Analysis
-
max time kernel
143s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 22:37
Static task
static1
Behavioral task
behavioral1
Sample
5bd8073eb6ee3b48ed4be6e769f8b6e0_JaffaCakes118.rtf
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
5bd8073eb6ee3b48ed4be6e769f8b6e0_JaffaCakes118.rtf
Resource
win10v2004-20240426-en
General
-
Target
5bd8073eb6ee3b48ed4be6e769f8b6e0_JaffaCakes118.rtf
-
Size
534KB
-
MD5
5bd8073eb6ee3b48ed4be6e769f8b6e0
-
SHA1
5906720656c80e96d3e35eeaaf48dbdc25236a7f
-
SHA256
d0919e2ea93d45755adec371d67a2c042a25a475c3f531b92d59d0270e8505e4
-
SHA512
6d8443b9a5d7b483ef8052b0de536483bfda875e1915d3c32d77d4b2bf1495768df28d54aa81cb391f4cb7ce74e3ded266166edc97abe60d82eb20fe287fb3b1
-
SSDEEP
12288:Hzcp3YHI+3q0vR7JZIibtiwN9wA3j+qeXA3JJkf+/u9ZGFQ:HrHh3qgJj1Nx3ypXG/4P
Malware Config
Extracted
lokibot
http://185.24.233.117/~zadmin/frb/cache.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.execmd.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 2280 2288 cmd.exe WINWORD.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 2832 2288 cmd.exe WINWORD.EXE -
Executes dropped EXE 2 IoCs
Processes:
exe.exeexe.exepid process 3004 exe.exe 1564 exe.exe -
Loads dropped DLL 3 IoCs
Processes:
cmd.exeexe.exepid process 2756 cmd.exe 2756 cmd.exe 3004 exe.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
exe.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook exe.exe Key opened \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook exe.exe Key opened \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook exe.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
exe.exedescription pid process target process PID 3004 set thread context of 1564 3004 exe.exe exe.exe -
Office loads VBA resources, possible macro or embedded object present
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2696 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3008 taskkill.exe -
Launches Equation Editor 1 TTPs 2 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
Processes:
EQNEDT32.EXEEQNEDT32.EXEpid process 2840 EQNEDT32.EXE 2592 EQNEDT32.EXE -
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 2288 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
taskkill.exeexe.exedescription pid process Token: SeDebugPrivilege 3008 taskkill.exe Token: SeDebugPrivilege 1564 exe.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
exe.exepid process 3004 exe.exe 3004 exe.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
exe.exepid process 3004 exe.exe 3004 exe.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
WINWORD.EXEexe.exepid process 2288 WINWORD.EXE 2288 WINWORD.EXE 2288 WINWORD.EXE 3004 exe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
WINWORD.EXEcmd.execmd.exeEQNEDT32.EXEdescription pid process target process PID 2288 wrote to memory of 2280 2288 WINWORD.EXE cmd.exe PID 2288 wrote to memory of 2280 2288 WINWORD.EXE cmd.exe PID 2288 wrote to memory of 2280 2288 WINWORD.EXE cmd.exe PID 2288 wrote to memory of 2280 2288 WINWORD.EXE cmd.exe PID 2280 wrote to memory of 2756 2280 cmd.exe cmd.exe PID 2280 wrote to memory of 2756 2280 cmd.exe cmd.exe PID 2280 wrote to memory of 2756 2280 cmd.exe cmd.exe PID 2280 wrote to memory of 2756 2280 cmd.exe cmd.exe PID 2756 wrote to memory of 2696 2756 cmd.exe timeout.exe PID 2756 wrote to memory of 2696 2756 cmd.exe timeout.exe PID 2756 wrote to memory of 2696 2756 cmd.exe timeout.exe PID 2756 wrote to memory of 2696 2756 cmd.exe timeout.exe PID 2288 wrote to memory of 2832 2288 WINWORD.EXE cmd.exe PID 2288 wrote to memory of 2832 2288 WINWORD.EXE cmd.exe PID 2288 wrote to memory of 2832 2288 WINWORD.EXE cmd.exe PID 2288 wrote to memory of 2832 2288 WINWORD.EXE cmd.exe PID 2840 wrote to memory of 2700 2840 EQNEDT32.EXE CmD.exe PID 2840 wrote to memory of 2700 2840 EQNEDT32.EXE CmD.exe PID 2840 wrote to memory of 2700 2840 EQNEDT32.EXE CmD.exe PID 2840 wrote to memory