metasploit | dfc5874e79146257ff910942b6a7801ea92638086558ff2bb7f77d6e8209f2e3

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
Size

1.2MB
MD5

e13376dec97e28d51aa80f68b7860849
SHA1

8a98aa1ff246723bee0d5d307ab69f20a61a1c09
SHA256

dfc5874e79146257ff910942b6a7801ea92638086558ff2bb7f77d6e8209f2e3
SHA512

cb5e1bb199b143c5ec5cf220c2701b0b4a07c3766fbe352440dfceefa12c105c9de668336608750b9d300a52599e8e931a36f033aeb95a2491129f5f985a97eb
SSDEEP

12288:MDeq6XQ2xIjrwg8d+G6e2S5Est12EUEYO27NUvLFyImxAuTdmsi:Mn5rwgxG6TSPGEU7VqvLFyInadms

Score

10^/10

metasploit backdoor discovery evasion trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	VMwareService.exe

Deletes itself 1 IoCs

pid	Process
2688	VMwareService.exe

Executes dropped EXE 1 IoCs

pid	Process
2688	VMwareService.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	VMwareService.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2688	VMwareService.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system\VMwareService.exe	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
File opened for modification	C:\Windows\system\VMwareService.exe	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VMwareService.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	VMwareService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	VMwareService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	VMwareService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	VMwareService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	VMwareService.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	VMwareService.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2688	VMwareService.exe
2688	VMwareService.exe

Suspicious behavior: MapViewOfSection 50 IoCs

pid	Process
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe
2688	VMwareService.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
Token: SeDebugPrivilege	2688	VMwareService.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2688	VMwareService.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 384	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	3
PID 2136 wrote to memory of 384	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	3
PID 2136 wrote to memory of 384	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	3
PID 2136 wrote to memory of 384	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	3
PID 2136 wrote to memory of 384	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	3
PID 2136 wrote to memory of 384	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	3
PID 2136 wrote to memory of 384	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	3
PID 2136 wrote to memory of 396	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	4
PID 2136 wrote to memory of 396	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	4
PID 2136 wrote to memory of 396	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	4
PID 2136 wrote to memory of 396	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	4
PID 2136 wrote to memory of 396	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	4
PID 2136 wrote to memory of 396	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	4
PID 2136 wrote to memory of 396	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	4
PID 2136 wrote to memory of 432	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	5
PID 2136 wrote to memory of 432	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	5
PID 2136 wrote to memory of 432	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	5
PID 2136 wrote to memory of 432	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	5
PID 2136 wrote to memory of 432	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	5
PID 2136 wrote to memory of 432	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	5
PID 2136 wrote to memory of 432	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	5
PID 2136 wrote to memory of 476	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	6
PID 2136 wrote to memory of 476	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	6
PID 2136 wrote to memory of 476	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	6
PID 2136 wrote to memory of 476	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	6
PID 2136 wrote to memory of 476	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	6
PID 2136 wrote to memory of 476	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	6
PID 2136 wrote to memory of 476	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	6
PID 2136 wrote to memory of 492	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	7
PID 2136 wrote to memory of 492	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	7
PID 2136 wrote to memory of 492	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	7
PID 2136 wrote to memory of 492	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	7
PID 2136 wrote to memory of 492	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	7
PID 2136 wrote to memory of 492	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	7
PID 2136 wrote to memory of 492	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	7
PID 2136 wrote to memory of 500	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	8
PID 2136 wrote to memory of 500	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	8
PID 2136 wrote to memory of 500	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	8
PID 2136 wrote to memory of 500	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	8
PID 2136 wrote to memory of 500	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	8
PID 2136 wrote to memory of 500	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	8
PID 2136 wrote to memory of 500	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	8
PID 2136 wrote to memory of 608	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	9
PID 2136 wrote to memory of 608	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	9
PID 2136 wrote to memory of 608	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	9
PID 2136 wrote to memory of 608	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	9
PID 2136 wrote to memory of 608	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	9
PID 2136 wrote to memory of 608	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	9
PID 2136 wrote to memory of 608	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	9
PID 2136 wrote to memory of 688	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	10
PID 2136 wrote to memory of 688	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	10
PID 2136 wrote to memory of 688	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	10
PID 2136 wrote to memory of 688	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	10
PID 2136 wrote to memory of 688	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	10
PID 2136 wrote to memory of 688	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	10
PID 2136 wrote to memory of 688	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	10
PID 2136 wrote to memory of 760	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	11
PID 2136 wrote to memory of 760	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	11
PID 2136 wrote to memory of 760	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	11
PID 2136 wrote to memory of 760	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	11
PID 2136 wrote to memory of 760	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	11
PID 2136 wrote to memory of 760	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	11
PID 2136 wrote to memory of 760	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	11
PID 2136 wrote to memory of 828	2136	e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe	12

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:384
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:476
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:608
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1684
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:468
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:688
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:760
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:828
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1080
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:876
  - - \\?\C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      4⤵
      PID:2104
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:992
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:292
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1072
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1088
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1168
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1580
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2860
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2996
- - C:\Windows\system\VMwareService.exe
    "C:\Windows\system\VMwareService.exe"
    3⤵
    - Checks BIOS information in registry
    - Deletes itself
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2688
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:492
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:500

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1156
- C:\Users\Admin\AppData\Local\Temp\e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e13376dec97e28d51aa80f68b7860849_JaffaCakes118.exe"
  2⤵
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2136

C:\Users\Admin\AppData\Local\Temp\1139296434\zmstage.exe
C:\Users\Admin\AppData\Local\Temp\1139296434\zmstage.exe
1⤵
PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\VMwareService.exe

Filesize
1.2MB

MD5
e13376dec97e28d51aa80f68b7860849

SHA1
8a98aa1ff246723bee0d5d307ab69f20a61a1c09

SHA256
dfc5874e79146257ff910942b6a7801ea92638086558ff2bb7f77d6e8209f2e3

SHA512
cb5e1bb199b143c5ec5cf220c2701b0b4a07c3766fbe352440dfceefa12c105c9de668336608750b9d300a52599e8e931a36f033aeb95a2491129f5f985a97eb

Download Submit
memory/2136-16-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2136-2-0x0000000077630000-0x0000000077631000-memory.dmp

Filesize
4KB

Download
memory/2136-1-0x000000007762F000-0x0000000077630000-memory.dmp

Filesize
4KB

Download
memory/2136-3-0x0000000000401000-0x0000000000408000-memory.dmp

Filesize
28KB

Download
memory/2136-4-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2136-8-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2136-9-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2136-0-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-21-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-27-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-12-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-15-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-14-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-18-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-20-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-11-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-22-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-23-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-24-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-25-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-26-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-13-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-28-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-29-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-30-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-31-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-32-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-33-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-34-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-35-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-36-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-37-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-38-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download
memory/2688-39-0x0000000000400000-0x00000000005B2000-memory.dmp

Filesize
1.7MB

Download