Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 18:31
Static task
static1
Behavioral task
behavioral1
Sample
fae9a9201c43ac34543f6917558e0565_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
fae9a9201c43ac34543f6917558e0565_JaffaCakes118.exe
-
Size
185KB
-
MD5
fae9a9201c43ac34543f6917558e0565
-
SHA1
0981d1a529d13eab3a151ed231c94f6aacfaef8b
-
SHA256
57f139c1799239e4bde2588dc2375cf30be9d3008b27e216c1e02ee3185d36a0
-
SHA512
d131df39d3e65bfca7d646519251d8317736d26e62192d6d4445b1766420d2466973cd1c81d7e45ca5d28761d96876987f035d4774d668c7befcdf6839cd2e20
-
SSDEEP
3072:+6lXhN336MdMfLirVQW0/nyypWE32BJ8q9kPKlhf8a7:rXHqqULirVT012BSiX8c
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fae9a9201c43ac34543f6917558e0565_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation fae9a9201c43ac34543f6917558e0565_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
fae9a9201c43ac34543f6917558e0565_JaffaCakes118mgr.exeWaterMark.exepid process 668 fae9a9201c43ac34543f6917558e0565_JaffaCakes118mgr.exe 1924 WaterMark.exe -
Processes:
resource yara_rule behavioral2/memory/668-6-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/668-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/668-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/668-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/668-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/668-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/668-18-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1924-32-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1924-42-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/1924-43-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
fae9a9201c43ac34543f6917558e0565_JaffaCakes118mgr.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe fae9a9201c43ac34543f6917558e0565_JaffaCakes118mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\px6CB4.tmp fae9a9201c43ac34543f6917558e0565_JaffaCakes118mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe fae9a9201c43ac34543f6917558e0565_JaffaCakes118mgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4496 2248 WerFault.exe svchost.exe -
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3879234084" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3879234084" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31101576" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101576" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3891265425" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3891265425" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101576" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3881577975" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31101576" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3881421988" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31101576" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419713811" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1233E7BB-FE7C-11EE-8A9B-FEF12A1805AF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101576" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{123B0D78-FE7C-11EE-8A9B-FEF12A1805AF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
WaterMark.exepid process 1924 WaterMark.exe 1924 WaterMark.exe 1924 WaterMark.exe 1924 WaterMark.exe 1924 WaterMark.exe 1924 WaterMark.exe 1924 WaterMark.exe 1924 WaterMark.exe 1924 WaterMark.exe 1924 WaterMark.exe 1924 WaterMark.exe 1924 WaterMark.exe 1924 WaterMark.exe 1924 WaterMark.exe 1924 WaterMark.exe 1924 WaterMark.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WaterMark.exedescription pid process Token: SeDebugPrivilege 1924 WaterMark.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 5040 iexplore.exe 2748 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 2748 iexplore.exe 5040 iexplore.exe 2748 iexplore.exe 5040 iexplore.exe 4412 IEXPLORE.EXE 4412 IEXPLORE.EXE 1252 IEXPLORE.EXE 1252 IEXPLORE.EXE 4412 IEXPLORE.EXE 4412 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
fae9a9201c43ac34543f6917558e0565_JaffaCakes118mgr.exeWaterMark.exepid process 668 fae9a9201c43ac34543f6917558e0565_JaffaCakes118mgr.exe 1924 WaterMark.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
fae9a9201c43ac34543f6917558e0565_JaffaCakes118.exefae9a9201c43ac34543f6917558e0565_JaffaCakes118mgr.exeWaterMark.exeiexplore.exeiexplore.exedescription pid process target process PID 3220 wrote to memory of 668 3220 fae9a9201c43ac34543f6917558e0565_JaffaCakes118.exe fae9a9201c43ac34543f6917558e0565_JaffaCakes118mgr.exe PID 3220 wrote to memory of 668 3220 fae9a9201c43ac34543f6917558e0565_JaffaCakes118.exe fae9a9201c43ac34543f6917558e0565_JaffaCakes118mgr.exe PID 3220 wrote to memory of 668 3220 fae9a9201c43ac34543f6917558e0565_JaffaCakes118.exe fae9a9201c43ac34543f6917558e0565_JaffaCakes118mgr.exe PID 668 wrote to memory of 1924 668 fae9a9201c43ac34543f6917558e0565_JaffaCakes118mgr.exe WaterMark.exe PID 668 wrote to memory of 1924 668 fae9a9201c43ac34543f6917558e0565_JaffaCakes118mgr.exe