of 2700 2840 EQNEDT32.EXE CmD.exe PID 2756 wrote to memory of 3004 2756 cmd.exe exe.exe PID 2756 wrote to memory of 3004 2756 cmd.exe exe.exe PID 2756 wrote to memory of 3004 2756 cmd.exe exe.exe PID 2756 wrote to memory of 3004 2756 cmd.exe exe.exe PID 2756 wrote to memory of 3008 2756 cmd.exe taskkill.exe PID 2756 wrote to memory of 3008 2756 cmd.exe taskkill.exe PID 2756 wrote to memory of 3008 2756 cmd.exe taskkill.exe PID 2756 wrote to memory of 3008 2756 cmd.exe taskkill.exe PID 2756 wrote to memory of 2860 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2860 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2860 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2860 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2864 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2864 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2864 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2864 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2780 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2780 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2780 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2780 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2892 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2892 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2892 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2892 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2896 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2896 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2896 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2896 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2636 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2636 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2636 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2636 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2900 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2900 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2900 2756 cmd.exe reg.exe PID 2756 wrote to memory of 2900 2756 cmd.exe reg.exe PID 2756 wrote to memory of 3000 2756 cmd.exe reg.exe PID 2756 wrote to memory of 3000 2756 cmd.exe reg.exe PID 2756 wrote to memory of 3000 2756 cmd.exe reg.exe PID 2756 wrote to memory of 3000 2756 cmd.exe reg.exe PID 2756 wrote to memory of 1292 2756 cmd.exe cmd.exe PID 2756 wrote to memory of 1292 2756 cmd.exe cmd.exe PID 2756 wrote to memory of 1292 2756 cmd.exe cmd.exe PID 2756 wrote to memory of 1292 2756 cmd.exe cmd.exe -
outlook_office_path 1 IoCs
Processes:
exe.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook exe.exe -
outlook_win_path 1 IoCs
Processes:
exe.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook exe.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5bd8073eb6ee3b48ed4be6e769f8b6e0_JaffaCakes118.rtf"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\TaSk.BaT2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\2nd.bat3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exeTIMEOUT 14⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\exe.exeC:\Users\Admin\AppData\Local\Temp\exe.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\exe.exeC:\Users\Admin\AppData\Local\Temp\exe.exe5⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im winword.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Word\Resiliency /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Resiliency /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\Resiliency /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\Resiliency /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\Resiliency /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Resiliency /f4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\8.0\Word\File MRU" /v "Item 1"4⤵
-
C:\Windows\SysWOW64\reg.exeREG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\8.0\Word\File MRU" /v "Item 1"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\9.0\Word\File MRU" /v "Item 1"4⤵
