2108904d8aa58741f227401e61b809de70b755415c973efa4d3b9951c20a7199

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08aa96b7e6fa56dc121f0f2c86c2f890_JaffaCakes118.exe
Size

22KB
MD5

08aa96b7e6fa56dc121f0f2c86c2f890
SHA1

55ca656c60875fac351cae41d5cef3052fa09579
SHA256

2108904d8aa58741f227401e61b809de70b755415c973efa4d3b9951c20a7199
SHA512

e2d7f7e82d38525e86c7c02d73581ad87fcf5bb7af8b57d579541d4c880dda6780b2410c39977bb68180a19b2594d4069d6a556eae182df7599656af0e7a1213
SSDEEP

384:0mQbikcUXPWN+strmAiQDJ1owhNhVo7m60+pb5q0E9kCnxWlBNKYVYzfDtEC9CvW:0uFNmABNNh6m60+pbofk7NKO4LtpEYZ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
4312	msedge.exe
4312	msedge.exe
396	identity_helper.exe
396	identity_helper.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 4312	2036	08aa96b7e6fa56dc121f0f2c86c2f890_JaffaCakes118.exe	81
PID 2036 wrote to memory of 4312	2036	08aa96b7e6fa56dc121f0f2c86c2f890_JaffaCakes118.exe	81
PID 4312 wrote to memory of 4712	4312	msedge.exe	82
PID 4312 wrote to memory of 4712	4312	msedge.exe	82
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 4728	4312	msedge.exe	83
PID 4312 wrote to memory of 216	4312	msedge.exe	84
PID 4312 wrote to memory of 216	4312	msedge.exe	84
PID 4312 wrote to memory of 3240	4312	msedge.exe	85
PID 4312 wrote to memory of 3240	4312	msedge.exe	85
PID 4312 wrote to memory of 3240	4312	msedge.exe	85
PID 4312 wrote to memory of 3240	4312	msedge.exe	85
PID 4312 wrote to memory of 3240	4312	msedge.exe	85
PID 4312 wrote to memory of 3240	4312	msedge.exe	85
PID 4312 wrote to memory of 3240	4312	msedge.exe	85
PID 4312 wrote to memory of 3240	4312	msedge.exe	85
PID 4312 wrote to memory of 3240	4312	msedge.exe	85
PID 4312 wrote to memory of 3240	4312	msedge.exe	85
PID 4312 wrote to memory of 3240	4312	msedge.exe	85
PID 4312 wrote to memory of 3240	4312	msedge.exe	85
PID 4312 wrote to memory of 3240	4312	msedge.exe	85
PID 4312 wrote to memory of 3240	4312	msedge.exe	85
PID 4312 wrote to memory of 3240	4312	msedge.exe	85
PID 4312 wrote to memory of 3240	4312	msedge.exe	85
PID 4312 wrote to memory of 3240	4312	msedge.exe	85
PID 4312 wrote to memory of 3240	4312	msedge.exe	85

C:\Users\Admin\AppData\Local\Temp\08aa96b7e6fa56dc121f0f2c86c2f890_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08aa96b7e6fa56dc121f0f2c86c2f890_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.google.com.br/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9924846f8,0x7ff992484708,0x7ff992484718
    3⤵
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,12645397174949746752,14697878427235425647,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,12645397174949746752,14697878427235425647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,12645397174949746752,14697878427235425647,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12645397174949746752,14697878427235425647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12645397174949746752,14697878427235425647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:3756
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,12645397174949746752,14697878427235425647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4444 /prefetch:8
    3⤵
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,12645397174949746752,14697878427235425647,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4444 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12645397174949746752,14697878427235425647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
    3⤵
    PID:2292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12645397174949746752,14697878427235425647,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12645397174949746752,14697878427235425647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
    3⤵
    PID:1296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12645397174949746752,14697878427235425647,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
    3⤵
    PID:1652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12645397174949746752,14697878427235425647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12645397174949746752,14697878427235425647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12645397174949746752,14697878427235425647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12645397174949746752,14697878427235425647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:1
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,12645397174949746752,14697878427235425647,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6080 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,12645397174949746752,14697878427235425647,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
    3⤵
    PID:3492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df7ff2714c9fa7e5680431cdbe486b19

SHA1
56d1f224021b7adc2d51683bc11534ddd3832e60

SHA256
ade003347dfc9eb5d8ae803f57c9fb56c1c025c66306fd338fb41a30ed4cbb16

SHA512
43ca49202088f5553a4d3a8f38efce669a9a9b657a9453bc9d7d63cb1ed9ddc5f7be8476f444ff1abb453f2721544075a5f71fa69cb93a1ea60722a47edbc0ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
58337e1091d0137be7cd69be511b91a0

SHA1
a0dbed0ed44e2dd29b70db42787e54c5da04ecc5

SHA256
dd4e26b565e7c43f0d9f41c8336aeac898f9e9d7715e276d7c6eaaa257871954

SHA512
ce3eff0d48a8f579c9037127b785205a348e02dcb8fbbe6739326e595138a837bc8f6a3092486a1f53b63a2227038104b2ac79304cdcebdfead0fd6e305f7bcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
7017bdf989ab1cbaefff75e74a112a95

SHA1
649e928eab14f5d3b9b691a70eb8f864c5720141

SHA256
5292c4fa42cfbc1de93869c46ab0063da2920d5891731abf66ceb0ebb7f17053

SHA512
a8fa84566ef264e3f8e6ff61a2062c65e64cfd80170f3e5fcb2488caad9d5e52396d6ed3afce93d469c869a0bde91ba978528415d5780f67e374df9446d3dc0e

Download Submit
memory/2036-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2036-53-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2036-66-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download