Overview

overview

10

Static

static

7

f048618096...18.exe

windows7-x64

7

f048618096...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    16s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/09/2024, 19:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    f04861809694b1c8661a3adbfd11045d_JaffaCakes118.exe

  • Size

    368KB

  • MD5

    f04861809694b1c8661a3adbfd11045d

  • SHA1

    01dc81993524aded936f960a7ea60f152abd80c5

  • SHA256

    da56ff6445214f6a37147898a55b6b3b2d4a83fa515ff213d45d550124f11c5e

  • SHA512

    f5e6ae66743f6dd95afaf560cb7ed8a5896733ac37379cf59d9f5c118b0df8852cb9569735c209e65ff294769697a786542d8238bcf6ef3d42713ede8538d079

  • SSDEEP

    6144:OYDhB6ActM8FbPt6a15RGkPNJAcb+k2WzoPiML3AYRYAe5mYkl5nm65jDDdgkeKH:p9BvctM85t35JPNJj2WzoRLQYRYzmYO9

Score
10/10
salitybackdoordiscoveryevasionpersistenceprivilege_escalationtrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 18 IoCs
    evasiontrojan
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Disables RegEdit via registry modification 5 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 48 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 3 IoCs
    evasion
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 21 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 5 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:780
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:784
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:1020
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2644
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2672
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:2756
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3464
                  • C:\Users\Admin\AppData\Local\Temp\f04861809694b1c8661a3adbfd11045d_JaffaCakes118.exe
                    "C:\Users\Admin\AppData\Local\Temp\f04861809694b1c8661a3adbfd11045d_JaffaCakes118.exe"
                    2⤵
                    • UAC bypass
                    • Windows security bypass
                    • Disables RegEdit via registry modification
                    • Checks computer location settings
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Drops desktop.ini file(s)
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:3164
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh firewall set opmode disable
                      3⤵
                      • Modifies Windows Firewall
                      • Event Triggered Execution: Netsh Helper DLL
                      • System Location Discovery: System Language Discovery
                      PID:4452
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        4⤵
                          PID:4252
                      • C:\Users\Admin\AppData\Local\Temp\svchost.com
                        "C:\Users\Admin\AppData\Local\Temp\svchost.com"
                        3⤵
                        • Modifies WinLogon for persistence
                        • Modifies visibility of file extensions in Explorer
                        • Modifies visiblity of hidden/system files in Explorer
                        • Disables RegEdit via registry modification
                        • Event Triggered Execution: Image File Execution Options Injection
                        • Checks computer location settings
                        • Drops startup file
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops desktop.ini file(s)
                        • Enumerates connected drives
                        • Drops autorun.inf file
                        • Drops file in System32 directory
                        • Drops file in Program Files directory
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2840
                        • C:\Program Files (x86)\Common Files\System\cftmon.exe
                          "C:\Program Files (x86)\Common Files\System\cftmon.exe" stay_alive -in
                          4⤵
                          • UAC bypass
                          • Windows security bypass
                          • Disables RegEdit via registry modification
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Windows security modification
                          • Checks whether UAC is enabled
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:4092
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall set opmode disable
                            5⤵
                            • Modifies Windows Firewall
                            • Event Triggered Execution: Netsh Helper DLL
                            • System Location Discovery: System Language Discovery
                            PID:1160
                            • C:\Windows\System32\Conhost.exe
                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              6⤵
                                PID:4976
                            • C:\Program Files (x86)\Common Files\System\cftmon.exe
                              "C:\Program Files (x86)\Common Files\System\cftmon.exe" stay_alive -r
                              5⤵
                              • UAC bypass
                              • Windows security bypass
                              • Disables RegEdit via registry modification
                              • Deletes itself
                              • Executes dropped EXE
                              • Windows security modification
                              • Checks whether UAC is enabled
                              • Drops file in Program Files directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:3448
                              • C:\Windows\SysWOW64\netsh.exe
                                netsh firewall set opmode disable
                                6⤵
                                • Modifies Windows Firewall
                                • Event Triggered Execution: Netsh Helper DLL
