latentbot | fe755742c5e65ce96b1c21e84bec688153d7bae1a89d4e3299a5802fec5805da

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

687caf067849f388fbe442a4c2650765_JaffaCakes118.exe
Size

1.1MB
MD5

687caf067849f388fbe442a4c2650765
SHA1

1e80d2bd0005f4a2f43c7ebf246a6922c667898e
SHA256

fe755742c5e65ce96b1c21e84bec688153d7bae1a89d4e3299a5802fec5805da
SHA512

e823441bdf42099ff521ebbf5187733801e79eb447f6ee55d6fc333066313881ed2404d1a53b8db469d5be7c4f37e10bf21ae307d8824e314c0b3da0c238685f
SSDEEP

24576:0E2hlP2AQ94zrk0TjO0duGNHbQXGR50393DsJgWRV:REPYV0G47Q2R50tzsBRV

Score

10^/10

latentbot bootkit discovery evasion persistence trojan upx

Malware Config

Extracted

Family

latentbot

diretoriawow.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	services.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	server.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}	server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	server.exe

Executes dropped EXE 3 IoCs

pid	Process
2920	server.exe
2728	fservice.exe
2336	services.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Wine	687caf067849f388fbe442a4c2650765_JaffaCakes118.exe

Loads dropped DLL 9 IoCs

pid	Process
2532	687caf067849f388fbe442a4c2650765_JaffaCakes118.exe
2532	687caf067849f388fbe442a4c2650765_JaffaCakes118.exe
2920	server.exe
2920	server.exe
2336	services.exe
2336	services.exe
2728	fservice.exe
2920	server.exe
2856	DllHost.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c000000012277-9.dat	upx
behavioral1/memory/2532-11-0x00000000061A0000-0x000000000639E000-memory.dmp	upx
behavioral1/memory/2920-19-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2920-25-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2728-34-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2336-54-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2920-72-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2728-69-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2336-77-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2336-78-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2336-79-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2336-80-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2336-81-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2336-82-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2336-83-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2336-84-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2336-85-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2336-86-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2336-87-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2336-88-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2336-89-0x0000000000400000-0x00000000005FE000-memory.dmp	upx
behavioral1/memory/2336-90-0x0000000000400000-0x00000000005FE000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	687caf067849f388fbe442a4c2650765_JaffaCakes118.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	server.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	services.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	687caf067849f388fbe442a4c2650765_JaffaCakes118.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fservice.exe	server.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	server.exe
File created	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File created	C:\Windows\SysWOW64\winkey.dll	services.exe
File created	C:\Windows\SysWOW64\reginv.dll	services.exe
File created	C:\Windows\SysWOW64\fservice.exe	services.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2532	687caf067849f388fbe442a4c2650765_JaffaCakes118.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system\sservice.exe	services.exe
File opened for modification	C:\Windows\system\sservice.exe	services.exe
File created	C:\Windows\system\sservice.exe	server.exe
File opened for modification	C:\Windows\system\sservice.exe	server.exe
File created	C:\Windows\services.exe	fservice.exe
File opened for modification	C:\Windows\services.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	fservice.exe
File opened for modification	C:\Windows\system\sservice.exe	fservice.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	687caf067849f388fbe442a4c2650765_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2532	687caf067849f388fbe442a4c2650765_JaffaCakes118.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe
2336	services.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2856	DllHost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2532	687caf067849f388fbe442a4c2650765_JaffaCakes118.exe
2336	services.exe
2336	services.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2920	2532	687caf067849f388fbe442a4c2650765_JaffaCakes118.exe	30
PID 2532 wrote to memory of 2920	2532	687caf067849f388fbe442a4c2650765_JaffaCakes118.exe	30
PID 2532 wrote to memory of 2920	2532	687caf067849f388fbe442a4c2650765_JaffaCakes118.exe	30
PID 2532 wrote to memory of 2920	2532	687caf067849f388fbe442a4c2650765_JaffaCakes118.exe	30
PID 2920 wrote to memory of 2728	2920	server.exe	32
PID 2920 wrote to memory of 2728	2920	server.exe	32
PID 2920 wrote to memory of 2728	2920	server.exe	32
PID 2920 wrote to memory of 2728	2920	server.exe	32
PID 2728 wrote to memory of 2336	2728	fservice.exe	33
PID 2728 wrote to memory of 2336	2728	fservice.exe	33
PID 2728 wrote to memory of 2336	2728	fservice.exe	33
PID 2728 wrote to memory of 2336	2728	fservice.exe	33
PID 2336 wrote to memory of 340	2336	services.exe	34
PID 2336 wrote to memory of 340	2336	services.exe	34
PID 2336 wrote to memory of 340	2336	services.exe	34
PID 2336 wrote to memory of 340	2336	services.exe	34
PID 2336 wrote to memory of 2892	2336	services.exe	35
PID 2336 wrote to memory of 2892	2336	services.exe	35
PID 2336 wrote to memory of 2892	2336	services.exe	35
PID 2336 wrote to memory of 2892	2336	services.exe	35
PID 2920 wrote to memory of 2008	2920	server.exe	38
PID 2920 wrote to memory of 2008	2920	server.exe	38
PID 2920 wrote to memory of 2008	2920	server.exe	38
PID 2920 wrote to memory of 2008	2920	server.exe	38
PID 2892 wrote to memory of 2860	2892	NET.exe	40
PID 2892 wrote to memory of 2860	2892	NET.exe	40
PID 2892 wrote to memory of 2860	2892	NET.exe	40
PID 2892 wrote to memory of 2860	2892	NET.exe	40
PID 340 wrote to memory of 2916	340	NET.exe	41
PID 340 wrote to memory of 2916	340	NET.exe	41
PID 340 wrote to memory of 2916	340	NET.exe	41
PID 340 wrote to memory of 2916	340	NET.exe	41

C:\Users\Admin\AppData\Local\Temp\687caf067849f388fbe442a4c2650765_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\687caf067849f388fbe442a4c2650765_JaffaCakes118.exe"
1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\SysWOW64\fservice.exe
    C:\Windows\system32\fservice.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\services.exe
      C:\Windows\services.exe -XP
      4⤵
      Modifies WinLogon for persistence
      Adds policy Run key to start application
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Loads dropped DLL
      Modifies WinLogon
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2336
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP srservice
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:340
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP srservice
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2916
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP navapsvc
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2892
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP navapsvc
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2860
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\server.exe.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2008

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Z1fvcfsf321321.jpg

Filesize
8KB

MD5
05c097baf25ef268e4393b1419c548d0

SHA1
fe5c2e3cb7f6f40eb7fa5caec23a55e78c419cc1

SHA256
730f73801eb303b20475d6aaef0615d0c713438946d07eeacc9581531b6d3c1d

SHA512
7f5a4a71ca82145c238a67fcdb0d741afb7ceb24237ca77a6a915a26498fb7a9f74b1c2c5836db9c9c8e0685e095fe5e1527e6b0f727cb9187c02e0e3df337c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\server.exe.bat

Filesize
129B

MD5
4f73a47eadc64c971ad4a3e09cceef9b

SHA1
7e782f6c004bfeb885ac5e05968ff8725a7a53bb

SHA256
b6f7c895d22726f59e43964ef4140ed8ee4f5b298dbafcdca2a01a40f7bf3c6c

SHA512
6332bffc816601e37217ad3111bf6658e8602857d92c97599cef1605c8ccb3c6e1fac7867be835f9fd26122a7d1ec34296ecfe9ca3a57cd47117036131c3f4d1

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe

Filesize
339KB

MD5
b9bd61e5d4ed80c8dd06e6a7874175e0

SHA1
e2321705b04cbbc4d4dcefb661230d49a9c92ed9

SHA256
b8267b2de073317bd1625bcb28aaa8acebd874da9266d88ecd59e730f971826a

SHA512
51a5af8cc78196f79df196bb69ecabaf3c0b63bd203e1f3be3f66c9ed522e44da4f394af231af53f8343387ea5a42d86236e32fe925c8826d6549d7d3d3713a8

Download Submit
\Windows\SysWOW64\reginv.dll

Filesize
36KB

MD5
d4a3f90e159ffbcbc4f9740de4b7f171

SHA1
0542f5d1e2c23dca8d90766b3a8537dc3880e5c9

SHA256
2200dd5f83d2fb8c5d3994206a4fa9ff34b4cbfe56ed39a9a03c954cf45d8f77

SHA512
5493beb50b5f7d8ec52f32718d01696916ae173456005d0c1294ce695161ce5004aff58ee3892bf5db0f9b23720146a6d3ae8ffbcbbd81f84d894fdc8cf75a94

Download Submit
\Windows\SysWOW64\winkey.dll

Filesize
24KB

MD5
43e7d9b875c921ba6be38d45540fb9dd

SHA1
f22a73fc0d4aa3ea6c0b8f61d974b028f308acc4

SHA256
f1b2b0abe844e6ba812c7f8709a463a7f6c56fa6ac38d376a0739cc3469f795b

SHA512
2e74e23c0875b69b82319391c392132f28f4eb45aa412805130382498ae48969a06a2b3a7528b626fa7d7ddb6b006f19f0ef8d73cf73cb9a0c0df44a21077622

Download Submit
memory/2336-90-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2336-80-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2336-82-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2336-81-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2336-89-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2336-88-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2336-87-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2336-84-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2336-86-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2336-79-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2336-78-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2336-54-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2336-77-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2336-83-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2336-85-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2532-0-0x0000000000400000-0x00000000005C2000-memory.dmp

Filesize
1.8MB

Download
memory/2532-5-0x0000000000400000-0x00000000005C2000-memory.dmp

Filesize
1.8MB

Download
memory/2532-6-0x0000000000400000-0x00000000005C2000-memory.dmp

Filesize
1.8MB

Download
memory/2532-11-0x00000000061A0000-0x000000000639E000-memory.dmp

Filesize
2.0MB

Download
memory/2532-2-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/2532-8-0x00000000056E0000-0x00000000056F0000-memory.dmp

Filesize
64KB

Download
memory/2532-41-0x0000000000400000-0x00000000005C2000-memory.dmp

Filesize
1.8MB

Download
memory/2532-42-0x0000000000400000-0x00000000005C2000-memory.dmp

Filesize
1.8MB

Download
memory/2532-35-0x0000000005750000-0x0000000005752000-memory.dmp

Filesize
8KB

Download
memory/2532-18-0x00000000061A0000-0x000000000639E000-memory.dmp

Filesize
2.0MB

Download
memory/2728-51-0x00000000032E0000-0x00000000034DE000-memory.dmp

Filesize
2.0MB

Download
memory/2728-69-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2728-49-0x00000000032E0000-0x00000000034DE000-memory.dmp

Filesize
2.0MB

Download
memory/2728-34-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2856-36-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2920-72-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2920-30-0x0000000003280000-0x000000000347E000-memory.dmp

Filesize
2.0MB

Download
memory/2920-25-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download
memory/2920-19-0x0000000000400000-0x00000000005FE000-memory.dmp

Filesize
2.0MB

Download