metasploit | 40976619899943690686051faa55e20f8fd832677e1b543590275222ed4b92b6

Analysis

max time kernel
149s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c228b24c705b36c5f791d788ca3d391_JaffaCakes118.exe
Size

292KB
MD5

1c228b24c705b36c5f791d788ca3d391
SHA1

c2e503d2c8f911e0a520d702772f96c00ab611ba
SHA256

40976619899943690686051faa55e20f8fd832677e1b543590275222ed4b92b6
SHA512

6f82a57b9ed40046a4f7d62ae7ee2c7fc875d7dbf23f342af27df9c2b63fe76c4b00fd2c8b35f1bf64b6db4ba99ae8b9661b4c3a90698e6a5d5dfa3413def0ef
SSDEEP

6144:DCHe6bLDtO3y1wqtafwGwwvP6bQ7yMP+DE8276p7zUDAddrB6:Ke4tDofw26b7MP+Dd2mNzU6V6

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Executes dropped EXE 10 IoCs

Processes:

syslog.exesyslog.exesyslog.exesyslog.exesyslog.exesyslog.exesyslog.exesyslog.exesyslog.exesyslog.exe

pid process

4516 syslog.exe
2312 syslog.exe
2148 syslog.exe
4620 syslog.exe
3408 syslog.exe
2828 syslog.exe
2588 syslog.exe
3336 syslog.exe
1336 syslog.exe
412 syslog.exe

pid	process
4516	syslog.exe
2312	syslog.exe
2148	syslog.exe
4620	syslog.exe
3408	syslog.exe
2828	syslog.exe
2588	syslog.exe
3336	syslog.exe
1336	syslog.exe
412	syslog.exe

Drops file in System32 directory 22 IoCs

Processes:

syslog.exe1c228b24c705b36c5f791d788ca3d391_JaffaCakes118.exesyslog.exesyslog.exesyslog.exesyslog.exesyslog.exesyslog.exesyslog.exesyslog.exesyslog.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File created	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File opened for modification	C:\Windows\SysWOW64\syslog.exe	1c228b24c705b36c5f791d788ca3d391_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File opened for modification	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File created	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File created	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File opened for modification	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File opened for modification	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File opened for modification	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File opened for modification	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File opened for modification	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File created	C:\Windows\SysWOW64\syslog.exe	1c228b24c705b36c5f791d788ca3d391_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File created	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File opened for modification	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File created	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File created	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File created	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File opened for modification	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File created	C:\Windows\SysWOW64\syslog.exe	syslog.exe
File created	C:\Windows\SysWOW64\syslog.exe	syslog.exe

Modifies registry class 33 IoCs

Processes:

syslog.exesyslog.exesyslog.exe1c228b24c705b36c5f791d788ca3d391_JaffaCakes118.exesyslog.exesyslog.exesyslog.exesyslog.exesyslog.exesyslog.exesyslog.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	syslog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	1c228b24c705b36c5f791d788ca3d391_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	syslog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	syslog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	syslog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	syslog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	syslog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	syslog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	syslog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	1c228b24c705b36c5f791d788ca3d391_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	syslog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	1c228b24c705b36c5f791d788ca3d391_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	syslog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	syslog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	syslog.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

1c228b24c705b36c5f791d788ca3d391_JaffaCakes118.exesyslog.exesyslog.exesyslog.exesyslog.exesyslog.exesyslog.exesyslog.exesyslog.exesyslog.exe

description	pid	process	target process
PID 2456 wrote to memory of 4516	2456	1c228b24c705b36c5f791d788ca3d391_JaffaCakes118.exe	syslog.exe
PID 2456 wrote to memory of 4516	2456	1c228b24c705b36c5f791d788ca3d391_JaffaCakes118.exe	syslog.exe
PID 2456 wrote to memory of 4516	2456	1c228b24c705b36c5f791d788ca3d391_JaffaCakes118.exe	syslog.exe
PID 4516 wrote to memory of 2312	4516	syslog.exe	syslog.exe
PID 4516 wrote to memory of 2312	4516	syslog.exe	syslog.exe
PID 4516 wrote to memory of 2312	4516	syslog.exe	syslog.exe
PID 2312 wrote to memory of 2148	2312	syslog.exe	syslog.exe
PID 2312 wrote to memory of 2148	2312	syslog.exe	syslog.exe
PID 2312 wrote to memory of 2148	2312	syslog.exe	syslog.exe
PID 2148 wrote to memory of 4620	2148	syslog.exe	syslog.exe
PID 2148 wrote to memory of 4620	2148	syslog.exe	syslog.exe
PID 2148 wrote to memory of 4620	2148	syslog.exe	syslog.exe
PID 4620 wrote to memory of 3408	4620	syslog.exe	syslog.exe
PID 4620 wrote to memory of 3408	4620	syslog.exe	syslog.exe
PID 4620 wrote to memory of 3408	4620	syslog.exe	syslog.exe
PID 3408 wrote to memory of 2828	3408	syslog.exe	syslog.exe
PID 3408 wrote to memory of 2828	3408	syslog.exe	syslog.exe
PID 3408 wrote to memory of 2828	3408	syslog.exe	syslog.exe
PID 2828 wrote to memory of 2588	2828	syslog.exe	syslog.exe
PID 2828 wrote to memory of 2588	2828	syslog.exe	syslog.exe
PID 2828 wrote to memory of 2588	2828	syslog.exe	syslog.exe
PID 2588 wrote to memory of 3336	2588	syslog.exe	syslog.exe
PID 2588 wrote to memory of 3336	2588	syslog.exe	syslog.exe
PID 2588 wrote to memory of 3336	2588	syslog.exe	syslog.exe
PID 3336 wrote to memory of 1336	3336	syslog.exe	syslog.exe
PID 3336 wrote to memory of 1336	3336	syslog.exe	syslog.exe
PID 3336 wrote to memory of 1336	3336	syslog.exe	syslog.exe
PID 1336 wrote to memory of 412	1336	syslog.exe	syslog.exe
PID 1336 wrote to memory of 412	1336	syslog.exe	syslog.exe
PID 1336 wrote to memory of 412	1336	syslog.exe	syslog.exe

C:\Users\Admin\AppData\Local\Temp\1c228b24c705b36c5f791d788ca3d391_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c228b24c705b36c5f791d788ca3d391_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\syslog.exe
C:\Windows\system32\syslog.exe 1236 "C:\Users\Admin\AppData\Local\Temp\1c228b24c705b36c5f791d788ca3d391_JaffaCakes118.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4516

C:\Windows\SysWOW64\syslog.exe
C:\Windows\system32\syslog.exe 1188 "C:\Windows\SysWOW64\syslog.exe"
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2312

C:\Windows\SysWOW64\syslog.exe
C:\Windows\system32\syslog.exe 1164 "C:\Windows\SysWOW64\syslog.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2148

C:\Windows\SysWOW64\syslog.exe
C:\Windows\system32\syslog.exe 1160 "C:\Windows\SysWOW64\syslog.exe"
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4620

C:\Windows\SysWOW64\syslog.exe
C:\Windows\system32\syslog.exe 1168 "C:\Windows\SysWOW64\syslog.exe"
6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3408

C:\Windows\SysWOW64\syslog.exe
C:\Windows\system32\syslog.exe 1176 "C:\Windows\SysWOW64\syslog.exe"
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2828

C:\Windows\SysWOW64\syslog.exe
C:\Windows\system32\syslog.exe 1184 "C:\Windows\SysWOW64\syslog.exe"
8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2588

C:\Windows\SysWOW64\syslog.exe
C:\Windows\system32\syslog.exe 1172 "C:\Windows\SysWOW64\syslog.exe"
9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3336

C:\Windows\SysWOW64\syslog.exe
C:\Windows\system32\syslog.exe 1180 "C:\Windows\SysWOW64\syslog.exe"
10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\syslog.exe
C:\Windows\system32\syslog.exe 1192 "C:\Windows\SysWOW64\syslog.exe"
11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\syslog.exe
Filesize
292KB

MD5
1c228b24c705b36c5f791d788ca3d391

SHA1
c2e503d2c8f911e0a520d702772f96c00ab611ba

SHA256
40976619899943690686051faa55e20f8fd832677e1b543590275222ed4b92b6

SHA512
6f82a57b9ed40046a4f7d62ae7ee2c7fc875d7dbf23f342af27df9c2b63fe76c4b00fd2c8b35f1bf64b6db4ba99ae8b9661b4c3a90698e6a5d5dfa3413def0ef

Download Submit
memory/412-116-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1336-115-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1336-113-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2148-97-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2148-94-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2148-91-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2312-93-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2312-89-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2312-85-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2456-0-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2456-20-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/2456-31-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/2456-30-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/2456-1-0x00000000009C0000-0x00000000009F0000-memory.dmp

Filesize
192KB

Download
memory/2456-22-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/2456-75-0x00000000009C0000-0x00000000009F0000-memory.dmp

Filesize
192KB

Download
memory/2456-74-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2456-3-0x00000000005E0000-0x00000000005EB000-memory.dmp

Filesize
44KB

Download
memory/2456-4-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/2456-5-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/2456-6-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/2456-7-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2456-8-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2456-9-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/2456-10-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/2456-11-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/2456-12-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/2456-13-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2456-52-0x00000000030F0000-0x00000000030F1000-memory.dmp

Filesize
4KB

Download
memory/2456-51-0x0000000003100000-0x0000000003101000-memory.dmp

Filesize
4KB

Download
memory/2456-50-0x00000000030D0000-0x00000000030D1000-memory.dmp

Filesize
4KB

Download
memory/2456-21-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/2456-48-0x00000000030B0000-0x00000000030B1000-memory.dmp

Filesize
4KB

Download
memory/2456-47-0x00000000030C0000-0x00000000030C1000-memory.dmp

Filesize
4KB

Download
memory/2456-46-0x0000000003090000-0x0000000003091000-memory.dmp

Filesize
4KB

Download
memory/2456-45-0x00000000030A0000-0x00000000030A1000-memory.dmp

Filesize
4KB

Download
memory/2456-44-0x0000000003070000-0x0000000003071000-memory.dmp

Filesize
4KB

Download
memory/2456-43-0x0000000003080000-0x0000000003081000-memory.dmp

Filesize
4KB

Download
memory/2456-42-0x0000000003050000-0x0000000003051000-memory.dmp

Filesize
4KB

Download
memory/2456-41-0x0000000003060000-0x0000000003061000-memory.dmp

Filesize
4KB

Download
memory/2456-40-0x0000000003030000-0x0000000003031000-memory.dmp

Filesize
4KB

Download
memory/2456-39-0x0000000003040000-0x0000000003041000-memory.dmp

Filesize
4KB

Download
memory/2456-38-0x0000000003000000-0x0000000003001000-memory.dmp

Filesize
4KB

Download
memory/2456-37-0x0000000003020000-0x0000000003021000-memory.dmp

Filesize
4KB

Download
memory/2456-36-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Filesize
4KB

Download
memory/2456-35-0x0000000002FF0000-0x0000000002FF1000-memory.dmp

Filesize
4KB

Download
memory/2456-29-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/2456-28-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/2456-27-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/2456-26-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/2456-25-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/2456-24-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/2456-23-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/2456-2-0x0000000002290000-0x0000000002295000-memory.dmp

Filesize
20KB

Download
memory/2456-14-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/2456-49-0x00000000030E0000-0x00000000030E1000-memory.dmp

Filesize
4KB

Download
memory/2456-19-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/2456-18-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/2456-17-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/2456-16-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/2456-15-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/2588-109-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2588-107-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2828-106-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/2828-104-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/3336-112-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/3336-110-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/3408-103-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/3408-101-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/4516-66-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/4516-58-0x0000000000660000-0x000000000066B000-memory.dmp

Filesize
44KB

Download
memory/4516-67-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/4516-68-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/4516-76-0x0000000003030000-0x0000000003031000-memory.dmp

Filesize
4KB

Download
memory/4516-77-0x0000000003050000-0x0000000003051000-memory.dmp

Filesize
4KB

Download
memory/4516-81-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/4516-84-0x00000000030E0000-0x00000000030E1000-memory.dmp

Filesize
4KB

Download
memory/4516-88-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/4516-62-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/4516-65-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/4516-83-0x00000000030C0000-0x00000000030C1000-memory.dmp

Filesize
4KB

Download
memory/4516-71-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download
memory/4516-72-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/4516-73-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/4516-80-0x0000000003080000-0x0000000003081000-memory.dmp

Filesize
4KB

Download
memory/4516-79-0x0000000003090000-0x0000000003091000-memory.dmp

Filesize
4KB

Download
memory/4516-56-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/4516-78-0x0000000003070000-0x0000000003071000-memory.dmp

Filesize
4KB

Download
memory/4516-57-0x0000000000780000-0x00000000007B0000-memory.dmp

Filesize
192KB

Download
memory/4516-64-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/4516-63-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/4516-70-0x0000000002460000-0x0000000002461000-memory.dmp

Filesize
4KB

Download
memory/4516-61-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/4516-60-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/4516-87-0x0000000000780000-0x00000000007B0000-memory.dmp

Filesize
192KB

Download
memory/4516-59-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download
memory/4516-69-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/4620-100-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/4620-98-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/4620-96-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download