Overview

overview

10

Static

static

3

8f128e6c0c...18.exe

windows7-x64

10

8f128e6c0c...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-11-2024 04:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8f128e6c0c42bd73084daf6f42e79663_JaffaCakes118.exe

  • Size

    760KB

  • MD5

    8f128e6c0c42bd73084daf6f42e79663

  • SHA1

    26c5ebb8f7394f8d9a46b7b5cc13fddcdb786535

  • SHA256

    06d0053abd5c3b62b77f18d22db7bb4646e26c1433cfbdfe76747195c23d5654

  • SHA512

    229b8e7a5b1bcef6227dc9158b873730ce31e4e719861d1b63874c4f974a08e322e9622d70cd4e04a776a3001a356681edd093770762d18f84f77908b6a9b391

  • SSDEEP

    12288:Yc4HGMupg4/8gsJwI7hJiCc9NNfftsAd/cYbQQNWQvviR1qxYNpl/RF0k3hf1Q5l:H4HGPyRdozvtryiQQNN3iR1n7HNhf1QH

Score
10/10
metasploitbackdoordiscoveryevasiontrojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Metasploit family
    metasploit
  • Modifies security service 2 TTPs 20 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 21 IoCs
  • Drops file in System32 directory 22 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Runs .reg file with regedit 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f128e6c0c42bd73084daf6f42e79663_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8f128e6c0c42bd73084daf6f42e79663_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2436
    • C:\Users\Admin\AppData\Local\Temp\8f128e6c0c42bd73084daf6f42e79663_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\8f128e6c0c42bd73084daf6f42e79663_JaffaCakes118.exe"
      2⤵
      • Checks BIOS information in registry
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c c:\a.bat
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2108
        • C:\Windows\SysWOW64\regedit.exe
          REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
          4⤵
          • Modifies security service
          • System Location Discovery: System Language Discovery
          • Runs .reg file with regedit
          PID:2040
      • C:\Windows\SysWOW64\msnmsgr.exe
        C:\Windows\system32\msnmsgr.exe 704 "C:\Users\Admin\AppData\Local\Temp\8f128e6c0c42bd73084daf6f42e79663_JaffaCakes118.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2620
        • C:\Windows\SysWOW64\msnmsgr.exe
          C:\Windows\system32\msnmsgr.exe 704 "C:\Users\Admin\AppData\Local\Temp\8f128e6c0c42bd73084daf6f42e79663_JaffaCakes118.exe"
          4⤵
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2900
          • C:\Windows\SysWOW64\msnmsgr.exe
            C:\Windows\system32\msnmsgr.exe 760 "C:\Windows\SysWOW64\msnmsgr.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1064
            • C:\Windows\SysWOW64\msnmsgr.exe
              C:\Windows\system32\msnmsgr.exe 760 "C:\Windows\SysWOW64\msnmsgr.exe"
              6⤵
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              PID:1944
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c c:\a.bat
                7⤵
                • System Location Discovery: System Language Discovery
                PID:972
                • C:\Windows\SysWOW64\regedit.exe
                  REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                  8⤵
                  • Modifies security service
                  • System Location Discovery: System Language Discovery
                  • Runs .reg file with regedit
                  PID:528
              • C:\Windows\SysWOW64\msnmsgr.exe
                C:\Windows\system32\msnmsgr.exe 784 "C:\Windows\SysWOW64\msnmsgr.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2348
                • C:\Windows\SysWOW64\msnmsgr.exe
                  C:\Windows\system32\msnmsgr.exe 784 "C:\Windows\SysWOW64\msnmsgr.exe"
                  8⤵
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2356
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c c:\a.bat
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:2584
                    • C:\Windows\SysWOW64\regedit.exe
                      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                      10⤵
                      • Modifies security service
                      • System Location Discovery: System Language Discovery
                      • Runs .reg file with regedit
                      PID:2916
                  • C:\Windows\SysWOW64\msnmsgr.exe
                    C:\Windows\system32\msnmsgr.exe 796 "C:\Windows\SysWOW64\msnmsgr.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2156
                    • C:\Windows\SysWOW64\msnmsgr.exe
                      C:\Windows\system32\msnmsgr.exe 796 "C:\Windows\SysWOW64\msnmsgr.exe"
                      10⤵
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2944
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c c:\a.bat
                        11⤵
                        • System Location Discovery: System Language Discovery
                        PID:448
                        • C:\Windows\SysWOW64\regedit.exe
                          REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                          12⤵
                          • Modifies security service
                          • System Location Discovery: System Language Discovery
                          • Runs .reg file with regedit
                          PID:892
                      • C:\Windows\SysWOW64\msnmsgr.exe
                        C:\Windows\system32\msnmsgr.exe 800 "C:\Windows\SysWOW64\msnmsgr.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:2460
                        • C:\Windows\SysWOW64\msnmsgr.exe
                          C:\Windows\system32\msnmsgr.exe 800 "C:\Windows\SysWOW64\msnmsgr.exe"
                          12⤵
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Drops file in System32 directory
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1624
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c c:\a.bat
                            13⤵
                            • System Location Discovery: System Language Discovery
                            PID:2712
                            • C:\Windows\SysWOW64\regedit.exe
                              REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                              14⤵
                              • Modifies security service
                              • System Location Discovery: System Language Discovery
                              • Runs .reg file with regedit
                              PID:2744
                          • C:\Windows\SysWOW64\msnmsgr.exe
