Overview
overview
10Static
static
33c23060bff...18.exe
windows7-x64
103c23060bff...18.exe
windows10-2004-x64
7$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7store.html
windows7-x64
1store.html
windows10-2004-x64
1youtube_activex.js
windows7-x64
3youtube_activex.js
windows10-2004-x64
3Analysis
-
max time kernel
122s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
13-05-2024 18:04
Static task
static1
Behavioral task
behavioral1
Sample
3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Uninstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Uninstall.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
store.html
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
store.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
youtube_activex.js
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
youtube_activex.js
Resource
win10v2004-20240426-en
General
-
Target
3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe
-
Size
279KB
-
MD5
3c23060bff44df650a2def69bf0733a7
-
SHA1
185a6c6d9bd9e7f660980132b5132b116b62f229
-
SHA256
954d80f7e2ee27d8056e565e351b2c81d7d22c430b5443cf59924015b5f3664f
-
SHA512
cb86e0f70dfe531ab6c7da16160d9b0e4f2b20bca9da1647c5d8705418025518d6c1ff4309373ea48f81e50dee10e3fea41f16ee2dce8747cfd340e250d775fe
-
SSDEEP
6144:Hy9v17kwz0RlV++MAQjZJogqzI/uROSOu+UT/+6kQT:y97klCAQjv1/uRni6kA
Malware Config
Extracted
C:\Users\Admin\Pictures\_README_.hta
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Blocklisted process makes network request 3 IoCs
Processes:
mshta.exeflow pid process 1736 2948 mshta.exe 1738 2948 mshta.exe 1740 2948 mshta.exe -
Contacts a large (517) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2888 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exepid process 1760 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpC275.bmp" 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exedescription pid process target process PID 1760 set thread context of 2664 1760 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe -
Drops file in Program Files directory 6 IoCs
Processes:
3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\_README_.hta 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2700 1760 WerFault.exe 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2224 taskkill.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exepid process 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exepid process 1760 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exeWMIC.exevssvc.exetaskkill.exedescription pid process Token: SeDebugPrivilege 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2756 WMIC.exe Token: SeSecurityPrivilege 2756 WMIC.exe Token: SeTakeOwnershipPrivilege 2756 WMIC.exe Token: SeLoadDriverPrivilege 2756 WMIC.exe Token: SeSystemProfilePrivilege 2756 WMIC.exe Token: SeSystemtimePrivilege 2756 WMIC.exe Token: SeProfSingleProcessPrivilege 2756 WMIC.exe Token: SeIncBasePriorityPrivilege 2756 WMIC.exe Token: SeCreatePagefilePrivilege 2756 WMIC.exe Token: SeBackupPrivilege 2756 WMIC.exe Token: SeRestorePrivilege 2756 WMIC.exe Token: SeShutdownPrivilege 2756 WMIC.exe Token: SeDebugPrivilege 2756 WMIC.exe Token: SeSystemEnvironmentPrivilege 2756 WMIC.exe Token: SeRemoteShutdownPrivilege 2756 WMIC.exe Token: SeUndockPrivilege 2756 WMIC.exe Token: SeManageVolumePrivilege 2756 WMIC.exe Token: 33 2756 WMIC.exe Token: 34 2756 WMIC.exe Token: 35 2756 WMIC.exe Token: SeIncreaseQuotaPrivilege 2756 WMIC.exe Token: SeSecurityPrivilege 2756 WMIC.exe Token: SeTakeOwnershipPrivilege 2756 WMIC.exe Token: SeLoadDriverPrivilege 2756 WMIC.exe Token: SeSystemProfilePrivilege 2756 WMIC.exe Token: SeSystemtimePrivilege 2756 WMIC.exe Token: SeProfSingleProcessPrivilege 2756 WMIC.exe Token: SeIncBasePriorityPrivilege 2756 WMIC.exe Token: SeCreatePagefilePrivilege 2756 WMIC.exe Token: SeBackupPrivilege 2756 WMIC.exe Token: SeRestorePrivilege 2756 WMIC.exe Token: SeShutdownPrivilege 2756 WMIC.exe Token: SeDebugPrivilege 2756 WMIC.exe Token: SeSystemEnvironmentPrivilege 2756 WMIC.exe Token: SeRemoteShutdownPrivilege 2756 WMIC.exe Token: SeUndockPrivilege 2756 WMIC.exe Token: SeManageVolumePrivilege 2756 WMIC.exe Token: 33 2756 WMIC.exe Token: 34 2756 WMIC.exe Token: 35 2756 WMIC.exe Token: SeBackupPrivilege 2644 vssvc.exe Token: SeRestorePrivilege 2644 vssvc.exe Token: SeAuditPrivilege 2644 vssvc.exe Token: SeDebugPrivilege 2224 taskkill.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mshta.exepid process 2948 mshta.exe 2948 mshta.