e978f34df962d94386dfa24ab780246f77370eaba6da3f2e1ad0e554d9007471

Analysis

max time kernel
141s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2025, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe
Size 33KB
Sample250127-sdadkatngx
SHA256 e978f34df962d94386dfa24ab780246f77370eaba6da3f2e1ad0e554d9007471
MD5 40c2d13d8ebbd9c83acb0c4a02fe661b
SHA1 7542595f1aafc65731907235814a808a7b40c761
SHA512 e4cebf36018f7c2453f4514a13de987a8ffe8d949e16d57fba3498d2a2fb1da5fb2b5b961eca400366438e4b8cacec30c19e81a7427bc07b310c8e281b7f5181
SSDEEP 768:uqSdfoTQvkdak16IjCsLpZcPm162qEZhP9iUI2jJWAEkXyG:uFfoTskdakk49Zc+Nv/IdAEkC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adware discovery persistence stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe C:\\Windows\\system32\\sxlntr.exe"	240622921.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe C:\\Windows\\SysWOW64\\sxlntr.exe"	sxlntr.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	240623218.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	240624265.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	240623218.exe

Executes dropped EXE 6 IoCs

pid	Process
2288	240622921.exe
5064	sxlntr.exe
4372	240623218.exe
4396	240624265.exe
4596	mpcsvc.exe
4788	mpcsvc.exe

Loads dropped DLL 1 IoCs

pid	Process
4916	Regsvr32.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hdloker = "C:\\Windows\\system32\\sxlntr.exe"	240622921.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hdloker = "C:\\Windows\\system32\\sxlntr.exe"	240622921.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hdloker = "C:\\Windows\\SysWOW64\\sxlntr.exe"	sxlntr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SiS Mpc Service = "C:\\Windows\\system32\\mpcsvc.exe"	240624265.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Manager e01 sp = "C:\\Windows\\system32\\mpcsvc.exe"	240623218.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Manager e01 sp = "C:\\Windows\\system32\\mpcsvc.exe"	240623218.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hdloker = "C:\\Windows\\system32\\sxlntr.exe"	240622921.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hdloker = "C:\\Windows\\system32\\sxlntr.exe"	240622921.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hdloker = "C:\\Windows\\SysWOW64\\sxlntr.exe"	sxlntr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hdloker = "C:\\Windows\\SysWOW64\\sxlntr.exe"	sxlntr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hdloker = "C:\\Windows\\SysWOW64\\sxlntr.exe"	sxlntr.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{455875B5-93F3-429D-FF34-660B206D897C}	Regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	Regsvr32.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sxlntr.exe	sxlntr.exe
File opened for modification	C:\Windows\SysWOW64\mpcsvc.exe	240624265.exe
File created	C:\Windows\SysWOW64\mpcsvc.exe	240624265.exe
File created	C:\Windows\SysWOW64\bensorty03.dll	JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe
File created	C:\Windows\SysWOW64\sxlntr.exe	240622921.exe
File opened for modification	C:\Windows\SysWOW64\sxlntr.exe	240622921.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240622921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240623218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mpcsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sxlntr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240624265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Desktop\host = "85.249.138.154"	240623218.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Security\host = "85.249.138.154"	240623218.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Desktop	240624265.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Internet Explorer\Desktop	mpcsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Desktop\id = "662400678383"	mpcsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\Desktop\host = "85.249.138.154"	mpcsvc.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{455875B5-93F3-429D-FF34-660B206D897C}\ = "C:\\Windows\\SysWow64\\bensorty03.dll"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{455875B5-93F3-429D-FF34-660B206D897C}\ThreadingModel = "Apartment"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{455875B5-93F3-429D-FF34-660B206D897C}\InProcServer32	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{455875B5-93F3-429D-FF34-660B206D897C}\InProcServer32\ = "C:\\Windows\\SysWow64\\bensorty03.dll"	Regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{455875B5-93F3-429D-FF34-660B206D897C}\InProcServer32\ThreadingModel = "Apartment"	Regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	240624265.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{455875B5-93F3-429D-FF34-660B206D897C}	Regsvr32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4372	240623218.exe
4372	240623218.exe
4396	240624265.exe
4396	240624265.exe
4372	240623218.exe
4372	240623218.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 2288	4896	JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe	82
PID 4896 wrote to memory of 2288	4896	JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe	82
PID 4896 wrote to memory of 2288	4896	JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe	82
PID 2288 wrote to memory of 5064	2288	240622921.exe	83
PID 2288 wrote to memory of 5064	2288	240622921.exe	83
PID 2288 wrote to memory of 5064	2288	240622921.exe	83
PID 4896 wrote to memory of 4372	4896	JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe	84
PID 4896 wrote to memory of 4372	4896	JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe	84
PID 4896 wrote to memory of 4372	4896	JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe	84
PID 4372 wrote to memory of 4396	4372	240623218.exe	85
PID 4372 wrote to memory of 4396	4372	240623218.exe	85
PID 4372 wrote to memory of 4396	4372	240623218.exe	85
PID 4372 wrote to memory of 4596	4372	240623218.exe	90
PID 4372 wrote to memory of 4596	4372	240623218.exe	90
PID 4372 wrote to memory of 4596	4372	240623218.exe	90
PID 4396 wrote to memory of 4788	4396	240624265.exe	91
PID 4396 wrote to memory of 4788	4396	240624265.exe	91
PID 4396 wrote to memory of 4788	4396	240624265.exe	91
PID 4896 wrote to memory of 4916	4896	JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe	93
PID 4896 wrote to memory of 4916	4896	JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe	93
PID 4896 wrote to memory of 4916	4896	JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe	93
PID 4372 wrote to memory of 1780	4372	240623218.exe	94
PID 4372 wrote to memory of 1780	4372	240623218.exe	94
PID 4372 wrote to memory of 1780	4372	240623218.exe	94
PID 4896 wrote to memory of 4420	4896	JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe	96
PID 4896 wrote to memory of 4420	4896	JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe	96
PID 4896 wrote to memory of 4420	4896	JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe	96