                                • System Location Discovery: System Language Discovery
                                PID:1508
                              • C:\Windows\SysWOW64\NOTEPAD.EXE
                                "C:\Windows\system32\NOTEPAD.EXE"
                                6⤵
                                  PID:4472
                            • C:\Users\Admin\AppData\Local\Temp\svchost.com
                              C:\Users\Admin\AppData\Local\Temp\svchost.com keep_fucking
                              4⤵
                              • Modifies WinLogon for persistence
                              • Modifies visibility of file extensions in Explorer
                              • Modifies visiblity of hidden/system files in Explorer
                              • Disables RegEdit via registry modification
                              • Event Triggered Execution: Image File Execution Options Injection
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Enumerates connected drives
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4332
                            • C:\Windows\SysWOW64\net.exe
                              "C:\Windows\System32\net.exe" share SYS_c=c:\
                              4⤵
                                PID:4092
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 share SYS_c=c:\
                                  5⤵
                                    PID:452
                                • C:\Windows\SysWOW64\net.exe
                                  "C:\Windows\System32\net.exe" share SYS_f=f:\
                                  4⤵
                                    PID:1964
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 share SYS_f=f:\
                                      5⤵
                                        PID:3452
                                    • C:\Windows\SysWOW64\net.exe
                                      "C:\Windows\System32\net.exe" user guest guest
                                      4⤵
                                        PID:1500
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 user guest guest
                                          5⤵
                                            PID:1628
                                        • C:\Windows\SysWOW64\net.exe
                                          "C:\Windows\System32\net.exe" user /add Network_Service
                                          4⤵
                                            PID:3480
                                            • C:\Windows\SysWOW64\net1.exe
                                              C:\Windows\system32\net1 user /add Network_Service
                                              5⤵
                                                PID:2376
                                            • C:\Windows\SysWOW64\net.exe
                                              "C:\Windows\System32\net.exe" user Network_Service 1016760
                                              4⤵
                                                PID:4828
                                                • C:\Windows\SysWOW64\net1.exe
                                                  C:\Windows\system32\net1 user Network_Service 1016760
                                                  5⤵
                                                    PID:3720
                                                • C:\Windows\SysWOW64\net.exe
                                                  "C:\Windows\System32\net.exe" localgroup administrators Network_Service /add
                                                  4⤵
                                                    PID:1196
                                                    • C:\Windows\SysWOW64\net1.exe
                                                      C:\Windows\system32\net1 localgroup administrators Network_Service /add
                                                      5⤵
                                                        PID:4480
                                                    • C:\Program Files (x86)\Common Files\System\cftmon.exe
                                                      "C:\Program Files (x86)\Common Files\System\cftmon.exe" stay_alive -in
                                                      4⤵
                                                        PID:3232
                                                        • C:\Program Files (x86)\Common Files\System\cftmon.exe
                                                          "C:\Program Files (x86)\Common Files\System\cftmon.exe" stay_alive -r
                                                          5⤵
                                                            PID:4728
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                    1⤵
                                                      PID:3652
                                                    • C:\Windows\system32\DllHost.exe
                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                      1⤵
                                                        PID:3832
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:3928
                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                          1⤵
                                                            PID:3992
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:4080
                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                              1⤵
                                                                PID:3748
                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                                                1⤵
                                                                  PID:1796
                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                  1⤵
                                                                    PID:3988

