2fefd5947e1f310af3f6b3e1aef0c12ff3d5eed25beda92531a7a76e7fb1639e

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe
Size

563KB
MD5

f951d45431b09d1dda8fc9aae3010c8a
SHA1

6b80c3d5c77848063ba634dcbf9fe7ad06a448eb
SHA256

2fefd5947e1f310af3f6b3e1aef0c12ff3d5eed25beda92531a7a76e7fb1639e
SHA512

d3022aa083a4f7fb8081052cc8e88b25b069eafb0a8c01718f13c334fd7209a19f841fed73a2826e356a32da932d40807078acbf681b022f83ec38b605997937
SSDEEP

12288:EiYco+gunQUBCEAWfykqVNe3U24eoz8LWy5:ENZunQU1aVNe3U24QLWy5

Score

10^/10

collection discovery persistence spyware stealer upx

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
azerty789

Signatures

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/2536-52-0x0000000000400000-0x000000000041E000-memory.dmp	MailPassView
behavioral1/memory/2536-54-0x0000000000400000-0x000000000041E000-memory.dmp	MailPassView

Nirsoft 13 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1260-8-0x0000000000400000-0x0000000000418000-memory.dmp	Nirsoft
behavioral1/memory/1260-11-0x0000000000400000-0x0000000000418000-memory.dmp	Nirsoft
behavioral1/memory/3028-18-0x0000000000400000-0x0000000000419000-memory.dmp	Nirsoft
behavioral1/memory/2548-25-0x0000000000400000-0x0000000000425000-memory.dmp	Nirsoft
behavioral1/memory/2548-26-0x0000000000400000-0x0000000000425000-memory.dmp	Nirsoft
behavioral1/memory/2596-34-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/2652-42-0x0000000000400000-0x000000000043D000-memory.dmp	Nirsoft
behavioral1/memory/2536-52-0x0000000000400000-0x000000000041E000-memory.dmp	Nirsoft
behavioral1/memory/2536-54-0x0000000000400000-0x000000000041E000-memory.dmp	Nirsoft
behavioral1/memory/2416-64-0x0000000000400000-0x0000000000418000-memory.dmp	Nirsoft
behavioral1/memory/2452-74-0x0000000000400000-0x0000000000419000-memory.dmp	Nirsoft
behavioral1/memory/1956-75-0x0000000001F00000-0x0000000001F80000-memory.dmp	Nirsoft
behavioral1/memory/3028-78-0x0000000000400000-0x0000000000419000-memory.dmp	Nirsoft

Executes dropped EXE 8 IoCs

Processes:

dialup.exepasswordfox.exemspass.exeiepv.exeChromePass.exemailpv.exeprodukey.exeOperaPassView.exe

pid process

1260 dialup.exe
3028 passwordfox.exe
2548 mspass.exe
2596 iepv.exe
2652 ChromePass.exe
2536 mailpv.exe
2416 produkey.exe
2452 OperaPassView.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1260	dialup.exe
3028	passwordfox.exe
2548	mspass.exe
2596	iepv.exe
2652	ChromePass.exe
2536	mailpv.exe
2416	produkey.exe
2452	OperaPassView.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\dialup.exe	upx
behavioral1/memory/1260-8-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/1260-11-0x0000000000400000-0x0000000000418000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\passwordfox.exe	upx
behavioral1/memory/3028-18-0x0000000000400000-0x0000000000419000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\mspass.exe	upx
behavioral1/memory/2548-25-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2548-26-0x0000000000400000-0x0000000000425000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\iepv.exe	upx
behavioral1/memory/2596-33-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2596-34-0x0000000000400000-0x000000000041B000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\ChromePass.exe	upx
behavioral1/memory/2652-42-0x0000000000400000-0x000000000043D000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\mailpv.exe	upx
behavioral1/memory/2536-52-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2536-54-0x0000000000400000-0x000000000041E000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\produkey.exe	upx
behavioral1/memory/2416-61-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/2416-64-0x0000000000400000-0x0000000000418000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe	upx
behavioral1/memory/2452-71-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/2452-74-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/3028-78-0x0000000000400000-0x0000000000419000-memory.dmp	upx

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

mailpv.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	mailpv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\My = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe"	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\svh0st.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe"	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 whatismyip.com

flow	ioc
4	whatismyip.com

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

mspass.exeiepv.exe

description	pid	process
Token: SeDebugPrivilege	2548	mspass.exe
Token: SeDebugPrivilege	2596	iepv.exe
Token: SeRestorePrivilege	2596	iepv.exe
Token: SeBackupPrivilege	2596	iepv.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe

description	pid	process	target process
PID 1956 wrote to memory of 1260	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	dialup.exe
PID 1956 wrote to memory of 1260	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	dialup.exe
PID 1956 wrote to memory of 1260	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	dialup.exe
PID 1956 wrote to memory of 1260	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	dialup.exe
PID 1956 wrote to memory of 3028	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	passwordfox.exe
PID 1956 wrote to memory of 3028	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	passwordfox.exe
PID 1956 wrote to memory of 3028	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	passwordfox.exe
PID 1956 wrote to memory of 3028	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	passwordfox.exe
PID 1956 wrote to memory of 2548	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	mspass.exe
PID 1956 wrote to memory of 2548	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	mspass.exe
PID 1956 wrote to memory of 2548	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	mspass.exe
PID 1956 wrote to memory of 2548	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	mspass.exe
PID 1956 wrote to memory of 2596	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	iepv.exe
PID 1956 wrote to memory of 2596	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	iepv.exe
PID 1956 wrote to memory of 2596	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	iepv.exe
PID 1956 wrote to memory of 2596	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	iepv.exe
PID 1956 wrote to memory of 2652	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	ChromePass.exe
PID 1956 wrote to memory of 2652	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	ChromePass.exe
PID 1956 wrote to memory of 2652	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	ChromePass.exe
PID 1956 wrote to memory of 2652	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	ChromePass.exe
PID 1956 wrote to memory of 2536	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	mailpv.exe
PID 1956 wrote to memory of 2536	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	mailpv.exe
PID 1956 wrote to memory of 2536	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	mailpv.exe
PID 1956 wrote to memory of 2536	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	mailpv.exe
PID 1956 wrote to memory of 2416	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	produkey.exe
PID 1956 wrote to memory of 2416	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	produkey.exe
PID 1956 wrote to memory of 2416	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	produkey.exe
PID 1956 wrote to memory of 2416	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	produkey.exe
PID 1956 wrote to memory of 2452	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	OperaPassView.exe
PID 1956 wrote to memory of 2452	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	OperaPassView.exe
PID 1956 wrote to memory of 2452	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	OperaPassView.exe
PID 1956 wrote to memory of 2452	1956	f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe	OperaPassView.exe

C:\Users\Admin\AppData\Local\Temp\f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f951d45431b09d1dda8fc9aae3010c8a_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1956

C:\Users\Admin\AppData\Local\Temp\dialup.exe
C:\Users\Admin\AppData\Local\Temp\dialup.exe /stext C:\Users\Admin\AppData\Local\Temp\data.txt
2⤵
- Executes dropped EXE
PID:1260

C:\Users\Admin\AppData\Local\Temp\passwordfox.exe
C:\Users\Admin\AppData\Local\Temp\passwordfox.exe /stext C:\Users\Admin\AppData\Local\Temp\firefox.txt
2⤵
- Executes dropped EXE
PID:3028

C:\Users\Admin\AppData\Local\Temp\mspass.exe
C:\Users\Admin\AppData\Local\Temp\mspass.exe /stext C:\Users\Admin\AppData\Local\Temp\mess.txt
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Users\Admin\AppData\Local\Temp\iepv.exe
C:\Users\Admin\AppData\Local\Temp\iepv.exe /stext C:\Users\Admin\AppData\Local\Temp\iepv.txt
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2596

C:\Users\Admin\AppData\Local\Temp\ChromePass.exe
C:\Users\Admin\AppData\Local\Temp\ChromePass.exe /stext C:\Users\Admin\AppData\Local\Temp\ChromePass.txt
2⤵
- Executes dropped EXE
PID:2652

C:\Users\Admin\AppData\Local\Temp\mailpv.exe
C:\Users\Admin\AppData\Local\Temp\mailpv.exe /stext C:\Users\Admin\AppData\Local\Temp\mailpv.txt
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
PID:2536

C:\Users\Admin\AppData\Local\Temp\produkey.exe
C:\Users\Admin\AppData\Local\Temp\produkey.exe /stext C:\Users\Admin\AppData\Local\Temp\produkey.txt
2⤵
- Executes dropped EXE
PID:2416

C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe
C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe /stext C:\Users\Admin\AppData\Local\Temp\OperaPassView.txt
2⤵
- Executes dropped EXE
PID:2452

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ChromePass.exe
Filesize
125KB

MD5
9b3b1c0db965166319469b2afa6c4f0c

SHA1
9f1e65a3056dff872949329c4e5e70c007cc5621

SHA256
dbfa10a7deeb6d1ac8fd95ffeb23b87adc58e6388e522812fabe7f710e3cdd89

SHA512
c11512599b83fa1875a67915a7e7454512ed8300a0a47c16692ebc1f526755c39c795fe9721dd97d417bfcb29f9e4c1f3283cf4c426af6571b3996005f7e4f5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\OperaPassView.exe
Filesize
38KB

MD5
37a89021ab1fbe5668c3974abc794bd4

SHA1
8ccaa4406f907a5a938fbb2db9d5af27092b811d

SHA256
2cb9a3d9587f79a6b1cfa95020b81d7d0d3cf9aa6ebf992f3b5e4ecf19bca8a8

SHA512
6eaef2c2c29eb5363a0193489dc989527e4087c61fe926efbbd8a0e3cc8b9675285a94d392ee0a906dfc109566cc144ab07166fd5b3defbfc8afd66d3fe8d1b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\data.txt
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\dialup.exe
Filesize
37KB

MD5
9c8872c879d0a9d82988920488370864

SHA1
87ff4231547462e6474c832e28831dd691d83fd4

SHA256
8f576d5191721f8fdb47bb22950f43fc8f2c9cc880fe067090ed96e6fcb07a97

SHA512
3c413427c46ef92a412840479896841ffd5c6eb9215b8ecc416cdbd4f8e0f2eb643ed3b7f2e18eb5710ba7c55e1cd82af6637285ee364e069503c5ecc187cb2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\iepv.exe
Filesize
42KB

MD5
28c110b8d0ad095131c8d06043678086

SHA1
c684cf321e890e0e766a97609a4cde866156d6c5

SHA256
dbc2216d5f31f5218e940e3d802998dee90eeb69af69cbeb063c69c6a5a3f1e1

SHA512
065e043b76b0e1163e73f4a1c257bae793ae9b46bff1951956c2174ef91deb2528730da77aab76b9e7246d705c3b8c1d23f05dc3b161cacabf3e52d0f563c922

Download Submit
C:\Users\Admin\AppData\Local\Temp\mailpv.exe
Filesize
49KB

MD5
29beed02d9e57505cf5f34edf24dba1c

SHA1
12f3cb339c182bcc62a369a92db2da45aab64f5e

SHA256
dc64825cf0d635320d4f72e70695084faf548ded12e5daf7ebc335cad64bc1fd

SHA512
957a8b6cbd20e62fcef513b8a5078fb9944aa5f79d517ffa23334198d718ec0db8a33f3c2763898124f88b582a4018537fbdb35650c0f040897a328ba5b919be

Download Submit
C:\Users\Admin\AppData\Local\Temp\mspass.exe
Filesize
63KB

MD5
fbb93d4c91453b06414d6973152d904e

SHA1
4624232c5450e7e9e7ba1f2113a07f8800dc5b5f

SHA256
8898b138a3f238fa985992a9d0e48f6b5865dd2cc35e08b83fa326260c510ffe

SHA512
4ed926d230af576a945bdd4d9b2d4001e8036abbcf1ef9a35669823d9420b6d95b426d80384a6fd022165c1fc2485fda0e28193b99b301927236928ddfcac6f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\passwordfox.exe
Filesize
37KB

MD5
a1d6a37917dcf4471486bc5a0e725cc6

SHA1
5b09f10dc215078ae44f535de12630c38f3b86e3

SHA256
8a06acd1158060a54d67098f07c1ff7895f799bc5834179b8aae04d28fb60e17

SHA512
5798a5d85052d5c2f6b781b91a400c85bc96c0127cc4e18079bff1f17bd302dc07c0f015ddf1105621a841680057322eb0172ba06063f55d795b7b079f1d26d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\produkey.exe
Filesize
35KB

MD5
279c6d1ff7c0dc77d68b6013288b40a8

SHA1
21e3620bfab7fa8c9c8ff0414b52a8e3f23d1fc2

SHA256
8e2373e94bff10ecb08e9e0cdeaa65ed57aec89f99312d3bbd90ab72de4f98f3

SHA512
a7ab94cac449b9494419d1e6fb9ea3cdd58a1c455fb003b3376b5717655aa15669eebdcfefffd18958326f15526afdac9b8978b47769e901f06ac2c782fc7ecd

Download Submit
C:\Users\Admin\AppData\Local\Temp\produkey.txt
Filesize
1KB

MD5
e57f9d9ee7d21151f8e73453b39e8807

SHA1
801a09048436bbbad8b811b1916398493c8463df

SHA256
873ad8e2629a6493abf9ea37efe36e1d013c6fa8f7c64e29a09eb381d6bf1930

SHA512
716b3051ddfcafffca4ee8bd85d8dd665c76953db56369f1d9634b09871166ba5015c0d115e117f7e4f772b6d015b26acfb13e436b0870e217803601e5f9866e

Download Submit
memory/1260-8-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1260-11-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1956-75-0x0000000001F00000-0x0000000001F80000-memory.dmp

Filesize
512KB

Download
memory/1956-1-0x0000000001F00000-0x0000000001F80000-memory.dmp

Filesize
512KB

Download
memory/1956-79-0x0000000001F00000-0x0000000001F80000-memory.dmp

Filesize
512KB

Download
memory/1956-0-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/1956-3-0x0000000001F00000-0x0000000001F80000-memory.dmp

Filesize
512KB

Download
memory/1956-43-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/1956-53-0x0000000001F00000-0x0000000001F80000-memory.dmp

Filesize
512KB

Download
memory/1956-45-0x0000000001F00000-0x0000000001F80000-memory.dmp

Filesize
512KB

Download
memory/1956-2-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2416-64-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2416-61-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2452-71-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2452-74-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2536-54-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2536-52-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2548-26-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2548-25-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2596-34-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2596-33-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2652-42-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3028-78-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3028-18-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download