Analysis
- max time kernel
147s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
21/06/2024, 22:56
General
- Target 0012d94e2f9dd9b39069f94c05fb0704_JaffaCakes118.exe
- Size 156KB
- Sample240621-2wpqmstfqc
- SHA256 febc3b9a43af66fb05568eef6e1eeaa6fdb24269872fe2237fd80f924c8c932f
Malware Config
Extracted
-
metasploit
-
encoder/call4_dword_xor
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Checks computer location settings 2 TTPs 36 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 64 IoCs
- Suspicious use of SetThreadContext 36 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 36 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0012d94e2f9dd9b39069f94c05fb0704_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0012d94e2f9dd9b39069f94c05fb0704_JaffaCakes118.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0012d94e2f9dd9b39069f94c05fb0704_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\0012d94e2f9dd9b39069f94c05fb0704_JaffaCakes118.exe2⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Users\Admin\AppData\Local\Temp\0012D9~1.EXE3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe7⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe8⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe9⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe10⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe11⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe12⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe13⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe14⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe15⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe16⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe17⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe18⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe19⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe20⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe21⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe22⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe23⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe24⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe25⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe26⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe27⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe28⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe29⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe30⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe31⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe32⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe33⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe34⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe35⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe36⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe37⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe38⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe39⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe40⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe41⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe42⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe43⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe44⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe45⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe46⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe47⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe48⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe49⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe50⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe51⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe52⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe53⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe54⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe55⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe56⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe57⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe58⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe59⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe60⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe61⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe62⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe63⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe64⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe65⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe66⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe67⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe68⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe69⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe70⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe71⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmirpcq.exeC:\Windows\SysWOW64\wmirpcq.exe72⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\wmirpcq.exe"C:\Windows\system32\wmirpcq.exe" C:\Windows\SysWOW64\wmirpcq.exe73⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
wmirpcq.exe
memory/220-234-0x0000000000400000-0x0000000000463000-memory.dmp
memory/400-53-0x0000000000400000-0x0000000000463000-memory.dmp
memory/400-55-0x0000000000400000-0x0000000000463000-memory.dmp
memory/400-51-0x0000000000400000-0x0000000000463000-memory.dmp
memory/400-52-0x0000000000400000-0x0000000000463000-memory.dmp
memory/764-170-0x0000000000400000-0x0000000000463000-memory.dmp
memory/856-92-0x0000000000400000-0x0000000000463000-memory.dmp
memory/856-90-0x0000000000400000-0x0000000000463000-memory.dmp
memory/1000-46-0x0000000000400000-0x0000000000463000-memory.dmp
memory/1000-45-0x0000000000400000-0x0000000000463000-memory.dmp
memory/1000-44-0x0000000000400000-0x0000000000463000-memory.dmp
memory/1000-43-0x0000000000400000-0x0000000000463000-memory.dmp
memory/1020-130-0x0000000000400000-0x0000000000463000-memory.dmp
memory/1020-135-0x0000000000400000-0x0000000000463000-memory.dmp
memory/1160-204-0x0000000000400000-0x0000000000463000-memory.dmp
memory/1304-82-0x0000000000400000-0x0000000000463000-memory.dmp
memory/1304-83-0x0000000000400000-0x0000000000463000-memory.dmp
memory/1484-188-0x0000000000400000-0x0000000000463000-memory.dmp
memory/1484-183-0x0000000000400000-0x0000000000463000-memory.dmp
memory/1832-196-0x0000000000400000-0x0000000000463000-memory.dmp
memory/2072-208-0x0000000000400000-0x0000000000463000-memory.dmp
memory/2072-213-0x0000000000400000-0x0000000000463000-memory.dmp
memory/2092-253-0x0000000000400000-0x0000000000463000-memory.dmp
memory/2164-286-0x0000000000400000-0x0000000000463000-memory.dmp
memory/2164-282-0x0000000000400000-0x0000000000463000-memory.dmp
memory/2776-68-0x0000000000400000-0x0000000000463000-memory.dmp
memory/2796-158-0x0000000000400000-0x0000000000463000-memory.dmp
memory/2796-162-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3020-272-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3132-276-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3132-279-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3256-108-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3372-0-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3372-37-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3372-3-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3372-4-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3372-2-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3736-222-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3876-97-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3876-100-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3928-62-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3932-153-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3932-149-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3972-76-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4112-123-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4112-122-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4136-304-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4340-240-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4376-178-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4428-266-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4484-114-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4484-115-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4520-139-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4520-144-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4680-260-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4680-256-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4700-292-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4864-247-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4864-243-0x0000000000400000-0x0000000000463000-memory.dmp
memory/5000-228-0x0000000000400000-0x0000000000463000-memory.dmp
memory/5028-298-0x0000000000400000-0x0000000000463000-memory.dmp