metasploit | 0dda61cd0a7b7da3e0671742af1164c22b5366120641d8ffa842424436a68874

Analysis

max time kernel
138s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe
Size

496KB
MD5

c9cb09702d6b75d5b8252df08dcd0027
SHA1

6f970d037569f0cbce6f7fe69138c6a420d0c6f4
SHA256

0dda61cd0a7b7da3e0671742af1164c22b5366120641d8ffa842424436a68874
SHA512

5b99d0e832e6572802330ecfa02b28e768b240d3ad7f04a645100e20cd4719b8931cbe40062a0148f7e13aef1f9facf27b2f7cb92988454bf891de2688fac326
SSDEEP

6144:n3sGVHIL/GWMn5XQWSI6UpWuLU/ivGVpR+Lcdu/BeBsZPJjgfaL+Kl6:cAjnAWcUI04ieYyuckPJ8Ic

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Executes dropped EXE 20 IoCs

pid	Process
2852	msq24.exe
2612	msq24.exe
2956	msq24.exe
2660	msq24.exe
2084	msq24.exe
1256	msq24.exe
2988	msq24.exe
2548	msq24.exe
1320	msq24.exe
1496	msq24.exe
1508	msq24.exe
1908	msq24.exe
2752	msq24.exe
2344	msq24.exe
2696	msq24.exe
2972	msq24.exe
2276	msq24.exe
3052	msq24.exe
2784	msq24.exe
2788	msq24.exe

Loads dropped DLL 21 IoCs

pid	Process
2824	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe
2824	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe
2852	msq24.exe
2612	msq24.exe
2612	msq24.exe
2660	msq24.exe
2660	msq24.exe
1256	msq24.exe
1256	msq24.exe
2548	msq24.exe
2548	msq24.exe
1496	msq24.exe
1496	msq24.exe
1908	msq24.exe
1908	msq24.exe
2344	msq24.exe
2344	msq24.exe
2972	msq24.exe
2972	msq24.exe
3052	msq24.exe
3052	msq24.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File created	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File created	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File created	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File created	C:\Windows\SysWOW64\msq24.exe	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File created	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File created	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File created	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File created	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	msq24.exe
File opened for modification	C:\Windows\SysWOW64\msq24.exe	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msq24.exe	msq24.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 2708 set thread context of 2824	2708	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe	30
PID 2852 set thread context of 2612	2852	msq24.exe	32
PID 2956 set thread context of 2660	2956	msq24.exe	34
PID 2084 set thread context of 1256	2084	msq24.exe	36
PID 2988 set thread context of 2548	2988	msq24.exe	38
PID 1320 set thread context of 1496	1320	msq24.exe	40
PID 1508 set thread context of 1908	1508	msq24.exe	43
PID 2752 set thread context of 2344	2752	msq24.exe	45
PID 2696 set thread context of 2972	2696	msq24.exe	47
PID 2276 set thread context of 3052	2276	msq24.exe	49
PID 2784 set thread context of 2788	2784	msq24.exe	51

