Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 17:07
Static task
static1
Behavioral task
behavioral1
Sample
72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
HelpButton.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
HelpButton.dll
Resource
win10v2004-20240426-en
General
-
Target
72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe
-
Size
238KB
-
MD5
72a89af065438ca5baba4e6ff6dd9f02
-
SHA1
60f1d8c7866c5a0b7bd9d6c51d593749d4a41b8e
-
SHA256
42b93254b754f4c8b4db78da230bd219e3cf6444f46369764939a6829fa62bb4
-
SHA512
8fc72da127c683346206cd1afd94a816f508835095c79058ca78463bbaa03bfe8f71883d390de5b3f24390cbc491066760c546ddecbd3a75ecd328cdee369a4a
-
SSDEEP
3072:qNdm6/Xbi5XJCp451wmxx+4s/SO/qtr5gNsPGRBU/u57tieksOe3XpljAFTvMQ55:qn/L+2uwm3w6O/EgNp55lO3Tks
Malware Config
Extracted
C:\Users\Admin\Pictures\README.hta
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Contacts a large (531) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe -
Loads dropped DLL 4 IoCs
Processes:
72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exepid process 5096 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 5096 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 5096 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 5096 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpD4A1.bmp" 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exedescription pid process target process PID 5096 set thread context of 4488 5096 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe -
Drops file in Program Files directory 6 IoCs
Processes:
72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\PLANNERS.ONE 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\DESIGNER.ONE 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\README.hta 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BUSINESS.ONE 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\ACADEMIC.ONE 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BLANK.ONE 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
Processes:
72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\mucin 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe File opened for modification C:\Windows\prosperousness 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2196 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exepid process 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exeWMIC.exevssvc.exeAUDIODG.EXEtaskkill.exedescription pid process Token: SeDebugPrivilege 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2928 WMIC.exe Token: SeSecurityPrivilege 2928 WMIC.exe Token: SeTakeOwnershipPrivilege 2928 WMIC.exe Token: SeLoadDriverPrivilege 2928 WMIC.exe Token: SeSystemProfilePrivilege 2928 WMIC.exe Token: SeSystemtimePrivilege 2928 WMIC.exe Token: SeProfSingleProcessPrivilege 2928 WMIC.exe Token: SeIncBasePriorityPrivilege 2928 WMIC.exe Token: SeCreatePagefilePrivilege 2928 WMIC.exe Token: SeBackupPrivilege 2928 WMIC.exe Token: SeRestorePrivilege 2928 WMIC.exe Token: SeShutdownPrivilege 2928 WMIC.exe Token: SeDebugPrivilege 2928 WMIC.exe Token: SeSystemEnvironmentPrivilege 2928 WMIC.exe Token: SeRemoteShutdownPrivilege 2928 WMIC.exe Token: SeUndockPrivilege 2928 WMIC.exe Token: SeManageVolumePrivilege 2928 WMIC.exe Token: 33 2928 WMIC.exe Token: 34 2928 WMIC.exe Token: 35 2928 WMIC.exe Token: 36 2928 WMIC.exe Token: SeIncreaseQuotaPrivilege 2928 WMIC.exe Token: SeSecurityPrivilege 2928 WMIC.exe Token: SeTakeOwnershipPrivilege 2928 WMIC.exe Token: SeLoadDriverPrivilege 2928 WMIC.exe Token: SeSystemProfilePrivilege 2928 WMIC.exe Token: SeSystemtimePrivilege 2928 WMIC.exe Token: SeProfSingleProcessPrivilege 2928 WMIC.exe Token: SeIncBasePriorityPrivilege 2928 WMIC.exe Token: SeCreatePagefilePrivilege 2928 WMIC.exe Token: SeBackupPrivilege 2928 WMIC.exe Token: SeRestorePrivilege 2928 WMIC.exe Token: SeShutdownPrivilege 2928 WMIC.exe Token: SeDebugPrivilege 2928 WMIC.exe Token: SeSystemEnvironmentPrivilege 2928 WMIC.exe Token: SeRemoteShutdownPrivilege 2928 WMIC.exe Token: SeUndockPrivilege 2928 WMIC.exe Token: SeManageVolumePrivilege 2928 WMIC.exe Token: 33 2928 WMIC.exe Token: 34 2928 WMIC.exe Token: 35 2928 WMIC.exe Token: 36 2928 WMIC.exe Token: SeBackupPrivilege 4644 vssvc.exe Token: SeRestorePrivilege 4644 vssvc.exe Token: SeAuditPrivilege 4644 vssvc.exe Token: 33 3500 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3500 AUDIODG.EXE Token: SeDebugPrivilege 2196 taskkill.