Overview
overview
10Static
static
3347251943c...18.exe
windows7-x64
10347251943c...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7audio_WhatAbouts.html
windows7-x64
1audio_WhatAbouts.html
windows10-2004-x64
1embed.js
windows7-x64
3embed.js
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-05-2024 11:51
Static task
static1
Behavioral task
behavioral1
Sample
347251943c940494c6e21c268907bbcc_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
347251943c940494c6e21c268907bbcc_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
Uninstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Uninstall.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
audio_WhatAbouts.html
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
audio_WhatAbouts.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
embed.js
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
embed.js
Resource
win10v2004-20240508-en
General
-
Target
347251943c940494c6e21c268907bbcc_JaffaCakes118.exe
-
Size
248KB
-
MD5
347251943c940494c6e21c268907bbcc
-
SHA1
33ce666e2f40c65f2da041ab22548badf0222be4
-
SHA256
20f9fc2278fae267ea2b4711b0f043c85aff368faaeed5b0c3c483c11a699925
-
SHA512
efe7c3a6da3f495322ea32ffa8dc543ff0a39f08164d96b57b372bf234b89165db02fbc87a341c0bfaff0924b4ce2efb2a21b09bea895e62c60160fc9947e914
-
SSDEEP
6144:Ny9v17kwzX7dthn0+ZZ9394hKTpxU0NRNkEVvh5qEqJ9TB:w97kk7jW+z9t44TpCeRNkq5AzB
Malware Config
Extracted
C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\README.hta
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Blocklisted process makes network request 3 IoCs
Processes:
mshta.exeflow pid process 3272 1488 mshta.exe 3274 1488 mshta.exe 3276 1488 mshta.exe -
Contacts a large (1093) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1484 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
347251943c940494c6e21c268907bbcc_JaffaCakes118.exepid process 1520 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
347251943c940494c6e21c268907bbcc_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpDAA6.bmp" 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
347251943c940494c6e21c268907bbcc_JaffaCakes118.exedescription pid process target process PID 1520 set thread context of 2964 1520 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe -
Drops file in Program Files directory 6 IoCs
Processes:
347251943c940494c6e21c268907bbcc_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\README.hta 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 640 taskkill.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
347251943c940494c6e21c268907bbcc_JaffaCakes118.exepid process 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
347251943c940494c6e21c268907bbcc_JaffaCakes118.exepid process 1520 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
347251943c940494c6e21c268907bbcc_JaffaCakes118.exeWMIC.exevssvc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2520 WMIC.exe Token: SeSecurityPrivilege 2520 WMIC.exe Token: SeTakeOwnershipPrivilege 2520 WMIC.exe Token: SeLoadDriverPrivilege 2520 WMIC.exe Token: SeSystemProfilePrivilege 2520 WMIC.exe Token: SeSystemtimePrivilege 2520 WMIC.exe Token: SeProfSingleProcessPrivilege 2520 WMIC.exe Token: SeIncBasePriorityPrivilege 2520 WMIC.exe Token: SeCreatePagefilePrivilege 2520 WMIC.exe Token: SeBackupPrivilege 2520 WMIC.exe Token: SeRestorePrivilege 2520 WMIC.exe Token: SeShutdownPrivilege 2520 WMIC.exe Token: SeDebugPrivilege 2520 WMIC.exe Token: SeSystemEnvironmentPrivilege 2520 WMIC.exe Token: SeRemoteShutdownPrivilege 2520 WMIC.exe Token: SeUndockPrivilege 2520 WMIC.exe Token: SeManageVolumePrivilege 2520 WMIC.exe Token: 33 2520 WMIC.exe Token: 34 2520 WMIC.exe Token: 35 2520 WMIC.exe Token: SeIncreaseQuotaPrivilege 2520 WMIC.exe Token: SeSecurityPrivilege 2520 WMIC.exe Token: SeTakeOwnershipPrivilege 2520 WMIC.exe Token: SeLoadDriverPrivilege 2520 WMIC.exe Token: SeSystemProfilePrivilege 2520 WMIC.exe Token: SeSystemtimePrivilege 2520 WMIC.exe Token: SeProfSingleProcessPrivilege 2520 WMIC.exe Token: SeIncBasePriorityPrivilege 2520 WMIC.exe Token: SeCreatePagefilePrivilege 2520 WMIC.exe Token: SeBackupPrivilege 2520 WMIC.exe Token: SeRestorePrivilege 2520 WMIC.exe Token: SeShutdownPrivilege 2520 WMIC.exe Token: SeDebugPrivilege 2520 WMIC.exe Token: SeSystemEnvironmentPrivilege 2520 WMIC.exe Token: SeRemoteShutdownPrivilege 2520 WMIC.exe Token: SeUndockPrivilege 2520 WMIC.exe Token: SeManageVolumePrivilege 2520 WMIC.exe Token: 33 2520 WMIC.exe Token: 34 2520 WMIC.exe Token: 35 2520 WMIC.exe Token: SeBackupPrivilege 2688 vssvc.exe Token: SeRestorePrivilege 2688 vssvc.exe Token: SeAuditPrivilege 2688 vssvc.exe Token: SeDebugPrivilege 640 taskkill.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mshta.exepid process 1488 mshta.exe 1488 mshta.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
