340ca0fa65336615188c3691c04309b85356ec58856c171683c8a1a64f8988ed

Analysis

max time kernel
142s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6943479bbabc626fc462c844f65c7afc_JaffaCakes118.exe
Size

898KB
MD5

6943479bbabc626fc462c844f65c7afc
SHA1

9aaf828eac38508f5308a73f9a6f99e2b72e34e0
SHA256

340ca0fa65336615188c3691c04309b85356ec58856c171683c8a1a64f8988ed
SHA512

531b4bd7e6998fe07b5e87568a6616f1738716b7b0d44486ca94cd0162ec8ec73be02a87fd5dc93206544f8710d9280427b000248e2dc07ae6d8d3e311ed2f31
SSDEEP

24576:oxGaFDpekdGp9Z1SlfscwzX0eCYRK+ILTfBLXSYo:Nau9nSSVkJ7+CK

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp

pid process

2880 6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp

pid	process
2880	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp

Loads dropped DLL 10 IoCs

Processes:

6943479bbabc626fc462c844f65c7afc_JaffaCakes118.exe6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp

pid	process
2724	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.exe
2880	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp
2880	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp
2880	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp
2880	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp
2880	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp
2880	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp
2880	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp
2880	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp
2880	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp

Modifies system certificate store 2 TTPs 4 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d461d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67080b00000001000000140000005500530045005200540072007500730074000000140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d8090000000100000016000000301406082b0601050507030306082b060105050703080f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb20000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 040000000100000010000000a7f2e41606411150306b9ce3b49cb0c90f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d80b000000010000001400000055005300450052005400720075007300740000001d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d46190000000100000010000000e843ac3b52ec8c297fa948c9b1fb281920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d80b000000010000001400000055005300450052005400720075007300740000001d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

6943479bbabc626fc462c844f65c7afc_JaffaCakes118.exe

description	pid	process	target process
PID 2724 wrote to memory of 2880	2724	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.exe	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp
PID 2724 wrote to memory of 2880	2724	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.exe	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp
PID 2724 wrote to memory of 2880	2724	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.exe	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp
PID 2724 wrote to memory of 2880	2724	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.exe	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp
PID 2724 wrote to memory of 2880	2724	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.exe	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp
PID 2724 wrote to memory of 2880	2724	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.exe	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp
PID 2724 wrote to memory of 2880	2724	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.exe	6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp

C:\Users\Admin\AppData\Local\Temp\6943479bbabc626fc462c844f65c7afc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6943479bbabc626fc462c844f65c7afc_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724

C:\Users\Admin\AppData\Local\Temp\is-B6LHB.tmp\6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp
"C:\Users\Admin\AppData\Local\Temp\is-B6LHB.tmp\6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp" /SL5="$50150,498928,146432,C:\Users\Admin\AppData\Local\Temp\6943479bbabc626fc462c844f65c7afc_JaffaCakes118.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies system certificate store
PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
348751acd89b4f8532c08187c8864dea

SHA1
34a76d721867ade9dcfd3a2f100b37850dd84c97

SHA256
56916b7acb66462499ebb8e7c6f2a1d2b111a8225883be4ecdc9a10fca16d657

SHA512
c44157cb30fb7c4df36c6066fc7398499dfc0e74f6e05f1e7bb1a9c6fde857ba38dcaf8fc8429eda1b99531af60d5cd5f5e815b187ecb83c7e89bebe1715776a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B74.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Users\Admin\AppData\Local\Temp\is-B6LHB.tmp\6943479bbabc626fc462c844f65c7afc_JaffaCakes118.tmp

Filesize
1.1MB

MD5
53d53cb910b764c67c7bc5f46bfe38a2

SHA1
acb9ae29d4ab5857fe3c837bc8c571f0aadb3351

SHA256
f1c6a977297caf94eb3b07259116aa9412f5b2f11a48833104c5582f32f2b499

SHA512
dba598908f5123d2f45ef40c1619b827055bf4a49904024957008daeccd561b02d70fe95d8a3531e5dfbb290e7a9454d858c297d09fcbd48c151b11456099da9