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Users\Admin\AppData\Local\Temp\240622921.exe
  C:\Users\Admin\AppData\Local\Temp\240622921.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\sxlntr.exe
    C:\Windows\system32\sxlntr.exe yeuieruieriro
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:5064
- C:\Users\Admin\AppData\Local\Temp\240623218.exe
  C:\Users\Admin\AppData\Local\Temp\240623218.exe
  2⤵
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Users\Admin\AppData\Local\Temp\240624265.exe
    C:\Users\Admin\AppData\Local\Temp\240624265.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Windows\SysWOW64\mpcsvc.exe
      "C:\Windows\system32\mpcsvc.exe"
      4⤵
      Executes dropped EXE
      PID:4788
- - C:\Windows\SysWOW64\mpcsvc.exe
    C:\Windows\system32\mpcsvc.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:4596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\p6hhr.bat" "C:\Users\Admin\AppData\Local\Temp\240623218.exe""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1780
- C:\Windows\SysWOW64\Regsvr32.exe
  Regsvr32.exe /s bensorty03.dll
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\p2hhr.bat" "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40c2d13d8ebbd9c83acb0c4a02fe661b.exe""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

240622921.exe

Path C:\Users\Admin\AppData\Local\Temp\240622921.exe
Size 14KB
SHA256 bd3e935ac31b64e2c009274cb416c80f8fd98862efb3b54d288696d36dd75f00
MD5 2f314e83de9f1ead9569d49760c0572c
SHA1 28e8a3100aaa90de6af21c20580d79af1ae5408e
SHA512 897a12b6b2093a652fcbfd0c03df26208f46866dad452d4aa1ac51ed74369fa2476d95947df5f16b6cb6f8dde550147cf23af01800f44194041d06fcebfbd865
SSDEEP 192:F/KyPcTAT5XS77nB9L7xdVPtCxjaqSE+l:FiIc8TZSXB9L7xdVPENaPF
MD5 SHA1 SHA512 SSDEEP

Submit Download

240623218.exe

Path C:\Users\Admin\AppData\Local\Temp\240623218.exe
Size 24KB
SHA256 20d5456266acb5b4c85dbbc8fc74ea4cf632ef89b0336e0bd07ba3f71dc73938
MD5 8a234b8f77179d1ec1ea75492b90c292
SHA1 290e3e37a30ba6b0f8bac7c38f4aeffc47468fe5
SHA512 2e2ded4376552ff2086f13431f486737a21af43aa25009e84019914171eab2a95df25e344b21c132035b7af6d1e638d252c00a5483c7963ceb6bf58437476dd4
SSDEEP 384:zKZtXVjcpiysZCwoWgqAmjbo2VjOItXOFkRRwcpQOSyqEcgcEasW:2ZtXxcpiyy4rmjboCjltXOsB/cgjasW
MD5 SHA1 SHA512 SSDEEP

Submit Download

240624265.exe

Path C:\Users\Admin\AppData\Local\Temp\240624265.exe
Size 19KB
SHA256 30989ec734622642ad50757c86e5ef346215122f3a7a7b1bc9d9cfe1510a2196
MD5 ddacc896a7308249cc7f7cd5109954fe
SHA1 3ad41112d31406b3e97d0703b1cf8f3d1935657e
SHA512 047011a60b67c24f2ef618998e72f74da6b4691ef3bea597ba17edaa04c3f1a012a9c8e8cb9eafaaae51473abb57382908843b2b9b298ed4d362df2c76f7f97c
SSDEEP 384:dpzF06lWK4k8WVa2n++WpfBY0zlxP1DkR3aPfQ:v+6ll8aa+RKY0teW4
MD5 SHA1 SHA512 SSDEEP

Submit Download

p2hhr.bat

Path C:\Users\Admin\AppData\Local\Temp\p2hhr.bat
Size 44B
SHA256 e8efa9da7c7006640c2f883bec45cc3013dda102fb4ae74dbd45b676c77820bf
MD5 76d2c58bc389bc1cc18aed4ff486a1a2
SHA1 421c4d20655a1270415e550fa9cc8831576abbf6
SHA512 241642d717fbf37c3f0970921f37246c5484a3763cde23dfe0e830ed26bb9347253b68e659a70e7e6017c883024c0ef678023f0b927438d1bda16f89f40d412e
MD5 SHA1 SHA512

Submit Download

p6hhr.bat

Path C:\Users\Admin\AppData\Local\Temp\p6hhr.bat
Size 44B
SHA256 be4a38adde88d522653b423794809d54e9af0abe7decafa0501cd4cc3a073925
MD5 400fba0cf5e5d608058f93959929b6d3
SHA1 162a0d2af9d2d836bba00e9015a29dd2914cd269
SHA512 350658631444b12db85ed4687f92eb2cc388257dcc731f84fad1077769adc493f2450075f669ed2c066778a1c1ed459de74db204b903702eceb3e1baa0e816c2
MD5 SHA1 SHA512

Submit Download

bensorty03.dll

Path C:\Windows\SysWOW64\bensorty03.dll
Size 9KB
SHA256 7f5185c72477e81a7959ed2a697bba5b9d6ded13687c24ef79dcb8bba776b75f
MD5 bf632e480127d1f20203aceb15c05062
SHA1 42d8147809d89088451dcd0143f451ac99047200
SHA512 448971e717e20dbea8884bc545eb61d9c98442f3580864aa9892f2c6e10d01c873939e0a610bc84cd50e05a43f4db55adbc8311ec807da1db0d88659eb8187f1
SSDEEP 192:j+CzKl7aVr+F17B5qmhAICiLLmEZFwTqXl:j+yrr+17bBCiTZD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2288-14-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/2288-6-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/2288-7-0x00000000001D0000-0x00000000001D1000-memory.dmp

Download

memory/4372-17-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4372-19-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/4372-50-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4372-30-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/4372-33-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4396-25-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/4396-27-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/4396-44-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/4396-41-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/4596-61-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/4596-63-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/4788-45-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/4896-0-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4896-31-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4896-59-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4896-28-0x00000000001C0000-0x00000000001C2000-memory.dmp

Download

memory/4896-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

Download

memory/4916-53-0x0000000010000000-0x0000000010008000-memory.dmp

Download

memory/5064-32-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/5064-29-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/5064-12-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download