Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 22:32
Static task
static1
Behavioral task
behavioral1
Sample
1cbee330bd30b6f7e9e35c785f7fa528_JaffaCakes118.dll
Resource
win7-20240611-en
General
-
Target
1cbee330bd30b6f7e9e35c785f7fa528_JaffaCakes118.dll
-
Size
166KB
-
MD5
1cbee330bd30b6f7e9e35c785f7fa528
-
SHA1
469a33d5e021e1b20aa903c93b3fb06f5529daf9
-
SHA256
5ef4a3a3d5e1f3b2a40f5893063b3253c51b31f37cedf5e41ef356d8b807d5ed
-
SHA512
cd18e0cbd6d0b586ca1fdf8ad9d0f0431c8ac6127c4d4d677973818e9bbb8e0554119abefcfb5a5dbf120a49a2e4626969f41f16282bf8b7d3070d36570b7625
-
SSDEEP
3072:1TU56gVxj27Ne4L99ZgyXf9MWebpjMGlDCdr1:i4L7vBsGd1
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 1888 regsvr32mgr.exe 2608 WaterMark.exe -
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exeregsvr32mgr.exepid process 1896 regsvr32.exe 1896 regsvr32.exe 1888 regsvr32mgr.exe 1888 regsvr32mgr.exe -
Processes:
resource yara_rule behavioral1/memory/1888-14-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2608-39-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2608-38-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1888-21-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1888-16-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1888-15-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1888-13-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1888-12-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1888-11-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/2608-565-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
regsvr32.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 64 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libfingerprinter_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll svchost.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Defender\MsMpLics.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_description_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\wab32.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe svchost.exe File opened for modification C:\Program Files\Internet Explorer\jsprofilerui.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Design.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\libremoteosd_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libadjust_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jdwp.dll svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jsound.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\liboldmovie_plugin.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icudt36.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_pitch_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libtwolame_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Defender\MsMpCom.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libvcd_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\JavaAccessBridge-64.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\liblogger_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe svchost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqloledb.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunmscapi.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html svchost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll svchost.exe File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextService.dll svchost.exe File opened for modification C:\Program Files\Windows Portable Devices\sqmapi.dll svchost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIBUtils.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsdl_image_plugin.dll svchost.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
WaterMark.exesvchost.exepid process 2608 WaterMark.exe 2608 WaterMark.exe 2608 WaterMark.exe 2608 WaterMark.exe 2608 WaterMark.exe 2608 WaterMark.exe 2608 WaterMark.exe 2608 WaterMark.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe 3020 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WaterMark.exesvchost.exedescription pid process Token: SeDebugPrivilege 2608 WaterMark.exe Token: SeDebugPrivilege 3020 svchost.exe Token: SeDebugPrivilege 2608 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
regsvr32mgr.exeWaterMark.exepid process 1888 regsvr32mgr.exe 2608 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32mgr.exeWaterMark.exesvchost.exedescription pid process target process PID 2208 wrote to memory of 1896 2208 regsvr32.exe regsvr32.exe PID 2208 wrote to memory of 1896 2208 regsvr32.exe regsvr32.exe PID 2208 wrote to memory of 1896 2208 regsvr32.exe regsvr32.exe PID 2208 wrote to memory of 1896 2208 regsvr32.exe regsvr32.exe PID 2208 wrote to memory of 1896 2208 regsvr32.exe regsvr32.exe PID 2208 wrote to memory of 1896 2208 regsvr32.exe regsvr32.exe PID 2208 wrote to memory of 1896 2208 regsvr32.exe regsvr32.exe PID 1896 wrote to memory of 1888 1896 regsvr32.exe regsvr32mgr.exe PID 1896 wrote to memory of 1888 1896 regsvr32.exe regsvr32mgr.exe PID 1896 wrote to memory of 1888 1896 regsvr32.exe regsvr32mgr.exe PID 1896 wrote to memory of 1888 1896 regsvr32.exe regsvr32mgr.exe PID 1888 wrote to memory of 2608 1888 regsvr32mgr.exe WaterMark.exe PID 1888 wrote to memory of 2608 1888 regsvr32mgr.exe WaterMark.exe PID 1888 wrote to memory of 2608 1888 regsvr32mgr.exe WaterMark.exe PID 1888 wrote to memory of 2608 1888 regsvr32mgr.exe WaterMark.exe PID 2608 wrote to memory of 2924 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 2924 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 2924 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 2924 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 2924 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 2924 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 2924 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 2924 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 2924 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 