Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2024 04:31

General

  • Target

    993a393bac58bcd1152e0c8f9ed81d64_JaffaCakes118.exe

  • Size

    134KB

  • MD5

    993a393bac58bcd1152e0c8f9ed81d64

  • SHA1

    c275ecc1e6a56b68a81c4429805de5e03b7836ac

  • SHA256

    ede0bece9f446543e867d2f5988f68a0d1ca2a3906025b7c72561204bee26787

  • SHA512

    924249a5779d664b3c5b5720aeb9a4416644ebefcac1eefc27064014e69293e0320e2bd49121ea2e04ea8faa245599c9507c32d326770ca4d5f7ef054c6616a5

  • SSDEEP

    3072:azQ5+gB4jMhYeIQf6djqn0t4+2sredD7FfPB2pdRV8o0r:2QpnOeIQf6djqn0t4XDBn0pd0om

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Metasploit family
  • Checks computer location settings 2 TTPs 17 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 34 IoCs
  • Maps connected drives based on registry 3 TTPs 36 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 34 IoCs
  • Suspicious use of SetThreadContext 18 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 17 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\993a393bac58bcd1152e0c8f9ed81d64_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\993a393bac58bcd1152e0c8f9ed81d64_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Users\Admin\AppData\Local\Temp\993a393bac58bcd1152e0c8f9ed81d64_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\993a393bac58bcd1152e0c8f9ed81d64_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • Maps connected drives based on registry
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3772
      • C:\Windows\SysWOW64\wnpvk2.exe
        "C:\Windows\system32\wnpvk2.exe" C:\Users\Admin\AppData\Local\Temp\993A39~1.EXE
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3988
        • C:\Windows\SysWOW64\wnpvk2.exe
          "C:\Windows\system32\wnpvk2.exe" C:\Users\Admin\AppData\Local\Temp\993A39~1.EXE
          4⤵
          • Checks computer location settings
          • Deletes itself
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3392
          • C:\Windows\SysWOW64\wnpvk2.exe
            "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2952
            • C:\Windows\SysWOW64\wnpvk2.exe
              "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Maps connected drives based on registry
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:5024
              • C:\Windows\SysWOW64\wnpvk2.exe
                "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4820
                • C:\Windows\SysWOW64\wnpvk2.exe
                  "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Maps connected drives based on registry
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:3300
                  • C:\Windows\SysWOW64\wnpvk2.exe
                    "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:736
                    • C:\Windows\SysWOW64\wnpvk2.exe
                      "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Maps connected drives based on registry
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:3660
                      • C:\Windows\SysWOW64\wnpvk2.exe
                        "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:2988
                        • C:\Windows\SysWOW64\wnpvk2.exe
                          "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Maps connected drives based on registry
                          • Drops file in System32 directory
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:3688
                          • C:\Windows\SysWOW64\wnpvk2.exe
                            "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:3624
                            • C:\Windows\SysWOW64\wnpvk2.exe
                              "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Maps connected drives based on registry
                              • Drops file in System32 directory
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1028
                              • C:\Windows\SysWOW64\wnpvk2.exe
                                "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                PID:4896
                                • C:\Windows\SysWOW64\wnpvk2.exe
                                  "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                  16⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Maps connected drives based on registry
                                  • Drops file in System32 directory
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4940
                                  • C:\Windows\SysWOW64\wnpvk2.exe
                                    "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    PID:1372
                                    • C:\Windows\SysWOW64\wnpvk2.exe
                                      "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                      18⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Maps connected drives based on registry
                                      • Drops file in System32 directory
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3076
                                      • C:\Windows\SysWOW64\wnpvk2.exe
                                        "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • System Location Discovery: System Language Discovery
                                        PID:1100
                                        • C:\Windows\SysWOW64\wnpvk2.exe
                                          "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                          20⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Maps connected drives based on registry
                                          • Drops file in System32 directory
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4680
                                          • C:\Windows\SysWOW64\wnpvk2.exe
                                            "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            • System Location Discovery: System Language Discovery
                                            PID:1900
                                            • C:\Windows\SysWOW64\wnpvk2.exe
                                              "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                              22⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Maps connected drives based on registry
                                              • Drops file in System32 directory
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4900
                                              • C:\Windows\SysWOW64\wnpvk2.exe
                                                "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetThreadContext
                                                • System Location Discovery: System Language Discovery
                                                PID:2556
                                                • C:\Windows\SysWOW64\wnpvk2.exe
                                                  "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                                  24⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Maps connected drives based on registry
                                                  • Drops file in System32 directory
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2932
                                                  • C:\Windows\SysWOW64\wnpvk2.exe
                                                    "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    • System Location Discovery: System Language Discovery
                                                    PID:428
                                                    • C:\Windows\SysWOW64\wnpvk2.exe
                                                      "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Maps connected drives based on registry
                                                      • Drops file in System32 directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:2184
                                                      • C:\Windows\SysWOW64\wnpvk2.exe
                                                        "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3160
                                                        • C:\Windows\SysWOW64\wnpvk2.exe
                                                          "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                                          28⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Maps connected drives based on registry
                                                          • Drops file in System32 directory
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3924
                                                          • C:\Windows\SysWOW64\wnpvk2.exe
                                                            "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2324
                                                            • C:\Windows\SysWOW64\wnpvk2.exe
                                                              "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                                              30⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Maps connected drives based on registry
                                                              • Drops file in System32 directory
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry class
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:1428
                                                              • C:\Windows\SysWOW64\wnpvk2.exe
                                                                "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1740
                                                                • C:\Windows\SysWOW64\wnpvk2.exe
                                                                  "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                                                  32⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Maps connected drives based on registry
                                                                  • Drops file in System32 directory
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry class
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:3412
                                                                  • C:\Windows\SysWOW64\wnpvk2.exe
                                                                    "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:760
                                                                    • C:\Windows\SysWOW64\wnpvk2.exe
                                                                      "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                                                      34⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Maps connected drives based on registry
                                                                      • Drops file in System32 directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:1896
                                                                      • C:\Windows\SysWOW64\wnpvk2.exe
                                                                        "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetThreadContext
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:4320
                                                                        • C:\Windows\SysWOW64\wnpvk2.exe
                                                                          "C:\Windows\system32\wnpvk2.exe" C:\Windows\SysWOW64\wnpvk2.exe
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • Maps connected drives based on registry
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:5044

Network

  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    217.72.21.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.72.21.2.in-addr.arpa
    IN PTR
    Response
    217.72.21.2.in-addr.arpa
    IN PTR
    a2-21-72-217deploystaticakamaitechnologiescom
  • flag-us
    DNS
    31.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    31.243.111.52.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    144 B
    158 B
    2
    1

    DNS Request

    232.168.11.51.in-addr.arpa

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
    160 B
    1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    217.72.21.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    217.72.21.2.in-addr.arpa

  • 8.8.8.8:53
    31.243.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    31.243.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\wnpvk2.exe

    Filesize

    134KB

    MD5

    993a393bac58bcd1152e0c8f9ed81d64

    SHA1

    c275ecc1e6a56b68a81c4429805de5e03b7836ac

    SHA256

    ede0bece9f446543e867d2f5988f68a0d1ca2a3906025b7c72561204bee26787

    SHA512

    924249a5779d664b3c5b5720aeb9a4416644ebefcac1eefc27064014e69293e0320e2bd49121ea2e04ea8faa245599c9507c32d326770ca4d5f7ef054c6616a5

  • memory/1028-85-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/1028-82-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/1428-149-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/1896-165-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2184-126-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2184-131-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2932-121-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3076-97-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3076-99-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3300-61-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3392-46-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3392-48-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3392-45-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3392-44-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3412-157-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3660-70-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3660-68-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3688-77-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3772-0-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3772-40-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3772-4-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3772-3-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3772-2-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3924-135-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/3924-141-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/4680-107-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/4900-113-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/4940-92-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/5024-55-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.