Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 12:50
Static task
static1
Behavioral task
behavioral1
Sample
1a2ed9d7af030d031d31b5f8f0f6b9e3_JaffaCakes118.dll
Resource
win7-20240611-en
General
-
Target
1a2ed9d7af030d031d31b5f8f0f6b9e3_JaffaCakes118.dll
-
Size
166KB
-
MD5
1a2ed9d7af030d031d31b5f8f0f6b9e3
-
SHA1
50719a20b13ed790c8c3078661c986a0904f9cda
-
SHA256
1c704dd9911e951ff3dc85c249908e2cac465f5a06d706607e33b3d1b56c7d87
-
SHA512
64a82741af0086e71895ae1c44e3b5d2ac277d7d0622562969662ec2bab264f8b957e4711866445d22af7a73a5860707a7d22be5139aee22b5d97808f153e609
-
SSDEEP
3072:OTU56gVxj27NevROEuPvisOpkTv7L2GQ6uWr:l4wRj+qYvW4uWr
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 2168 regsvr32mgr.exe 2644 WaterMark.exe -
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exeregsvr32mgr.exepid process 2996 regsvr32.exe 2996 regsvr32.exe 2168 regsvr32mgr.exe 2168 regsvr32mgr.exe -
Processes:
resource yara_rule behavioral1/memory/2644-39-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2644-37-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2168-18-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2168-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2168-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2168-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2168-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2168-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2168-10-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2644-563-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
regsvr32.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exeregsvr32mgr.exedescription ioc process File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\RSSFeeds.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libtdummy_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\penusa.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe svchost.exe File opened for modification C:\Program Files\Internet Explorer\MemoryAnalyzer.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\libmosaic_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_transcode_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtospdif_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jsdt.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Windows.Presentation.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libfluidsynth_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegaudio_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe regsvr32mgr.exe File opened for modification C:\Program Files\Internet Explorer\jsprofilerui.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClient.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\logger\libfile_logger_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdarem.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\settings.html svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\logger\libconsole_logger_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libpanoramix_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\currency.html svchost.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libvcd_plugin.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Printing.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libscte18_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libgnutls_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libdav1d_plugin.dll svchost.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
WaterMark.exesvchost.exepid process 2644 WaterMark.exe 2644 WaterMark.exe 2644 WaterMark.exe 2644 WaterMark.exe 2644 WaterMark.exe 2644 WaterMark.exe 2644 WaterMark.exe 2644 WaterMark.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe 3060 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 2644 WaterMark.exe Token: SeDebugPrivilege 3060 svchost.exe Token: SeDebugPrivilege 2644 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 2168 regsvr32mgr.exe 2644 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32mgr.exeWaterMark.exesvchost.exedescription pid process target process PID 2792 wrote to memory of 2996 2792 regsvr32.exe regsvr32.exe PID 2792 wrote to memory of 2996 2792 regsvr32.exe regsvr32.exe PID 2792 wrote to memory of 2996 2792 regsvr32.exe regsvr32.exe PID 2792 wrote to memory of 2996 2792 regsvr32.exe regsvr32.exe PID 2792 wrote to memory of 2996 2792 regsvr32.exe regsvr32.exe PID 2792 wrote to memory of 2996 2792 regsvr32.exe regsvr32.exe PID 2792 wrote to memory of 2996 2792 regsvr32.exe regsvr32.exe PID 2996 wrote to memory of 2168 2996 regsvr32.exe regsvr32mgr.exe PID 2996 wrote to memory of 2168 2996 regsvr32.exe regsvr32mgr.exe PID 2996 wrote to memory of 2168 2996 regsvr32.exe regsvr32mgr.exe PID 2996 wrote to memory of 2168 2996 regsvr32.exe regsvr32mgr.exe PID 2168 wrote to memory of 2644 2168 regsvr32mgr.exe WaterMark.exe PID 2168 wrote to memory of 2644 2168 regsvr32mgr.exe WaterMark.exe PID 2168 wrote to memory of 2644 2168 regsvr32mgr.exe WaterMark.exe PID 2168 wrote to memory of 2644 2168 regsvr32mgr.exe WaterMark.exe PID 2644 wrote to memory of 2976 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 2976 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 2976 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 2976 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 2976 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 2976 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 2976 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 