Overview

overview

10

Static

static

3

JaffaCakes...f6.exe

windows7-x64

10

JaffaCakes...f6.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/01/2025, 05:27 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_0251b280207661e4e9e068551ed6b0f6.exe

  • Size

    208KB

  • MD5

    0251b280207661e4e9e068551ed6b0f6

  • SHA1

    e4a5f85a2b79b89f543736c2242e8bb894f5b435

  • SHA256

    611af8c903d8b619dc7f72c8981eca1a8cbd8d2bd8d900e2377b07463ee06448

  • SHA512

    1a8193981ffbdb8cccfc310f94da4a0e8a37ec0e3baadf366e45c9b451e5324c10ba65a7a971640161437d423733989c310352cdb67950a36ed7c59961b41797

  • SSDEEP

    3072:wzYGrTgMTcw7XLMcHlFabmm0caiuJ77XsXD/swM7KOEOEQ3kaiImZHYUVw/Qg:5wgFw77MdbnazDOcOO73kaRgkQg

Score
10/10
metasploitbackdoordiscoverytrojanupx

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Metasploit family
    metasploit
  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 30 IoCs
  • Maps connected drives based on registry 3 TTPs 32 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 47 IoCs
  • Suspicious use of SetThreadContext 16 IoCs
  • UPX packed file 35 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0251b280207661e4e9e068551ed6b0f6.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0251b280207661e4e9e068551ed6b0f6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3156
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0251b280207661e4e9e068551ed6b0f6.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0251b280207661e4e9e068551ed6b0f6.exe"
      2⤵
      • Checks computer location settings
      • Maps connected drives based on registry
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:900
      • C:\Windows\SysWOW64\wmpds32.exe
        "C:\Windows\system32\wmpds32.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:436
        • C:\Windows\SysWOW64\wmpds32.exe
          "C:\Windows\system32\wmpds32.exe" C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE
          4⤵
          • Checks computer location settings
          • Deletes itself
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1908
          • C:\Windows\SysWOW64\wmpds32.exe
            "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4556
            • C:\Windows\SysWOW64\wmpds32.exe
              "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Maps connected drives based on registry
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1872
              • C:\Windows\SysWOW64\wmpds32.exe
                "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2916
                • C:\Windows\SysWOW64\wmpds32.exe
                  "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Maps connected drives based on registry
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:4660
                  • C:\Windows\SysWOW64\wmpds32.exe
                    "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1352
                    • C:\Windows\SysWOW64\wmpds32.exe
                      "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Maps connected drives based on registry
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:3264
                      • C:\Windows\SysWOW64\wmpds32.exe
                        "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4184
                        • C:\Windows\SysWOW64\wmpds32.exe
                          "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Maps connected drives based on registry
                          • Drops file in System32 directory
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:3232
                          • C:\Windows\SysWOW64\wmpds32.exe
                            "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:2012
                            • C:\Windows\SysWOW64\wmpds32.exe
                              "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Maps connected drives based on registry
                              • Drops file in System32 directory
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2984
                              • C:\Windows\SysWOW64\wmpds32.exe
                                "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                PID:4296
                                • C:\Windows\SysWOW64\wmpds32.exe
                                  "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                                  16⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Maps connected drives based on registry
                                  • Drops file in System32 directory
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3460
                                  • C:\Windows\SysWOW64\wmpds32.exe
                                    "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    PID:4260
                                    • C:\Windows\SysWOW64\wmpds32.exe
                                      "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                                      18⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Maps connected drives based on registry
                                      • Drops file in System32 directory
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:920
                                      • C:\Windows\SysWOW64\wmpds32.exe
                                        "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • System Location Discovery: System Language Discovery
                                        PID:2360
                                        • C:\Windows\SysWOW64\wmpds32.exe
                                          "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                                          20⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Maps connected drives based on registry
                                          • Drops file in System32 directory
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5116
                                          • C:\Windows\SysWOW64\wmpds32.exe
                                            "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            • System Location Discovery: System Language Discovery
                                            PID:3624
                                            • C:\Windows\SysWOW64\wmpds32.exe
                                              "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                                              22⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Maps connected drives based on registry
                                              • Drops file in System32 directory
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:1152
                                              • C:\Windows\SysWOW64\wmpds32.exe
                                                "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetThreadContext
                                                • System Location Discovery: System Language Discovery
                                                PID:2124
                                                • C:\Windows\SysWOW64\wmpds32.exe
                                                  "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                                                  24⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Maps connected drives based on registry
                                                  • Drops file in System32 directory
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4976
                                                  • C:\Windows\SysWOW64\wmpds32.exe
                                                    "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1472
                                                    • C:\Windows\SysWOW64\wmpds32.exe
                                                      "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Maps connected drives based on registry
                                                      • Drops file in System32 directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3228
                                                      • C:\Windows\SysWOW64\wmpds32.exe
                                                        "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        • System Location Discovery: System Language Discovery
                                                        PID:372
                                                        • C:\Windows\SysWOW64\wmpds32.exe
                                                          "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                                                          28⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Maps connected drives based on registry
                                                          • Drops file in System32 directory
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1292
                                                          • C:\Windows\SysWOW64\wmpds32.exe
                                                            "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4724
                                                            • C:\Windows\SysWOW64\wmpds32.exe
                                                              "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                                                              30⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Maps connected drives based on registry
                                                              • Drops file in System32 directory
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry class
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:4048
                                                              • C:\Windows\SysWOW64\wmpds32.exe
                                                                "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                • System Location Discovery: System Language Discovery
                                                                PID:3568
                                                                • C:\Windows\SysWOW64\wmpds32.exe
                                                                  "C:\Windows\system32\wmpds32.exe" C:\Windows\SysWOW64\wmpds32.exe
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Maps connected drives based on registry
                                                                  • Drops file in System32 directory
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:1572

Network

  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    167.173.78.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    167.173.78.104.in-addr.arpa
    IN PTR
    Response
    167.173.78.104.in-addr.arpa
    IN PTR
    a104-78-173-167deploystaticakamaitechnologiescom
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.42.69.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.42.69.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.42.69.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.42.69.40.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    241.42.69.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.42.69.40.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    167.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    167.190.18.2.in-addr.arpa
    IN PTR
    Response
    167.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-167deploystaticakamaitechnologiescom
  • flag-us
    DNS
    167.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    167.190.18.2.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    23.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.236.111.52.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    167.173.78.104.in-addr.arpa
    dns
    145 B
     297 B
     2
    2

    DNS Request

    167.173.78.104.in-addr.arpa

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    241.42.69.40.in-addr.arpa
    dns
    213 B
     145 B
     3
    1

    DNS Request

    241.42.69.40.in-addr.arpa

    DNS Request

    241.42.69.40.in-addr.arpa

    DNS Request

    241.42.69.40.in-addr.arpa

  • 8.8.8.8:53
    167.190.18.2.in-addr.arpa
    dns
    142 B
     135 B
     2
    1

    DNS Request

    167.190.18.2.in-addr.arpa

    DNS Request

    167.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    23.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    23.236.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\wmpds32.exe
    Filesize

    208KB

    MD5

    0251b280207661e4e9e068551ed6b0f6

    SHA1

    e4a5f85a2b79b89f543736c2242e8bb894f5b435

    SHA256

    611af8c903d8b619dc7f72c8981eca1a8cbd8d2bd8d900e2377b07463ee06448

    SHA512

    1a8193981ffbdb8cccfc310f94da4a0e8a37ec0e3baadf366e45c9b451e5324c10ba65a7a971640161437d423733989c310352cdb67950a36ed7c59961b41797

    Download Submit

  • memory/900-2-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/900-3-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/900-4-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/900-31-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/900-41-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/900-0-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/920-122-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/920-118-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/1152-138-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/1152-135-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/1292-161-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/1872-58-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/1872-60-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/1872-64-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/1908-45-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/1908-57-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/1908-46-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/1908-47-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/1908-48-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/2984-101-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/2984-105-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/3228-157-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/3228-152-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/3232-97-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/3232-92-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/3264-76-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/3264-83-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/3460-110-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/4048-170-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/4660-69-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/4660-75-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/4660-79-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/4976-143-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/4976-147-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

  • memory/5116-125-0x0000000000400000-0x0000000000451000-memory.dmp

    Filesize

    324KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.