metasploit | eebde709fb575f25dc0440d7b493d94db7312f77689c2872a1a86c24c55a35ef

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe
Size

152KB
MD5

ee49d6f49490ad98a6eda7ca6a93e9c3
SHA1

693d7773436fbc79c404721a3228036fdd862c30
SHA256

eebde709fb575f25dc0440d7b493d94db7312f77689c2872a1a86c24c55a35ef
SHA512

b6069cffe146870ce750b965d411c7e58a3d7bd6eafd93f700a308e0dc06a4d9081f81e21d44b771f9d895331b7fd25f5e6b56ad6e02fb8892404f000e1c457a
SSDEEP

3072:fi6XBulAuDQaj0et2Q5BvcGDKKo3n114RHGE3gVLKLVX:f3xulTEGt2Qfvc1114RHGVVYd

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 20 IoCs

pid	Process
3052	Sysctrls.exe
1116	Sysctrls.exe
3640	Sysctrls.exe
1340	Sysctrls.exe
4312	Sysctrls.exe
1044	Sysctrls.exe
2564	Sysctrls.exe
2592	Sysctrls.exe
3512	Sysctrls.exe
4264	Sysctrls.exe
1048	Sysctrls.exe
860	Sysctrls.exe
688	Sysctrls.exe
2204	Sysctrls.exe
3408	Sysctrls.exe
2224	Sysctrls.exe
232	Sysctrls.exe
1684	Sysctrls.exe
4324	Sysctrls.exe
2012	Sysctrls.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File created	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File opened for modification	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File created	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File opened for modification	C:\Windows\SysWOW64\Sysctrls.exe	ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File created	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File created	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File opened for modification	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File created	C:\Windows\SysWOW64\Sysctrls.exe	ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File created	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File opened for modification	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File opened for modification	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File created	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File created	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File created	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File created	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File created	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File opened for modification	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File opened for modification	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe
File opened for modification	C:\Windows\SysWOW64\Sysctrls.exe	Sysctrls.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 3136 set thread context of 448	3136	ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe	82
PID 3052 set thread context of 1116	3052	Sysctrls.exe	84
PID 3640 set thread context of 1340	3640	Sysctrls.exe	93
PID 4312 set thread context of 1044	4312	Sysctrls.exe	96
PID 2564 set thread context of 2592	2564	Sysctrls.exe	99
PID 3512 set thread context of 4264	3512	Sysctrls.exe	101
PID 1048 set thread context of 860	1048	Sysctrls.exe	103
PID 688 set thread context of 2204	688	Sysctrls.exe	105
PID 3408 set thread context of 2224	3408	Sysctrls.exe	107
PID 232 set thread context of 1684	232	Sysctrls.exe	109
PID 4324 set thread context of 2012	4324	Sysctrls.exe	111

