Analysis
-
max time kernel
147s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 20:38
Static task
static1
Behavioral task
behavioral1
Sample
64afe55adefb842826b08effa0af8094_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
64afe55adefb842826b08effa0af8094_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
NsResize.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
NsResize.dll
Resource
win10v2004-20240508-en
General
-
Target
64afe55adefb842826b08effa0af8094_JaffaCakes118.exe
-
Size
241KB
-
MD5
64afe55adefb842826b08effa0af8094
-
SHA1
9f324e8a2f55360667263c1aa0e3f37eb9b43195
-
SHA256
b3c36cbbaf27bc03e3c6d892565d18a46918b87ee4112dbbef108dafd17cd3ec
-
SHA512
de8817fa1deb07d56922d684d2d350378a84e1798bbbc21d7a9624e63161c4a07ab1337d293e36280068fcaeb19e570524525aa5dd53c6f24d8a2d384536cf4b
-
SSDEEP
6144:Kn/L+GOmXqA8VtR4ZhSTpkdpNRauPmuRfV/A/ETrSQ1tM:0zOmXqActRYhgk5Ra6mkflTrSh
Malware Config
Extracted
C:\Users\Admin\Documents\OneNote Notebooks\README.hta
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Contacts a large (522) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
64afe55adefb842826b08effa0af8094_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe -
Loads dropped DLL 4 IoCs
Processes:
64afe55adefb842826b08effa0af8094_JaffaCakes118.exepid process 4652 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 4652 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 4652 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 4652 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
64afe55adefb842826b08effa0af8094_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpFEDD.bmp" 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
64afe55adefb842826b08effa0af8094_JaffaCakes118.exedescription pid process target process PID 4652 set thread context of 1912 4652 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe -
Drops file in Program Files directory 6 IoCs
Processes:
64afe55adefb842826b08effa0af8094_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\DESIGNER.ONE 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\README.hta 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\PLANNERS.ONE 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\ACADEMIC.ONE 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BLANK.ONE 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BUSINESS.ONE 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3472 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
64afe55adefb842826b08effa0af8094_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
64afe55adefb842826b08effa0af8094_JaffaCakes118.exepid process 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
64afe55adefb842826b08effa0af8094_JaffaCakes118.exeWMIC.exevssvc.exeAUDIODG.EXEtaskkill.exedescription pid process Token: SeDebugPrivilege 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 1748 WMIC.exe Token: SeSecurityPrivilege 1748 WMIC.exe Token: SeTakeOwnershipPrivilege 1748 WMIC.exe Token: SeLoadDriverPrivilege 1748 WMIC.exe Token: SeSystemProfilePrivilege 1748 WMIC.exe Token: SeSystemtimePrivilege 1748 WMIC.exe Token: SeProfSingleProcessPrivilege 1748 WMIC.exe Token: SeIncBasePriorityPrivilege 1748 WMIC.exe Token: SeCreatePagefilePrivilege 1748 WMIC.exe Token: SeBackupPrivilege 1748 WMIC.exe Token: SeRestorePrivilege 1748 WMIC.exe Token: SeShutdownPrivilege 1748 WMIC.exe Token: SeDebugPrivilege 1748 WMIC.exe Token: SeSystemEnvironmentPrivilege 1748 WMIC.exe Token: SeRemoteShutdownPrivilege 1748 WMIC.exe Token: SeUndockPrivilege 1748 WMIC.exe Token: SeManageVolumePrivilege 1748 WMIC.exe Token: 33 1748 WMIC.exe Token: 34 1748 WMIC.exe Token: 35 1748 WMIC.exe Token: 36 1748 WMIC.exe Token: SeIncreaseQuotaPrivilege 1748 WMIC.exe Token: SeSecurityPrivilege 1748 WMIC.exe Token: SeTakeOwnershipPrivilege 1748 WMIC.exe Token: SeLoadDriverPrivilege 1748 WMIC.exe Token: SeSystemProfilePrivilege 1748 WMIC.exe Token: SeSystemtimePrivilege 1748 WMIC.exe Token: SeProfSingleProcessPrivilege 1748 WMIC.exe Token: SeIncBasePriorityPrivilege 1748 WMIC.exe Token: SeCreatePagefilePrivilege 1748 WMIC.exe Token: SeBackupPrivilege 1748 WMIC.exe Token: SeRestorePrivilege 1748 WMIC.exe Token: SeShutdownPrivilege 1748 WMIC.exe Token: SeDebugPrivilege 1748 WMIC.exe Token: SeSystemEnvironmentPrivilege 1748 WMIC.exe Token: SeRemoteShutdownPrivilege 1748 WMIC.exe Token: SeUndockPrivilege 1748 WMIC.exe Token: SeManageVolumePrivilege 1748 WMIC.exe Token: 33 1748 WMIC.exe Token: 34 1748 WMIC.exe Token: 35 1748 WMIC.exe Token: 36 1748 WMIC.exe Token: SeBackupPrivilege 4236 vssvc.exe Token: SeRestorePrivilege 4236 vssvc.exe Token: SeAuditPrivilege 4236 vssvc.exe Token: 33 1380 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1380 AUDIODG.EXE Token: SeDebugPrivilege 3472 taskkill.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
