isass.exe
                                          "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                          20⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Suspicious use of WriteProcessMemory
                                          PID:2616
                                          • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                            "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
                                            21⤵
                                            • Checks computer location settings
                                            • Suspicious use of WriteProcessMemory
                                            PID:2124
                                            • C:\Users\Public\Microsoft Build\Isass.exe
                                              "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                              22⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              PID:644
                                              • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                                "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
                                                23⤵
                                                • Checks computer location settings
                                                PID:1440
                                                • C:\Users\Public\Microsoft Build\Isass.exe
                                                  "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                                  24⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  PID:4524
                                                  • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
                                                    25⤵
                                                    • Checks computer location settings
                                                    PID:4328
                                                    • C:\Users\Public\Microsoft Build\Isass.exe
                                                      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      PID:2408
                                                      • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
                                                        27⤵
                                                        • Checks computer location settings
                                                        PID:4996
                                                        • C:\Users\Public\Microsoft Build\Isass.exe
                                                          "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                                          28⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          PID:1100
                                                          • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
                                                            29⤵
                                                            • Checks computer location settings
                                                            PID:628
                                                            • C:\Users\Public\Microsoft Build\Isass.exe
                                                              "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                                              30⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              PID:4684
                                                              • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
                                                                31⤵
                                                                • Checks computer location settings
                                                                PID:1696
                                                                • C:\Users\Public\Microsoft Build\Isass.exe
                                                                  "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                                                  32⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  PID:4104
                                                                  • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
                                                                    33⤵
                                                                    • Checks computer location settings
                                                                    PID:4476
                                                                    • C:\Users\Public\Microsoft Build\Isass.exe
                                                                      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                                                      34⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      PID:1516
                                                                      • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
                                                                        35⤵
                                                                        • Checks computer location settings
                                                                        PID:852
                                                                        • C:\Users\Public\Microsoft Build\Isass.exe
                                                                          "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                                                          36⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          PID:5024
                                                                          • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:5048

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\a414244ecb89d5bdc1a0ece12bb2c2a9_JaffaCakes118.exe

          Filesize

          452KB

          MD5

          276c1b7f46b8488344e85387c9ce6e80

          SHA1

          2901f43aa439f48baf786018696546e580ba9880

          SHA256

          608c5265075bacf05353a4d816fe815ec1ba2e95bb88313d5cf38655274841be

          SHA512

          5e02be9cfd27c3de2e17618958c5b82b38ef402ca59c260a1c93e2b0ac30871be29f43b3f160c8adb9c56061f5138db33a07e172c7c445c62fe0cd78f5fd1c8f

        • C:\Users\Public\Microsoft Build\Isass.exe

          Filesize

          624KB

          MD5

          dedd8708721873baf3d803c3554dc7dd

          SHA1

          070047ee6b6fe52be226009c817370f6e69f9d31

          SHA256

          529b1a8217a932c507302ad85cd050d294316c7155122026ea11ef0233397685

          SHA512

          913bac5400e1fcdff288521a1832330566d2c136e899f4a60874509dd0837d09b3b474af57da951fd50f1a8abdad2edfd0a463827b4f1b7dbbfd5a9cf7d3fd92

        • C:\odt\office2016setup.exe

          Filesize

          5.7MB

          MD5

          d8055cda69331f4f37c18884d24833de

          SHA1

          ac89e8d5a454621904706379a23eb239fbf13de0

          SHA256

          06855835067e1e441ae668647e35c8118993b24356bc00b03c0744d88dbc419d

          SHA512

          a1849831a5c160e2d023fe09af4cccad39ac0725315f6936c8858e9315769a05bd59a91db6c7493b1a208f5c86cd833e95715a1fa853c1aed39608fcd2ab9445

        • memory/628-75-0x0000000001A50000-0x0000000001A51000-memory.dmp

          Filesize

          4KB

        • memory/628-77-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/644-58-0x0000000001A40000-0x0000000001A41000-memory.dmp

          Filesize

          4KB

        • memory/644-59-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/824-33-0x00000000024A0000-0x00000000024A1000-memory.dmp

          Filesize

          4KB

        • memory/824-34-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/852-93-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/852-91-0x0000000001A60000-0x0000000001A61000-memory.dmp

          Filesize

          4KB

        • memory/1100-74-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/1100-73-0x0000000001A30000-0x0000000001A31000-memory.dmp

          Filesize

          4KB

        • memory/1440-60-0x0000000001B70000-0x0000000001B71000-memory.dmp

          Filesize

          4KB

        • memory/1440-62-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/1516-90-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/1516-89-0x00000000001F0000-0x00000000001F1000-memory.dmp

          Filesize

          4KB

        • memory/1696-82-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/1696-80-0x00000000001F0000-0x00000000001F1000-memory.dmp

          Filesize

          4KB

        • memory/2124-57-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/2124-55-0x0000000002160000-0x0000000002161000-memory.dmp

          Filesize

          4KB

        • memory/2324-12-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/2324-10-0x0000000001B00000-0x0000000001B01000-memory.dmp

          Filesize

          4KB

        • memory/2344-49-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/2344-48-0x0000000001C70000-0x0000000001C71000-memory.dmp

          Filesize

          4KB

        • memory/2408-68-0x0000000001A00000-0x0000000001A01000-memory.dmp

          Filesize

          4KB

        • memory/2408-69-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/2564-9-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/2564-8-0x0000000001A70000-0x0000000001A71000-memory.dmp

          Filesize

          4KB

        • memory/2616-54-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/2616-53-0x00000000001E0000-0x00000000001E1000-memory.dmp

          Filesize

          4KB

        • memory/3108-14-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/3108-13-0x0000000003710000-0x0000000003711000-memory.dmp

          Filesize

          4KB

        • memory/3292-17-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/3292-15-0x0000000003800000-0x0000000003801000-memory.dmp

          Filesize

          4KB

        • memory/4064-24-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4064-23-0x0000000001A60000-0x0000000001A61000-memory.dmp

          Filesize

          4KB

        • memory/4104-85-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4104-84-0x0000000001A60000-0x0000000001A61000-memory.dmp

          Filesize

          4KB

        • memory/4328-65-0x0000000001A60000-0x0000000001A61000-memory.dmp

          Filesize

          4KB

        • memory/4328-67-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4352-112-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4352-5-0x0000000001A50000-0x0000000001A51000-memory.dmp

          Filesize

          4KB

        • memory/4352-163-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4352-154-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4352-153-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4352-141-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4352-140-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4352-133-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4352-132-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4352-122-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4352-117-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4352-116-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4352-111-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4352-123-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4352-83-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4368-44-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4368-43-0x00000000001F0000-0x00000000001F1000-memory.dmp

          Filesize

          4KB

        • memory/4408-28-0x00000000001E0000-0x00000000001E1000-memory.dmp

          Filesize

          4KB

        • memory/4408-29-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4476-88-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4476-25-0x0000000001B50000-0x0000000001B51000-memory.dmp

          Filesize

          4KB

        • memory/4476-86-0x0000000001A00000-0x0000000001A01000-memory.dmp

          Filesize

          4KB

        • memory/4476-27-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4524-63-0x0000000001A30000-0x0000000001A31000-memory.dmp

          Filesize

          4KB

        • memory/4524-64-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4544-18-0x00000000001F0000-0x00000000001F1000-memory.dmp

          Filesize

          4KB

        • memory/4544-19-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4576-40-0x0000000001A30000-0x0000000001A31000-memory.dmp

          Filesize

          4KB

        • memory/4576-42-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4600-52-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4600-50-0x0000000001A80000-0x0000000001A81000-memory.dmp

          Filesize

          4KB

        • memory/4676-47-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4676-45-0x0000000001A00000-0x0000000001A01000-memory.dmp

          Filesize

          4KB

        • memory/4684-79-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4684-78-0x0000000001A70000-0x0000000001A71000-memory.dmp

          Filesize

          4KB

        • memory/4692-32-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4692-30-0x0000000001A60000-0x0000000001A61000-memory.dmp

          Filesize

          4KB

        • memory/4932-35-0x00000000001F0000-0x00000000001F1000-memory.dmp

          Filesize

          4KB

        • memory/4932-37-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/4996-70-0x0000000003810000-0x0000000003811000-memory.dmp

          Filesize

          4KB

        • memory/4996-72-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/5020-0-0x0000000001AA0000-0x0000000001AA1000-memory.dmp

          Filesize

          4KB

        • memory/5020-7-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/5024-105-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/5024-94-0x0000000000170000-0x0000000000171000-memory.dmp

          Filesize

          4KB

        • memory/5048-38-0x0000000001B70000-0x0000000001B71000-memory.dmp

          Filesize

          4KB

        • memory/5048-39-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/5080-22-0x0000000000400000-0x00000000016A3000-memory.dmp

          Filesize

          18.6MB

        • memory/5080-20-0x0000000001A50000-0x0000000001A51000-memory.dmp

          Filesize

          4KB