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sysctrls.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3136	ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe
3136	ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe
3052	Sysctrls.exe
3052	Sysctrls.exe
3640	Sysctrls.exe
3640	Sysctrls.exe
4312	Sysctrls.exe
4312	Sysctrls.exe
2564	Sysctrls.exe
2564	Sysctrls.exe
3512	Sysctrls.exe
3512	Sysctrls.exe
1048	Sysctrls.exe
1048	Sysctrls.exe
688	Sysctrls.exe
688	Sysctrls.exe
3408	Sysctrls.exe
3408	Sysctrls.exe
232	Sysctrls.exe
232	Sysctrls.exe
4324	Sysctrls.exe
4324	Sysctrls.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 448	3136	ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe	82
PID 3136 wrote to memory of 448	3136	ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe	82
PID 3136 wrote to memory of 448	3136	ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe	82
PID 3136 wrote to memory of 448	3136	ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe	82
PID 3136 wrote to memory of 448	3136	ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe	82
PID 448 wrote to memory of 3052	448	ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe	83
PID 448 wrote to memory of 3052	448	ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe	83
PID 448 wrote to memory of 3052	448	ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe	83
PID 3052 wrote to memory of 1116	3052	Sysctrls.exe	84
PID 3052 wrote to memory of 1116	3052	Sysctrls.exe	84
PID 3052 wrote to memory of 1116	3052	Sysctrls.exe	84
PID 3052 wrote to memory of 1116	3052	Sysctrls.exe	84
PID 3052 wrote to memory of 1116	3052	Sysctrls.exe	84
PID 1116 wrote to memory of 3640	1116	Sysctrls.exe	92
PID 1116 wrote to memory of 3640	1116	Sysctrls.exe	92
PID 1116 wrote to memory of 3640	1116	Sysctrls.exe	92
PID 3640 wrote to memory of 1340	3640	Sysctrls.exe	93
PID 3640 wrote to memory of 1340	3640	Sysctrls.exe	93
PID 3640 wrote to memory of 1340	3640	Sysctrls.exe	93
PID 3640 wrote to memory of 1340	3640	Sysctrls.exe	93
PID 3640 wrote to memory of 1340	3640	Sysctrls.exe	93
PID 1340 wrote to memory of 4312	1340	Sysctrls.exe	95
PID 1340 wrote to memory of 4312	1340	Sysctrls.exe	95
PID 1340 wrote to memory of 4312	1340	Sysctrls.exe	95
PID 4312 wrote to memory of 1044	4312	Sysctrls.exe	96
PID 4312 wrote to memory of 1044	4312	Sysctrls.exe	96
PID 4312 wrote to memory of 1044	4312	Sysctrls.exe	96
PID 4312 wrote to memory of 1044	4312	Sysctrls.exe	96
PID 4312 wrote to memory of 1044	4312	Sysctrls.exe	96
PID 1044 wrote to memory of 2564	1044	Sysctrls.exe	98
PID 1044 wrote to memory of 2564	1044	Sysctrls.exe	98
PID 1044 wrote to memory of 2564	1044	Sysctrls.exe	98
PID 2564 wrote to memory of 2592	2564	Sysctrls.exe	99
PID 2564 wrote to memory of 2592	2564	Sysctrls.exe	99
PID 2564 wrote to memory of 2592	2564	Sysctrls.exe	99
PID 2564 wrote to memory of 2592	2564	Sysctrls.exe	99
PID 2564 wrote to memory of 2592	2564	Sysctrls.exe	99
PID 2592 wrote to memory of 3512	2592	Sysctrls.exe	100
PID 2592 wrote to memory of 3512	2592	Sysctrls.exe	100
PID 2592 wrote to memory of 3512	2592	Sysctrls.exe	100
PID 3512 wrote to memory of 4264	3512	Sysctrls.exe	101
PID 3512 wrote to memory of 4264	3512	Sysctrls.exe	101
PID 3512 wrote to memory of 4264	3512	Sysctrls.exe	101
PID 3512 wrote to memory of 4264	3512	Sysctrls.exe	101
PID 3512 wrote to memory of 4264	3512	Sysctrls.exe	101
PID 4264 wrote to memory of 1048	4264	Sysctrls.exe	102
PID 4264 wrote to memory of 1048	4264	Sysctrls.exe	102
PID 4264 wrote to memory of 1048	4264	Sysctrls.exe	102
PID 1048 wrote to memory of 860	1048	Sysctrls.exe	103
PID 1048 wrote to memory of 860	1048	Sysctrls.exe	103
PID 1048 wrote to memory of 860	1048	Sysctrls.exe	103
PID 1048 wrote to memory of 860	1048	Sysctrls.exe	103
PID 1048 wrote to memory of 860	1048	Sysctrls.exe	103
PID 860 wrote to memory of 688	860	Sysctrls.exe	104
PID 860 wrote to memory of 688	860	Sysctrls.exe	104
PID 860 wrote to memory of 688	860	Sysctrls.exe	104
PID 688 wrote to memory of 2204	688	Sysctrls.exe	105
PID 688 wrote to memory of 2204	688	Sysctrls.exe	105
PID 688 wrote to memory of 2204	688	Sysctrls.exe	105
PID 688 wrote to memory of 2204	688	Sysctrls.exe	105
PID 688 wrote to memory of 2204	688	Sysctrls.exe	105
PID 2204 wrote to memory of 3408	2204	Sysctrls.exe	106
PID 2204 wrote to memory of 3408	2204	Sysctrls.exe	106
PID 2204 wrote to memory of 3408	2204	Sysctrls.exe	106

C:\Users\Admin\AppData\Local\Temp\ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Users\Admin\AppData\Local\Temp\ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Windows\SysWOW64\Sysctrls.exe
    C:\Windows\system32\Sysctrls.exe 976 "C:\Users\Admin\AppData\Local\Temp\ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Windows\SysWOW64\Sysctrls.exe
      976 C:\Users\Admin\AppData\Local\Temp\ee49d6f49490ad98a6eda7ca6a93e9c3_JaffaCakes118.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1116
    - - C:\Windows\SysWOW64\Sysctrls.exe
        
        C:\Windows\system32\Sysctrls.exe 1120 "C:\Windows\SysWOW64\Sysctrls.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3640
      - C:\Windows\SysWOW64\Sysctrls.exe
        
        1120 C:\Windows\SysWOW64\Sysctrls.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Windows\SysWOW64\Sysctrls.exe
        
        C:\Windows\system32\Sysctrls.exe 1092 "C:\Windows\SysWOW64\Sysctrls.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Windows\SysWOW64\Sysctrls.exe
        
        1092 C:\Windows\SysWOW64\Sysctrls.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1044
        
        C:\Windows\SysWOW64\Sysctrls.exe
        
        C:\Windows\system32\Sysctrls.exe 1096 "C:\Windows\SysWOW64\Sysctrls.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2564
        
        C:\Windows\SysWOW64\Sysctrls.exe
        
        1096 C:\Windows\SysWOW64\Sysctrls.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\SysWOW64\Sysctrls.exe
        
        C:\Windows\system32\Sysctrls.exe 1092 "C:\Windows\SysWOW64\Sysctrls.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3512
        
        C:\Windows\SysWOW64\Sysctrls.exe
        
        1092 C:\Windows\SysWOW64\Sysctrls.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\SysWOW64\Sysctrls.exe
        
        C:\Windows\system32\Sysctrls.exe 1092 "C:\Windows\SysWOW64\Sysctrls.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1048
        
        C:\Windows\SysWOW64\Sysctrls.exe
        
        1092 C:\Windows\SysWOW64\Sysctrls.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:860
        
        C:\Windows\SysWOW64\Sysctrls.exe
        
        C:\Windows\system32\Sysctrls.exe 1092 "C:\Windows\SysWOW64\Sysctrls.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:688
        
        C:\Windows\SysWOW64\Sysctrls.exe
        
        1092 C:\Windows\SysWOW64\Sysctrls.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\SysWOW64\Sysctrls.exe
        
        C:\Windows\system32\Sysctrls.exe 1096 "C:\Windows\SysWOW64\Sysctrls.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3408
        
        C:\Windows\SysWOW64\Sysctrls.exe
        
        1096 C:\Windows\SysWOW64\Sysctrls.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2224
        
        C:\Windows\SysWOW64\Sysctrls.exe
        
        C:\Windows\system32\Sysctrls.exe 1092 "C:\Windows\SysWOW64\Sysctrls.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:232
        
        C:\Windows\SysWOW64\Sysctrls.exe
        
        1092 C:\Windows\SysWOW64\Sysctrls.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Windows\SysWOW64\Sysctrls.exe
        
        C:\Windows\system32\Sysctrls.exe 1092 "C:\Windows\SysWOW64\Sysctrls.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4324
        
        C:\Windows\SysWOW64\Sysctrls.exe
        
        1092 C:\Windows\SysWOW64\Sysctrls.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Sysctrls.exe

Filesize
152KB

MD5
ee49d6f49490ad98a6eda7ca6a93e9c3

SHA1
693d7773436fbc79c404721a3228036fdd862c30

SHA256
eebde709fb575f25dc0440d7b493d94db7312f77689c2872a1a86c24c55a35ef

SHA512
b6069cffe146870ce750b965d411c7e58a3d7bd6eafd93f700a308e0dc06a4d9081f81e21d44b771f9d895331b7fd25f5e6b56ad6e02fb8892404f000e1c457a

Download Submit
memory/232-61-0x0000000010000000-0x000000001002B5F8-memory.dmp

Filesize
173KB

Download
memory/448-2-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/448-0-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/688-49-0x0000000010000000-0x000000001002B5F8-memory.dmp

Filesize
173KB

Download
memory/1048-43-0x0000000010000000-0x000000001002B5F8-memory.dmp

Filesize
173KB

Download
memory/1116-14-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1340-20-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2564-32-0x0000000010000000-0x000000001002B5F8-memory.dmp

Filesize
173KB

Download
memory/3052-11-0x0000000010000000-0x000000001002B5F8-memory.dmp

Filesize
173KB

Download
memory/3136-3-0x0000000010000000-0x000000001002B5F8-memory.dmp

Filesize
173KB

Download
memory/3408-55-0x0000000010000000-0x000000001002B5F8-memory.dmp

Filesize
173KB

Download
memory/3512-37-0x0000000010000000-0x000000001002B5F8-memory.dmp

Filesize
173KB

Download
memory/3640-19-0x0000000010000000-0x000000001002B5F8-memory.dmp

Filesize
173KB

Download
memory/4312-25-0x0000000010000000-0x000000001002B5F8-memory.dmp

Filesize
173KB

Download
memory/4324-68-0x0000000010000000-0x000000001002B5F8-memory.dmp

Filesize
173KB

Download