2924 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 3020 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 3020 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 3020 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 3020 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 3020 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 3020 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 3020 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 3020 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 3020 2608 WaterMark.exe svchost.exe PID 2608 wrote to memory of 3020 2608 WaterMark.exe svchost.exe PID 3020 wrote to memory of 256 3020 svchost.exe smss.exe PID 3020 wrote to memory of 256 3020 svchost.exe smss.exe PID 3020 wrote to memory of 256 3020 svchost.exe smss.exe PID 3020 wrote to memory of 256 3020 svchost.exe smss.exe PID 3020 wrote to memory of 256 3020 svchost.exe smss.exe PID 3020 wrote to memory of 332 3020 svchost.exe csrss.exe PID 3020 wrote to memory of 332 3020 svchost.exe csrss.exe PID 3020 wrote to memory of 332 3020 svchost.exe csrss.exe PID 3020 wrote to memory of 332 3020 svchost.exe csrss.exe PID 3020 wrote to memory of 332 3020 svchost.exe csrss.exe PID 3020 wrote to memory of 368 3020 svchost.exe wininit.exe PID 3020 wrote to memory of 368 3020 svchost.exe wininit.exe PID 3020 wrote to memory of 368 3020 svchost.exe wininit.exe PID 3020 wrote to memory of 368 3020 svchost.exe wininit.exe PID 3020 wrote to memory of 368 3020 svchost.exe wininit.exe PID 3020 wrote to memory of 376 3020 svchost.exe csrss.exe PID 3020 wrote to memory of 376 3020 svchost.exe csrss.exe PID 3020 wrote to memory of 376 3020 svchost.exe csrss.exe PID 3020 wrote to memory of 376 3020 svchost.exe csrss.exe PID 3020 wrote to memory of 376 3020 svchost.exe csrss.exe PID 3020 wrote to memory of 416 3020 svchost.exe winlogon.exe PID 3020 wrote to memory of 416 3020 svchost.exe winlogon.exe PID 3020 wrote to memory of 416 3020 svchost.exe winlogon.exe PID 3020 wrote to memory of 416 3020 svchost.exe winlogon.exe PID 3020 wrote to memory of 416 3020 svchost.exe winlogon.exe PID 3020 wrote to memory of 460 3020 svchost.exe services.exe PID 3020 wrote to memory of 460 3020 svchost.exe services.exe PID 3020 wrote to memory of 460 3020 svchost.exe services.exe PID 3020 wrote to memory of 460 3020 svchost.exe services.exe
Processes
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}4⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1cbee330bd30b6f7e9e35c785f7fa528_JaffaCakes118.dll2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1cbee330bd30b6f7e9e35c785f7fa528_JaffaCakes118.dll3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.htmlFilesize
205KB
MD55f9e075e758677d3b7919b9534f97257
SHA1c3d243c613607a7ce16fc91548b10b0dfcc84010
SHA25620a620136214c1cff8002e7e4465d05949fc67413d02b4750b9529bd8390a6b7
SHA5129f9ee812c15e51ab7fd1212a08a86396425c6a4a94a91bb9973a849832c766f264e9863eec4dffcf7f36385a281fbec985141ff187ffef4e67c87a406a8f80cc
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.htmlFilesize
202KB
MD5f7863c01fafc61fc7083b5b6968d56ea
SHA171aa058b47380c2cba289e816af9d17ca2b0b1a8
SHA256313f7299ab1eb1555434a5b3d24bf9d8f8af41cdf0d180eda261490133139442
SHA512d7c31e1587bfa078fa2e26c4ab81efe13ed8d913570b06d4e9c9b55760e9c451c2657227bddee9489f74a1718871c63a0f3c9542ebcf6aa15ad6f727f7d274c9
-
\Windows\SysWOW64\regsvr32mgr.exeFilesize
96KB
MD58c51fd9d6daa7b6137634de19a49452c
SHA1db2a11cca434bacad2bf42adeecae38e99cf64f8
SHA256528d190fc376cff62a83391a5ba10ae4ef0c02bedabd0360274ddc2784e11da3
SHA512b93dd6c86d0618798a11dbaa2ded7dac659f6516ca4a87da7297601c27f340fffa4126a852c257654d562529273d8a3f639ec020ab54b879c68226deae549837
-
memory/1888-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1888-15-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1888-20-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/1888-21-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1888-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1888-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1888-12-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1888-11-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1896-3-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1896-1-0x00000000744D0000-0x00000000744FC000-memory.dmpFilesize
176KB
-
memory/1896-9-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2608-70-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2608-30-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2608-40-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/2608-565-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2608-41-0x00000000772AF000-0x00000000772B0000-memory.dmpFilesize
4KB
-
memory/2608-38-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2608-39-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2924-61-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2924-58-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/2924-53-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2924-57-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/2924-45-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/2924-59-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/2924-66-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/2924-43-0x0000000020010000-0x0000000020022000-memory.dmpFilesize
72KB
-
memory/3020-87-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/3020-85-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/3020-82-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/3020-72-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/3020-86-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/3020-88-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB
-
memory/3020-89-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/3020-90-0x0000000020010000-0x000000002001B000-memory.dmpFilesize
44KB