9a804b2df2bbcd9c356f4f6857c6e157cc85bfed5d34b975a7c1f32a563b81e1

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

485b531fb21bc962730459490d092f99_JaffaCakes118.exe
Size

444KB
MD5

485b531fb21bc962730459490d092f99
SHA1

2876791d766bc04dbedd178a18db1360a7532e56
SHA256

9a804b2df2bbcd9c356f4f6857c6e157cc85bfed5d34b975a7c1f32a563b81e1
SHA512

dc7146524bddf82273ae3a08acd600217ae2309e1cd54f7daa1f770428180b7e7cb25fb27bf6cce9bafa8d73a6e723dec9fb26e2e7e34cdc22127ebf832e0bc6
SSDEEP

12288:KiGWmFkqXGFS6jFF3Z4mxxnV5lSS/crOoBoKiWi:2WLyGFSKFQmXnV1FaoKS

Score

8^/10

persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscntfy.exe\debugger = "IFEOFILE"	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav.exe\debugger = "IFEOFILE"	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exe\debugger = "IFEOFILE"	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe\debugger = "IFEOFILE"	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guard.exe\debugger = "IFEOFILE"	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmon.exe\debugger = "IFEOFILE"	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavmonD.exe	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe\debugger = "IFEOFILE"	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\debugger = "IFEOFILE"	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe\debugger = "IFEOFILE"	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avast.exe	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe\debugger = "IFEOFILE"	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe\debugger = "IFEOFILE"	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe\debugger = "IFEOFILE"	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guard.exe	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVXP.exe\debugger = "IFEOFILE"	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe\debugger = "IFEOFILE"	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe\debugger = "IFEOFILE"	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe\debugger = "IFEOFILE"	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe\debugger = "IFEOFILE"	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rsaupd.exe\debugger = "IFEOFILE"	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvMonXP.exe\debugger = "IFEOFILE"	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe\debugger = "IFEOFILE"	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe\debugger = "IFEOFILE"	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe\debugger = "IFEOFILE"	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe\debugger = "IFEOFILE"	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ravmon.exe	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe\debugger = "IFEOFILE"	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe\debugger = "IFEOFILE"	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe\debugger = "IFEOFILE"	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscntfy.exe	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe\debugger = "IFEOFILE"	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavmonD.exe\debugger = "IFEOFILE"	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav.exe	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avast.exe\debugger = "IFEOFILE"	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "IFEOFILE"	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVXP.exe	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exe	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wuauclt.exe	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\debugger = "IFEOFILE"	SaveFile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe\debugger = "IFEOFILE"	SaveFile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvMonXP.exe	SaveFile.exe

Server Software Component: Terminal Services DLL 1 TTPs 3 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ynnllm\ParameteRs\ServiceDll = "%SystemRoot%\\System32\\ogvzjj.dll"	aueqx891.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\ynnllm\ParameteRs\ServiceDll = "%SystemRoot%\\System32\\ogvzjj.dll"	aueqx891.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\ynnllm\ParameteRs\ServiceDll = "%SystemRoot%\\System32\\ogvzjj.dll"	aueqx891.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	485b531fb21bc962730459490d092f99_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation	SaveFile.exe

Executes dropped EXE 3 IoCs

pid	Process
1160	2.exe
1896	SaveFile.exe
736	aueqx891.exe

Loads dropped DLL 2 IoCs

pid	Process
736	aueqx891.exe
2260	SVCHOST.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\000464dc.ini	aueqx891.exe
File created	C:\Windows\SysWOW64\ogvzjj.dll	aueqx891.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe
1896	SaveFile.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	SaveFile.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1896	SaveFile.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1160	2012	485b531fb21bc962730459490d092f99_JaffaCakes118.exe	85
PID 2012 wrote to memory of 1160	2012	485b531fb21bc962730459490d092f99_JaffaCakes118.exe	85
PID 2012 wrote to memory of 1160	2012	485b531fb21bc962730459490d092f99_JaffaCakes118.exe	85
PID 1160 wrote to memory of 1896	1160	2.exe	87
PID 1160 wrote to memory of 1896	1160	2.exe	87
PID 1160 wrote to memory of 1896	1160	2.exe	87
PID 1896 wrote to memory of 736	1896	SaveFile.exe	88
PID 1896 wrote to memory of 736	1896	SaveFile.exe	88
PID 1896 wrote to memory of 736	1896	SaveFile.exe	88

C:\Users\Admin\AppData\Local\Temp\485b531fb21bc962730459490d092f99_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\485b531fb21bc962730459490d092f99_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SaveFile.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SaveFile.exe
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Temp\aueqx891.exe
      "C:\Temp\aueqx891.exe"
      4⤵
      Server Software Component: Terminal Services DLL
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      PID:736

C:\Windows\SysWOW64\SVCHOST.EXE
C:\Windows\SysWOW64\SVCHOST.EXE -k ynnllm
1⤵
- Loads dropped DLL
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Temp\aueqx891.exe

Filesize
60KB

MD5
0f2de7b0fcce30d295367f56c6504151

SHA1
c6a8923a16a81ad82bcbfb9b75d970eed946fedb

SHA256
f795a386155e22358b665291bc229f23aa107e7a86a11b16fe44b950386f07ba

SHA512
addb92abb6798a6f0ab8df9924ab03497233eece7e289efa7f44a36aac3927b09d275bb83ea1549d5636e194fea752c686db6a89da9eca152a40b61e48aca270

Download Submit
C:\Users\Admin\AppData\Local\Temp\2.exe

Filesize
121KB

MD5
2105f453c0b2133fc1c697e9bfc15541

SHA1
ba3b5fe9153ca936f4486d84926f74184fb6f4d4

SHA256
896c4c52b645f3e1d253eb896e23d27b2e3c094f3d684b0f5078837763aaf91c

SHA512
f61490592c7f0c5790d5803b5cadaa5e219c2ad99a93a057e17263f71b3a92928bd88086d49d6c35868271c9f2e29a0eb895f70b4c34836745b0f1cf93a4064f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SaveFile.exe

Filesize
88KB

MD5
3d035524c4f4e18c82a582cd9054fcb3

SHA1
1bba3b7e3e4b2944bc11e062d87597c93fdcc6ba

SHA256
b8e232ec0a216b1c5deb0c550e59a25d73d877ef7cb2dc90c60f31fe064db62e

SHA512
ed0c465a92d224fa34a67558835320918d7040341e151d7b86a1ef4f096d2d10660f059608198a7d37231d3b8906891fb4f4289fd0867f366a0c235cedbccfd4

Download Submit
C:\Windows\SysWOW64\ogvzjj.dll

Filesize
93KB

MD5
42aa0a8c345a6c8d16402b4848f4a188

SHA1
a8f9f2c090ac8b64deb691069a82db53fb5547ff

SHA256
12fbfe2b1b44923eadce50d96d896368f4ae408603b94b3d7cc108f120404498

SHA512
bd516a6674cdc7a5ab1dfeb693954be325f0dc8ee23e58847a2a6f250ffdaaa192bcbb07099b69d837ebec0fcd51f8bf39bcbe9d03ca650af92b932d5949f22f

Download Submit
memory/2012-0-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/2012-1-0x0000000000AC0000-0x0000000000B14000-memory.dmp

Filesize
336KB

Download
memory/2012-2-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/2012-73-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-72-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-71-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-70-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-69-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-68-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-67-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-66-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-65-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-64-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-63-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-62-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-61-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-60-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-59-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-58-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-57-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-56-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-55-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-54-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-53-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-52-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-51-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-50-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-49-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-48-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-47-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-46-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-45-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-44-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-43-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-42-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-41-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-40-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-39-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-38-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-37-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-36-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-35-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-34-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-33-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-32-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-31-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-30-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-29-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-28-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-27-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-26-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-25-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-24-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-23-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-22-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-21-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-20-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-19-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-18-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-17-0x0000000003410000-0x0000000003411000-memory.dmp

Filesize
4KB

Download
memory/2012-16-0x0000000003420000-0x0000000003421000-memory.dmp

Filesize
4KB

Download
memory/2012-15-0x0000000003420000-0x0000000003421000-memory.dmp

Filesize
4KB

Download
memory/2012-14-0x0000000003420000-0x0000000003421000-memory.dmp

Filesize
4KB

Download
memory/2012-13-0x0000000003420000-0x0000000003421000-memory.dmp

Filesize
4KB

Download
memory/2012-12-0x0000000003420000-0x0000000003421000-memory.dmp

Filesize
4KB

Download
memory/2012-11-0x0000000003420000-0x0000000003421000-memory.dmp

Filesize
4KB

Download
memory/2012-10-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/2012-9-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/2012-8-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/2012-7-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/2012-6-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/2012-5-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2012-4-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/2012-3-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/2012-85-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/2012-86-0x0000000000AC0000-0x0000000000B14000-memory.dmp

Filesize
336KB

Download