dcbad31af67c2cc1ff686779f7ada2849cfa513f8ae20ef189bf633a76299a1f

Analysis

max time kernel
144s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26/06/2024, 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Size

2.3MB
MD5

104a44601afcf43fbc433d08906bb54d
SHA1

110c91465ac004cf1d44c872cfb6794b83122cb4
SHA256

dcbad31af67c2cc1ff686779f7ada2849cfa513f8ae20ef189bf633a76299a1f
SHA512

4f9810451993fda36e4c9ab7ac1f0b472d65cad2f9db0f38edf59813dd0c7a34c63040d444697fadfe2e9cb895eacb08161b9b80ce719b3ac5b2a7416b29c559
SSDEEP

24576:caJaJF5+7m7hf0ZwvSmMFvHNC1EtoGUJAMz0jBTDGWOv/HgbpM:cDJ8mlf0ZwUHg1EtoGUJAMz0jBTD3O9

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
3068	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
3068	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
3068	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe

Modifies registry class 62 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\qmacro\\qdisp.dll"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\104A44~1.EXE"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary.Inner\CLSID	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\ = "QMDispatch.QMRoutine"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InprocServer32	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\ = "QMDispatch.QMFunction"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\ProgID\ = "QMDispatch.QMFunction"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary.Inner\ = "QMDispatch.QMLibrary.Inner"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary\CLSID	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ProgID	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction\CLSID	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ = "QMDispatch.QMVBSRoutine"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}\ProgID	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}\InprocHandler32	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ProgID\ = "QMDispatch.QMVBSRoutine"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\InProcServer32\ThreadingModel = "Apartment"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\InprocHandler32\ = "ole32.dll"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\ProgID	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}\ = "QMDispatch.QMLibrary.Inner"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary.Inner\CLSID\ = "{EBEB87A5-E151-4054-AB45-A6E094C5334B}"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}\InprocHandler32\ = "ole32.dll"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InProcServer32	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction\ = "QMDispatch.QMFunction"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\104A44~1.EXE"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\CLSID\ = "{241D7F03-9232-4024-8373-149860BE27C0}"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\qmacro\\qdisp.dll"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InProcServer32\ThreadingModel = "Apartment"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\CLSID	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ = "QMDispatch.QMRoutine"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\ = "QMDispatch.QMVBSRoutine"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}\ProgID\ = "QMDispatch.QMLibrary.Inner"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}\LocalServer32	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InProcServer32	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\qmacro\\qdisp.dll"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\ = "QMDispatch.QMLibrary"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\ProgID\ = "QMDispatch.QMLibrary"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\InprocServer32	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InprocServer32	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InProcServer32\ThreadingModel = "Apartment"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ProgID\ = "QMDispatch.QMRoutine"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\InprocHandler32	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ProgID	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\LocalServer32	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\InProcServer32	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary\CLSID\ = "{EBEB87A6-E151-4054-AB45-A6E094C5334B}"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary.Inner	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\CLSID	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction\CLSID\ = "{EBEB87A4-E151-4054-AB45-A6E094C5334B}"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\ProgID	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\CLSID\ = "{C07DB6A3-34FC-4084-BE2E-76BB9203B049}"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary\ = "QMDispatch.QMLibrary"	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3068	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3068	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
3068	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
3068	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
3068	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
3068	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
3068	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
3068	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
3068	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
3068	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
3068	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
3068	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
3068	104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\104a44601afcf43fbc433d08906bb54d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\104a44601afcf43fbc433d08906bb54d_JaffaCakes118.ini

Filesize
50B

MD5
52f125f8639e4bf2d46825376bd70a5d

SHA1
8cf26ac080b698b11926c707ed44f03bedb9ecc9

SHA256
fa918a5a58be6eceb0763003444bda2a824f7ce6a13934a2cd6e08458493bac0

SHA512
43897ed016cc5972c36a0addb14a29c1b0175fea79b76683586f3c3f547636b577a88262641c6bc24917d15cd98e6e9aab868e6e1b7ec25107cb6aea8980b6fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\8E6.tmp

Filesize
515B

MD5
848af47f1c448c4f7659b7955437b7d6

SHA1
83c8e0ce13b42397aaadaca392a6aeb3520dc943

SHA256
8ed5e6ec7bd2b6c8bec42f1892ab4c6bb6b09cc3302e94548fade43c23b29c20

SHA512
5f92eb2652b08b8d5c39221f3279003eebb963c85aea9958583422f9a440550595075ff0389847e0c6b5f3ea22408f55efc34709911ef79586d54db37984d85c

Download Submit
\Users\Admin\AppData\Local\Temp\cfgdll.dll

Filesize
45KB

MD5
1479c26076bb69ef920b567bbe166fb5

SHA1
725b96c0aa4d3ed117ab4f9ddedc5243b1b5b489

SHA256
ec4f7a4bce0407f7d04492e036b149b5db0224231b8ecbb77eb88cf94507be3a

SHA512
afad589f9c512ba40149a25055ec9beba761933a64aed3b10aa4263150adcfad7b0c93e94c173a97e446117f2b4006861914944856be1bf227b04ce6704068b3

Download Submit
\Users\Admin\AppData\Roaming\qmacro\qdisp.dll

Filesize
41KB

MD5
a20de3836893f50f73c61ec0a2e45ad7

SHA1
eee63ff2190d6e2ed3eb4041c51075b4ed961c88

SHA256
2bcdf199d79f40191ba92513021f99390a8e07abdb151975e5df739b46d97473

SHA512
cab618b4b07bbdc36e5b679da9afa2d9e3f5ebdfef11c10e461dc9a588db2cabf1589ce10898dae8a9a12a0b5f571a6dffeb4faff504ea31eed9eba0c6b76f40

Download Submit
memory/3068-67-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/3068-71-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/3068-36-0x0000000000770000-0x0000000000870000-memory.dmp

Filesize
1024KB

Download
memory/3068-49-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/3068-53-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/3068-60-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/3068-28-0x00000000006D0000-0x00000000006DA000-memory.dmp

Filesize
40KB

Download
memory/3068-42-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/3068-89-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/3068-93-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/3068-110-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/3068-114-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/3068-121-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/3068-128-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/3068-132-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/3068-139-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download