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe3c23060bff44df650a2def69bf0733a7_JaffaCakes118.execmd.execmd.exedescription pid process target process PID 1760 wrote to memory of 2664 1760 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe PID 1760 wrote to memory of 2664 1760 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe PID 1760 wrote to memory of 2664 1760 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe PID 1760 wrote to memory of 2664 1760 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe PID 1760 wrote to memory of 2664 1760 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe PID 1760 wrote to memory of 2700 1760 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe WerFault.exe PID 1760 wrote to memory of 2700 1760 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe WerFault.exe PID 1760 wrote to memory of 2700 1760 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe WerFault.exe PID 1760 wrote to memory of 2700 1760 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe WerFault.exe PID 2664 wrote to memory of 2740 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe cmd.exe PID 2664 wrote to memory of 2740 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe cmd.exe PID 2664 wrote to memory of 2740 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe cmd.exe PID 2664 wrote to memory of 2740 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe cmd.exe PID 2740 wrote to memory of 2756 2740 cmd.exe WMIC.exe PID 2740 wrote to memory of 2756 2740 cmd.exe WMIC.exe PID 2740 wrote to memory of 2756 2740 cmd.exe WMIC.exe PID 2664 wrote to memory of 2948 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe mshta.exe PID 2664 wrote to memory of 2948 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe mshta.exe PID 2664 wrote to memory of 2948 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe mshta.exe PID 2664 wrote to memory of 2948 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe mshta.exe PID 2664 wrote to memory of 2888 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe cmd.exe PID 2664 wrote to memory of 2888 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe cmd.exe PID 2664 wrote to memory of 2888 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe cmd.exe PID 2664 wrote to memory of 2888 2664 3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe cmd.exe PID 2888 wrote to memory of 2224 2888 cmd.exe taskkill.exe PID 2888 wrote to memory of 2224 2888 cmd.exe taskkill.exe PID 2888 wrote to memory of 2224 2888 cmd.exe taskkill.exe PID 2888 wrote to memory of 320 2888 cmd.exe PING.EXE PID 2888 wrote to memory of 320 2888 cmd.exe PING.EXE PID 2888 wrote to memory of 320 2888 cmd.exe PING.EXE -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe"2⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic.exe shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\_README_.hta"3⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im "3c23060bff44df650a2def69bf0733a7_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 4282⤵
- Program crash
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Pictures\_README_.htaFilesize
66KB
MD52d1e6a29ba1380cba775d03d10e40937
SHA1464e9b865800ea96f9695ec6d0ae555ff7927bf3
SHA256566fffb2357b35d01eca9e2c01590906e3541c67b996aa7df824a3a5540609a1
SHA51282010207480f589bf65d56fdde5f647ab1353dfd181986f4f1091b803c33e1b2d8555724944582df8fc61b68c7b134a19f73e16e69c6b7a176cc99ed94148253
-
\Users\Admin\AppData\Local\Temp\nso1B9D.tmp\System.dllFilesize
11KB
MD5ca332bb753b0775d5e806e236ddcec55
SHA1f35ef76592f20850baef2ebbd3c9a2cfb5ad8d8f
SHA256df5ae79fa558dc7af244ec6e53939563b966e7dbd8867e114e928678dbd56e5d
SHA5122de0956a1ad58ad7086e427e89b819089f2a7f1e4133ed2a0a736adc0614e8588ebe2d97f1b59ab8886d662aeb40e0b4838c6a65fbfc652253e3a45664a03a00
-
memory/1760-11-0x00000000003C0000-0x00000000003ED000-memory.dmpFilesize
180KB
-
memory/1760-24-0x00000000003C0000-0x00000000003ED000-memory.dmpFilesize
180KB
-
memory/2664-22-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2664-21-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2664-16-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2664-15-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2664-25-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2664-27-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2664-26-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2664-13-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2664-299-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2664-305-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2664-316-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB