modiloader | 2944d1e90da2dc73c66fd97f9df66f110f2b01930d24391a4e8e199fe826c3d2

Analysis

max time kernel
140s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Size

3.4MB
MD5

de2444fae2831674dbfc4db0d3f3456a
SHA1

1457bef00341e146b69d3667d94172e090a1a453
SHA256

2944d1e90da2dc73c66fd97f9df66f110f2b01930d24391a4e8e199fe826c3d2
SHA512

d78b739a7a480742b843b63236707c4634703b7cb577b0cdca3db6301138b2368abbb4f854dc6a2e841af9e9119ede932fae12db76ce73476f8967cf966f9f45
SSDEEP

98304:Lw8bx6XN8LqpTS8irKg9rsInRO6i3YEMHEU+KqrWXr0ZNMDji:08N8N8Gp+hsIRU3M8W7wNMD+

Score

10^/10

modiloader discovery trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader

ModiLoader First Stage 2 IoCs

resource	yara_rule
behavioral1/memory/2220-22-0x0000000003CC0000-0x0000000003E67000-memory.dmp	modiloader_stage1
behavioral1/memory/2220-31-0x0000000003CC0000-0x0000000003E67000-memory.dmp	modiloader_stage1

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000012116-11.dat	acprotect
behavioral1/files/0x0007000000016cd3-16.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
2220	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
2220	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2220-0-0x0000000000400000-0x00000000005F3000-memory.dmp	upx
behavioral1/memory/2220-19-0x0000000000400000-0x00000000005F3000-memory.dmp	upx
behavioral1/memory/2220-23-0x0000000000400000-0x00000000005F3000-memory.dmp	upx
behavioral1/memory/2220-27-0x0000000000400000-0x00000000005F3000-memory.dmp	upx
behavioral1/memory/2220-30-0x0000000000400000-0x00000000005F3000-memory.dmp	upx
behavioral1/memory/2220-33-0x0000000000400000-0x00000000005F3000-memory.dmp	upx
behavioral1/memory/2220-36-0x0000000000400000-0x00000000005F3000-memory.dmp	upx
behavioral1/memory/2220-39-0x0000000000400000-0x00000000005F3000-memory.dmp	upx
behavioral1/memory/2220-42-0x0000000000400000-0x00000000005F3000-memory.dmp	upx
behavioral1/memory/2220-45-0x0000000000400000-0x00000000005F3000-memory.dmp	upx
behavioral1/memory/2220-48-0x0000000000400000-0x00000000005F3000-memory.dmp	upx
behavioral1/memory/2220-51-0x0000000000400000-0x00000000005F3000-memory.dmp	upx
behavioral1/memory/2220-54-0x0000000000400000-0x00000000005F3000-memory.dmp	upx
behavioral1/memory/2220-57-0x0000000000400000-0x00000000005F3000-memory.dmp	upx
behavioral1/memory/2220-60-0x0000000000400000-0x00000000005F3000-memory.dmp	upx
behavioral1/memory/2220-63-0x0000000000400000-0x00000000005F3000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe

Modifies registry class 62 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.BrowserToDelphi	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.BrowserToDelphi\Clsid\ = "{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\HELPDIR	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\LocalServer32	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ = "IBrowserToDelphiEvents"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ = "IBrowserToDelphiEvents"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ProxyStubClsid32	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.NeoBookIEProtocol\Clsid\ = "{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ProxyStubClsid32	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\Version	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ProxyStubClsid32	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.NeoBookIEProtocol	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ = "IBrowserToDelphi"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.NeoBookIEProtocol\Clsid	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\ProgID\ = "NBRun.BrowserToDelphi"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\FLAGS\ = "0"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib\Version = "1.0"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\ProgID\ = "NBRun.NeoBookIEProtocol"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\FLAGS	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\ProxyStubClsid32	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.NeoBookIEProtocol\	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.BrowserToDelphi\Clsid	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\0	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\0\win32	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1551601C-141C-4499-9C05-557CA1440A05}\TypeLib\Version = "1.0"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\ProgID	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\ = "NBRun Library"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C2B40D2-963F-4307-AD3E-44A17D530D67}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\Version\ = "1.0"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\TypeLib	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\TypeLib\ = "{8C2B40D2-963F-4307-AD3E-44A17D530D67}"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\ = "IBrowserToDelphi"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib\Version = "1.0"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\LocalServer32	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NBRun.BrowserToDelphi\ = "BrowserToDelphi Object"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib\Version = "1.0"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\ProgID	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1F35EFE-C7D9-4628-A63C-DD41F5DE5914}\	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDB878B2-3F43-4471-B746-47906E644468}\TypeLib	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED4F5A35-81E4-4CBF-A823-AAA3C0847C6E}\ = "BrowserToDelphi Object"	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2220	JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_de2444fae2831674dbfc4db0d3f3456a.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\95CF7A16.nbp

Filesize
470KB

MD5
d250d6ede2a85620f4de7bce8a2f1e48

SHA1
c4565d907699fdb322dcac8994314bffd9119f8d

SHA256
b92a986c0fadacb9154da5ec8d4662b09e3b1db39e0943a685c5a3338e75f6e8

SHA512
5fd2c015e7eae4e8c2416733cf4278214ea70e0b64ea18ba1957aa2c1257cc2ea11df1dae3508e7dba174ed48f5b298cf1f2b79e276b89ecb1d3cb4f5248f47c

Download Submit
\Users\Admin\AppData\Local\Temp\95CF7A17.nbp

Filesize
330KB

MD5
2f627d8ec9c66dc62fac452638df40bc

SHA1
5af161e578f7442ea167b7a1461bbd9e1acaa607

SHA256
397110bd333e3f2be57d9fb92482c30b5b6ca306bf7518cf34c385ecb0b242ad

SHA512
aac36b2c8b7e5b2102ca1a3ffaab71aebe11588b461471cfe6a5b378fd81ac8a47193695cd65a18e6d6ab4fefc14abd193b863b9397a2e69a8a4bb098fecace0

Download Submit
memory/2220-32-0x0000000003F70000-0x0000000004075000-memory.dmp

Filesize
1.0MB

Download
memory/2220-13-0x0000000003CC0000-0x0000000003E67000-memory.dmp

Filesize
1.7MB

Download
memory/2220-30-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-31-0x0000000003CC0000-0x0000000003E67000-memory.dmp

Filesize
1.7MB

Download
memory/2220-2-0x0000000000DE0000-0x0000000000FD3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-19-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-20-0x0000000000DE0000-0x0000000000FD3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-21-0x0000000000DE0000-0x0000000000FD3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-22-0x0000000003CC0000-0x0000000003E67000-memory.dmp

Filesize
1.7MB

Download
memory/2220-23-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-26-0x0000000003F70000-0x0000000004075000-memory.dmp

Filesize
1.0MB

Download
memory/2220-27-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-63-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-1-0x0000000000DE0000-0x0000000000FD3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-18-0x0000000003F70000-0x0000000004075000-memory.dmp

Filesize
1.0MB

Download
memory/2220-33-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-36-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-39-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-42-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-45-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-48-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-51-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-54-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-57-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-60-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/2220-0-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download