347251943c940494c6e21c268907bbcc_JaffaCakes118.exe347251943c940494c6e21c268907bbcc_JaffaCakes118.execmd.execmd.exedescription pid process target process PID 1520 wrote to memory of 2964 1520 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe PID 1520 wrote to memory of 2964 1520 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe PID 1520 wrote to memory of 2964 1520 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe PID 1520 wrote to memory of 2964 1520 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe PID 1520 wrote to memory of 2964 1520 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe PID 2964 wrote to memory of 2636 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe cmd.exe PID 2964 wrote to memory of 2636 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe cmd.exe PID 2964 wrote to memory of 2636 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe cmd.exe PID 2964 wrote to memory of 2636 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe cmd.exe PID 2636 wrote to memory of 2520 2636 cmd.exe WMIC.exe PID 2636 wrote to memory of 2520 2636 cmd.exe WMIC.exe PID 2636 wrote to memory of 2520 2636 cmd.exe WMIC.exe PID 2964 wrote to memory of 1488 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe mshta.exe PID 2964 wrote to memory of 1488 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe mshta.exe PID 2964 wrote to memory of 1488 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe mshta.exe PID 2964 wrote to memory of 1488 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe mshta.exe PID 2964 wrote to memory of 1484 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe cmd.exe PID 2964 wrote to memory of 1484 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe cmd.exe PID 2964 wrote to memory of 1484 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe cmd.exe PID 2964 wrote to memory of 1484 2964 347251943c940494c6e21c268907bbcc_JaffaCakes118.exe cmd.exe PID 1484 wrote to memory of 640 1484 cmd.exe taskkill.exe PID 1484 wrote to memory of 640 1484 cmd.exe taskkill.exe PID 1484 wrote to memory of 640 1484 cmd.exe taskkill.exe PID 1484 wrote to memory of 2016 1484 cmd.exe PING.EXE PID 1484 wrote to memory of 2016 1484 cmd.exe PING.EXE PID 1484 wrote to memory of 2016 1484 cmd.exe PING.EXE -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\347251943c940494c6e21c268907bbcc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\347251943c940494c6e21c268907bbcc_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\347251943c940494c6e21c268907bbcc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\347251943c940494c6e21c268907bbcc_JaffaCakes118.exe"2⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic.exe shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\README.hta"3⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im "347251943c940494c6e21c268907bbcc_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\README.htaFilesize
66KB
MD514be4d9e7be114e49c4061bd249b67e2
SHA1fb61d894c713d1921883bdc4cc932311dc7dc96e
SHA256a1ae71b82759050804b9160976a6cc8e978afad2db6d86e4a28fe5db1e5406ec
SHA512d7a9a82956b7cff589d5993658e4dc670e3e36ce833592ddaba9d1a828afc228b66ec5be3cb26e40c51ec13eb5079d638c194e30450f6d9918223735c7de21b1
-
\Users\Admin\AppData\Local\Temp\nsy2379.tmp\System.dllFilesize
11KB
MD5ca332bb753b0775d5e806e236ddcec55
SHA1f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA256df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
SHA5122de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
-
memory/1520-14-0x0000000000540000-0x000000000056C000-memory.dmpFilesize
176KB
-
memory/1520-19-0x0000000000540000-0x000000000056C000-memory.dmpFilesize
176KB
-
memory/2964-288-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-297-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-25-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-26-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-28-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-30-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-29-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-20-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-282-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-285-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-16-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-291-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-294-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-18-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-300-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-303-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-306-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-309-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-312-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-315-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-316-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-319-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-322-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-325-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-328-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-335-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/2964-347-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB