c6ce4fdd22b4053a72356d044b39752f1534b1f5459863dbbcd2c94157bdc5a8

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 06:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
Size

267KB
MD5

72ec8925b8a71e8756bc25941cdbc85a
SHA1

c576ac60b3166e57c7782d8f808ddb86279a2892
SHA256

c6ce4fdd22b4053a72356d044b39752f1534b1f5459863dbbcd2c94157bdc5a8
SHA512

8515e2b70b31a84927384ff18277248ad0bb80f33091feaaf6706777233e6638cde41b80af8254be4628248a52b90fab3c0887725c7041e12a1911ad9142a433
SSDEEP

6144:TO//AV7U++3nY7AlWgn/b95lR9g1UHsk4:a/IVcI70z9HR9XsZ

Score

7^/10

aspackv2 discovery persistence upx vmprotect

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0033000000016398-48.dat	aspack_v212_v242

Executes dropped EXE 8 IoCs

pid	Process
2756	A_v_DVD.dll
2792	new_ma.exe_7B280F7BA9D5F7B440C60E753A5D9A3790A16255.exe
2668	services.exe
1144	A_v_AuTo.dll
2896	services.exe
2188	A_v_AuTo.dll
2124	services.exe
2388	A_v_TT.dll

Loads dropped DLL 31 IoCs

pid	Process
3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
2756	A_v_DVD.dll
2756	A_v_DVD.dll
2756	A_v_DVD.dll
2756	A_v_DVD.dll
2756	A_v_DVD.dll
2792	new_ma.exe_7B280F7BA9D5F7B440C60E753A5D9A3790A16255.exe
2792	new_ma.exe_7B280F7BA9D5F7B440C60E753A5D9A3790A16255.exe
2792	new_ma.exe_7B280F7BA9D5F7B440C60E753A5D9A3790A16255.exe
3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
2668	services.exe
2668	services.exe
2668	services.exe
3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
1144	A_v_AuTo.dll
1144	A_v_AuTo.dll
1144	A_v_AuTo.dll
1144	A_v_AuTo.dll
1144	A_v_AuTo.dll
2896	services.exe
2896	services.exe
2896	services.exe
2188	A_v_AuTo.dll
2188	A_v_AuTo.dll
3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
2388	A_v_TT.dll
2388	A_v_TT.dll
2388	A_v_TT.dll

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000016c88-70.dat	upx
behavioral1/memory/3052-72-0x0000000000260000-0x0000000000275000-memory.dmp	upx
behavioral1/memory/3052-82-0x0000000000260000-0x0000000000281000-memory.dmp	upx
behavioral1/memory/1144-88-0x0000000000020000-0x0000000000035000-memory.dmp	upx
behavioral1/memory/3052-92-0x0000000000260000-0x0000000000281000-memory.dmp	upx
behavioral1/memory/2188-101-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/memory/1144-109-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/memory/2188-115-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/memory/2388-135-0x0000000000020000-0x0000000000037000-memory.dmp	upx
behavioral1/memory/1144-147-0x0000000000400000-0x0000000000415000-memory.dmp	upx

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2388-137-0x0000000000400000-0x0000000000417000-memory.dmp	vmprotect
behavioral1/memory/2388-133-0x0000000000400000-0x0000000000417000-memory.dmp	vmprotect
behavioral1/files/0x0007000000016d21-130.dat	vmprotect
behavioral1/memory/2388-149-0x0000000000400000-0x0000000000417000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Internet = "C:\\Program Files\\Common Files\\Microsoft Shared\\services.exe"	A_v_AuTo.dll

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\A_v_Tj.ocx	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Au_ing_Code.ini	services.exe
File created	C:\Program Files\Common Files\Microsoft Shared\services.exe	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\A_v_AuTo.dll	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Au_ing_Code.ini	services.exe
File opened for modification	C:\Program Files\Common Files\Au_ing_Code.ini	services.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\A_v_TT.dll	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\A_v_DVD.dll	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\A_v_AuTo.ocx	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\A_v_bind.au	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\services.exe	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\A_v_AuTo.dll	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\A_v_Dw.ocx	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\A_v_TT.dll	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\A_v_Dvd.ocx	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\A_v_DVD.dll	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A_v_DVD.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	new_ma.exe_7B280F7BA9D5F7B440C60E753A5D9A3790A16255.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A_v_AuTo.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A_v_TT.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A_v_AuTo.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1144	A_v_AuTo.dll
1144	A_v_AuTo.dll
1144	A_v_AuTo.dll
2188	A_v_AuTo.dll
2188	A_v_AuTo.dll
2188	A_v_AuTo.dll
2388	A_v_TT.dll
2388	A_v_TT.dll
2388	A_v_TT.dll
2388	A_v_TT.dll

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2668	services.exe
Token: SeDebugPrivilege	2896	services.exe
Token: SeDebugPrivilege	2124	services.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2792	new_ma.exe_7B280F7BA9D5F7B440C60E753A5D9A3790A16255.exe
2792	new_ma.exe_7B280F7BA9D5F7B440C60E753A5D9A3790A16255.exe
2792	new_ma.exe_7B280F7BA9D5F7B440C60E753A5D9A3790A16255.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2792	new_ma.exe_7B280F7BA9D5F7B440C60E753A5D9A3790A16255.exe
2792	new_ma.exe_7B280F7BA9D5F7B440C60E753A5D9A3790A16255.exe
2792	new_ma.exe_7B280F7BA9D5F7B440C60E753A5D9A3790A16255.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2388	A_v_TT.dll
2388	A_v_TT.dll

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2756	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	30
PID 3052 wrote to memory of 2756	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	30
PID 3052 wrote to memory of 2756	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	30
PID 3052 wrote to memory of 2756	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	30
PID 3052 wrote to memory of 2756	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	30
PID 3052 wrote to memory of 2756	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	30
PID 3052 wrote to memory of 2756	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	30
PID 2756 wrote to memory of 2792	2756	A_v_DVD.dll	31
PID 2756 wrote to memory of 2792	2756	A_v_DVD.dll	31
PID 2756 wrote to memory of 2792	2756	A_v_DVD.dll	31
PID 2756 wrote to memory of 2792	2756	A_v_DVD.dll	31
PID 2756 wrote to memory of 2792	2756	A_v_DVD.dll	31
PID 2756 wrote to memory of 2792	2756	A_v_DVD.dll	31
PID 2756 wrote to memory of 2792	2756	A_v_DVD.dll	31
PID 3052 wrote to memory of 2668	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2668	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2668	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2668	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2668	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2668	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	32
PID 3052 wrote to memory of 2668	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	32
PID 3052 wrote to memory of 1144	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	33
PID 3052 wrote to memory of 1144	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	33
PID 3052 wrote to memory of 1144	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	33
PID 3052 wrote to memory of 1144	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	33
PID 3052 wrote to memory of 1144	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	33
PID 3052 wrote to memory of 1144	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	33
PID 3052 wrote to memory of 1144	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	33
PID 1144 wrote to memory of 2896	1144	A_v_AuTo.dll	34
PID 1144 wrote to memory of 2896	1144	A_v_AuTo.dll	34
PID 1144 wrote to memory of 2896	1144	A_v_AuTo.dll	34
PID 1144 wrote to memory of 2896	1144	A_v_AuTo.dll	34
PID 1144 wrote to memory of 2896	1144	A_v_AuTo.dll	34
PID 1144 wrote to memory of 2896	1144	A_v_AuTo.dll	34
PID 1144 wrote to memory of 2896	1144	A_v_AuTo.dll	34
PID 2188 wrote to memory of 2124	2188	A_v_AuTo.dll	36
PID 2188 wrote to memory of 2124	2188	A_v_AuTo.dll	36
PID 2188 wrote to memory of 2124	2188	A_v_AuTo.dll	36
PID 2188 wrote to memory of 2124	2188	A_v_AuTo.dll	36
PID 3052 wrote to memory of 2388	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	37
PID 3052 wrote to memory of 2388	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	37
PID 3052 wrote to memory of 2388	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	37
PID 3052 wrote to memory of 2388	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	37
PID 3052 wrote to memory of 2388	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	37
PID 3052 wrote to memory of 2388	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	37
PID 3052 wrote to memory of 2388	3052	72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe	37

C:\Users\Admin\AppData\Local\Temp\72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\72ec8925b8a71e8756bc25941cdbc85a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files\Common Files\Microsoft Shared\A_v_DVD.dll
  "C:\Program Files\Common Files\Microsoft Shared\A_v_DVD.dll"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Users\Admin\AppData\Local\Temp\new_ma.exe_7B280F7BA9D5F7B440C60E753A5D9A3790A16255.exe
    "C:\Users\Admin\AppData\Local\Temp\new_ma.exe_7B280F7BA9D5F7B440C60E753A5D9A3790A16255.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2792
- C:\Program Files\Common Files\Microsoft Shared\services.exe
  "C:\Program Files\Common Files\Microsoft Shared\services.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Program Files\Common Files\Microsoft Shared\A_v_AuTo.dll
  "C:\Program Files\Common Files\Microsoft Shared\A_v_AuTo.dll"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Program Files\Common Files\Microsoft Shared\services.exe
    "C:\Program Files\Common Files\Microsoft Shared\services.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2896
- C:\Program Files\Common Files\Microsoft Shared\A_v_TT.dll
  "C:\Program Files\Common Files\Microsoft Shared\A_v_TT.dll"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2388

C:\Program Files\Common Files\Microsoft Shared\A_v_AuTo.dll
"C:\Program Files\Common Files\Microsoft Shared\A_v_AuTo.dll"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files\Common Files\Microsoft Shared\services.exe
  "C:\Program Files\Common Files\Microsoft Shared\services.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\services.exe

Filesize
47.7MB

MD5
7e2dd6b9af4a9b25e2aeabae31827df5

SHA1
e3b642a258803b8ba0088da386e45cf2af4c19e9

SHA256
0c3917d3ff1521e7c9d781095dde8c762c1784e5d0640d748ed770ee81c6f3c9

SHA512
1e2f7fe33c746a6210757424e1eae371350eeb903ffb8487af75cbc4f4d5e42ad46b0b19ecad5b5eda433d698aea3cbfd69949317aa9a932cb1c7dd21e8eb7a6

Download Submit
\Program Files\Common Files\Microsoft Shared\A_v_AuTo.dll

Filesize
47.7MB

MD5
eef634fac0fb250e1338782e0e869133

SHA1
ee83e32b63503925b93ced1cd5a29f96f9b1c8a6

SHA256
c76ef98fbc408c2448ca1442c0f68068e7a9a4571e4f0e73d1d05c58047d7fa8

SHA512
a93d770ed7c6486c9f1b011ef761ddf8b66a675ec440729537619349ff0dde4c6a187d80104722a4caf2d0c3f13670c96e40a51e18e8e9e22900905eda379482

Download Submit
\Program Files\Common Files\Microsoft Shared\A_v_DVD.dll

Filesize
606KB

MD5
05e0c2e0494da0c4c453dc4aa37f2f60

SHA1
71b981a5cc5478dfa1b75c4b03e4fa7eb7a5d4ae

SHA256
b1feab7ff93c3207edd8f51cd29dc3a675e0ef4b8d53104a21f4824c0dc5e9f0

SHA512
a9bcab32aeea890861d7d1fccc92b10a56d9611de8a95ac9427c1aebe09380e7d027efce19366904eafbece36dd6a0a3c7db512bc2bf524f6d9b8c1b55c6a64d

Download Submit
\Program Files\Common Files\Microsoft Shared\A_v_TT.dll

Filesize
47.7MB

MD5
24fa3adc79a56001cf6052435283b02a

SHA1
9f90f3ee2e9a91354e1ddd5b545db8986eae4fa4

SHA256
27814cb3a63e9c8c493090a7aed8fedf1335327f94f9d159f0c8477714da210f

SHA512
6ee4e08a23ecb6ba416014705056ef301185f4aed5121afc4c291bce98b86eda9fdd8a128fce78e9e8c1c10d35751a1fa47e1945a6f2e1b05060fd8d3f132c4e

Download Submit
\Users\Admin\AppData\Local\Temp\new_ma.exe_7B280F7BA9D5F7B440C60E753A5D9A3790A16255.exe

Filesize
252KB

MD5
f84d7e77b87e8a4867802e2e244ab8f5

SHA1
b773711a957f583fd76a72933dc7554f6c842f0a

SHA256
4d1a70f0e30ba919572a6102328d870b19ae8c33950fee05f25b2f5ac1127aa9

SHA512
e3a097c10572e53751e9a7a1c7486cbeeed3c60c076a9e8ef845186ea31160779fe0dd4bc5bfd8958e84793d66ad563fdb13007887809c34171a47079da75c0d

Download Submit
memory/1144-118-0x0000000000020000-0x0000000000035000-memory.dmp

Filesize
84KB

Download
memory/1144-89-0x0000000000020000-0x0000000000035000-memory.dmp

Filesize
84KB

Download
memory/1144-88-0x0000000000020000-0x0000000000035000-memory.dmp

Filesize
84KB

Download
memory/1144-147-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1144-109-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1144-117-0x0000000000020000-0x0000000000035000-memory.dmp

Filesize
84KB

Download
memory/2124-116-0x0000000000400000-0x0000000000420FD9-memory.dmp

Filesize
131KB

Download
memory/2124-104-0x0000000000400000-0x0000000000420FD9-memory.dmp

Filesize
131KB

Download
memory/2188-101-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2188-115-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2388-152-0x0000000000020000-0x0000000000037000-memory.dmp

Filesize
92KB

Download
memory/2388-151-0x0000000000020000-0x0000000000037000-memory.dmp

Filesize
92KB

Download
memory/2388-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2388-150-0x0000000000020000-0x0000000000037000-memory.dmp

Filesize
92KB

Download
memory/2388-136-0x0000000000020000-0x0000000000037000-memory.dmp

Filesize
92KB

Download
memory/2388-135-0x0000000000020000-0x0000000000037000-memory.dmp

Filesize
92KB

Download
memory/2388-134-0x0000000000020000-0x0000000000037000-memory.dmp

Filesize
92KB

Download
memory/2388-133-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2388-149-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2668-52-0x0000000000400000-0x0000000000420FD9-memory.dmp

Filesize
131KB

Download
memory/2668-58-0x0000000000230000-0x0000000000251000-memory.dmp

Filesize
132KB

Download
memory/2668-66-0x0000000000400000-0x0000000000420FD9-memory.dmp

Filesize
131KB

Download
memory/2668-62-0x0000000000400000-0x0000000000420FD9-memory.dmp

Filesize
131KB

Download
memory/2668-60-0x0000000000230000-0x0000000000251000-memory.dmp

Filesize
132KB

Download
memory/2668-59-0x0000000000230000-0x0000000000251000-memory.dmp

Filesize
132KB

Download
memory/2756-11-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2756-21-0x0000000000250000-0x0000000000252000-memory.dmp

Filesize
8KB

Download
memory/2756-16-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2756-20-0x0000000000230000-0x000000000027E000-memory.dmp

Filesize
312KB

Download
memory/2756-19-0x0000000000230000-0x000000000027E000-memory.dmp

Filesize
312KB

Download
memory/2756-57-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2792-36-0x0000000003340000-0x0000000003544000-memory.dmp

Filesize
2.0MB

Download
memory/2792-29-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2792-35-0x0000000003340000-0x0000000003544000-memory.dmp

Filesize
2.0MB

Download
memory/2896-111-0x0000000000400000-0x0000000000420FD9-memory.dmp

Filesize
131KB

Download
memory/2896-98-0x0000000000400000-0x0000000000420FD9-memory.dmp

Filesize
131KB

Download
memory/2896-93-0x0000000000400000-0x0000000000420FD9-memory.dmp

Filesize
131KB

Download
memory/3052-92-0x0000000000260000-0x0000000000281000-memory.dmp

Filesize
132KB

Download
memory/3052-132-0x0000000000260000-0x0000000000277000-memory.dmp

Filesize
92KB

Download
memory/3052-0-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3052-41-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3052-108-0x0000000000260000-0x0000000000275000-memory.dmp

Filesize
84KB

Download
memory/3052-44-0x0000000000260000-0x0000000000281000-memory.dmp

Filesize
132KB

Download
memory/3052-50-0x0000000000250000-0x0000000000252000-memory.dmp

Filesize
8KB

Download
memory/3052-64-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3052-106-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3052-51-0x0000000000260000-0x0000000000281000-memory.dmp

Filesize
132KB

Download
memory/3052-131-0x0000000000260000-0x0000000000277000-memory.dmp

Filesize
92KB

Download
memory/3052-139-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3052-82-0x0000000000260000-0x0000000000281000-memory.dmp

Filesize
132KB

Download
memory/3052-79-0x0000000000260000-0x0000000000275000-memory.dmp

Filesize
84KB

Download
memory/3052-72-0x0000000000260000-0x0000000000275000-memory.dmp

Filesize
84KB

Download
memory/3052-8-0x0000000000380000-0x00000000003CE000-memory.dmp

Filesize
312KB

Download
memory/3052-2-0x0000000000250000-0x0000000000252000-memory.dmp

Filesize
8KB

Download
memory/3052-1-0x0000000000230000-0x000000000028A000-memory.dmp

Filesize
360KB

Download