                                                                  Network

                                                                        MITRE ATT&CK Enterprise v15

                                                                        Reconnaissance

                                                                        Resource Development

                                                                        Initial Access

                                                                        Replication Through Removable Media

                                                                        1
                                                                        T1091

                                                                        Execution

                                                                        Persistence

                                                                        Account Manipulation

                                                                        1
                                                                        T1098

                                                                        Boot or Logon Autostart Execution

                                                                        2
                                                                        T1547

                                                                        Registry Run Keys / Startup Folder

                                                                        1
                                                                        T1547.001

                                                                        Winlogon Helper DLL

                                                                        1
                                                                        T1547.004

                                                                        Create or Modify System Process

                                                                        1
                                                                        T1543

                                                                        Windows Service

                                                                        1
                                                                        T1543.003

                                                                        Event Triggered Execution

                                                                        2
                                                                        T1546

                                                                        Image File Execution Options Injection

                                                                        1
                                                                        T1546.012

                                                                        Netsh Helper DLL

                                                                        1
                                                                        T1546.007

                                                                        Privilege Escalation

                                                                        Abuse Elevation Control Mechanism

                                                                        1
                                                                        T1548

                                                                        Bypass User Account Control

                                                                        1
                                                                        T1548.002

                                                                        Account Manipulation

                                                                        1
                                                                        T1098

                                                                        Boot or Logon Autostart Execution

                                                                        2
                                                                        T1547

                                                                        Registry Run Keys / Startup Folder

                                                                        1
                                                                        T1547.001

                                                                        Winlogon Helper DLL

                                                                        1
                                                                        T1547.004

                                                                        Create or Modify System Process

                                                                        1
                                                                        T1543

                                                                        Windows Service

                                                                        1
                                                                        T1543.003

                                                                        Event Triggered Execution

                                                                        2
                                                                        T1546

                                                                        Image File Execution Options Injection

                                                                        1
                                                                        T1546.012

                                                                        Netsh Helper DLL

                                                                        1
                                                                        T1546.007

                                                                        Defense Evasion

                                                                        Abuse Elevation Control Mechanism

                                                                        1
                                                                        T1548

                                                                        Bypass User Account Control

                                                                        1
                                                                        T1548.002

                                                                        Hide Artifacts

                                                                        2
                                                                        T1564

                                                                        Hidden Files and Directories

                                                                        2
                                                                        T1564.001

                                                                        Impair Defenses

                                                                        4
                                                                        T1562

                                                                        Disable or Modify System Firewall

                                                                        1
                                                                        T1562.004

                                                                        Disable or Modify Tools

                                                                        3
                                                                        T1562.001

                                                                        Modify Registry

                                                                        8
                                                                        T1112

                                                                        Credential Access

                                                                        Discovery

                                                                        Network Share Discovery

                                                                        1
                                                                        T1135

                                                                        Peripheral Device Discovery

                                                                        1
                                                                        T1120

                                                                        Permission Groups Discovery

                                                                        1
                                                                        T1069

                                                                        Local Groups

                                                                        1
                                                                        T1069.001

                                                                        Query Registry

                                                                        2
                                                                        T1012

                                                                        System Information Discovery

                                                                        4
                                                                        T1082

                                                                        System Location Discovery

                                                                        1
                                                                        T1614

                                                                        System Language Discovery

                                                                        1
                                                                        T1614.001

                                                                        Lateral Movement

                                                                        Replication Through Removable Media

                                                                        1
                                                                        T1091

                                                                        Collection

                                                                        Command and Control

                                                                        Exfiltration

                                                                        Impact

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\Users\Admin\AppData\Local\Temp\svchost.com
                                                                          Filesize

                                                                          368KB

                                                                          MD5

                                                                          f04861809694b1c8661a3adbfd11045d

                                                                          SHA1

                                                                          01dc81993524aded936f960a7ea60f152abd80c5

                                                                          SHA256

                                                                          da56ff6445214f6a37147898a55b6b3b2d4a83fa515ff213d45d550124f11c5e

                                                                          SHA512

                                                                          f5e6ae66743f6dd95afaf560cb7ed8a5896733ac37379cf59d9f5c118b0df8852cb9569735c209e65ff294769697a786542d8238bcf6ef3d42713ede8538d079

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\cache\desktop.ini
                                                                          Filesize

                                                                          129B

                                                                          MD5

                                                                          a526b9e7c716b3489d8cc062fbce4005

                                                                          SHA1

                                                                          2df502a944ff721241be20a9e449d2acd07e0312

                                                                          SHA256

                                                                          e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                          SHA512

                                                                          d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                          Download Submit

                                                                        • C:\Windows\SYSTEM.INI
                                                                          Filesize

                                                                          257B

                                                                          MD5

                                                                          e3bc7fef3591487f663e640778d8f414

                                                                          SHA1

                                                                          f32da9c7722d22b0bc6ee9dd740e2f2331621541

                                                                          SHA256

                                                                          558cc848fc8aaa292115648f75cb2afd49f173ae376faaa9633a556d75adb3e5

                                                                          SHA512

                                                                          1f7cdf3652454504e42cb53c113cd2c3eb07731970e4c97349584167aec939e53a920f2df031e165ad9e2005b903123c07d5b53bfab693dcfc0822eebd7b3192

                                                                          Download Submit

                                                                        • memory/1160-110-0x0000000000380000-0x0000000000382000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                          Download

                                                                        • memory/1160-95-0x0000000000390000-0x0000000000391000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/2840-41-0x0000000000400000-0x00000000004C8000-memory.dmp

                                                                          Filesize

                                                                          800KB

                                                                          Download

                                                                        • memory/2840-154-0x0000000000400000-0x00000000004C8000-memory.dmp

                                                                          Filesize

                                                                          800KB

                                                                          Download

                                                                        • memory/2840-91-0x00000000033C0000-0x00000000033C1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/2840-101-0x00000000033B0000-0x00000000033B2000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                          Download

                                                                        • memory/3164-24-0x0000000003680000-0x00000000046B3000-memory.dmp

                                                                          Filesize

                                                                          16.2MB

                                                                          Download

                                                                        • memory/3164-1-0x0000000003680000-0x00000000046B3000-memory.dmp

                                                                          Filesize

                                                                          16.2MB

                                                                          Download

                                                                        • memory/3164-0-0x0000000000400000-0x00000000004C8000-memory.dmp

                                                                          Filesize

                                                                          800KB

                                                                          Download

                                                                        • memory/3164-8-0x00000000001E0000-0x00000000001E2000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                          Download