WaterMark.exe PID 668 wrote to memory of 1924 668 fae9a9201c43ac34543f6917558e0565_JaffaCakes118mgr.exe WaterMark.exe PID 3220 wrote to memory of 2156 3220 fae9a9201c43ac34543f6917558e0565_JaffaCakes118.exe setup_wm.exe PID 3220 wrote to memory of 2156 3220 fae9a9201c43ac34543f6917558e0565_JaffaCakes118.exe setup_wm.exe PID 3220 wrote to memory of 2156 3220 fae9a9201c43ac34543f6917558e0565_JaffaCakes118.exe setup_wm.exe PID 1924 wrote to memory of 2248 1924 WaterMark.exe svchost.exe PID 1924 wrote to memory of 2248 1924 WaterMark.exe svchost.exe PID 1924 wrote to memory of 2248 1924 WaterMark.exe svchost.exe PID 1924 wrote to memory of 2248 1924 WaterMark.exe svchost.exe PID 1924 wrote to memory of 2248 1924 WaterMark.exe svchost.exe PID 1924 wrote to memory of 2248 1924 WaterMark.exe svchost.exe PID 1924 wrote to memory of 2248 1924 WaterMark.exe svchost.exe PID 1924 wrote to memory of 2248 1924 WaterMark.exe svchost.exe PID 1924 wrote to memory of 2248 1924 WaterMark.exe svchost.exe PID 1924 wrote to memory of 5040 1924 WaterMark.exe iexplore.exe PID 1924 wrote to memory of 5040 1924 WaterMark.exe iexplore.exe PID 1924 wrote to memory of 2748 1924 WaterMark.exe iexplore.exe PID 1924 wrote to memory of 2748 1924 WaterMark.exe iexplore.exe PID 2748 wrote to memory of 1252 2748 iexplore.exe IEXPLORE.EXE PID 2748 wrote to memory of 1252 2748 iexplore.exe IEXPLORE.EXE PID 2748 wrote to memory of 1252 2748 iexplore.exe IEXPLORE.EXE PID 5040 wrote to memory of 4412 5040 iexplore.exe IEXPLORE.EXE PID 5040 wrote to memory of 4412 5040 iexplore.exe IEXPLORE.EXE PID 5040 wrote to memory of 4412 5040 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\fae9a9201c43ac34543f6917558e0565_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fae9a9201c43ac34543f6917558e0565_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fae9a9201c43ac34543f6917558e0565_JaffaCakes118mgr.exeC:\Users\Admin\AppData\Local\Temp\fae9a9201c43ac34543f6917558e0565_JaffaCakes118mgr.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 2045⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5040 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Users\Admin\AppData\Local\Temp\fae9a9201c43ac34543f6917558e0565_JaffaCakes118.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2248 -ip 22481⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1233E7BB-FE7C-11EE-8A9B-FEF12A1805AF}.datFilesize
5KB
MD512b1732e5923b91c7b6f906d03fa0c9c
SHA114a9955a22ca1c092f96e003681d9d17fa0b8b65
SHA256a1e6361119ef22267ebb6747e29b157d402f9a244f00fb199e95a3a1bc6b4eb3
SHA5126a665da3862d5889e4edc3779c63d34feb009a82bd63c763663189888e9400c4a52c687cad5c447074f2734120da7a17fb49aa0561b45580082c047ca6d42d23
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{123B0D78-FE7C-11EE-8A9B-FEF12A1805AF}.datFilesize
3KB
MD5008e28a064edc786f2492484f21c4614
SHA1ca5ad04c8035bf485fb6de2e97de97fc2c9faf25
SHA25673fd6ba8d666f9ca052ce2e0886b8ba6eba75bf0cbc1adc3c17932ec635a3190
SHA51267ce07d997e6daf46a530b72eca0b70300e59985de88b9d1e83b5cceca68b36729dc94eb097fc11d72c659249917ac0e852106a26bd7610bc147489ab727657b
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verF415.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Temp\fae9a9201c43ac34543f6917558e0565_JaffaCakes118mgr.exeFilesize
119KB
MD56ccc1cdfb26daeb170fe75a4a476d30b
SHA100cb344695ad75cb667c1335d92f87ed8e7250a3
SHA2565128c0d27138fa7f11f79bc77f5d8f6e585b13a92ea582114a4e7a57922eac06
SHA5123f922709b0c1a83247e78ccf7e5c52fba6b2a9c4f6daf7382f8889c4571dbf89bf44bee487ff0954a02df07cdbc480e73a75d9bff2409cf1c44397853405046a
-
memory/668-18-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/668-10-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/668-12-0x0000000002850000-0x0000000002851000-memory.dmpFilesize
4KB
-
memory/668-11-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/668-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/668-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/668-5-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/668-6-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/668-8-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1924-33-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/1924-34-0x00000000777A2000-0x00000000777A3000-memory.dmpFilesize
4KB
-
memory/1924-32-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1924-39-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/1924-38-0x00000000777A2000-0x00000000777A3000-memory.dmpFilesize
4KB
-
memory/1924-22-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1924-42-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1924-43-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2248-37-0x0000000000CE0000-0x0000000000CE1000-memory.dmpFilesize
4KB
-
memory/2248-36-0x0000000000D00000-0x0000000000D01000-memory.dmpFilesize
4KB
-
memory/3220-0-0x0000000000070000-0x00000000000A2000-memory.dmpFilesize
200KB
-
memory/3220-24-0x0000000000070000-0x00000000000A2000-memory.dmpFilesize
200KB