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msq24.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2708	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe
2852	msq24.exe
2956	msq24.exe
2084	msq24.exe
2988	msq24.exe
1320	msq24.exe
1508	msq24.exe
2752	msq24.exe
2696	msq24.exe
2276	msq24.exe
2784	msq24.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2824	2708	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe	30
PID 2708 wrote to memory of 2824	2708	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe	30
PID 2708 wrote to memory of 2824	2708	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe	30
PID 2708 wrote to memory of 2824	2708	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe	30
PID 2708 wrote to memory of 2824	2708	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe	30
PID 2708 wrote to memory of 2824	2708	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe	30
PID 2708 wrote to memory of 2824	2708	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe	30
PID 2708 wrote to memory of 2824	2708	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe	30
PID 2708 wrote to memory of 2824	2708	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe	30
PID 2708 wrote to memory of 2824	2708	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe	30
PID 2708 wrote to memory of 2824	2708	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe	30
PID 2708 wrote to memory of 2824	2708	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe	30
PID 2824 wrote to memory of 2852	2824	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe	31
PID 2824 wrote to memory of 2852	2824	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe	31
PID 2824 wrote to memory of 2852	2824	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe	31
PID 2824 wrote to memory of 2852	2824	c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe	31
PID 2852 wrote to memory of 2612	2852	msq24.exe	32
PID 2852 wrote to memory of 2612	2852	msq24.exe	32
PID 2852 wrote to memory of 2612	2852	msq24.exe	32
PID 2852 wrote to memory of 2612	2852	msq24.exe	32
PID 2852 wrote to memory of 2612	2852	msq24.exe	32
PID 2852 wrote to memory of 2612	2852	msq24.exe	32
PID 2852 wrote to memory of 2612	2852	msq24.exe	32
PID 2852 wrote to memory of 2612	2852	msq24.exe	32
PID 2852 wrote to memory of 2612	2852	msq24.exe	32
PID 2852 wrote to memory of 2612	2852	msq24.exe	32
PID 2852 wrote to memory of 2612	2852	msq24.exe	32
PID 2852 wrote to memory of 2612	2852	msq24.exe	32
PID 2612 wrote to memory of 2956	2612	msq24.exe	33
PID 2612 wrote to memory of 2956	2612	msq24.exe	33
PID 2612 wrote to memory of 2956	2612	msq24.exe	33
PID 2612 wrote to memory of 2956	2612	msq24.exe	33
PID 2956 wrote to memory of 2660	2956	msq24.exe	34
PID 2956 wrote to memory of 2660	2956	msq24.exe	34
PID 2956 wrote to memory of 2660	2956	msq24.exe	34
PID 2956 wrote to memory of 2660	2956	msq24.exe	34
PID 2956 wrote to memory of 2660	2956	msq24.exe	34
PID 2956 wrote to memory of 2660	2956	msq24.exe	34
PID 2956 wrote to memory of 2660	2956	msq24.exe	34
PID 2956 wrote to memory of 2660	2956	msq24.exe	34
PID 2956 wrote to memory of 2660	2956	msq24.exe	34
PID 2956 wrote to memory of 2660	2956	msq24.exe	34
PID 2956 wrote to memory of 2660	2956	msq24.exe	34
PID 2956 wrote to memory of 2660	2956	msq24.exe	34
PID 2660 wrote to memory of 2084	2660	msq24.exe	35
PID 2660 wrote to memory of 2084	2660	msq24.exe	35
PID 2660 wrote to memory of 2084	2660	msq24.exe	35
PID 2660 wrote to memory of 2084	2660	msq24.exe	35
PID 2084 wrote to memory of 1256	2084	msq24.exe	36
PID 2084 wrote to memory of 1256	2084	msq24.exe	36
PID 2084 wrote to memory of 1256	2084	msq24.exe	36
PID 2084 wrote to memory of 1256	2084	msq24.exe	36
PID 2084 wrote to memory of 1256	2084	msq24.exe	36
PID 2084 wrote to memory of 1256	2084	msq24.exe	36
PID 2084 wrote to memory of 1256	2084	msq24.exe	36
PID 2084 wrote to memory of 1256	2084	msq24.exe	36
PID 2084 wrote to memory of 1256	2084	msq24.exe	36
PID 2084 wrote to memory of 1256	2084	msq24.exe	36
PID 2084 wrote to memory of 1256	2084	msq24.exe	36
PID 2084 wrote to memory of 1256	2084	msq24.exe	36
PID 1256 wrote to memory of 2988	1256	msq24.exe	37
PID 1256 wrote to memory of 2988	1256	msq24.exe	37
PID 1256 wrote to memory of 2988	1256	msq24.exe	37
PID 1256 wrote to memory of 2988	1256	msq24.exe	37

C:\Users\Admin\AppData\Local\Temp\c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Local\Temp\c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\msq24.exe
    C:\Windows\system32\msq24.exe 488 "C:\Users\Admin\AppData\Local\Temp\c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Windows\SysWOW64\msq24.exe
      488 "C:\Users\Admin\AppData\Local\Temp\c9cb09702d6b75d5b8252df08dcd0027_JaffaCakes118.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\Windows\SysWOW64\msq24.exe
        
        C:\Windows\system32\msq24.exe 524 "C:\Windows\SysWOW64\msq24.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2956
      - C:\Windows\SysWOW64\msq24.exe
        
        524 "C:\Windows\SysWOW64\msq24.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Windows\SysWOW64\msq24.exe
        
        C:\Windows\system32\msq24.exe 524 "C:\Windows\SysWOW64\msq24.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SysWOW64\msq24.exe
        
        524 "C:\Windows\SysWOW64\msq24.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1256
        
        C:\Windows\SysWOW64\msq24.exe
        
        C:\Windows\system32\msq24.exe 524 "C:\Windows\SysWOW64\msq24.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2988
        
        C:\Windows\SysWOW64\msq24.exe
        
        524 "C:\Windows\SysWOW64\msq24.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2548
        
        C:\Windows\SysWOW64\msq24.exe
        
        C:\Windows\system32\msq24.exe 524 "C:\Windows\SysWOW64\msq24.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1320
        
        C:\Windows\SysWOW64\msq24.exe
        
        524 "C:\Windows\SysWOW64\msq24.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1496
        
        C:\Windows\SysWOW64\msq24.exe
        
        C:\Windows\system32\msq24.exe 524 "C:\Windows\SysWOW64\msq24.exe"
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1508
        
        C:\Windows\SysWOW64\msq24.exe
        
        524 "C:\Windows\SysWOW64\msq24.exe"
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1908
        
        C:\Windows\SysWOW64\msq24.exe
        
        C:\Windows\system32\msq24.exe 524 "C:\Windows\SysWOW64\msq24.exe"
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2752
        
        C:\Windows\SysWOW64\msq24.exe
        
        524 "C:\Windows\SysWOW64\msq24.exe"
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2344
        
        C:\Windows\SysWOW64\msq24.exe
        
        C:\Windows\system32\msq24.exe 524 "C:\Windows\SysWOW64\msq24.exe"
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2696
        
        C:\Windows\SysWOW64\msq24.exe
        
        524 "C:\Windows\SysWOW64\msq24.exe"
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2972
        
        C:\Windows\SysWOW64\msq24.exe
        
        C:\Windows\system32\msq24.exe 524 "C:\Windows\SysWOW64\msq24.exe"
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2276
        
        C:\Windows\SysWOW64\msq24.exe
        
        524 "C:\Windows\SysWOW64\msq24.exe"
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3052
        
        C:\Windows\SysWOW64\msq24.exe
        
        C:\Windows\system32\msq24.exe 524 "C:\Windows\SysWOW64\msq24.exe"
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2784
        
        C:\Windows\SysWOW64\msq24.exe
        
        524 "C:\Windows\SysWOW64\msq24.exe"
        22⤵
        Executes dropped EXE
        
        PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msq24.exe

Filesize
496KB

MD5
c9cb09702d6b75d5b8252df08dcd0027

SHA1
6f970d037569f0cbce6f7fe69138c6a420d0c6f4

SHA256
0dda61cd0a7b7da3e0671742af1164c22b5366120641d8ffa842424436a68874

SHA512
5b99d0e832e6572802330ecfa02b28e768b240d3ad7f04a645100e20cd4719b8931cbe40062a0148f7e13aef1f9facf27b2f7cb92988454bf891de2688fac326

Download Submit
memory/2612-53-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2612-54-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2660-83-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2824-6-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2824-12-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2824-11-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2824-10-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2824-2-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2824-4-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2824-8-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2824-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2824-34-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2824-18-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2824-17-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download
memory/2824-15-0x0000000000400000-0x0000000000507000-memory.dmp

Filesize
1.0MB

Download