                                                                        • memory/3164-9-0x0000000000A60000-0x0000000000A61000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/3164-42-0x0000000000400000-0x00000000004C8000-memory.dmp

                                                                          Filesize

                                                                          800KB

                                                                          Download

                                                                        • memory/3164-32-0x00000000001E0000-0x00000000001E2000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                          Download

                                                                        • memory/3164-12-0x00000000001E0000-0x00000000001E2000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                          Download

                                                                        • memory/3164-28-0x0000000003680000-0x00000000046B3000-memory.dmp

                                                                          Filesize

                                                                          16.2MB

                                                                          Download

                                                                        • memory/3164-6-0x0000000003680000-0x00000000046B3000-memory.dmp

                                                                          Filesize

                                                                          16.2MB

                                                                          Download

                                                                        • memory/3164-13-0x00000000001E0000-0x00000000001E2000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                          Download

                                                                        • memory/3164-4-0x0000000003680000-0x00000000046B3000-memory.dmp

                                                                          Filesize

                                                                          16.2MB

                                                                          Download

                                                                        • memory/3232-238-0x0000000000400000-0x00000000004C8000-memory.dmp

                                                                          Filesize

                                                                          800KB

                                                                          Download

                                                                        • memory/3232-241-0x0000000000400000-0x00000000004C8000-memory.dmp

                                                                          Filesize

                                                                          800KB

                                                                          Download

                                                                        • memory/3448-125-0x00000000033B0000-0x00000000043E3000-memory.dmp

                                                                          Filesize

                                                                          16.2MB

                                                                          Download

                                                                        • memory/3448-124-0x0000000000400000-0x00000000004C8000-memory.dmp

                                                                          Filesize

                                                                          800KB

                                                                          Download

                                                                        • memory/3448-236-0x0000000000400000-0x00000000004C8000-memory.dmp

                                                                          Filesize

                                                                          800KB

                                                                          Download

                                                                        • memory/3448-165-0x0000000000400000-0x00000000004C8000-memory.dmp

                                                                          Filesize

                                                                          800KB

                                                                          Download

                                                                        • memory/4092-84-0x0000000003270000-0x00000000042A3000-memory.dmp

                                                                          Filesize

                                                                          16.2MB

                                                                          Download

                                                                        • memory/4092-119-0x0000000003270000-0x00000000042A3000-memory.dmp

                                                                          Filesize

                                                                          16.2MB

                                                                          Download

                                                                        • memory/4092-80-0x0000000003270000-0x00000000042A3000-memory.dmp

                                                                          Filesize

                                                                          16.2MB

                                                                          Download

                                                                        • memory/4092-93-0x0000000005BB0000-0x0000000005BB1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/4092-71-0x0000000000400000-0x00000000004C8000-memory.dmp

                                                                          Filesize

                                                                          800KB

                                                                          Download

                                                                        • memory/4092-113-0x0000000000A30000-0x0000000000A32000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                          Download

                                                                        • memory/4092-102-0x0000000000A30000-0x0000000000A32000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                          Download

                                                                        • memory/4092-87-0x0000000003270000-0x00000000042A3000-memory.dmp

                                                                          Filesize

                                                                          16.2MB

                                                                          Download

                                                                        • memory/4092-122-0x0000000000400000-0x00000000004C8000-memory.dmp

                                                                          Filesize

                                                                          800KB

                                                                          Download

                                                                        • memory/4332-97-0x0000000000020000-0x0000000000021000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/4332-159-0x0000000000400000-0x00000000004C8000-memory.dmp

                                                                          Filesize

                                                                          800KB

                                                                          Download

                                                                        • memory/4332-230-0x0000000000400000-0x00000000004C8000-memory.dmp

                                                                          Filesize

                                                                          800KB

                                                                          Download

                                                                        • memory/4332-103-0x0000000000010000-0x0000000000012000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                          Download

                                                                        • memory/4452-98-0x00000000000F0000-0x00000000000F2000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                          Download

                                                                        • memory/4452-21-0x00000000000F0000-0x00000000000F2000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                          Download

                                                                        • memory/4452-11-0x0000000000100000-0x0000000000101000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                          Download

                                                                        • memory/4452-20-0x00000000000F0000-0x00000000000F2000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                          Download

                                                                        • memory/4728-244-0x0000000000400000-0x00000000004C8000-memory.dmp

                                                                          Filesize

                                                                          800KB

                                                                          Download