                            C:\Windows\system32\msnmsgr.exe 816 "C:\Windows\SysWOW64\msnmsgr.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:2584
                            • C:\Windows\SysWOW64\msnmsgr.exe
                              C:\Windows\system32\msnmsgr.exe 816 "C:\Windows\SysWOW64\msnmsgr.exe"
                              14⤵
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Drops file in System32 directory
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              PID:556
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c c:\a.bat
                                15⤵
                                • System Location Discovery: System Language Discovery
                                PID:1516
                                • C:\Windows\SysWOW64\regedit.exe
                                  REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                                  16⤵
                                  • Modifies security service
                                  • System Location Discovery: System Language Discovery
                                  • Runs .reg file with regedit
                                  PID:3036
                              • C:\Windows\SysWOW64\msnmsgr.exe
                                C:\Windows\system32\msnmsgr.exe 828 "C:\Windows\SysWOW64\msnmsgr.exe"
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:1580
                                • C:\Windows\SysWOW64\msnmsgr.exe
                                  C:\Windows\system32\msnmsgr.exe 828 "C:\Windows\SysWOW64\msnmsgr.exe"
                                  16⤵
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Drops file in System32 directory
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1484
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /c c:\a.bat
                                    17⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2832
                                    • C:\Windows\SysWOW64\regedit.exe
                                      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                                      18⤵
                                      • Modifies security service
                                      • System Location Discovery: System Language Discovery
                                      • Runs .reg file with regedit
                                      PID:2752
                                  • C:\Windows\SysWOW64\msnmsgr.exe
                                    C:\Windows\system32\msnmsgr.exe 840 "C:\Windows\SysWOW64\msnmsgr.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:2828
                                    • C:\Windows\SysWOW64\msnmsgr.exe
                                      C:\Windows\system32\msnmsgr.exe 840 "C:\Windows\SysWOW64\msnmsgr.exe"
                                      18⤵
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Drops file in System32 directory
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1824
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c c:\a.bat
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2200
                                        • C:\Windows\SysWOW64\regedit.exe
                                          REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                                          20⤵
                                          • Modifies security service
                                          • System Location Discovery: System Language Discovery
                                          • Runs .reg file with regedit
                                          PID:1980
                                      • C:\Windows\SysWOW64\msnmsgr.exe
                                        C:\Windows\system32\msnmsgr.exe 856 "C:\Windows\SysWOW64\msnmsgr.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:2452
                                        • C:\Windows\SysWOW64\msnmsgr.exe
                                          C:\Windows\system32\msnmsgr.exe 856 "C:\Windows\SysWOW64\msnmsgr.exe"
                                          20⤵
                                          • Checks BIOS information in registry
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Drops file in System32 directory
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1456
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd /c c:\a.bat
                                            21⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:448
                                            • C:\Windows\SysWOW64\regedit.exe
                                              REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                                              22⤵
                                              • Modifies security service
                                              • System Location Discovery: System Language Discovery
                                              • Runs .reg file with regedit
                                              PID:2256
                                          • C:\Windows\SysWOW64\msnmsgr.exe
                                            C:\Windows\system32\msnmsgr.exe 860 "C:\Windows\SysWOW64\msnmsgr.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:2272
                                            • C:\Windows\SysWOW64\msnmsgr.exe
                                              C:\Windows\system32\msnmsgr.exe 860 "C:\Windows\SysWOW64\msnmsgr.exe"
                                              22⤵
                                              • Checks BIOS information in registry
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2304
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd /c c:\a.bat
                                                23⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:2152
                                                • C:\Windows\SysWOW64\regedit.exe
                                                  REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
                                                  24⤵
                                                  • Modifies security service
                                                  • System Location Discovery: System Language Discovery
                                                  • Runs .reg file with regedit
                                                  PID:1968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1.reg
    Filesize

    3KB

    MD5

    9e5db93bd3302c217b15561d8f1e299d

    SHA1

    95a5579b336d16213909beda75589fd0a2091f30

    SHA256

    f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

    SHA512

    b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\FA36D0AD.TMP
    Filesize

    113B

    MD5

    afc13e8e2c91750aa13411f1140dbc42

    SHA1

    5326b2ca31963b5255b29036be41e9963b69026b

    SHA256

    6a6e2bde5b3dd045670a3285c0a93924e1539bb417c3f443974399a236b6b7fa

    SHA512

    cb3c8f8ff61234158cdb9ea4b0d03aec8b19620ae0fb301ba5f3a600552660c61c71c1ea3c97b02028cda61aca9ef5dbf58bd82b63608fba183c6ad821aa892f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\FA36D0AD.TMP
    Filesize

    113B

    MD5

    aa748ff89963b46055f4d3b408a7038c

    SHA1

    9b1eb849ed1a8afce9b7efbf66390e3452d47935

    SHA256

    268d5ce94fafee1309616ff6a1a46418d33189575542092773cd8ef4682295e6

    SHA512

    e6b498cc5f642886fecf46e32acd0edeb11f08b8f1c4a4781b3a1999d2df8a013e2272e5670eb952b3f3bcd2ed489af0b582acf47eb315115e34b5a4137318a6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\FA36D0AD.TMP
    Filesize

    113B

    MD5

    25f42764207610cf62c8900674cddd0e

    SHA1

    09a5f673645cba2af4f609580934bae7d46c5d3a

    SHA256

    2885c7f4c965ebaf1f39941e1b4e690dfd03e2c06fbaad5fc43e6866e2550ce2

    SHA512

    db346fe457d902996bc0ec54b33afdf840d2da0c0d033f5589dab0a63cfe5ece5be5f78834ba3d4da432965ea294568ca66e7ab8a788ad0042bc12cf75efca61

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\FA36D0AD.TMP
    Filesize

    113B

    MD5

    96e56219bfccbc3cd1e550d061cd9b8e

    SHA1

    0b92e1ce8dfa6ac1a98a61597bef858263844b69

    SHA256

    dc16b31308ffecd9e945806345d2115e26562e118b2bf40a2e80e5c3347ab940

    SHA512

    0fb95ec1ee74dacdc4520a554dc083c13e24772d079bdaa54b846f11f00b6f1c958861c21c942b3ce0cad1f4751a024086ec3fd587d693dc451b757283cfe256

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\FA36D0AD.TMP
    Filesize

    113B

    MD5

    dd2c352787f6c3bdec125fd124199677

    SHA1

    ecd79f83acbf9a42743ad8d057626ebe3bec6c64

    SHA256

    54f7ce75d0fe9dcabb609a3bd5d0383c2d5fda062667caea56f3bbe386a44eb5

    SHA512

    021b1e2f1c2512423e0394154a24d98dbfe6243252795a3ae55f8c6afd4ec629b803b853ddda14ba6fca3be6c692c660a794037a67ac65d749dce6b0f8a28ed9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\FA36D0AD.TMP
    Filesize

    113B

    MD5

    66e9d5caf98bbefaf93368644ca24a78

    SHA1

    2c6abf79a2ae5ce191d493de99901190209166d7

    SHA256

    5c0616031499df9ee9159e3896d158c06107ac2cd0b6211832d220516bee4970

    SHA512

    622d0d5523d7def5190a12017d2583860181f08082e36ad55286ef8f6d9d9f0245949a0f88706bb8cf0bf17565a3dd14622329775cd83bfb3a3ec2c549e61ba7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\FA36D0AD.TMP
    Filesize

    113B

    MD5

    b2c2b930b0d0fc38d7619d6fb03efe66

    SHA1

    07e90789ab7ae9a33d8492d4356e90b8085e2fc4

    SHA256

    b4cfc5f80755558872803d4948bc1684060a70d1f56d2627a0239c47ee2b7462

    SHA512

    a9f56c3ae0278ab217eb7a5448e7f4649040a0f5c84b7ceeda93fb382cefbc71fc3f72f48da2d9605b2153bd09094917646d68d3a994cf8c055e7a94c9f0a022

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\FA36D0AD.TMP
    Filesize

    113B

    MD5

    06ec8d15994d80e9105ff2b88d721865

    SHA1

    9ce21a0e02c7896eefc6c3167916236047a16ba2

    SHA256

    5e80d4b78e84c4fa8270410f800afbf50a530507b45b47dcb628380476ce5193

    SHA512

    e85403ed7b823501ed1912922cfb408dc7e8c97d9c1c9d8f8c90f38971257e06d91c2bd70904d8f202f799cff3454d7a557f0f73971e9adfe9bdb452e59661dc

    Download Submit

  • C:\a.bat
    Filesize

    5KB

    MD5

    0019a0451cc6b9659762c3e274bc04fb

    SHA1

    5259e256cc0908f2846e532161b989f1295f479b

    SHA256

    ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

    SHA512

    314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

    Download Submit

  • \Windows\SysWOW64\msnmsgr.exe
    Filesize

    760KB

    MD5

    8f128e6c0c42bd73084daf6f42e79663

    SHA1

    26c5ebb8f7394f8d9a46b7b5cc13fddcdb786535

    SHA256

    06d0053abd5c3b62b77f18d22db7bb4646e26c1433cfbdfe76747195c23d5654

    SHA512

    229b8e7a5b1bcef6227dc9158b873730ce31e4e719861d1b63874c4f974a08e322e9622d70cd4e04a776a3001a356681edd093770762d18f84f77908b6a9b391

    Download Submit

  • memory/556-745-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1064-172-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1064-324-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1064-310-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1484-889-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1484-1032-0x0000000003290000-0x000000000349F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1580-887-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1580-1026-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1580-1036-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1624-742-0x0000000003310000-0x000000000351F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1944-187-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1944-308-0x0000000000610000-0x00000000006A5000-memory.dmp

    Filesize

    596KB

    Download

  • memory/1944-190-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1944-191-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1944-192-0x0000000000610000-0x00000000006A5000-memory.dmp

    Filesize

    596KB

    Download

  • memory/1944-189-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1944-188-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1944-316-0x0000000000610000-0x00000000006A5000-memory.dmp

    Filesize

    596KB

    Download

  • memory/1944-179-0x0000000000610000-0x00000000006A5000-memory.dmp

    Filesize

    596KB

    Download

  • memory/2156-604-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2156-594-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2324-3-0x000000000056F000-0x0000000000570000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2324-9-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2324-14-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2324-13-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2324-2-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2324-146-0x0000000001F50000-0x0000000001FE5000-memory.dmp

    Filesize

    596KB

    Download

  • memory/2324-4-0x0000000001F50000-0x0000000001FE5000-memory.dmp

    Filesize

    596KB

    Download

  • memory/2324-15-0x0000000001F50000-0x0000000001FE5000-memory.dmp

    Filesize

    596KB

    Download

  • memory/2324-11-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2324-10-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2324-12-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2324-141-0x00000000030C0000-0x00000000032CF000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2348-452-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2348-462-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2356-331-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2356-458-0x0000000001FB0000-0x0000000002045000-memory.dmp

    Filesize

    596KB

    Download

  • memory/2356-334-0x0000000001FB0000-0x0000000002045000-memory.dmp

    Filesize

    596KB

    Download

  • memory/2356-333-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2356-332-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2356-330-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2356-329-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2356-450-0x0000000001FB0000-0x0000000002045000-memory.dmp

    Filesize

    596KB

    Download

  • memory/2356-319-0x0000000001FB0000-0x0000000002045000-memory.dmp

    Filesize

    596KB

    Download

  • memory/2436-149-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2436-148-0x0000000002030000-0x000000000223F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2436-147-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2436-1-0x0000000002030000-0x000000000223F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2436-0-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2452-1174-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2452-1312-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2452-1323-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2460-750-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2460-599-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2460-737-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2584-882-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2584-743-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2584-894-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2620-177-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2620-167-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2828-1179-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2828-1169-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2900-161-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2900-163-0x0000000000610000-0x00000000006A5000-memory.dmp

    Filesize

    596KB

    Download

  • memory/2900-151-0x0000000000610000-0x00000000006A5000-memory.dmp

    Filesize

    596KB

    Download

  • memory/2900-158-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2900-173-0x0000000000610000-0x00000000006A5000-memory.dmp

    Filesize

    596KB

    Download

  • memory/2900-160-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2900-164-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2900-165-0x0000000000610000-0x00000000006A5000-memory.dmp

    Filesize

    596KB

    Download

  • memory/2900-162-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2900-159-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2944-471-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2944-473-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2944-472-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2944-463-0x0000000001DC0000-0x0000000001E55000-memory.dmp

    Filesize

    596KB

    Download

  • memory/2944-475-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2944-474-0x0000000000400000-0x000000000060F000-memory.dmp

    Filesize

    2.1MB

    Download