-
C:\Windows\SysWOW64\reg.exeREG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\9.0\Word\File MRU" /v "Item 1"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\10.0\Word\File MRU" /v "Item 1"4⤵
-
C:\Windows\SysWOW64\reg.exeREG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\10.0\Word\File MRU" /v "Item 1"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"4⤵
-
C:\Windows\SysWOW64\reg.exeREG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"4⤵
-
C:\Windows\SysWOW64\reg.exeREG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"4⤵
-
C:\Windows\SysWOW64\reg.exeREG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"4⤵
-
C:\Windows\SysWOW64\reg.exeREG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"4⤵
-
C:\Windows\SysWOW64\reg.exeREG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\TaSk.BaT2⤵
- Process spawned unexpected child process
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\CmD.exeCmD /C %tmp%\task.bat & UUUUUUUUc2⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Launches Equation Editor
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2nd.batFilesize
2KB
MD507fbf92580a91f32c5c96c156ccb3fa9
SHA1f70cdd08113e9cd4c2bc3d91dee526e634089c23
SHA256d1d7d1dfc3980b56620e8fe6af0358e676a4dbd6288a3e3bf0712191d5bf0b69
SHA5124acb7b4bbe0ca72c6233605bc356c90a501039c32c03d4e4783a840bfd3a97aab06e0dc8b15546e6840cce412ed89b943744e4e9281afafd2de9be03e1ac1abd
-
C:\Users\Admin\AppData\Local\Temp\decoy.docFilesize
9KB
MD5c463af2be5752a2e345ffe110cd93d31
SHA1bb5cf6cd2801c58afe29002baa9ace348fcbd14b
SHA256ab89cb877fdeeebbf3d75559cc3d9bbbf0c4dfcd3295bfcf7269d7d14e716445
SHA512bc60f4deb50289547c872570eb4ed85aa75c8bc513e7be6153bcaee1c29c84e5d3445925561f2caab48c338b71bb83c7a51c666f55f15e8a15b65eb73131565e
-
C:\Users\Admin\AppData\Local\Temp\inteldriverupd1.sctFilesize
423B
MD536ad6d953da9665f7ff59e4145d5278a
SHA1d6b7685ec25b5a40b3d40c945df56b3dee4a580e
SHA256002394c515bc0df787f99f565b6c032bef239a5e40a33ac710395bf264520df7
SHA512afdbf8ffb330d2f4b3893adecd7153be7ce2b53c1635ca0f506d7a71354e576d70cfd5ff0787e2d61915525ed26a0dd729696be32c202e4acc2b4854dec4229f
-
C:\Users\Admin\AppData\Local\Temp\task.batFilesize
150B
MD5418334ad7eb95ff82969646a7bf5a164
SHA14cefdfad3fee1412e1aa5b1ae0057ad0b4126db7
SHA256731abba49e150da730d1b94879ce42b7f89f2a16c2b3d6f1e8d4c7d31546d35d
SHA51238eeec94e6495c06161dac7f3bf832ac91a200a8dd958d8849e3191b3dcdc36cdbb3d186ad8fe5ad175dc56d355973741ee027987615a244f587911e09dc0640
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-481678230-3773327859-3495911762-1000\0f5007522459c86e95ffcc62f32308f1_62d00eb3-39d9-4013-96e4-e92894ec756eFilesize
46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-481678230-3773327859-3495911762-1000\0f5007522459c86e95ffcc62f32308f1_62d00eb3-39d9-4013-96e4-e92894ec756eFilesize
46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
\Users\Admin\AppData\Local\Temp\exe.exeFilesize
224KB
MD536dda4e85633c64a16e1be2cacb4bd13
SHA1270052141f401e4b529c53e0aecd295de0f6db48
SHA2564a0bc6f05059436664c08d70ea8118af946f7a4b0a64bae7280b255145c290d4
SHA512863e01a45d2d238a72d2514550765e1c0f1cb70d3c1f07b238bbe6afd79138b5b67c395b00bf78c63c376b36b5c45a4907773b09fa781a0684e6ff934b288bd9
-
memory/1564-46-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1564-48-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1564-52-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1564-70-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1564-92-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2288-0-0x000000002F041000-0x000000002F042000-memory.dmpFilesize
4KB
-
memory/2288-2-0x000000007191D000-0x0000000071928000-memory.dmpFilesize
44KB
-
memory/2288-42-0x000000007191D000-0x0000000071928000-memory.dmpFilesize
44KB
-
memory/2288-1-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB