Analysis
-
max time kernel
63s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22-08-2024 13:19
Static task
static1
Behavioral task
behavioral1
Sample
b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe
-
Size
400KB
-
MD5
b7c9f4aa2997f249de6399cdaf45b9c4
-
SHA1
660ffed712239cbc28e98734cbd58e8530b0e235
-
SHA256
3f8d97689244074e678c6bd0930ee8f97788b625e5de04f87c6fa5536c9d4f1c
-
SHA512
7da303c64aeca38af16ec9aa1ddc6e9b18388ae59e705472b913b066fb732151396089b277083fb2edaff5fa7319db8e3336b9ac377e73739974bb7efa81dbb5
-
SSDEEP
12288:bV5YH45cBHGc3CvZIgrNUoJWPCZHBe5UMPw3:ZK45IGc3EeINUoJWPCVBow3
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\ANTIVIRUS = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe" b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ANTIVIRUS = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe" b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exedescription ioc process File opened for modification \??\PhysicalDrive0 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 29 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exedescription ioc process Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Signature b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform ID b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Signature b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform ID b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Signature b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 45 IoCs
Processes:
b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exedescription ioc process Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Configuration Data b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BootArchitecture b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\PreferredProfile b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Component Information b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Configuration Data b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Component Information b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Component Information b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Identifier b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Capabilities b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Configuration Data b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Identifier b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe -
Processes:
b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe -
Modifies registry class 3 IoCs
Processes:
b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exepid process 624 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exepid process 624 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exepid process 624 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe 624 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe 624 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe 624 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe 624 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe 624 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe 624 b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b7c9f4aa2997f249de6399cdaf45b9c4_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/624-0-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/624-1-0x0000000000340000-0x0000000000375000-memory.dmpFilesize
212KB
-
memory/624-3-0x00000000004A0000-0x00000000004A1000-memory.dmpFilesize
4KB
-
memory/624-2-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/624-4-0x00000000004A0000-0x00000000004A1000-memory.dmpFilesize
4KB
-
memory/624-13-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/624-17-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/624-16-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/624-15-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/624-14-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/624-12-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/624-11-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/624-10-0x00000000004A0000-0x00000000004A1000-memory.dmpFilesize
4KB
-
memory/624-9-0x00000000004A0000-0x00000000004A1000-memory.dmpFilesize
4KB
-
memory/624-8-0x00000000004A0000-0x00000000004A1000-memory.dmpFilesize
4KB
-
memory/624-7-0x00000000004A0000-0x00000000004A1000-memory.dmpFilesize
4KB
-
memory/624-6-0x00000000004A0000-0x00000000004A1000-memory.dmpFilesize
4KB
-
memory/624-5-0x00000000004A0000-0x00000000004A1000-memory.dmpFilesize
4KB
-
memory/624-18-0x00000000003F0000-0x00000000003F5000-memory.dmpFilesize
20KB
-
memory/624-19-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/624-20-0x00000000004F0000-0x00000000004F1000-memory.dmpFilesize
4KB
-
memory/624-21-0x00000000003E0000-0x00000000003E5000-memory.dmpFilesize
20KB
-
memory/624-22-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/624-30-0x00000000004A0000-0x00000000004A1000-memory.dmpFilesize
4KB
-
memory/624-29-0x00000000004B0000-0x00000000004B1000-memory.dmpFilesize
4KB
-
memory/624-28-0x00000000004C0000-0x00000000004C1000-memory.dmpFilesize
4KB
-
memory/624-27-0x00000000004D0000-0x00000000004D1000-memory.dmpFilesize
4KB
-
memory/624-26-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/624-25-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/624-24-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/624-23-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/624-32-0x0000000000340000-0x0000000000375000-memory.dmpFilesize
212KB
-
memory/624-33-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/624-83-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/624-84-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/624-85-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/624-86-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/624-87-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/624-88-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/624-89-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/624-102-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/624-103-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/624-104-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/624-105-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/624-106-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/624-107-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/624-108-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/624-109-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB