Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-10-2024 23:47

General

  • Target

    5f4e35a011f3717d5ada9865d8867fb0_JaffaCakes118.exe

  • Size

    2.4MB

  • MD5

    5f4e35a011f3717d5ada9865d8867fb0

  • SHA1

    cae012e3dcffac07162c72d48f32b62db71b8759

  • SHA256

    0f33a9d0abe2c1c7902d861e4bd8b4f419cbd431a2048cb7a17827ac7dec2e61

  • SHA512

    7ec2493933cc700c216574f60070f0baaed2ce24c306ce123556bc7c149c573083290cc6f1a7e1b3ed33851a28fdcd5716a0c806d8dbe1d7d2c43a226b19182e

  • SSDEEP

    49152:VdAKs1ZTeWKH7qC2huWZYz827+doDBfEzbsDDS/BsuPYfq7DTAQ:wKs1ZTc7uQWZKb7goFfEzbsDDS/CkOuH

Malware Config

Signatures

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

  • Adds policy Run key to start application 2 TTPs 16 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f4e35a011f3717d5ada9865d8867fb0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5f4e35a011f3717d5ada9865d8867fb0_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Users\Admin\AppData\Local\Temp\5f4e35a011f3717d5ada9865d8867fb0_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\5f4e35a011f3717d5ada9865d8867fb0_JaffaCakes118.exe"
      2⤵
      • Adds policy Run key to start application
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2992
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
        • Adds policy Run key to start application
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2584
        • C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe
          "C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:2968
          • C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe
            "C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe" vCenter3\vmvctr3.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1944
        • C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe
          "C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:2248
          • C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe
            "C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe" vCenter3\vmvctr3.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1956
        • C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe
          "C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:1868
          • C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe
            "C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe" vCenter3\vmvctr3.exe"
            5⤵
            • Adds policy Run key to start application
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:2832
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              6⤵
                PID:2952
              • C:\Windows\SysWOW64\explorer.exe
                explorer.exe
                6⤵
                  PID:2900
                • C:\Program Files\Internet Explorer\iexplore.exe
                  "C:\Program Files\Internet Explorer\iexplore.exe"
                  6⤵
                    PID:1440
                  • C:\Windows\SysWOW64\explorer.exe
                    explorer.exe
                    6⤵
                      PID:2932
                    • C:\Program Files\Internet Explorer\iexplore.exe
                      "C:\Program Files\Internet Explorer\iexplore.exe"
                      6⤵
                        PID:628
                      • C:\Windows\SysWOW64\explorer.exe
                        explorer.exe
                        6⤵
                          PID:2912
                        • C:\Program Files\Internet Explorer\iexplore.exe
                          "C:\Program Files\Internet Explorer\iexplore.exe"
                          6⤵
                            PID:684
                          • C:\Windows\SysWOW64\explorer.exe
                            explorer.exe
                            6⤵
                              PID:1588
                            • C:\Program Files\Internet Explorer\iexplore.exe
                              "C:\Program Files\Internet Explorer\iexplore.exe"
                              6⤵
                                PID:2580
                              • C:\Windows\SysWOW64\explorer.exe
                                explorer.exe
                                6⤵
                                  PID:2572
                                • C:\Program Files\Internet Explorer\iexplore.exe
                                  "C:\Program Files\Internet Explorer\iexplore.exe"
                                  6⤵
                                    PID:2624
                                  • C:\Windows\SysWOW64\explorer.exe
                                    explorer.exe
                                    6⤵
                                      PID:1636
                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                      "C:\Program Files\Internet Explorer\iexplore.exe"
                                      6⤵
                                        PID:2060
                                      • C:\Windows\SysWOW64\explorer.exe
                                        explorer.exe
                                        6⤵
                                          PID:2592
                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                          "C:\Program Files\Internet Explorer\iexplore.exe"
                                          6⤵
                                            PID:1984
                                          • C:\Windows\SysWOW64\explorer.exe
                                            explorer.exe
                                            6⤵
                                              PID:2196
                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                              "C:\Program Files\Internet Explorer\iexplore.exe"
                                              6⤵
                                                PID:2104
                                              • C:\Windows\SysWOW64\explorer.exe
                                                explorer.exe
                                                6⤵
                                                  PID:2132
                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                  "C:\Program Files\Internet Explorer\iexplore.exe"
                                                  6⤵
                                                    PID:2936
                                                  • C:\Windows\SysWOW64\explorer.exe
                                                    explorer.exe
                                                    6⤵
                                                      PID:1728
                                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                                      "C:\Program Files\Internet Explorer\iexplore.exe"
                                                      6⤵
                                                        PID:2068
                                                      • C:\Windows\SysWOW64\explorer.exe
                                                        explorer.exe
                                                        6⤵
                                                          PID:2888
                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                          "C:\Program Files\Internet Explorer\iexplore.exe"
                                                          6⤵
                                                            PID:2620
                                                          • C:\Windows\SysWOW64\explorer.exe
                                                            explorer.exe
                                                            6⤵
                                                              PID:2804
                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                              "C:\Program Files\Internet Explorer\iexplore.exe"
                                                              6⤵
                                                                PID:2852
                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                explorer.exe
                                                                6⤵
                                                                  PID:2848
                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                  "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                  6⤵
                                                                    PID:1884
                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                    explorer.exe
                                                                    6⤵
                                                                      PID:2660
                                                                • C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe
                                                                  "C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe"
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2920
                                                                  • C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe
                                                                    "C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe" vCenter3\vmvctr3.exe"
                                                                    5⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2352
                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                3⤵
                                                                  PID:2920
                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                  explorer.exe
                                                                  3⤵
                                                                    PID:2572
                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                    explorer.exe
                                                                    3⤵
                                                                    • Deletes itself
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2796
                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                    3⤵
                                                                      PID:2568
                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                      explorer.exe
                                                                      3⤵
                                                                        PID:2600
                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                        3⤵
                                                                          PID:2624
                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                          explorer.exe
                                                                          3⤵
                                                                            PID:1636
                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                            "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                            3⤵
