metasploit | 755abefc2b2250d297fd8d971abf23bed13130feaf8eb81150f935e10fadb6ee

Analysis

max time kernel
148s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-09-2024 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f12a3388d4157a781d43e4ab9594bccd_JaffaCakes118.exe
Size

583KB
MD5

f12a3388d4157a781d43e4ab9594bccd
SHA1

f4396944022e12e88867258e4d9ac04dfc028fff
SHA256

755abefc2b2250d297fd8d971abf23bed13130feaf8eb81150f935e10fadb6ee
SHA512

9899883230987cc266b4c9e08ef5697d33cfb35c3d02b5c806bd116448363076bcb202cdc170c89c6b5351e1c511c42c3f195c9543b74530359f339fa76cffd0
SSDEEP

12288:AWSHVrQxktwW0Z2ZL9hNqFCQYTama57XwtsI/2jTPMD9:AWyVUxvW0kLYFCQGGXW2jTU

Score

10^/10

metasploit backdoor discovery evasion trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 10 IoCs

pid	Process
2512	IEXPLORE.exe
2708	IEXPLORE.exe
2196	IEXPLORE.exe
2088	IEXPLORE.exe
1472	IEXPLORE.exe
1912	IEXPLORE.exe
316	IEXPLORE.exe
2668	IEXPLORE.exe
3040	IEXPLORE.exe
2940	IEXPLORE.exe

Identifies Wine through registry keys 2 TTPs 11 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine	IEXPLORE.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine	IEXPLORE.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine	IEXPLORE.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine	f12a3388d4157a781d43e4ab9594bccd_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine	IEXPLORE.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine	IEXPLORE.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine	IEXPLORE.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine	IEXPLORE.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine	IEXPLORE.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine	IEXPLORE.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Wine	IEXPLORE.exe

Loads dropped DLL 20 IoCs

pid	Process
1620	f12a3388d4157a781d43e4ab9594bccd_JaffaCakes118.exe
1620	f12a3388d4157a781d43e4ab9594bccd_JaffaCakes118.exe
2512	IEXPLORE.exe
2512	IEXPLORE.exe
2708	IEXPLORE.exe
2708	IEXPLORE.exe
2196	IEXPLORE.exe
2196	IEXPLORE.exe
2088	IEXPLORE.exe
2088	IEXPLORE.exe
1472	IEXPLORE.exe
1472	IEXPLORE.exe
1912	IEXPLORE.exe
1912	IEXPLORE.exe
316	IEXPLORE.exe
316	IEXPLORE.exe
2668	IEXPLORE.exe
2668	IEXPLORE.exe
3040	IEXPLORE.exe
3040	IEXPLORE.exe

Checks whether UAC is enabled 1 TTPs 10 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IEXPLORE.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File created	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File created	C:\Windows\SysWOW64\IEXPLORE.exe	f12a3388d4157a781d43e4ab9594bccd_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File created	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File created	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPLORE.exe	f12a3388d4157a781d43e4ab9594bccd_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File created	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File created	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File created	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File created	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File created	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File opened for modification	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe
File created	C:\Windows\SysWOW64\IEXPLORE.exe	IEXPLORE.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f12a3388d4157a781d43e4ab9594bccd_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1620	f12a3388d4157a781d43e4ab9594bccd_JaffaCakes118.exe
2512	IEXPLORE.exe
2708	IEXPLORE.exe
2196	IEXPLORE.exe
2088	IEXPLORE.exe
1472	IEXPLORE.exe
1912	IEXPLORE.exe
316	IEXPLORE.exe
2668	IEXPLORE.exe
3040	IEXPLORE.exe
2940	IEXPLORE.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2512	1620	f12a3388d4157a781d43e4ab9594bccd_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2512	1620	f12a3388d4157a781d43e4ab9594bccd_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2512	1620	f12a3388d4157a781d43e4ab9594bccd_JaffaCakes118.exe	30
PID 1620 wrote to memory of 2512	1620	f12a3388d4157a781d43e4ab9594bccd_JaffaCakes118.exe	30
PID 2512 wrote to memory of 2708	2512	IEXPLORE.exe	31
PID 2512 wrote to memory of 2708	2512	IEXPLORE.exe	31
PID 2512 wrote to memory of 2708	2512	IEXPLORE.exe	31
PID 2512 wrote to memory of 2708	2512	IEXPLORE.exe	31
PID 2708 wrote to memory of 2196	2708	IEXPLORE.exe	33
PID 2708 wrote to memory of 2196	2708	IEXPLORE.exe	33
PID 2708 wrote to memory of 2196	2708	IEXPLORE.exe	33
PID 2708 wrote to memory of 2196	2708	IEXPLORE.exe	33
PID 2196 wrote to memory of 2088	2196	IEXPLORE.exe	34
PID 2196 wrote to memory of 2088	2196	IEXPLORE.exe	34
PID 2196 wrote to memory of 2088	2196	IEXPLORE.exe	34
PID 2196 wrote to memory of 2088	2196	IEXPLORE.exe	34
PID 2088 wrote to memory of 1472	2088	IEXPLORE.exe	35
PID 2088 wrote to memory of 1472	2088	IEXPLORE.exe	35
PID 2088 wrote to memory of 1472	2088	IEXPLORE.exe	35
PID 2088 wrote to memory of 1472	2088	IEXPLORE.exe	35
PID 1472 wrote to memory of 1912	1472	IEXPLORE.exe	36
PID 1472 wrote to memory of 1912	1472	IEXPLORE.exe	36
PID 1472 wrote to memory of 1912	1472	IEXPLORE.exe	36
PID 1472 wrote to memory of 1912	1472	IEXPLORE.exe	36
PID 1912 wrote to memory of 316	1912	IEXPLORE.exe	37
PID 1912 wrote to memory of 316	1912	IEXPLORE.exe	37
PID 1912 wrote to memory of 316	1912	IEXPLORE.exe	37
PID 1912 wrote to memory of 316	1912	IEXPLORE.exe	37
PID 316 wrote to memory of 2668	316	IEXPLORE.exe	38
PID 316 wrote to memory of 2668	316	IEXPLORE.exe	38
PID 316 wrote to memory of 2668	316	IEXPLORE.exe	38
PID 316 wrote to memory of 2668	316	IEXPLORE.exe	38
PID 2668 wrote to memory of 3040	2668	IEXPLORE.exe	39
PID 2668 wrote to memory of 3040	2668	IEXPLORE.exe	39
PID 2668 wrote to memory of 3040	2668	IEXPLORE.exe	39
PID 2668 wrote to memory of 3040	2668	IEXPLORE.exe	39
PID 3040 wrote to memory of 2940	3040	IEXPLORE.exe	40
PID 3040 wrote to memory of 2940	3040	IEXPLORE.exe	40
PID 3040 wrote to memory of 2940	3040	IEXPLORE.exe	40
PID 3040 wrote to memory of 2940	3040	IEXPLORE.exe	40

