Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 10:38
Static task
static1
Behavioral task
behavioral1
Sample
b313bbe17bd5ee9c00acff3bfccdb48a_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
b313bbe17bd5ee9c00acff3bfccdb48a_JaffaCakes118.exe
-
Size
257KB
-
MD5
b313bbe17bd5ee9c00acff3bfccdb48a
-
SHA1
2efd3fc16f44525e4a1bb5f7c2e01e2a87b2cf04
-
SHA256
71f7a9da99b5e3c9520bc2cc73e520598d469be6539b3c243fb435fe02e44338
-
SHA512
2244a9b0a24d763c6bfff4c38957ba9d9bbeca43c7659f7e3589c9f11080fe0905883a77fe666892813167251e94ee2604b77c6cc48632f71ed4a9eb45094e10
-
SSDEEP
6144:yz+92mhAMJ/cPl3iej1LV3j+uHe9PoV9o2xjKHUkcVW:yK2mhAMJ/cPlfTX+Ao8/kco
Malware Config
Signatures
-
Detects PlugX payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2216-27-0x0000000000320000-0x0000000000359000-memory.dmp family_plugx behavioral1/memory/3024-46-0x0000000000450000-0x0000000000489000-memory.dmp family_plugx behavioral1/memory/2716-49-0x0000000000450000-0x0000000000489000-memory.dmp family_plugx behavioral1/memory/2528-55-0x0000000000250000-0x0000000000289000-memory.dmp family_plugx behavioral1/memory/2528-58-0x0000000000250000-0x0000000000289000-memory.dmp family_plugx behavioral1/memory/2528-71-0x0000000000250000-0x0000000000289000-memory.dmp family_plugx behavioral1/memory/2528-74-0x0000000000250000-0x0000000000289000-memory.dmp family_plugx behavioral1/memory/2528-73-0x0000000000250000-0x0000000000289000-memory.dmp family_plugx behavioral1/memory/2528-72-0x0000000000250000-0x0000000000289000-memory.dmp family_plugx behavioral1/memory/2528-69-0x0000000000250000-0x0000000000289000-memory.dmp family_plugx behavioral1/memory/2528-70-0x0000000000250000-0x0000000000289000-memory.dmp family_plugx behavioral1/memory/2216-57-0x0000000000320000-0x0000000000359000-memory.dmp family_plugx behavioral1/memory/2716-56-0x0000000000450000-0x0000000000489000-memory.dmp family_plugx behavioral1/memory/3024-77-0x0000000000450000-0x0000000000489000-memory.dmp family_plugx behavioral1/memory/2104-85-0x00000000008D0000-0x0000000000909000-memory.dmp family_plugx behavioral1/memory/2104-83-0x00000000008D0000-0x0000000000909000-memory.dmp family_plugx behavioral1/memory/2104-86-0x00000000008D0000-0x0000000000909000-memory.dmp family_plugx behavioral1/memory/2528-87-0x0000000000250000-0x0000000000289000-memory.dmp family_plugx behavioral1/memory/2528-88-0x0000000000250000-0x0000000000289000-memory.dmp family_plugx behavioral1/memory/2528-89-0x0000000000250000-0x0000000000289000-memory.dmp family_plugx -
Deletes itself 1 IoCs
Processes:
Nv.exepid process 2216 Nv.exe -
Executes dropped EXE 3 IoCs
Processes:
Nv.exeNv.exeNv.exepid process 2216 Nv.exe 3024 Nv.exe 2716 Nv.exe -
Loads dropped DLL 8 IoCs
Processes:
b313bbe17bd5ee9c00acff3bfccdb48a_JaffaCakes118.exeNv.exeNv.exeNv.exepid process 2580 b313bbe17bd5ee9c00acff3bfccdb48a_JaffaCakes118.exe 2580 b313bbe17bd5ee9c00acff3bfccdb48a_JaffaCakes118.exe 2580 b313bbe17bd5ee9c00acff3bfccdb48a_JaffaCakes118.exe 2580 b313bbe17bd5ee9c00acff3bfccdb48a_JaffaCakes118.exe 2580 b313bbe17bd5ee9c00acff3bfccdb48a_JaffaCakes118.exe 2216 Nv.exe 3024 Nv.exe 2716 Nv.exe -
Drops file in System32 directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 37 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{43C94297-09D6-4250-A7D2-668F5D09A1EB} svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{43C94297-09D6-4250-A7D2-668F5D09A1EB}\WpadDecision = "0" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-54-90-6c-76-2f\WpadDecisionTime = 20063462d9bfda01 svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-54-90-6c-76-2f\WpadDecisionReason = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{43C94297-09D6-4250-A7D2-668F5D09A1EB}\WpadNetworkName = "Network 3" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0022000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-54-90-6c-76-2f\WpadDecisionTime = a06910a2d9bfda01 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{43C94297-09D6-4250-A7D2-668F5D09A1EB}\WpadDecisionTime = 20063462d9bfda01 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-54-90-6c-76-2f svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0022000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-54-90-6c-76-2f\WpadDetectedUrl svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{43C94297-09D6-4250-A7D2-668F5D09A1EB}\WpadDecisionReason = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{43C94297-09D6-4250-A7D2-668F5D09A1EB}\aa-54-90-6c-76-2f svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-54-90-6c-76-2f\WpadDecision = "0" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{43C94297-09D6-4250-A7D2-668F5D09A1EB}\WpadDecisionTime = a06910a2d9bfda01 svchost.exe -
Modifies registry class 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 38003200330033004500340031003300350039003700330046004600360038000000 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Nv.exesvchost.exemsiexec.exepid process 2216 Nv.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2528 svchost.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2528 svchost.exe 2528 svchost.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2528 svchost.exe 2528 svchost.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2528 svchost.exe 2528 svchost.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2528 svchost.exe 2528 svchost.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2104 msiexec.exe 2528 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
svchost.exemsiexec.exepid process 2528 svchost.exe 2104 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
Nv.exeNv.exeNv.exesvchost.exemsiexec.exedescription pid process Token: SeDebugPrivilege 2216 Nv.exe Token: SeTcbPrivilege 2216 Nv.exe Token: SeDebugPrivilege 3024 Nv.exe Token: SeTcbPrivilege 3024 Nv.exe Token: SeDebugPrivilege 2716 Nv.exe Token: SeTcbPrivilege 2716 Nv.exe Token: SeDebugPrivilege 2528 svchost.exe Token: SeTcbPrivilege 2528 svchost.exe Token: SeDebugPrivilege 2104 msiexec.exe Token: SeTcbPrivilege 2104 msiexec.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
b313bbe17bd5ee9c00acff3bfccdb48a_JaffaCakes118.exeNv.exesvchost.exedescription pid process target process PID 2580 wrote to memory of 2216 2580 b313bbe17bd5ee9c00acff3bfccdb48a_JaffaCakes118.exe Nv.exe PID 2580 wrote to memory of 2216 2580 b313bbe17bd5ee9c00acff3bfccdb48a_JaffaCakes118.exe Nv.exe PID 2580 wrote to memory of 2216 2580 b313bbe17bd5ee9c00acff3bfccdb48a_JaffaCakes118.exe Nv.exe PID 2580 wrote to memory of 2216 2580 b313bbe17bd5ee9c00acff3bfccdb48a_JaffaCakes118.exe Nv.exe PID 2580 wrote to memory of 2216 2580 b313bbe17bd5ee9c00acff3bfccdb48a_JaffaCakes118.exe Nv.exe PID 2580 wrote to memory of 2216 2580 b313bbe17bd5ee9c00acff3bfccdb48a_JaffaCakes118.exe Nv.exe PID 2580 wrote to memory of 2216 2580 b313bbe17bd5ee9c00acff3bfccdb48a_JaffaCakes118.exe Nv.exe PID 2716 wrote to memory of 2528 2716 Nv.exe svchost.exe PID 2716 wrote to memory of 2528 2716 Nv.exe svchost.exe PID 2716 wrote to memory of 2528 2716 Nv.exe svchost.exe PID 2716 wrote to memory of 2528 2716 Nv.exe svchost.exe PID 2716 wrote to memory of 2528 2716 Nv.exe svchost.exe PID 2716 wrote to memory of 2528 2716 Nv.exe svchost.exe PID 2716 wrote to memory of 2528 2716 Nv.exe svchost.exe PID 2716 wrote to memory of 2528 2716 Nv.exe svchost.exe PID 2716 wrote to memory of 2528 2716 Nv.exe svchost.exe PID 2528 wrote to memory of 2104 2528 svchost.exe msiexec.exe PID 2528 wrote to memory of 2104 2528 svchost.exe msiexec.exe PID 2528 wrote to memory of 2104 2528 svchost.exe msiexec.exe PID 2528 wrote to memory of 2104 2528 svchost.exe msiexec.exe PID 2528 wrote to memory of 2104 2528 svchost.exe msiexec.exe PID 2528 wrote to memory of 2104 2528 svchost.exe msiexec.exe PID 2528 wrote to memory of 2104 2528 svchost.exe msiexec.exe PID 2528 wrote to memory of 2104 2528 svchost.exe msiexec.exe PID 2528 wrote to memory of 2104 2528 svchost.exe msiexec.exe PID 2528 wrote to memory of 2104 2528 svchost.exe msiexec.exe PID 2528 wrote to memory of 2104 2528 svchost.exe msiexec.exe PID 2528 wrote to memory of 2104 2528 svchost.exe msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b313bbe17bd5ee9c00acff3bfccdb48a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b313bbe17bd5ee9c00acff3bfccdb48a_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Nv.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Nv.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\SxS\Nv.exe"C:\ProgramData\SxS\Nv.exe" 100 22161⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\SxS\Nv.exe"C:\ProgramData\SxS\Nv.exe" 200 01⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 201 02⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 25283⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmartMax.dllFilesize
7KB
MD50aa39c6eafc45d18d4a15f1ed6dff6a8
SHA1daa921673a22a6b3c03e311e51d7e74ac1710fc2
SHA2565e2ca5276edc4f5df39b40733acfd1298192432a66fa477ac32056a473a4636a
SHA5120c107b57fd7678c169f62a085a90f5ad6eed56b431c5a67fd2c195b1960a2a38f19e9d1e2bff8b3a0cc39c7ae32608459b82f91e99a6852d059ad6567c22ec6e
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\NvSmartMax.dll.URLFilesize
131KB
MD5bbb5f685f91b0d0d8e272d1c23911e19
SHA1aa2154c4549e37397588f3a38b1d0f906bc87e9a
SHA25629641dccedf3a220524ce2fff5d1fa48576aa92de9dfc4ec3da39ca5bf5d8bdd
SHA51286f8dd3b9a904ae5a687be5370ced5bcb677608747c4f5576435a3d421a9e49d3101056bf09fb76711800cc6f1f0dbe78da7cdcb0c0329b7866c432a2317d69c
-
\Users\Admin\AppData\Local\Temp\RarSFX0\Nv.exeFilesize
46KB
MD509b8b54f78a10c435cd319070aa13c28
SHA16474d0369f97e72e01e4971128d1062f5c2b3656
SHA256523d28df917f9d265cd2c0d38df26277bc56a535145100ed82e6f5fdeaae7256
SHA512c1f2f5c4aa5eb55d255e22db032da954a38a0204fb4d9bc76042f140f1b1e171944aa09b0eb11159323a8b9f33974c73fd32a4f76d976aaa8a16cc9c60a34ca7
-
memory/2104-86-0x00000000008D0000-0x0000000000909000-memory.dmpFilesize
228KB
-
memory/2104-83-0x00000000008D0000-0x0000000000909000-memory.dmpFilesize
228KB
-
memory/2104-85-0x00000000008D0000-0x0000000000909000-memory.dmpFilesize
228KB
-
memory/2104-84-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/2216-26-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/2216-25-0x0000000000401000-0x0000000000402000-memory.dmpFilesize
4KB
-
memory/2216-27-0x0000000000320000-0x0000000000359000-memory.dmpFilesize
228KB
-
memory/2216-57-0x0000000000320000-0x0000000000359000-memory.dmpFilesize
228KB
-
memory/2528-71-0x0000000000250000-0x0000000000289000-memory.dmpFilesize
228KB
-
memory/2528-70-0x0000000000250000-0x0000000000289000-memory.dmpFilesize
228KB
-
memory/2528-58-0x0000000000250000-0x0000000000289000-memory.dmpFilesize
228KB
-
memory/2528-50-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2528-74-0x0000000000250000-0x0000000000289000-memory.dmpFilesize
228KB
-
memory/2528-73-0x0000000000250000-0x0000000000289000-memory.dmpFilesize
228KB
-
memory/2528-72-0x0000000000250000-0x0000000000289000-memory.dmpFilesize
228KB
-
memory/2528-69-0x0000000000250000-0x0000000000289000-memory.dmpFilesize
228KB
-
memory/2528-68-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB
-
memory/2528-55-0x0000000000250000-0x0000000000289000-memory.dmpFilesize
228KB
-
memory/2528-53-0x00000000000A0000-0x00000000000C0000-memory.dmpFilesize
128KB
-
memory/2528-89-0x0000000000250000-0x0000000000289000-memory.dmpFilesize
228KB
-
memory/2528-88-0x0000000000250000-0x0000000000289000-memory.dmpFilesize
228KB
-
memory/2528-54-0x00000000000C0000-0x00000000000C2000-memory.dmpFilesize
8KB
-
memory/2528-87-0x0000000000250000-0x0000000000289000-memory.dmpFilesize
228KB
-
memory/2716-49-0x0000000000450000-0x0000000000489000-memory.dmpFilesize
228KB
-
memory/2716-56-0x0000000000450000-0x0000000000489000-memory.dmpFilesize
228KB
-
memory/3024-46-0x0000000000450000-0x0000000000489000-memory.dmpFilesize
228KB
-
memory/3024-45-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/3024-77-0x0000000000450000-0x0000000000489000-memory.dmpFilesize
228KB