64afe55adefb842826b08effa0af8094_JaffaCakes118.exe64afe55adefb842826b08effa0af8094_JaffaCakes118.execmd.execmd.exedescription pid process target process PID 4652 wrote to memory of 1912 4652 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 4652 wrote to memory of 1912 4652 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 4652 wrote to memory of 1912 4652 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 4652 wrote to memory of 1912 4652 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 4652 wrote to memory of 1912 4652 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 4652 wrote to memory of 1912 4652 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 4652 wrote to memory of 1912 4652 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 4652 wrote to memory of 1912 4652 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 4652 wrote to memory of 1912 4652 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 4652 wrote to memory of 1912 4652 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe PID 1912 wrote to memory of 3620 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe cmd.exe PID 1912 wrote to memory of 3620 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe cmd.exe PID 3620 wrote to memory of 1748 3620 cmd.exe WMIC.exe PID 3620 wrote to memory of 1748 3620 cmd.exe WMIC.exe PID 1912 wrote to memory of 112 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe mshta.exe PID 1912 wrote to memory of 112 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe mshta.exe PID 1912 wrote to memory of 112 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe mshta.exe PID 1912 wrote to memory of 3712 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe cmd.exe PID 1912 wrote to memory of 3712 1912 64afe55adefb842826b08effa0af8094_JaffaCakes118.exe cmd.exe PID 3712 wrote to memory of 3472 3712 cmd.exe taskkill.exe PID 3712 wrote to memory of 3472 3712 cmd.exe taskkill.exe PID 3712 wrote to memory of 4092 3712 cmd.exe PING.EXE PID 3712 wrote to memory of 4092 3712 cmd.exe PING.EXE -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\64afe55adefb842826b08effa0af8094_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\64afe55adefb842826b08effa0af8094_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\64afe55adefb842826b08effa0af8094_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\64afe55adefb842826b08effa0af8094_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic.exe shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im "64afe55adefb842826b08effa0af8094_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x40c 0x2f41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsa6013.tmp\System.dllFilesize
11KB
MD5a436db0c473a087eb61ff5c53c34ba27
SHA165ea67e424e75f5065132b539c8b2eda88aa0506
SHA25675ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
-
C:\Users\Admin\AppData\Roaming\Addendum.HFilesize
189KB
MD579382b8ded97b3c296d13ec3174627c4
SHA10941ac3bcf63768986fc247587edf7b93ff14137
SHA25698d3bbb508f1e7dc27acc7820f91b6dfb4602bedaa76da8bca49ad33150524db
SHA51276eee44a156dc7183febf03978df9f378a2cbb873f5f70c9ed034dd78d07bae0ada72f022c1d07e9b828a9d14eeff7be994ecb77380ae91180ced57621a6eb5a
-
C:\Users\Admin\AppData\Roaming\NsResize.dllFilesize
28KB
MD5d53bd2d5591a78ea15b3bd59e2652bd6
SHA140968bcae13ee63469d241200679b25dfa5fdd4c
SHA2561734bceb77dab6739b80575fd7ee87c437327d8eb147339e1d93b7d3235c5394
SHA512c07bbab95251f16ac4b1c03e0324792b35badd111cced2e5c8e0de467226e572edfe5ca6e528c3494664f2569774f6a422806f54883cc2ef3726e21f4a011f5b
-
C:\Users\Admin\AppData\Roaming\article.appendix.title.properties.xmlFilesize
1KB
MD5adb1a285a2b926f98c062fbb74e1e992
SHA11f9799a61072673042a1a3da0fdf3fa93cf10f90
SHA2564ba4637bffa741ba5619c3de97b6c209b5a9deb330385efc7a588492a98b7b45
SHA512aa65628e34601645dfcdcb1f5f0347ae84555bd1a99432d4c25a50044dae932385bfa1f50551f6577d184de684f9264743facb53f4aa2e46bdfeff5c85bc6bd7
-
C:\Users\Admin\AppData\Roaming\btn-next-static.pngFilesize
3KB
MD520418349e7f8244ea53bc174b2ff9576
SHA1edb9087b6d85247ea0cad0060f540b0f890a80e1
SHA25635d36d6619e249e8bf4838098fd1770c78617e3019162aaca092f8fa37c82dcb
SHA512b12946ca17bb23403e106d561ae42d15695efde73eb4efb4099b57824c7ba0d2e331850022405f1d5da9502b568a217c06f259600cbbacc0d1c2b7210b31081f
-
C:\Users\Admin\Documents\OneNote Notebooks\README.htaFilesize
61KB
MD5acf33454ab73b9ef9e9c937ba9b38785
SHA1fdd849399578886905240a5f259866627ea8d812
SHA2565bc491df52ffaa77bfc8cb51f44daa9ce6ce91eebfa58f3ac413f9fcb75dc16d
SHA512a629849ac01326e4a7763b168ce5b27a6eea3558ade09347f65d9a3c01076bec0fcf988ee0d591ed09d53e1edb58edad64a8f25ad105bdab238ea38c377bbe41
-
memory/1912-772-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-781-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-40-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-39-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-33-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-32-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-27-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-591-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-26-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-769-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-24-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-775-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-778-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-34-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-784-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-787-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-790-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-793-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-796-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-799-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-802-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-805-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-808-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-811-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-814-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-820-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/1912-825-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB