Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 10:54
Static task
static1
Behavioral task
behavioral1
Sample
b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe
-
Size
314KB
-
MD5
b83ea939e613dd56cb93f4917e7d9d50
-
SHA1
121f18843dc6fe8779247ab0a931bd6840c67436
-
SHA256
38381aa1b897a8c4533a83fd5bfc60fdc9a839b568a26033649005dfc164ad75
-
SHA512
3ab8a22f6c6ca34dbd59b4ff37e4ee46cc607a5d1321cfbf263fbc17c6c670188feface18aa1729808911c6dee7013d36c90f4522f71f7a534d16ed2fb96e229
-
SSDEEP
6144:iz+92mhAMJ/cPl3i3SyLzZOxIEiAfwIfCipkMVwdz4gygrA2+atP3qqvQECNfXO8:iK2mhAMJ/cPlcZOlxfwIf1qMVwKMA2+N
Malware Config
Signatures
-
Detects PlugX payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/3064-23-0x00000000002F0000-0x0000000000320000-memory.dmp family_plugx behavioral1/memory/3064-24-0x00000000002F0000-0x0000000000320000-memory.dmp family_plugx behavioral1/memory/2536-43-0x0000000000320000-0x0000000000350000-memory.dmp family_plugx behavioral1/memory/2536-44-0x0000000000320000-0x0000000000350000-memory.dmp family_plugx behavioral1/memory/2512-48-0x0000000000640000-0x0000000000670000-memory.dmp family_plugx behavioral1/memory/2612-54-0x0000000000220000-0x0000000000250000-memory.dmp family_plugx behavioral1/memory/2612-77-0x0000000000220000-0x0000000000250000-memory.dmp family_plugx behavioral1/memory/3064-73-0x00000000002F0000-0x0000000000320000-memory.dmp family_plugx behavioral1/memory/2612-72-0x0000000000220000-0x0000000000250000-memory.dmp family_plugx behavioral1/memory/2612-71-0x0000000000220000-0x0000000000250000-memory.dmp family_plugx behavioral1/memory/2612-70-0x0000000000220000-0x0000000000250000-memory.dmp family_plugx behavioral1/memory/2612-56-0x0000000000220000-0x0000000000250000-memory.dmp family_plugx behavioral1/memory/2512-55-0x0000000000640000-0x0000000000670000-memory.dmp family_plugx behavioral1/memory/2612-78-0x0000000000220000-0x0000000000250000-memory.dmp family_plugx behavioral1/memory/2536-82-0x0000000000320000-0x0000000000350000-memory.dmp family_plugx behavioral1/memory/2612-83-0x0000000000220000-0x0000000000250000-memory.dmp family_plugx behavioral1/memory/2236-89-0x0000000000270000-0x00000000002A0000-memory.dmp family_plugx behavioral1/memory/2612-91-0x0000000000220000-0x0000000000250000-memory.dmp family_plugx behavioral1/memory/2236-93-0x0000000000270000-0x00000000002A0000-memory.dmp family_plugx behavioral1/memory/2236-94-0x0000000000270000-0x00000000002A0000-memory.dmp family_plugx -
Deletes itself 1 IoCs
Processes:
QQBrowserUpdateService.exepid process 3064 QQBrowserUpdateService.exe -
Executes dropped EXE 3 IoCs
Processes:
QQBrowserUpdateService.exeQQBrowserUpdateService.exeQQBrowserUpdateService.exepid process 3064 QQBrowserUpdateService.exe 2536 QQBrowserUpdateService.exe 2512 QQBrowserUpdateService.exe -
Loads dropped DLL 7 IoCs
Processes:
b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exeQQBrowserUpdateService.exeQQBrowserUpdateService.exeQQBrowserUpdateService.exepid process 1912 b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe 1912 b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe 1912 b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe 1912 b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe 3064 QQBrowserUpdateService.exe 2536 QQBrowserUpdateService.exe 2512 QQBrowserUpdateService.exe -
Drops file in System32 directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 33 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-35-88-e1-3d-52\WpadDecision = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C4650D3-5B5F-4777-84BE-2FC2F7559D24} svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C4650D3-5B5F-4777-84BE-2FC2F7559D24}\WpadDecision = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C4650D3-5B5F-4777-84BE-2FC2F7559D24}\WpadNetworkName = "Network 3" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-35-88-e1-3d-52\WpadDecisionTime = 00824ad3a4c0da01 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0056000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C4650D3-5B5F-4777-84BE-2FC2F7559D24}\WpadDecisionTime = 00824ad3a4c0da01 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C4650D3-5B5F-4777-84BE-2FC2F7559D24}\fa-35-88-e1-3d-52 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-35-88-e1-3d-52 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C4650D3-5B5F-4777-84BE-2FC2F7559D24}\WpadDecisionReason = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-35-88-e1-3d-52\WpadDecisionReason = "1" svchost.exe -
Modifies registry class 2 IoCs
Processes:
svchost.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 39004100390039003400370039004400350037003800300033004200310033000000 svchost.exe Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
QQBrowserUpdateService.exesvchost.exemsiexec.exepid process 3064 QQBrowserUpdateService.exe 2612 svchost.exe 2612 svchost.exe 2612 svchost.exe 2612 svchost.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2612 svchost.exe 2612 svchost.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2612 svchost.exe 2612 svchost.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2612 svchost.exe 2612 svchost.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2612 svchost.exe 2612 svchost.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2236 msiexec.exe 2612 svchost.exe 2612 svchost.exe 2236 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
svchost.exemsiexec.exepid process 2612 svchost.exe 2236 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
QQBrowserUpdateService.exeQQBrowserUpdateService.exeQQBrowserUpdateService.exesvchost.exemsiexec.exedescription pid process Token: SeDebugPrivilege 3064 QQBrowserUpdateService.exe Token: SeTcbPrivilege 3064 QQBrowserUpdateService.exe Token: SeDebugPrivilege 2536 QQBrowserUpdateService.exe Token: SeTcbPrivilege 2536 QQBrowserUpdateService.exe Token: SeDebugPrivilege 2512 QQBrowserUpdateService.exe Token: SeTcbPrivilege 2512 QQBrowserUpdateService.exe Token: SeDebugPrivilege 2612 svchost.exe Token: SeTcbPrivilege 2612 svchost.exe Token: SeDebugPrivilege 2236 msiexec.exe Token: SeTcbPrivilege 2236 msiexec.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exeQQBrowserUpdateService.exesvchost.exedescription pid process target process PID 1912 wrote to memory of 3064 1912 b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe QQBrowserUpdateService.exe PID 1912 wrote to memory of 3064 1912 b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe QQBrowserUpdateService.exe PID 1912 wrote to memory of 3064 1912 b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe QQBrowserUpdateService.exe PID 1912 wrote to memory of 3064 1912 b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe QQBrowserUpdateService.exe PID 1912 wrote to memory of 3064 1912 b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe QQBrowserUpdateService.exe PID 1912 wrote to memory of 3064 1912 b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe QQBrowserUpdateService.exe PID 1912 wrote to memory of 3064 1912 b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe QQBrowserUpdateService.exe PID 2512 wrote to memory of 2612 2512 QQBrowserUpdateService.exe svchost.exe PID 2512 wrote to memory of 2612 2512 QQBrowserUpdateService.exe svchost.exe PID 2512 wrote to memory of 2612 2512 QQBrowserUpdateService.exe svchost.exe PID 2512 wrote to memory of 2612 2512 QQBrowserUpdateService.exe svchost.exe PID 2512 wrote to memory of 2612 2512 QQBrowserUpdateService.exe svchost.exe PID 2512 wrote to memory of 2612 2512 QQBrowserUpdateService.exe svchost.exe PID 2512 wrote to memory of 2612 2512 QQBrowserUpdateService.exe svchost.exe PID 2512 wrote to memory of 2612 2512 QQBrowserUpdateService.exe svchost.exe PID 2512 wrote to memory of 2612 2512 QQBrowserUpdateService.exe svchost.exe PID 2612 wrote to memory of 2236 2612 svchost.exe msiexec.exe PID 2612 wrote to memory of 2236 2612 svchost.exe msiexec.exe PID 2612 wrote to memory of 2236 2612 svchost.exe msiexec.exe PID 2612 wrote to memory of 2236 2612 svchost.exe msiexec.exe PID 2612 wrote to memory of 2236 2612 svchost.exe msiexec.exe PID 2612 wrote to memory of 2236 2612 svchost.exe msiexec.exe PID 2612 wrote to memory of 2236 2612 svchost.exe msiexec.exe PID 2612 wrote to memory of 2236 2612 svchost.exe msiexec.exe PID 2612 wrote to memory of 2236 2612 svchost.exe msiexec.exe PID 2612 wrote to memory of 2236 2612 svchost.exe msiexec.exe PID 2612 wrote to memory of 2236 2612 svchost.exe msiexec.exe PID 2612 wrote to memory of 2236 2612 svchost.exe msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b83ea939e613dd56cb93f4917e7d9d50_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe"C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe" 100 30641⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe"C:\ProgramData\QQUpdater\QQBrowserUpdateService.exe" 200 01⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 201 02⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 26123⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\SxS\bug.logFilesize
622B
MD548ee62f0e96d2859bd486a77956cfe11
SHA16af9e7d180860236dfd836fcce59709f39d63026
SHA25678a67a5f511dfc1150dd4756f5993e3c4823873fccdbb1507f58a076bc2f909a
SHA5124ab5030d2d218cabb06a7873f1d8420f04c4f697b0de59c73d9d9336dd173969d89a262dcac8da87ee4ca219efb37ed263444513dd73072d2ffc3e6bd4b4a580
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowser.pakFilesize
120KB
MD5768fb7e913b66701a20cdea2abc7f884
SHA110e8ddf7333109b430ccaeb87ae644051d120f5e
SHA25692812f4d34aca0bd7c7e2f67abd2c1813546f2826ec3380fc45a5ea0822ea76b
SHA51219c261f9b6508288f0e88d1b9f6385d3393bcb92d6a31c521ea6a22955f17d02b9e1dc690812bdaa9a3ad84ba9929a5732529b78b0f6df560bca573170a23290
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\pdh.dllFilesize
8KB
MD52ab8934a0133f1cf3122b1bbab6de846
SHA14e0db9d32f99d724fdaa56d18e9fad687333f18a
SHA256462713911bac73ee904afab28d19f366b6b125ca7656144142654892319259fc
SHA512164075833213b164b722854252f5349fdae8cb9ba80028fde7670f5bb90b9dae34befd4e32ffc1cd11ae6cbad3fc3176e77a3a85cdf1583c73153387d6d831c5
-
\Users\Admin\AppData\Local\Temp\RarSFX0\QQBrowserUpdateService.exeFilesize
204KB
MD5bf8c7b6e88a049fda4ebd7407488aca6
SHA18b889494f25aafcef5e92b6cc7b2e0e0e217e60a
SHA25628e0bafc9b20c4a5104d558a36600098429e8ac779a46e52a28edd432e6457e2
SHA51235a72a887e4389bf7faa5ebe712d569301d03678816b2631712138628f03dd26430682a2ec656ae7167c19314f8c6dc162993789bdb0b3eca298f95c3f27da08
-
memory/2236-94-0x0000000000270000-0x00000000002A0000-memory.dmpFilesize
192KB
-
memory/2236-93-0x0000000000270000-0x00000000002A0000-memory.dmpFilesize
192KB
-
memory/2236-92-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/2236-89-0x0000000000270000-0x00000000002A0000-memory.dmpFilesize
192KB
-
memory/2512-55-0x0000000000640000-0x0000000000670000-memory.dmpFilesize
192KB
-
memory/2512-48-0x0000000000640000-0x0000000000670000-memory.dmpFilesize
192KB
-
memory/2536-43-0x0000000000320000-0x0000000000350000-memory.dmpFilesize
192KB
-
memory/2536-82-0x0000000000320000-0x0000000000350000-memory.dmpFilesize
192KB
-
memory/2536-44-0x0000000000320000-0x0000000000350000-memory.dmpFilesize
192KB
-
memory/2612-69-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB
-
memory/2612-78-0x0000000000220000-0x0000000000250000-memory.dmpFilesize
192KB
-
memory/2612-91-0x0000000000220000-0x0000000000250000-memory.dmpFilesize
192KB
-
memory/2612-72-0x0000000000220000-0x0000000000250000-memory.dmpFilesize
192KB
-
memory/2612-71-0x0000000000220000-0x0000000000250000-memory.dmpFilesize
192KB
-
memory/2612-70-0x0000000000220000-0x0000000000250000-memory.dmpFilesize
192KB
-
memory/2612-52-0x0000000000120000-0x000000000013D000-memory.dmpFilesize
116KB
-
memory/2612-56-0x0000000000220000-0x0000000000250000-memory.dmpFilesize
192KB
-
memory/2612-54-0x0000000000220000-0x0000000000250000-memory.dmpFilesize
192KB
-
memory/2612-77-0x0000000000220000-0x0000000000250000-memory.dmpFilesize
192KB
-
memory/2612-49-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/2612-83-0x0000000000220000-0x0000000000250000-memory.dmpFilesize
192KB
-
memory/2612-53-0x0000000000140000-0x0000000000142000-memory.dmpFilesize
8KB
-
memory/3064-73-0x00000000002F0000-0x0000000000320000-memory.dmpFilesize
192KB
-
memory/3064-24-0x00000000002F0000-0x0000000000320000-memory.dmpFilesize
192KB
-
memory/3064-23-0x00000000002F0000-0x0000000000320000-memory.dmpFilesize
192KB
-
memory/3064-22-0x0000000001E80000-0x0000000001F80000-memory.dmpFilesize
1024KB