C:\Users\Admin\AppData\Local\Temp\f12a3388d4157a781d43e4ab9594bccd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f12a3388d4157a781d43e4ab9594bccd_JaffaCakes118.exe"
1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\IEXPLORE.exe
  C:\Windows\system32\IEXPLORE.exe 628 "C:\Users\Admin\AppData\Local\Temp\f12a3388d4157a781d43e4ab9594bccd_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\IEXPLORE.exe
    C:\Windows\system32\IEXPLORE.exe 712 "C:\Windows\SysWOW64\IEXPLORE.exe"
    3⤵
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\SysWOW64\IEXPLORE.exe
      C:\Windows\system32\IEXPLORE.exe 720 "C:\Windows\SysWOW64\IEXPLORE.exe"
      4⤵
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Checks whether UAC is enabled
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2196
    - - C:\Windows\SysWOW64\IEXPLORE.exe
        
        C:\Windows\system32\IEXPLORE.exe 724 "C:\Windows\SysWOW64\IEXPLORE.exe"
        5⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Checks whether UAC is enabled
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2088
      - C:\Windows\SysWOW64\IEXPLORE.exe
        
        C:\Windows\system32\IEXPLORE.exe 732 "C:\Windows\SysWOW64\IEXPLORE.exe"
        6⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Checks whether UAC is enabled
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1472
        
        C:\Windows\SysWOW64\IEXPLORE.exe
        
        C:\Windows\system32\IEXPLORE.exe 728 "C:\Windows\SysWOW64\IEXPLORE.exe"
        7⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Checks whether UAC is enabled
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\SysWOW64\IEXPLORE.exe
        
        C:\Windows\system32\IEXPLORE.exe 740 "C:\Windows\SysWOW64\IEXPLORE.exe"
        8⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Checks whether UAC is enabled
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:316
        
        C:\Windows\SysWOW64\IEXPLORE.exe
        
        C:\Windows\system32\IEXPLORE.exe 716 "C:\Windows\SysWOW64\IEXPLORE.exe"
        9⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Checks whether UAC is enabled
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2668
        
        C:\Windows\SysWOW64\IEXPLORE.exe
        
        C:\Windows\system32\IEXPLORE.exe 744 "C:\Windows\SysWOW64\IEXPLORE.exe"
        10⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Checks whether UAC is enabled
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Windows\SysWOW64\IEXPLORE.exe
        
        C:\Windows\system32\IEXPLORE.exe 752 "C:\Windows\SysWOW64\IEXPLORE.exe"
        11⤵
        Executes dropped EXE
        Identifies Wine through registry keys
        Checks whether UAC is enabled
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\IEXPLORE.exe

Filesize
583KB

MD5
f12a3388d4157a781d43e4ab9594bccd

SHA1
f4396944022e12e88867258e4d9ac04dfc028fff

SHA256
755abefc2b2250d297fd8d971abf23bed13130feaf8eb81150f935e10fadb6ee

SHA512
9899883230987cc266b4c9e08ef5697d33cfb35c3d02b5c806bd116448363076bcb202cdc170c89c6b5351e1c511c42c3f195c9543b74530359f339fa76cffd0

Download Submit
memory/316-86-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/316-79-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/316-81-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/316-82-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/1472-69-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/1472-68-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/1472-73-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/1620-5-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/1620-18-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/1620-19-0x00000000047C0000-0x000000000495B000-memory.dmp

Filesize
1.6MB

Download
memory/1620-2-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/1620-4-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/1620-6-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/1620-3-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/1620-0-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/1620-1-0x0000000000401000-0x0000000000413000-memory.dmp

Filesize
72KB

Download
memory/1912-75-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/1912-74-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/1912-80-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2088-62-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2088-67-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2088-63-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2196-61-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2196-51-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2196-57-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2196-56-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2196-55-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2196-54-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2196-52-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2196-49-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2196-50-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2512-26-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2512-27-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2512-20-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2512-22-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2512-25-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2512-24-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2512-23-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2512-28-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2512-40-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2512-29-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2512-30-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2512-32-0x00000000047E0000-0x000000000497B000-memory.dmp

Filesize
1.6MB

Download
memory/2668-87-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2668-93-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2668-88-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2708-37-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2708-39-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2708-41-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2708-42-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2708-43-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2708-44-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2708-48-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2708-35-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2708-36-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2940-100-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/2940-101-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/3040-92-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/3040-94-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/3040-95-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download
memory/3040-99-0x0000000000400000-0x000000000059B000-memory.dmp

Filesize
1.6MB

Download