dbfdf8e451c3dabf8be991f38284e114cc208432b6cce1ff2a132fff129e29c5

Analysis

max time kernel
145s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
Size

1.5MB
MD5

68f15793cd17480d51f9502c42455820
SHA1

e9f561ccb6459315d7a3b5fb2ba414ce5669968f
SHA256

dbfdf8e451c3dabf8be991f38284e114cc208432b6cce1ff2a132fff129e29c5
SHA512

f1757e7de967322f87dfc08ac5d03c06e7955a0096c10de41014b5d0c41df794766ef2692fcc2768ca3494b0c8ced41d986392b9e83107e3e261ffc131699b83
SSDEEP

24576:u9IyvSiqdMexsVSzGLqVrWyTLQWTrvYtvAETM5ynvXtXJrujxUDyCBsJ82v0uwmD:MqiexqSQwFJTivAETM4nvxhaq/B5W0IB

Score

8^/10

discovery upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

68f15793cd17480d51f9502c42455820_JaffaCakes118.exe

description ioc process

File created C:\Windows\System32\drivers\crfilterdrv.sys 68f15793cd17480d51f9502c42455820_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\System32\drivers\crfilterdrv.sys	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\nsd12D7.tmp\SelfDel.dll	acprotect
behavioral1/memory/2464-48-0x00000000748A0000-0x00000000748A9000-memory.dmp	acprotect

Deletes itself 1 IoCs

Processes:

explorer.exe

pid process

2564 explorer.exe
Executes dropped EXE 3 IoCs

Processes:

nfregdrv.exeCashReminder.exeCashReminder.exe

pid process

2940 nfregdrv.exe
2512 CashReminder.exe
2020 CashReminder.exe

pid	process
2564	explorer.exe

pid	process
2940	nfregdrv.exe
2512	CashReminder.exe
2020	CashReminder.exe

Loads dropped DLL 16 IoCs

Processes:

68f15793cd17480d51f9502c42455820_JaffaCakes118.exenfregdrv.exeCashReminder.exeCashReminder.exe

pid	process
2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
2940	nfregdrv.exe
2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
2512	CashReminder.exe
2512	CashReminder.exe
2512	CashReminder.exe
2512	CashReminder.exe
2020	CashReminder.exe
2020	CashReminder.exe
2020	CashReminder.exe
2020	CashReminder.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\nsd12D7.tmp\SelfDel.dll	upx
behavioral1/memory/2464-48-0x00000000748A0000-0x00000000748A9000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

Processes:

CashReminder.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	CashReminder.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

68f15793cd17480d51f9502c42455820_JaffaCakes118.exe

description pid process target process

PID 2464 set thread context of 2564 2464 68f15793cd17480d51f9502c42455820_JaffaCakes118.exe explorer.exe

description	pid	process	target process
PID 2464 set thread context of 2564	2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	explorer.exe

Drops file in Program Files directory 9 IoCs

Processes:

68f15793cd17480d51f9502c42455820_JaffaCakes118.exe

description	ioc	process
File created	C:\Program Files (x86)\CashReminder\CashReminder.exe	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
File created	C:\Program Files (x86)\CashReminder\nfregdrv.exe	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
File created	C:\Program Files (x86)\CashReminder\remove.exe	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\CashReminder\crfilterdrv.sys	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
File created	C:\Program Files (x86)\CashReminder\nfapi.dll	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
File created	C:\Program Files (x86)\CashReminder\ssleay32.dll	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
File created	C:\Program Files (x86)\CashReminder\libeay32.dll	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
File created	C:\Program Files (x86)\CashReminder\ProtocolFilters.dll	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
File created	C:\Program Files (x86)\CashReminder\crfilterdrv.sys	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 24 IoCs

Processes:

CashReminder.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f013b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	CashReminder.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BE58B978-6C19-4DAC-97AA-1F12AF7C3E2F}\WpadDecisionTime = 2067c3769cacda01	CashReminder.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	CashReminder.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	CashReminder.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	CashReminder.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BE58B978-6C19-4DAC-97AA-1F12AF7C3E2F}	CashReminder.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BE58B978-6C19-4DAC-97AA-1F12AF7C3E2F}\WpadDecisionReason = "1"	CashReminder.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e6-8d-16-2d-53-ba	CashReminder.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BE58B978-6C19-4DAC-97AA-1F12AF7C3E2F}\e6-8d-16-2d-53-ba	CashReminder.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e6-8d-16-2d-53-ba\WpadDecision = "0"	CashReminder.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	CashReminder.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	CashReminder.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	CashReminder.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BE58B978-6C19-4DAC-97AA-1F12AF7C3E2F}\WpadNetworkName = "Network 3"	CashReminder.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e6-8d-16-2d-53-ba\WpadDecisionReason = "1"	CashReminder.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	CashReminder.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	CashReminder.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	CashReminder.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	CashReminder.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BE58B978-6C19-4DAC-97AA-1F12AF7C3E2F}\WpadDecision = "0"	CashReminder.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\e6-8d-16-2d-53-ba\WpadDecisionTime = 2067c3769cacda01	CashReminder.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	CashReminder.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	CashReminder.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	CashReminder.exe