2976 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 2976 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 2976 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 3060 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 3060 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 3060 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 3060 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 3060 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 3060 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 3060 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 3060 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 3060 2644 WaterMark.exe svchost.exe PID 2644 wrote to memory of 3060 2644 WaterMark.exe svchost.exe PID 3060 wrote to memory of 256 3060 svchost.exe smss.exe PID 3060 wrote to memory of 256 3060 svchost.exe smss.exe PID 3060 wrote to memory of 256 3060 svchost.exe smss.exe PID 3060 wrote to memory of 256 3060 svchost.exe smss.exe PID 3060 wrote to memory of 256 3060 svchost.exe smss.exe PID 3060 wrote to memory of 336 3060 svchost.exe csrss.exe PID 3060 wrote to memory of 336 3060 svchost.exe csrss.exe PID 3060 wrote to memory of 336 3060 svchost.exe csrss.exe PID 3060 wrote to memory of 336 3060 svchost.exe csrss.exe PID 3060 wrote to memory of 336 3060 svchost.exe csrss.exe PID 3060 wrote to memory of 372 3060 svchost.exe wininit.exe PID 3060 wrote to memory of 372 3060 svchost.exe wininit.exe PID 3060 wrote to memory of 372 3060 svchost.exe wininit.exe PID 3060 wrote to memory of 372 3060 svchost.exe wininit.exe PID 3060 wrote to memory of 372 3060 svchost.exe wininit.exe PID 3060 wrote to memory of 384 3060 svchost.exe csrss.exe PID 3060 wrote to memory of 384 3060 svchost.exe csrss.exe PID 3060 wrote to memory of 384 3060 svchost.exe csrss.exe PID 3060 wrote to memory of 384 3060 svchost.exe csrss.exe PID 3060 wrote to memory of 384 3060 svchost.exe csrss.exe PID 3060 wrote to memory of 420 3060 svchost.exe winlogon.exe PID 3060 wrote to memory of 420 3060 svchost.exe winlogon.exe PID 3060 wrote to memory of 420 3060 svchost.exe winlogon.exe PID 3060 wrote to memory of 420 3060 svchost.exe winlogon.exe PID 3060 wrote to memory of 420 3060 svchost.exe winlogon.exe PID 3060 wrote to memory of 468 3060 svchost.exe services.exe PID 3060 wrote to memory of 468 3060 svchost.exe services.exe PID 3060 wrote to memory of 468 3060 svchost.exe services.exe PID 3060 wrote to memory of 468 3060 svchost.exe services.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1a2ed9d7af030d031d31b5f8f0f6b9e3_JaffaCakes118.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1a2ed9d7af030d031d31b5f8f0f6b9e3_JaffaCakes118.dll3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.htmlFilesize
206KB
MD5772cd7657e1169f37e6f0ad886f0395b
SHA166a02b0bb43a909287d79166558780c09edef7db
SHA2564a108f2cd873e0f5c02c840134999104abfc8dc383d83817f428e638af1e7c92
SHA5129d9e9be1fe9ddbb4c7cc3212f04524c7c4dc9c4f624d70660ae5126874567209008f4d9ea5dbb15642a3d07b71b2ce2a07963dae1e1093f6bbd5d9102377ddac
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.htmlFilesize
202KB
MD59456dd58a90ed2d951e5c14b0a4d47c3
SHA1d04ac393468faa1b98ccea7a0f7934c2bf3c5577
SHA256a9fdeb8c146c3d774e13a1cecfb65a2cfcb3cdd8c727f05b1edd84efc6af8900
SHA512412c1fc3427d5bf89ae1d6d2468257bd8b2ed915ae627efc689178760b5a5e44568cd9af14b17d4ca341e35eafdf2c93a53d5a62ddcb69e0d0898ffca6513fb2
-
memory/2168-10-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2168-11-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2168-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2168-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2168-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2168-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2168-17-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/2168-18-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2644-40-0x0000000077C9F000-0x0000000077CA0000-memory.dmpFilesize
4KB
-
memory/2644-563-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2644-38-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2644-39-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2644-68-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2644-37-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2976-51-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2976-44-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2976-52-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/2976-53-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2976-59-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2976-42-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2976-63-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2976-54-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/2996-1-0x0000000075130000-0x000000007515C000-memory.dmpFilesize
176KB
-
memory/2996-3-0x0000000000170000-0x00000000001A5000-memory.dmpFilesize
212KB
-
memory/3060-83-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/3060-85-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/3060-84-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/3060-86-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/3060-88-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/3060-87-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/3060-80-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/3060-70-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB