Overview

overview

10

Static

static

3

JaffaCakes...62.exe

windows7-x64

10

JaffaCakes...62.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/01/2025, 16:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_05e7034160522201de6324078818b562.exe

  • Size

    512KB

  • MD5

    05e7034160522201de6324078818b562

  • SHA1

    29d72e130ce958186446839139d25e0415cdc587

  • SHA256

    8679615f3852762d7dd71fcd657b86cdf0c4f56dcf3e6e991b65770752c57bfe

  • SHA512

    5d566113f3ed3df1a4baebc8ce80a300901a5ab8e20dafaabf33e824c26191f4281c64a783901743ebd71e69602b239f4158819a536e3d147d7e629c5efe4e9a

  • SSDEEP

    12288:WNge6O1X/GkpN4hpCHvmc+5zR2JqaAwUKPF2mqhScG:Q96SPGm4b06aqpwl2mqIc

Score
10/10
cycbotponybackdoorcredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 5 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    defense_evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 54 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 5 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_05e7034160522201de6324078818b562.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_05e7034160522201de6324078818b562.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2588
    • C:\Users\Admin\vrSlJ6C3.exe
      C:\Users\Admin\vrSlJ6C3.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2268
      • C:\Users\Admin\meoebej.exe
        "C:\Users\Admin\meoebej.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:64
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del vrSlJ6C3.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1840
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2276
    • C:\Users\Admin\2nob.exe
      C:\Users\Admin\2nob.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3872
      • C:\Users\Admin\2nob.exe
        "C:\Users\Admin\2nob.exe"
        3⤵
        • Executes dropped EXE
        PID:384
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 80
          4⤵
          • Program crash
          PID:1560
      • C:\Users\Admin\2nob.exe
        "C:\Users\Admin\2nob.exe"
        3⤵
        • Executes dropped EXE
        • Maps connected drives based on registry
        • Suspicious behavior: EnumeratesProcesses
        PID:4788
      • C:\Users\Admin\2nob.exe
        "C:\Users\Admin\2nob.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3304
      • C:\Users\Admin\2nob.exe
        "C:\Users\Admin\2nob.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3596
      • C:\Users\Admin\2nob.exe
        "C:\Users\Admin\2nob.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1900
    • C:\Users\Admin\3nob.exe
      C:\Users\Admin\3nob.exe
      2⤵
      • Modifies security service
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1052
      • C:\Users\Admin\3nob.exe
        C:\Users\Admin\3nob.exe startC:\Users\Admin\AppData\Roaming\62EF7\E71E4.exe%C:\Users\Admin\AppData\Roaming\62EF7
        3⤵
        • Executes dropped EXE
        PID:1500
      • C:\Program Files (x86)\LP\E4E6\F349.tmp
        "C:\Program Files (x86)\LP\E4E6\F349.tmp"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3140
      • C:\Users\Admin\3nob.exe
        C:\Users\Admin\3nob.exe startC:\Program Files (x86)\F7252\lvvm.exe%C:\Program Files (x86)\F7252
        3⤵
        • Executes dropped EXE
        PID:4456
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_05e7034160522201de6324078818b562.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1004
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1744
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 384 -ip 384
    1⤵
      PID:4832
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1548
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3312
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2492
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1388
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3916
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1408
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:3796
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3080
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2788

    Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Defense Evasion

          Hide Artifacts

          1
          T1564

          Hidden Files and Directories

          1
          T1564.001

          Modify Registry

          6
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          3
          T1552

          Credentials In Files

          3
          T1552.001

          Discovery

          Peripheral Device Discovery

          3
          T1120

          Process Discovery

          1
          T1057

          Query Registry

          6
          T1012

          System Information Discovery

          5
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          2
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\LP\E4E6\F349.tmp
            Filesize

            96KB

            MD5

            74a1e9547eb8c42e9ca482c5c8bdd261

            SHA1

            c56c60e84b4ef45065289636cfdfab21654acdb3

            SHA256

            f4ac8ead1ff2f95c2b50405531d433d7af912b8f848095d3cb00401576ee90fb

            SHA512

            ae90627a5f1485383b6de178aea4b36f9e44891d78fe5a274d1632727dd71906061323725a7c3c106b039cb65e10ea7e9c7d277ce35fb0ac6458fdc3e346ecb9

            Download Submit

          • C:\Users\Admin\2nob.exe
            Filesize

            148KB

            MD5

            b7146cf0b0ce852ffb2edc1b43499d36

            SHA1

            7a65b2d9a243f0a9d5e1d22e19619c9b057cfdf7

            SHA256

            3c553adafe4adc74c390d9190aca168b822a902bbab695988de7efe30b2c3f4d

            SHA512

            d182fb2afe61832da56b7446de87ca8f65965b7a0cc284dd4d51df0453d304c157e2dea302239f038e71f73f7dd662d138903366367601b42aa3c4b03416a711

            Download Submit

          • C:\Users\Admin\3nob.exe
            Filesize

            272KB

            MD5

            7ddee7ec4bd22ba0b43bc4105e5b7901

            SHA1

            9fb11a97faff55730d5f838db2bfd5dbcce9f0b6

            SHA256

            e765624ac2a2e40e95befcf847804345e74d3a35872f279c5d86f6a0dc51071f

            SHA512

            c1307d2851949d8809a71f3255cabfb18c2b9e5a41633bf09192ccf778026f894e0b6564502763bac440b1442e2b6fcff90e8b0090b9503290bd140875ea62fc

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
            Filesize

            471B

            MD5

            20e64b00088a9559c728a14e4531ffa3

            SHA1

            c9d7ab909a2ffb7dc79ae5090895b861c0de3196

            SHA256

            8432920aae7dd6cdc1a0faf4aae7cffc8042da0df9b634e06ab8c0651921630d

            SHA512

            c50b86cb7aa4198424e9420e18e511a8cec1de1b4380efa0dd6e147cb60b2fe59b5698ea27374a213d1ecbe579982b0ef7d53d121f370df874d073f4e71704b2

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
            Filesize

            412B

            MD5

            08119328416bf9ffb2d9dc43ce64181c

            SHA1

            3a92914cf5a01ce2aabc3e85352abfe4ecd5d438

            SHA256

            5c8ad1fbb438ffa9a69367391ff87db66aae3d429281fb676ddc65ac7f05216c

            SHA512

            f343de73e53c0e0d9a1cc8809ad5d3483c7c6b7db4b88067e8249334396e4a25587deaa693c3ac3a15643fa42e88ff9287ccbb45aea1ecfc7bc444c7fb1732b0

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
            Filesize

            2KB

            MD5

            afff30a5c5099952b9a36531fe3a3780

            SHA1

            0fdf0e8fcb1a9f0047a9a0cc25961ddcb8d9b86f

            SHA256

            e3908dfcfcb31189687c576c58cda520919285697454ad86be0cd620cb40a48e

            SHA512

            8d0455511c6589c5a259d9a3da0a9a6dda181def49a0b5866779c123b33561d5620e84467d55d8711cefd4f45804b9eb01337beb1d64d4cdc961e2ef63611b68

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133819505451994771.txt
            Filesize

            75KB

            MD5

            3358b265a2e8fbd6c2b8b632a487002a

            SHA1

            fb62b79841dec6ec6d08c0d249a20c6ff97ee5c5

            SHA256

            c25203a2be50ac321d3470ec1a887d99b72f094c01e05a831dbcd54dddce15fa

            SHA512

            529e0deec5b403f6d1da19f0dc762889b502b4dbbba63bff5260e0b92410f312ec56c0384620df740709cc493073f701c118ae4198bca30c59987ebcc48323a8

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2CFNWDLC\microsoft.windows[1].xml
            Filesize

            97B

            MD5

            539db492f33fccee9be530dd0bf34a46

            SHA1

            650b2a3583d6c9499b4ed73e9a5dca37f342a50e

            SHA256

            f6d425aad05b46e77b53e5737c85f4ceab6531e773ea87eb985754be5ec19999

            SHA512

            9328f2fa286b4a9ca6ae57ddd9fca0b1140e5f68a5e143fd8ae6ea212a1af5d7b6b2289c324fa9480ca8d2e6d3b0cf7115611a56a3a161c5ad2f988f6ae62a0a

            Download Submit

          • C:\Users\Admin\AppData\Roaming\62EF7\7252.2EF
            Filesize

            600B

            MD5

            1c3ae761da7d1d1e4752f6dccba81bb9

            SHA1

            1cdace23a5650c0ba665dabb7b73f5245db89846

            SHA256

            3773af825ecb214273f4e65467b2f3abafd880bcabfc1ced396a0f63352413f9

            SHA512

            2c39bbc978342effc68218a71481a96a3d67bc101ea2dd40baacf0e7614096d577a59342ba3ee21334d130a711664943196f50f277bc8cefefe367a5a4bc987f

            Download Submit

          • C:\Users\Admin\AppData\Roaming\62EF7\7252.2EF
            Filesize

            897B

            MD5

            bd21ff25f5301860f297d184a6954973

            SHA1

            6c4d24d0d972ee40bd486bd739dedc4b241f5ce6

            SHA256

            2a9f6f07e00da6c6867ba1034fc65e8b9decfea30112e531a3297aa478f5aa88

            SHA512

            f8160578a277f27c4600a30f43bbd486df00a8fb5c77f9609fe63018c5f2ed6f5f2912c69ac8188a57901d8f526e40d6444a5374ae1749a1528c9c0d4d0c7b01

            Download Submit

          • C:\Users\Admin\AppData\Roaming\62EF7\7252.2EF
            Filesize

            1KB

            MD5

            ee82964699643ec2a6f8dea88fbc25ac

            SHA1

            2a314902d3095f95fbe7bfc2fa0c53eb3064d83a

            SHA256

            766a655c77e64ce24d2d5ae836ea7a28756c19fd21759b43301229b3c549f34c

            SHA512

            93e9b17935fdfc5e2a3b3439bc3476f1652fab16604a9d3c11ef8daa6b4439d57578d54ae17bb367e79e8c082487684780d976f2119efed6ed736417f0f9fb66

            Download Submit

          • C:\Users\Admin\AppData\Roaming\62EF7\7252.2EF
            Filesize

            1KB

            MD5

            ef4f37d61081678b043f440859d1b4d7

            SHA1

            402000ac6cdccc91110bd4dce79d9f00bbce8e58

            SHA256

            fa5d8abdb3bf3ad003071efe6325f98b0586eeb0278db263c948df87b2b5cbd8

            SHA512

            826ddd594a6e68f365e20c7575b130f32763bf672ef1e4789263b759af407e933bcbcf0058538ab7d38926b5d8387afea47923b7516be714da3ed12c08fbf42c

            Download Submit

          • C:\Users\Admin\meoebej.exe
            Filesize

            180KB

            MD5

            700cb30f7b415241097dd68cb42434e3

            SHA1

            ffbafb28d2bf5649c0b9e2ede9973d904a6a44e7

            SHA256

            517310a0ce03bc9daed5abcbcaa8edabe048504549bbb8a6f0138c15886d11c8

            SHA512

            17602ebd6516cba084c2adb0d403e09b95e5d6c16ede9209c807b5cdfa6ea8cff3119316eb2df6bff194f02799e71b380e90b52af7b082cacf18430dbbc5930a

            Download Submit

          • C:\Users\Admin\vrSlJ6C3.exe
            Filesize

            180KB

            MD5

            7401ba7763fe55ddc93dd8bac9ec9879

            SHA1

            0dcdcf981aa98b878e311626478bf71545051ecd

            SHA256

            4cba3615f537b6273a7fa8be2f96942b27dc858fa1cd217f8db1ab1a5ffb21ab

            SHA512

            57b744717249d6e97b90a09c2a5e5636df6ebc0f6c1a48fac27ce536391b3bc31b1554e1ac252aa26d40f15b7f039d6c9b25df782db0ab55155284fc9d601d8c

            Download Submit

          • memory/1052-265-0x0000000000400000-0x000000000046A000-memory.dmp

            Filesize

            424KB

            Download

          • memory/1052-575-0x0000000000400000-0x000000000046A000-memory.dmp

            Filesize

            424KB

            Download

          • memory/1052-87-0x0000000000400000-0x000000000046A000-memory.dmp

            Filesize

            424KB

            Download

          • memory/1388-160-0x0000000003F90000-0x0000000003F91000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1408-167-0x0000029C05520000-0x0000029C05540000-memory.dmp

            Filesize

            128KB

            Download

          • memory/1408-162-0x0000029C04620000-0x0000029C04720000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/1408-163-0x0000029C04620000-0x0000029C04720000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/1408-197-0x0000029C058F0000-0x0000029C05910000-memory.dmp

            Filesize

            128KB

            Download

          • memory/1408-180-0x0000029C051E0000-0x0000029C05200000-memory.dmp

            Filesize

            128KB

            Download

          • memory/1500-153-0x0000000000400000-0x000000000046A000-memory.dmp

            Filesize

            424KB

            Download

          • memory/1900-65-0x0000000000400000-0x000000000040A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/1900-58-0x0000000000400000-0x000000000040A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/1900-62-0x0000000000400000-0x000000000040A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/1900-75-0x0000000000400000-0x000000000040A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/2788-443-0x000001F862680000-0x000001F8626A0000-memory.dmp

            Filesize

            128KB

            Download

          • memory/2788-432-0x000001F862070000-0x000001F862090000-memory.dmp

            Filesize

            128KB

            Download

          • memory/2788-424-0x000001F8620B0000-0x000001F8620D0000-memory.dmp

            Filesize

            128KB

            Download

          • memory/3140-571-0x0000000000400000-0x000000000041C000-memory.dmp

            Filesize

            112KB

            Download

          • memory/3304-56-0x0000000000400000-0x0000000000455000-memory.dmp

            Filesize

            340KB

            Download

          • memory/3304-50-0x0000000000400000-0x0000000000455000-memory.dmp

            Filesize

            340KB

            Download

          • memory/3304-82-0x0000000000400000-0x0000000000455000-memory.dmp

            Filesize

            340KB

            Download

          • memory/3304-64-0x0000000000400000-0x0000000000455000-memory.dmp

            Filesize

            340KB

            Download

          • memory/3304-54-0x0000000000400000-0x0000000000455000-memory.dmp

            Filesize

            340KB

            Download

          • memory/3596-68-0x0000000000400000-0x0000000000407000-memory.dmp

            Filesize

            28KB

            Download

          • memory/3596-53-0x0000000000400000-0x0000000000407000-memory.dmp

            Filesize

            28KB

            Download

          • memory/3596-67-0x0000000000400000-0x0000000000407000-memory.dmp

            Filesize

            28KB

            Download

          • memory/3596-83-0x0000000000400000-0x0000000000407000-memory.dmp

            Filesize

            28KB

            Download

          • memory/4456-569-0x0000000000400000-0x000000000046A000-memory.dmp

            Filesize

            424KB

            Download

          • memory/4788-61-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

            Download

          • memory/4788-66-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

            Download

          • memory/4788-48-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

            Download

          • memory/4788-59-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

            Download

          • memory/4788-81-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

            Download