Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 19:39
Static task
static1
Behavioral task
behavioral1
Sample
1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe
-
Size
95KB
-
MD5
1747bd6ec5a7f0885dd83f81bf5e217d
-
SHA1
561ffdedb67a0099b1cf234cf0eb8afaacf49a04
-
SHA256
de5f9b20738114231dac80a55bc3e0f2f1e2e7d27a84cf98f171aff34de05838
-
SHA512
461a20c9c23a54cbb22c65b975ca420aa0d2033d451ed494f6dc25e6969059ba9fda6523b4a78bff78bee137f27b3af84621d0f3b45c15f2033243dfea6368d4
-
SSDEEP
768:W06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9Y:0R0vxn3Pc0LCH9MtbvabUDzJYWu3B
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
WaterMark.exepid process 2460 WaterMark.exe -
Loads dropped DLL 2 IoCs
Processes:
1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exepid process 1708 1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe 1708 1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/1708-0-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1708-1-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1708-3-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1708-8-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1708-7-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1708-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2460-29-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1708-2-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2460-538-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libwin_hotkeys_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\Microsoft.Ink.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\mozglue.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libwall_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadds.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Xml.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationCore.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudiobargraph_a_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icudt36.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libes_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmkv_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libflac_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_nv12_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGM.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\mlib_image.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\tpcps.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe svchost.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\ChkrRes.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODEXL.DLL svchost.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libamem_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_a52_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libclone_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\msdatl3.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Client.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\librist_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXSLE.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\vdk150.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libtextst_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmotiondetect_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_bridge_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\cpu.html svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
WaterMark.exesvchost.exepid process 2460 WaterMark.exe 2460 WaterMark.exe 2460 WaterMark.exe 2460 WaterMark.exe 2460 WaterMark.exe 2460 WaterMark.exe 2460 WaterMark.exe 2460 WaterMark.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe 2484 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 2460 WaterMark.exe Token: SeDebugPrivilege 2484 svchost.exe Token: SeDebugPrivilege 2460 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exeWaterMark.exepid process 1708 1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe 2460 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exeWaterMark.exesvchost.exedescription pid process target process PID 1708 wrote to memory of 2460 1708 1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe WaterMark.exe PID 1708 wrote to memory of 2460 1708 1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe WaterMark.exe PID 1708 wrote to memory of 2460 1708 1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe WaterMark.exe PID 1708 wrote to memory of 2460 1708 1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe WaterMark.exe PID 2460 wrote to memory of 2712 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2712 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2712 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2712 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2712 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2712 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2712 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2712 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2712 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2712 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2484 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2484 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2484 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2484 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2484 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2484 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2484 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2484 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2484 2460 WaterMark.exe svchost.exe PID 2460 wrote to memory of 2484 2460 WaterMark.exe svchost.exe PID 2484 wrote to memory of 256 2484 svchost.exe