Download Submit
\Users\Admin\AppData\Local\Temp\is-B85CE.tmp\InnoSetupHelper.dll

Filesize
81KB

MD5
f0a34e1b4fcf7bf515c63dc4a8ebe349

SHA1
e7f254b30b3254850d95753005f16e9b3a82ce2a

SHA256
51f1c6b2f2fa40a645556f5be64eec7425e604406ef90573a5e9a0e9df7c8780

SHA512
0ba1af4131266a2fe29f0f48d918f1921b2de7e26d84624dc639cd8175c0a6397c23fb9bcab44d68fa8598e66b0373e01dd81a53e26a099ceaa4ae467fa81bb2

Download Submit
\Users\Admin\AppData\Local\Temp\is-B85CE.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-B85CE.tmp\cinshlpr.dll

Filesize
191KB

MD5
67a2873ab35dbcb4834d3b4582e99f11

SHA1
c72adfd291edb1c8b9931a158622b9c9ac3eb678

SHA256
530520fd9e20e3677df29943621a0c01acb995147169826bf175f88890b2ccae

SHA512
591d969dbc3763c9a28d01edea10d156893c6ec44ce6fe938a63a48f8481cb201e5cbe4a0b65adbeb2a9dd763034e1d224febd35f20ce34690d2c16aca944eb0

Download Submit
\Users\Admin\AppData\Local\Temp\is-B85CE.tmp\innocallback.dll

Filesize
69KB

MD5
c161e8bee1e81d8d4f75ceb3a619f879

SHA1
5c1319bfe5529c93e371faa616dcbf32fc7b0aaa

SHA256
1ce3e9e0bdca3aef9b68a7672696c11ac493bd2153d013c92aa078006c8184de

SHA512
a6ac4418024b6e3bb2e490492ef9a2e0236a5a349cfcbb3256a646769dd9fdf144a2b1260cac42dda70c9cf98437dccb6ca0eb22548f2667ed6da906ecb861da

Download Submit
\Users\Admin\AppData\Local\Temp\is-B85CE.tmp\isxdl.dll

Filesize
121KB

MD5
48ad1a1c893ce7bf456277a0a085ed01

SHA1
803997ef17eedf50969115c529a2bf8de585dc91

SHA256
b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

SHA512
7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

Download Submit
\Users\Admin\AppData\Local\Temp\is-B85CE.tmp\webbrowser.dll

Filesize
425KB

MD5
b576c4fdd6d0d3db25e2917ff3cd95a4

SHA1
3724f3708b4f8f76e9c8ff8c2f7bed70fc976d2d

SHA256
0ad1dc0094ad376eee23433b9416e8e1d7f6326a50c1f7bce5957f119ecc0e7e

SHA512
1a5e88a297b694dc7fe45756e5ef77abce5d1d45ef0a975f0278d8ce06cd32032ae34b62f436f83bc02463cab17802eca6bf1ab48930eceabdb3b72f45fbeefb

Download Submit
memory/2724-2-0x0000000000401000-0x0000000000412000-memory.dmp

Filesize
68KB

Download
memory/2724-155-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2724-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2880-35-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2880-14-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2880-21-0x0000000002050000-0x00000000020C0000-memory.dmp

Filesize
448KB

Download
memory/2880-149-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2880-153-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2880-25-0x0000000000580000-0x0000000000595000-memory.dmp

Filesize
84KB

Download
memory/2880-157-0x0000000002050000-0x00000000020C0000-memory.dmp

Filesize
448KB

Download
memory/2880-158-0x0000000000580000-0x0000000000595000-memory.dmp

Filesize
84KB

Download
memory/2880-156-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2880-182-0x0000000000580000-0x0000000000595000-memory.dmp

Filesize
84KB

Download