Runs net.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

480
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

68f15793cd17480d51f9502c42455820_JaffaCakes118.exe

pid process

2464 68f15793cd17480d51f9502c42455820_JaffaCakes118.exe

pid	process
480

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

68f15793cd17480d51f9502c42455820_JaffaCakes118.exeCashReminder.execmd.exenet.exe

description	pid	process	target process
PID 2464 wrote to memory of 2940	2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	nfregdrv.exe
PID 2464 wrote to memory of 2940	2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	nfregdrv.exe
PID 2464 wrote to memory of 2940	2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	nfregdrv.exe
PID 2464 wrote to memory of 2940	2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	nfregdrv.exe
PID 2464 wrote to memory of 2512	2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	CashReminder.exe
PID 2464 wrote to memory of 2512	2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	CashReminder.exe
PID 2464 wrote to memory of 2512	2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	CashReminder.exe
PID 2464 wrote to memory of 2512	2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	CashReminder.exe
PID 2464 wrote to memory of 2564	2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	explorer.exe
PID 2464 wrote to memory of 2564	2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	explorer.exe
PID 2464 wrote to memory of 2564	2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	explorer.exe
PID 2464 wrote to memory of 2564	2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	explorer.exe
PID 2464 wrote to memory of 2564	2464	68f15793cd17480d51f9502c42455820_JaffaCakes118.exe	explorer.exe
PID 2512 wrote to memory of 2508	2512	CashReminder.exe	cmd.exe
PID 2512 wrote to memory of 2508	2512	CashReminder.exe	cmd.exe
PID 2512 wrote to memory of 2508	2512	CashReminder.exe	cmd.exe
PID 2512 wrote to memory of 2508	2512	CashReminder.exe	cmd.exe
PID 2508 wrote to memory of 2924	2508	cmd.exe	net.exe
PID 2508 wrote to memory of 2924	2508	cmd.exe	net.exe
PID 2508 wrote to memory of 2924	2508	cmd.exe	net.exe
PID 2508 wrote to memory of 2924	2508	cmd.exe	net.exe
PID 2924 wrote to memory of 2024	2924	net.exe	net1.exe
PID 2924 wrote to memory of 2024	2924	net.exe	net1.exe
PID 2924 wrote to memory of 2024	2924	net.exe	net1.exe
PID 2924 wrote to memory of 2024	2924	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\68f15793cd17480d51f9502c42455820_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68f15793cd17480d51f9502c42455820_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2464

C:\Program Files (x86)\CashReminder\nfregdrv.exe
nfregdrv.exe C:\Windows\system32\drivers\crfilterdrv.sys
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940

C:\Program Files (x86)\CashReminder\CashReminder.exe
"C:\Program Files (x86)\CashReminder\CashReminder.exe" /install /SILENT
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c net start CashReminder
3⤵
- Suspicious use of WriteProcessMemory
PID:2508

C:\Windows\SysWOW64\net.exe
net start CashReminder
4⤵
- Suspicious use of WriteProcessMemory
PID:2924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start CashReminder
5⤵
PID:2024

C:\Windows\SysWOW64\explorer.exe
C:\Windows\system32\explorer.exe
2⤵
- Deletes itself
PID:2564

C:\Program Files (x86)\CashReminder\CashReminder.exe
"C:\Program Files (x86)\CashReminder\CashReminder.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2020

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\CashReminder\LIBEAY32.dll
Filesize
1.4MB

MD5
47a9d585dbf59f54574d978c4200a520

SHA1
ee99ab151751ee720833efb0c3a031d09bd13833

SHA256
421454bccf67fe6def1c13ff6314fd3fb69d667a421a1c1461209164bc9ad780

SHA512
d23516719ff06134c8614d27813b828b7815298404824623ae25a35dafde6515ebf80476405235933faad9bc70acfe5e295e8fabe5af091f544a23f3e2a0b565

Download Submit
C:\Program Files (x86)\CashReminder\crfilterdrv.sys
Filesize
55KB

MD5
9a12e8a6f226b76f633a7f00db65bedc

SHA1
dbc162f06df1967401e537a7dbc7598c3bc6d782

SHA256
65b30bb6e4716a87f446c594edbd31d4c296e2c3cbd2e1e5eba3001ec2184103

SHA512
e35a60ee5a3894feb8c160fca75a0ce585e2264a6aa74f5e8fbf3292b00ce2c4b49196a432fc988d5511a7c3423ee901479fc921829b6ba90d5f17f7256f138a

Download Submit
C:\Program Files (x86)\CashReminder\nfapi.dll
Filesize
124KB

MD5
04a835251535006c85473a604fba8bdc

SHA1
4bed678d9836e20d1f48792a8f4ba1d41e94f629

SHA256
e99db65a51db72018f0469b6d5096a2d469b790efdeec50a955b8ac4e19f16e8

SHA512
e47c5072fd8b581e8312148ca48490a86d4f51d58e6acef90d3d3de8bca5660d62a1b935357f9307c6f89cc35d1d332b0f42f402abf87a8959d4c29af8e5ee67

Download Submit
\Program Files (x86)\CashReminder\CashReminder.exe
Filesize
433KB

MD5
e6791bdbe847d61dd230d755959f2da5

SHA1
dd8594aeb11317135d36382a1961bc9d5893c97f

SHA256
1598a10fd9bff8ba91aca0e500cf6d0c8b338d34adf4559adf2af5c1a0964b09

SHA512
f80e64a7d15bee857a7c38fefa2cb7490a46427cce0b972ffdf96c90ea99f698e069672e7ea7570e8d76fba07a664699468009d1e6173d83cdc9fc94e60135e8

Download Submit
\Program Files (x86)\CashReminder\ProtocolFilters.dll
Filesize
360KB

MD5
fab8104ced422c551bcf2dda631e5930

SHA1
ccdb59de36d3ca7fe080f173bf437a98701a367b

SHA256
34fd513f254f3491a314b64f8883b289ab96a2b975ce6fa357c0ae11ed12d3df

SHA512
52608279186f108284bef7cf5e6031d67ae1d700121a22ef7da00a8ef81ae2430e64adabd2fa9c186ebf7d7d5c9df8bd0183d35071d4c1e594e8118a0f576870

Download Submit
\Program Files (x86)\CashReminder\nfregdrv.exe
Filesize
48KB

MD5
01b5780505301ada6dc102fb77b2298c

SHA1
328c3931a54af2d7adb88ba4c4c18ce1af8d5a72

SHA256
aad2d85472448abe8250cf3180c3d0373540f46e8a8e76d8ef2f78db62be0812

SHA512
bc5bd91c46f452a76ae0595287622256e8c79e90158171bedf6b68d4439dfefceb06948bd49deb0aeb1344ce89a312bb87b01e2daf3880729fff642951c33947

Download Submit
\Program Files (x86)\CashReminder\ssleay32.dll
Filesize
368KB

MD5
2da6e9df4979ca65a01c4df6eb5600d2

SHA1
8bb90aca4e3387629e76d5c8cb53743990d891ec

SHA256
bfb7a9a4d5501d21cd575ec6f65b10ec3d43e6bc137d7b6469daf24ee0b65d14

SHA512
e146c42fee06702b80ca46d7a281a8c0600b9a35213accac29dc3c505d9d1f0405c4a69f22258042fbe4d35278c2c47ba878b1f2bfaa739eb1501428ea5f90af

Download Submit
\Users\Admin\AppData\Local\Temp\nsd12D7.tmp\SelfDel.dll
Filesize
5KB

MD5
e5786e8703d651bc8bd4bfecf46d3844

SHA1
fee5aa4b325deecbf69ccb6eadd89bd5ae59723f

SHA256
d115bce0a787b4f895e700efe943695c8f1087782807d91d831f6015b0f98774

SHA512
d14ad43a01db19428cd8ccd2fe101750860933409b5be2eb85a3e400efcd37b1b6425ce84e87a7fe46ecabc7b91c4b450259e624c178b86e194ba7da97957ba3

Download Submit
\Users\Admin\AppData\Local\Temp\nsd12D7.tmp\SimpleSC.dll
Filesize
61KB

MD5
d63975ce28f801f236c4aca5af726961

SHA1
3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9

SHA256
e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43

SHA512
8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810

Download Submit
\Users\Admin\AppData\Local\Temp\nsd12D7.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
memory/2020-83-0x0000000000690000-0x0000000000803000-memory.dmp

Filesize
1.4MB

Download
memory/2020-80-0x0000000000340000-0x000000000039D000-memory.dmp

Filesize
372KB

Download
memory/2020-77-0x0000000000220000-0x000000000027C000-memory.dmp

Filesize
368KB

Download
memory/2020-85-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2464-32-0x00000000021F0000-0x0000000002203000-memory.dmp

Filesize
76KB

Download
memory/2464-13-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/2464-48-0x00000000748A0000-0x00000000748A9000-memory.dmp

Filesize
36KB

Download
memory/2512-66-0x00000000004E0000-0x000000000053D000-memory.dmp

Filesize
372KB

Download
memory/2512-72-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2512-70-0x0000000000540000-0x00000000006B3000-memory.dmp

Filesize
1.4MB

Download
memory/2512-62-0x0000000000480000-0x00000000004DC000-memory.dmp

Filesize
368KB

Download
memory/2512-73-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download