smss.exe PID 2484 wrote to memory of 256 2484 svchost.exe smss.exe PID 2484 wrote to memory of 256 2484 svchost.exe smss.exe PID 2484 wrote to memory of 256 2484 svchost.exe smss.exe PID 2484 wrote to memory of 256 2484 svchost.exe smss.exe PID 2484 wrote to memory of 332 2484 svchost.exe csrss.exe PID 2484 wrote to memory of 332 2484 svchost.exe csrss.exe PID 2484 wrote to memory of 332 2484 svchost.exe csrss.exe PID 2484 wrote to memory of 332 2484 svchost.exe csrss.exe PID 2484 wrote to memory of 332 2484 svchost.exe csrss.exe PID 2484 wrote to memory of 380 2484 svchost.exe wininit.exe PID 2484 wrote to memory of 380 2484 svchost.exe wininit.exe PID 2484 wrote to memory of 380 2484 svchost.exe wininit.exe PID 2484 wrote to memory of 380 2484 svchost.exe wininit.exe PID 2484 wrote to memory of 380 2484 svchost.exe wininit.exe PID 2484 wrote to memory of 388 2484 svchost.exe csrss.exe PID 2484 wrote to memory of 388 2484 svchost.exe csrss.exe PID 2484 wrote to memory of 388 2484 svchost.exe csrss.exe PID 2484 wrote to memory of 388 2484 svchost.exe csrss.exe PID 2484 wrote to memory of 388 2484 svchost.exe csrss.exe PID 2484 wrote to memory of 428 2484 svchost.exe winlogon.exe PID 2484 wrote to memory of 428 2484 svchost.exe winlogon.exe PID 2484 wrote to memory of 428 2484 svchost.exe winlogon.exe PID 2484 wrote to memory of 428 2484 svchost.exe winlogon.exe PID 2484 wrote to memory of 428 2484 svchost.exe winlogon.exe PID 2484 wrote to memory of 472 2484 svchost.exe services.exe PID 2484 wrote to memory of 472 2484 svchost.exe services.exe PID 2484 wrote to memory of 472 2484 svchost.exe services.exe PID 2484 wrote to memory of 472 2484 svchost.exe services.exe PID 2484 wrote to memory of 472 2484 svchost.exe services.exe PID 2484 wrote to memory of 488 2484 svchost.exe lsass.exe PID 2484 wrote to memory of 488 2484 svchost.exe lsass.exe PID 2484 wrote to memory of 488 2484 svchost.exe lsass.exe PID 2484 wrote to memory of 488 2484 svchost.exe lsass.exe PID 2484 wrote to memory of 488 2484 svchost.exe lsass.exe PID 2484 wrote to memory of 496 2484 svchost.exe lsm.exe PID 2484 wrote to memory of 496 2484 svchost.exe lsm.exe PID 2484 wrote to memory of 496 2484 svchost.exe lsm.exe PID 2484 wrote to memory of 496 2484 svchost.exe lsm.exe PID 2484 wrote to memory of 496 2484 svchost.exe lsm.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118.exe"2⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.htmlFilesize
204KB
MD56296a074664c222e4effeec6b59a8be7
SHA1747a9842b019e0209b784f8b1134bb1db3ce71d7
SHA2569d9bb251d4c6c99e642fa0bc539d9af824bfc6800a68cb9646ab167375e881d7
SHA512b2c6d10cd6c48db6d4f71c5bb88a7466db7ef9b755050a3f01f844451d420193128bae3000492a910a808e322b0cd8e6b0abe466529a2dcb10853f7b0d70928a
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.htmlFilesize
200KB
MD5ed057269474415a836e8c82aa4328945
SHA189851c72649d431290c36a5c00d055c257084914
SHA256e90a7354155d41644095882f463246e00c564615ceca6dd85a9c29a7800c072b
SHA512aa8c20cfbb3e11795c6089dfcb83adf55699180de1b9b53f60ebcb8e19e0a5847c8b951c7bae7ef9f1b770823189281bbf99e81fa4b760d725813638faf6968b
-
\Program Files (x86)\Microsoft\WaterMark.exeFilesize
95KB
MD51747bd6ec5a7f0885dd83f81bf5e217d
SHA1561ffdedb67a0099b1cf234cf0eb8afaacf49a04
SHA256de5f9b20738114231dac80a55bc3e0f2f1e2e7d27a84cf98f171aff34de05838
SHA512461a20c9c23a54cbb22c65b975ca420aa0d2033d451ed494f6dc25e6969059ba9fda6523b4a78bff78bee137f27b3af84621d0f3b45c15f2033243dfea6368d4
-
memory/1708-4-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1708-2-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1708-10-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1708-5-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/1708-8-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1708-0-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1708-1-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1708-3-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1708-7-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2460-59-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2460-27-0x0000000000430000-0x0000000000431000-memory.dmpFilesize
4KB
-
memory/2460-29-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2460-30-0x000000007785F000-0x0000000077860000-memory.dmpFilesize
4KB
-
memory/2460-538-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2460-19-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/2460-70-0x000000007785F000-0x0000000077860000-memory.dmpFilesize
4KB
-
memory/2484-71-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2484-76-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/2484-85-0x0000000077860000-0x0000000077861000-memory.dmpFilesize
4KB
-
memory/2484-79-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2484-80-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2484-61-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2484-78-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2484-75-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2484-77-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/2712-45-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/2712-47-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/2712-48-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2712-46-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2712-55-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2712-50-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2712-41-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2712-981-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2712-34-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2712-32-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB