e451310ccd2dc212d3c4233ef75c6bd4a6b238e6ef44119ae4769cac2a2e5f54

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d35381609a7837b54625620b260ceba0_JaffaCakes118.exe
Size 580KB
Sample240405-pbmpbsbe51
SHA256 e451310ccd2dc212d3c4233ef75c6bd4a6b238e6ef44119ae4769cac2a2e5f54
MD5 d35381609a7837b54625620b260ceba0
SHA1 e2a849cd29fe4584fe183ec4a3d231b96c11510f
SHA512 a12e110cba61403f88f16ce101297d221f29050c5b7111245c73ed6dbd797493d3f96ed18a175106a1f49d57bd628b2e69695c637e624319a848dc513fd3092e
SSDEEP 12288:Q4gzhRXZrOMlRYpl3U077HwPoTxqLWPiXjJ/whUFT:ehRXZr1ypl3p77QwTUki9/who
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

agilenet

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	steamerrorreporter.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	d35381609a7837b54625620b260ceba0_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\steamerrorreporter.b2bqemce.lnk	d35381609a7837b54625620b260ceba0_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
3752	steamerrorreporter.exe
1588	steamerrorreporter.exe

Loads dropped DLL 13 IoCs

pid	Process
544	RegAsm.exe
3316	RegAsm.exe
1576	RegAsm.exe
692	RegAsm.exe
4448	RegAsm.exe
4032	RegAsm.exe
1592	RegAsm.exe
4628	RegAsm.exe
2856	RegAsm.exe
396	RegAsm.exe
1872	RegAsm.exe
3960	RegAsm.exe
4568	RegAsm.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/544-27-0x0000000000400000-0x000000000046E000-memory.dmp	agile_net

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 3752 set thread context of 544	3752	steamerrorreporter.exe	96
PID 3752 set thread context of 3316	3752	steamerrorreporter.exe	99
PID 3752 set thread context of 1576	3752	steamerrorreporter.exe	100
PID 3752 set thread context of 692	3752	steamerrorreporter.exe	102
PID 3752 set thread context of 4448	3752	steamerrorreporter.exe	103
PID 3752 set thread context of 4032	3752	steamerrorreporter.exe	105
PID 3752 set thread context of 1592	3752	steamerrorreporter.exe	104
PID 3752 set thread context of 4628	3752	steamerrorreporter.exe	107
PID 3752 set thread context of 2856	3752	steamerrorreporter.exe	106
PID 3752 set thread context of 396	3752	steamerrorreporter.exe	108
PID 3752 set thread context of 1872	3752	steamerrorreporter.exe	109
PID 3752 set thread context of 4568	3752	steamerrorreporter.exe	111
PID 3752 set thread context of 3960	3752	steamerrorreporter.exe	110

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe
3752	steamerrorreporter.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	d35381609a7837b54625620b260ceba0_JaffaCakes118.exe
Token: SeDebugPrivilege	3752	steamerrorreporter.exe
Token: SeDebugPrivilege	1588	steamerrorreporter.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1600	d35381609a7837b54625620b260ceba0_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1600	d35381609a7837b54625620b260ceba0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 3752	1600	d35381609a7837b54625620b260ceba0_JaffaCakes118.exe	89
PID 1600 wrote to memory of 3752	1600	d35381609a7837b54625620b260ceba0_JaffaCakes118.exe	89
PID 1600 wrote to memory of 3752	1600	d35381609a7837b54625620b260ceba0_JaffaCakes118.exe	89
PID 3752 wrote to memory of 1588	3752	steamerrorreporter.exe	94
PID 3752 wrote to memory of 1588	3752	steamerrorreporter.exe	94
PID 3752 wrote to memory of 1588	3752	steamerrorreporter.exe	94
PID 3752 wrote to memory of 544	3752	steamerrorreporter.exe	96
PID 3752 wrote to memory of 544	3752	steamerrorreporter.exe	96
PID 3752 wrote to memory of 544	3752	steamerrorreporter.exe	96
PID 3752 wrote to memory of 544	3752	steamerrorreporter.exe	96
PID 3752 wrote to memory of 544	3752	steamerrorreporter.exe	96
PID 3752 wrote to memory of 544	3752	steamerrorreporter.exe	96
PID 3752 wrote to memory of 544	3752	steamerrorreporter.exe	96
PID 3752 wrote to memory of 544	3752	steamerrorreporter.exe	96
PID 3752 wrote to memory of 3316	3752	steamerrorreporter.exe	99
PID 3752 wrote to memory of 3316	3752	steamerrorreporter.exe	99
PID 3752 wrote to memory of 3316	3752	steamerrorreporter.exe	99
PID 3752 wrote to memory of 1576	3752	steamerrorreporter.exe	100
PID 3752 wrote to memory of 1576	3752	steamerrorreporter.exe	100
PID 3752 wrote to memory of 1576	3752	steamerrorreporter.exe	100
PID 3752 wrote to memory of 1576	3752	steamerrorreporter.exe	100
PID 3752 wrote to memory of 3316	3752	steamerrorreporter.exe	99
PID 3752 wrote to memory of 1576	3752	steamerrorreporter.exe	100
PID 3752 wrote to memory of 3316	3752	steamerrorreporter.exe	99
PID 3752 wrote to memory of 1576	3752	steamerrorreporter.exe	100
PID 3752 wrote to memory of 3316	3752	steamerrorreporter.exe	99
PID 3752 wrote to memory of 1576	3752	steamerrorreporter.exe	100
PID 3752 wrote to memory of 3316	3752	steamerrorreporter.exe	99
PID 3752 wrote to memory of 3316	3752	steamerrorreporter.exe	99
PID 3752 wrote to memory of 1576	3752	steamerrorreporter.exe	100
PID 3752 wrote to memory of 692	3752	steamerrorreporter.exe	102
PID 3752 wrote to memory of 692	3752	steamerrorreporter.exe	102
PID 3752 wrote to memory of 692	3752	steamerrorreporter.exe	102
PID 3752 wrote to memory of 4448	3752	steamerrorreporter.exe	103
PID 3752 wrote to memory of 4448	3752	steamerrorreporter.exe	103
PID 3752 wrote to memory of 4448	3752	steamerrorreporter.exe	103
PID 3752 wrote to memory of 4448	3752	steamerrorreporter.exe	103
PID 3752 wrote to memory of 692	3752	steamerrorreporter.exe	102
PID 3752 wrote to memory of 692	3752	steamerrorreporter.exe	102
PID 3752 wrote to memory of 4448	3752	steamerrorreporter.exe	103
PID 3752 wrote to memory of 4448	3752	steamerrorreporter.exe	103
PID 3752 wrote to memory of 692	3752	steamerrorreporter.exe	102
PID 3752 wrote to memory of 4448	3752	steamerrorreporter.exe	103
PID 3752 wrote to memory of 692	3752	steamerrorreporter.exe	102
PID 3752 wrote to memory of 4448	3752	steamerrorreporter.exe	103
PID 3752 wrote to memory of 692	3752	steamerrorreporter.exe	102
PID 3752 wrote to memory of 1592	3752	steamerrorreporter.exe	104
PID 3752 wrote to memory of 4032	3752	steamerrorreporter.exe	105
PID 3752 wrote to memory of 4032	3752	steamerrorreporter.exe	105
PID 3752 wrote to memory of 1592	3752	steamerrorreporter.exe	104
PID 3752 wrote to memory of 1592	3752	steamerrorreporter.exe	104
PID 3752 wrote to memory of 4032	3752	steamerrorreporter.exe	105
PID 3752 wrote to memory of 4032	3752	steamerrorreporter.exe	105
PID 3752 wrote to memory of 1592	3752	steamerrorreporter.exe	104
PID 3752 wrote to memory of 4032	3752	steamerrorreporter.exe	105
PID 3752 wrote to memory of 1592	3752	steamerrorreporter.exe	104
PID 3752 wrote to memory of 4032	3752	steamerrorreporter.exe	105
PID 3752 wrote to memory of 1592	3752	steamerrorreporter.exe	104
PID 3752 wrote to memory of 4032	3752	steamerrorreporter.exe	105
PID 3752 wrote to memory of 1592	3752	steamerrorreporter.exe	104
PID 3752 wrote to memory of 4032	3752	steamerrorreporter.exe	105
PID 3752 wrote to memory of 1592	3752	steamerrorreporter.exe	104
PID 3752 wrote to memory of 2856	3752	steamerrorreporter.exe	106
PID 3752 wrote to memory of 2856	3752	steamerrorreporter.exe	106

C:\Users\Admin\AppData\Local\Temp\d35381609a7837b54625620b260ceba0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d35381609a7837b54625620b260ceba0_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\steamerrorreporter.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\steamerrorreporter.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\steamerrorreporter.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\steamerrorreporter.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    - Loads dropped DLL
    PID:544
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    - Loads dropped DLL
    PID:3316
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    - Loads dropped DLL
    PID:1576
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    - Loads dropped DLL
    PID:692
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    - Loads dropped DLL
    PID:4448
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    - Loads dropped DLL
    PID:1592
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    - Loads dropped DLL
    PID:4032
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    - Loads dropped DLL
    PID:2856
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    - Loads dropped DLL
    PID:4628
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    - Loads dropped DLL
    PID:396
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    - Loads dropped DLL
    PID:1872
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    - Loads dropped DLL
    PID:3960
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    - Loads dropped DLL
    PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RegAsm.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegAsm.exe.log
Size 128B
SHA256 e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5
MD5 a5dcc7c9c08af7dddd82be5b036a4416
SHA1 4f998ca1526d199e355ffb435bae111a2779b994
SHA512 56035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a
MD5 SHA1 SHA512

Submit Download

AgileDotNetRT.dll

Path C:\Users\Admin\AppData\Local\Temp\ee50048c-b6eb-4ad3-b983-551cd617a0fd\AgileDotNetRT.dll
Size 136KB
SHA256 77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db
MD5 9af5eb006bb0bab7f226272d82c896c7
SHA1 c2a5bb42a5f08f4dc821be374b700652262308f0
SHA512 7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a
SSDEEP 3072:nIuwb3gn+bp4G6qepZn07UHGm2pM1g23mGpzqQ4AZ2Z34E:nIb3gn+bp45DGP923mGpzjcZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

steamerrorreporter.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\steamerrorreporter.exe
Size 580KB
SHA256 e451310ccd2dc212d3c4233ef75c6bd4a6b238e6ef44119ae4769cac2a2e5f54
MD5 d35381609a7837b54625620b260ceba0
SHA1 e2a849cd29fe4584fe183ec4a3d231b96c11510f
SHA512 a12e110cba61403f88f16ce101297d221f29050c5b7111245c73ed6dbd797493d3f96ed18a175106a1f49d57bd628b2e69695c637e624319a848dc513fd3092e
SSDEEP 12288:Q4gzhRXZrOMlRYpl3U077HwPoTxqLWPiXjJ/whUFT:ehRXZr1ypl3p77QwTUki9/who
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/396-123-0x0000000074190000-0x00000000741EB000-memory.dmp

Download

memory/544-36-0x0000000003060000-0x0000000003070000-memory.dmp

Download

memory/544-27-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/544-37-0x0000000074190000-0x00000000741EB000-memory.dmp

Download

memory/544-35-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/544-45-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/544-44-0x00000000722A0000-0x00000000722D7000-memory.dmp

Download

memory/544-41-0x00000000722A0000-0x00000000722D7000-memory.dmp

Download

memory/544-38-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/692-83-0x00000000722D0000-0x0000000072307000-memory.dmp

Download

memory/692-84-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/692-77-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/692-80-0x00000000722D0000-0x0000000072307000-memory.dmp

Download

memory/692-71-0x0000000074190000-0x00000000741EB000-memory.dmp

Download

memory/692-78-0x00000000029B0000-0x00000000029C0000-memory.dmp

Download

memory/1576-64-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/1576-57-0x0000000074190000-0x00000000741EB000-memory.dmp

Download

memory/1576-59-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/1576-61-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

Download

memory/1576-62-0x00000000722D0000-0x0000000072307000-memory.dmp

Download

memory/1576-65-0x00000000722D0000-0x0000000072307000-memory.dmp

Download

memory/1588-25-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/1588-23-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/1588-46-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/1588-47-0x0000000000F50000-0x0000000000F60000-memory.dmp

Download

memory/1588-48-0x0000000000F50000-0x0000000000F60000-memory.dmp

Download

memory/1588-24-0x0000000000F50000-0x0000000000F60000-memory.dmp

Download

memory/1588-26-0x0000000000F50000-0x0000000000F60000-memory.dmp

Download

memory/1592-91-0x0000000074190000-0x00000000741EB000-memory.dmp

Download

memory/1592-98-0x00000000722D0000-0x0000000072307000-memory.dmp

Download

memory/1592-92-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/1592-95-0x00000000722D0000-0x0000000072307000-memory.dmp

Download

memory/1592-97-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/1600-0-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/1600-2-0x00000000014F0000-0x0000000001500000-memory.dmp

Download

memory/1600-3-0x00000000014F0000-0x0000000001500000-memory.dmp

Download

memory/1600-1-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/1600-20-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/1872-130-0x0000000074190000-0x00000000741EB000-memory.dmp

Download

memory/2856-113-0x0000000074190000-0x00000000741EB000-memory.dmp

Download

memory/2856-111-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/2856-109-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/2856-110-0x0000000000BD0000-0x0000000000BE0000-memory.dmp

Download

memory/3316-67-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/3316-66-0x00000000722D0000-0x0000000072307000-memory.dmp

Download

memory/3316-56-0x0000000074190000-0x00000000741EB000-memory.dmp

Download

memory/3316-63-0x00000000722D0000-0x0000000072307000-memory.dmp

Download

memory/3316-60-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/3316-58-0x0000000002D40000-0x0000000002D50000-memory.dmp

Download

memory/3316-52-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/3752-39-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/3752-42-0x00000000018D0000-0x00000000018E0000-memory.dmp

Download

memory/3752-15-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/3752-16-0x00000000018D0000-0x00000000018E0000-memory.dmp

Download

memory/3752-19-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/3752-21-0x00000000018D0000-0x00000000018E0000-memory.dmp

Download

memory/3752-40-0x00000000018D0000-0x00000000018E0000-memory.dmp

Download

memory/3960-140-0x0000000074190000-0x00000000741EB000-memory.dmp

Download

memory/4032-99-0x00000000722D0000-0x0000000072307000-memory.dmp

Download

memory/4032-94-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/4032-96-0x00000000722D0000-0x0000000072307000-memory.dmp

Download

memory/4032-93-0x0000000002D30000-0x0000000002D40000-memory.dmp

Download

memory/4032-89-0x0000000074190000-0x00000000741EB000-memory.dmp

Download

memory/4032-87-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/4032-100-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/4448-82-0x00000000722D0000-0x0000000072307000-memory.dmp

Download

memory/4448-74-0x0000000074190000-0x00000000741EB000-memory.dmp

Download

memory/4448-72-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/4448-76-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/4448-75-0x0000000002860000-0x0000000002870000-memory.dmp

Download

memory/4448-79-0x00000000722D0000-0x0000000072307000-memory.dmp

Download

memory/4448-81-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/4568-143-0x0000000074190000-0x00000000741EB000-memory.dmp

Download

memory/4628-104-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/4628-106-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

Download

memory/4628-107-0x0000000075470000-0x0000000075A21000-memory.dmp

Download

memory/4628-108-0x00000000722D0000-0x0000000072307000-memory.dmp

Download

memory/4628-105-0x0000000074190000-0x00000000741EB000-memory.dmp

Download