                                                                              PID:1048
                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                              explorer.exe
                                                                              3⤵
                                                                                PID:2060
                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                3⤵
                                                                                  PID:2592
                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                  explorer.exe
                                                                                  3⤵
                                                                                    PID:1984
                                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                    3⤵
                                                                                      PID:2196
                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                      explorer.exe
                                                                                      3⤵
                                                                                        PID:2104
                                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                        3⤵
                                                                                          PID:2132
                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                          explorer.exe
                                                                                          3⤵
                                                                                            PID:640
                                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                            "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                            3⤵
                                                                                              PID:2536
                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                              explorer.exe
                                                                                              3⤵
                                                                                                PID:2860
                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                3⤵
                                                                                                  PID:2944
                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                  explorer.exe
                                                                                                  3⤵
                                                                                                    PID:2880
                                                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                    3⤵
                                                                                                      PID:2352
                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                      explorer.exe
                                                                                                      3⤵
                                                                                                        PID:1932
                                                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                        3⤵
                                                                                                          PID:2440
                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                          explorer.exe
                                                                                                          3⤵
                                                                                                            PID:2512
                                                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                            "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                            3⤵
                                                                                                              PID:1452
                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                              explorer.exe
                                                                                                              3⤵
                                                                                                                PID:596
                                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                3⤵
                                                                                                                  PID:2640
                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  3⤵
                                                                                                                    PID:2876
                                                                                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                    3⤵
                                                                                                                      PID:1140
                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      3⤵
                                                                                                                        PID:1484
                                                                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                        3⤵
                                                                                                                          PID:1652
                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          3⤵
                                                                                                                            PID:2620
                                                                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                            "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                            3⤵
                                                                                                                              PID:2804
                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              3⤵
                                                                                                                                PID:2852
                                                                                                                              • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                3⤵
                                                                                                                                  PID:2848
                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                  explorer.exe
                                                                                                                                  3⤵
                                                                                                                                    PID:2808
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe
                                                                                                                                    "C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe"
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:276
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe
                                                                                                                                      "C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe" vCenter3\vmvctr3.exe"
                                                                                                                                      4⤵
                                                                                                                                      • Adds policy Run key to start application
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Adds Run key to start application
                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:1548
                                                                                                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                                        "C:\Program Files\Internet Explorer\iexplore.exe"
                                                                                                                                        5⤵
                                                                                                                                          PID:580
                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                          explorer.exe
                                                                                                                                          5⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          PID:1740

                                                                                                                                Network

                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\LQRSoNEZq\LQRSoNEZq.nfo

                                                                                                                                  Filesize

                                                                                                                                  3KB

                                                                                                                                  MD5

                                                                                                                                  14bae2561a767133725257c6ef55c89e

                                                                                                                                  SHA1

                                                                                                                                  27f7d1009dcf7205e1709146bede191632374ddf

                                                                                                                                  SHA256

                                                                                                                                  af93288f4018559643aef401759c059fa53f05be73568eda783092e9d2aed73a

                                                                                                                                  SHA512

                                                                                                                                  f7c3ccad371b08105d286521808e2159320b40afdfee957ba2031264d11ba165aef3f71d814534c42c0d00f5823cd2166101b61b85fb62f21a55785cac70a66e

                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\LQRSoNEZq\LQRSoNEZq.svr

                                                                                                                                  Filesize

                                                                                                                                  1018KB

                                                                                                                                  MD5

                                                                                                                                  bc9b20d15be56588dc1716ce4b0aedee

                                                                                                                                  SHA1

                                                                                                                                  054a2970bc0c453b656d0ef2bd1a4f4c97707145

                                                                                                                                  SHA256

                                                                                                                                  35b282de1c0bd77fac64a1b1f692f521a37a706d9f110a696d428a81e3035120

                                                                                                                                  SHA512

                                                                                                                                  0620e13687e7d3441ad0c11f30e5d2345b26da00f38ef299eb624f338f900b24b403600c2b153faa6e22d98a2ca0e2cd1307997e62052f04d2fa2176fe5648cb

                                                                                                                                • C:\Users\Admin\AppData\Roaming\VMware vCenter3\vmvctr3.exe

                                                                                                                                  Filesize

                                                                                                                                  2.4MB

                                                                                                                                  MD5

                                                                                                                                  5f4e35a011f3717d5ada9865d8867fb0

                                                                                                                                  SHA1

                                                                                                                                  cae012e3dcffac07162c72d48f32b62db71b8759

                                                                                                                                  SHA256

                                                                                                                                  0f33a9d0abe2c1c7902d861e4bd8b4f419cbd431a2048cb7a17827ac7dec2e61

                                                                                                                                  SHA512

                                                                                                                                  7ec2493933cc700c216574f60070f0baaed2ce24c306ce123556bc7c149c573083290cc6f1a7e1b3ed33851a28fdcd5716a0c806d8dbe1d7d2c43a226b19182e

                                                                                                                                • memory/276-56-0x0000000000400000-0x0000000000B28000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/276-69-0x0000000000400000-0x0000000000B28000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/276-92-0x0000000000400000-0x0000000000B28000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/1868-174-0x0000000000400000-0x0000000000B28000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/1868-197-0x0000000000400000-0x0000000000B28000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2248-68-0x0000000000400000-0x0000000000B28000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2248-140-0x0000000000400000-0x0000000000B28000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2320-2-0x0000000000400000-0x0000000000B28000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2320-4-0x0000000003A70000-0x0000000004198000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2320-0-0x0000000000400000-0x0000000000B28000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2320-1-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/2320-25-0x0000000000400000-0x0000000000B28000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2320-3-0x00000000004B1000-0x00000000004B9000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  32KB

                                                                                                                                • memory/2584-59-0x00000000048D0000-0x0000000004FF8000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2584-200-0x00000000048D0000-0x0000000004FF8000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2584-40-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.1MB

                                                                                                                                • memory/2584-173-0x00000000048D0000-0x0000000004FF8000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2584-70-0x00000000048D0000-0x0000000004FF8000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2584-206-0x00000000048D0000-0x0000000004FF8000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2584-144-0x0000000004A20000-0x0000000005148000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2584-67-0x0000000004A20000-0x0000000005148000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2584-38-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.1MB

                                                                                                                                • memory/2796-43-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.1MB

                                                                                                                                • memory/2920-226-0x0000000000400000-0x0000000000B28000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2920-207-0x0000000000400000-0x0000000000B28000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2968-113-0x0000000000400000-0x0000000000B28000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2968-60-0x0000000000400000-0x0000000000B28000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2968-71-0x0000000000400000-0x0000000000B28000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2992-8-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.1MB

                                                                                                                                • memory/2992-14-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.1MB

                                                                                                                                • memory/2992-50-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.1MB

                                                                                                                                • memory/2992-23-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.1MB

                                                                                                                                • memory/2992-29-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.1MB

                                                                                                                                • memory/2992-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                • memory/2992-62-0x00000000009B0000-0x0000000000B31000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.5MB

                                                                                                                                • memory/2992-10-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.1MB

                                                                                                                                • memory/2992-12-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.1MB

                                                                                                                                • memory/2992-46-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.1MB

                                                                                                                                • memory/2992-16-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.1MB

                                                                                                                                • memory/2992-18-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.1MB

                                                                                                                                • memory/2992-20-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.1MB

                                                                                                                                • memory/2992-26-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.1MB

                                                                                                                                • memory/2992-54-0x00000000056F0000-0x0000000005E18000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2992-55-0x00000000056F0000-0x0000000005E18000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  7.2MB

                                                                                                                                • memory/2992-24-0x0000000000400000-0x0000000000514000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.1MB