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.execmd.execmd.exedescription pid process target process PID 5096 wrote to memory of 4488 5096 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe PID 5096 wrote to memory of 4488 5096 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe PID 5096 wrote to memory of 4488 5096 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe PID 5096 wrote to memory of 4488 5096 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe PID 5096 wrote to memory of 4488 5096 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe PID 5096 wrote to memory of 4488 5096 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe PID 5096 wrote to memory of 4488 5096 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe PID 5096 wrote to memory of 4488 5096 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe PID 5096 wrote to memory of 4488 5096 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe PID 5096 wrote to memory of 4488 5096 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe PID 4488 wrote to memory of 1652 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe cmd.exe PID 4488 wrote to memory of 1652 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe cmd.exe PID 1652 wrote to memory of 2928 1652 cmd.exe WMIC.exe PID 1652 wrote to memory of 2928 1652 cmd.exe WMIC.exe PID 4488 wrote to memory of 3664 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe mshta.exe PID 4488 wrote to memory of 3664 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe mshta.exe PID 4488 wrote to memory of 3664 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe mshta.exe PID 4488 wrote to memory of 864 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe cmd.exe PID 4488 wrote to memory of 864 4488 72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe cmd.exe PID 864 wrote to memory of 2196 864 cmd.exe taskkill.exe PID 864 wrote to memory of 2196 864 cmd.exe taskkill.exe PID 864 wrote to memory of 1704 864 cmd.exe PING.EXE PID 864 wrote to memory of 1704 864 cmd.exe PING.EXE -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\wmic.exe shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\README.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /f /im "72a89af065438ca5baba4e6ff6dd9f02_JaffaCakes118.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\PING.EXEping -n 1 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4bc 0x2f41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsq8771.tmp\System.dllFilesize
11KB
MD5a436db0c473a087eb61ff5c53c34ba27
SHA165ea67e424e75f5065132b539c8b2eda88aa0506
SHA25675ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
SHA512908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
-
C:\Users\Admin\AppData\Roaming\HelpButton.dllFilesize
28KB
MD56a0cb229593ec529e5c7e62c67aa542f
SHA130888613c9f44d9fa4a0adb0e5d575343dce6be7
SHA256a7c597241392090a4d01e164db834fd5252d97fb9759be1d9684813aab68ae1e
SHA512d44855dfdb2f338373ec140b2cfb83141396cc0810dc684fdef26828fa63afff43116be89e4c8b31f99dd0c5c01b36d565b9b0dd2ab5ff1a41d405779a83bb4d
-
C:\Users\Admin\Pictures\README.htaFilesize
61KB
MD5ea6150127bdac29dc37fbccc0a262ee0
SHA1560c786871311da140b2bfc740760c66bd7cea02
SHA2566c421fbbb9a7f9a1879775c5df88816933f2a29e62897fa873a14acb510796c5
SHA512abc0d7337a06f46411596d80d46b59eb8f4feff074093b49980793d06712c34625222b95fa362b2ac68b085348016288f56416d80c5f8cced0026f5117aea8a6
-
memory/4488-732-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-741-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-26-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-31-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-32-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-33-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-39-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-38-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-24-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-384-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-729-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-22-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-735-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-25-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-738-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-750-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-744-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-747-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-762-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-759-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-756-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-765-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-753-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-768-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-771-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-774-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-781-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB
-
memory/4488-786-0x0000000000400000-0x0000000000431000-memory.dmpFilesize
196KB