d3d07d5f9818f7531fa667fefeae8627bb5141c538973624d6c4e403387191b1

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Size

697KB
MD5

1c186f01de5b2c94942e630f4f777d18
SHA1

2ed4384640595888c23d90859180d95a64b1f504
SHA256

d3d07d5f9818f7531fa667fefeae8627bb5141c538973624d6c4e403387191b1
SHA512

bc41502b306a20eb99a14a4511a71b37dd25a0e7f43588a80979cc85e2702f558da28213a77585dac3e8005ca215ddc6625b4f2148f6998dcbc57766d5ffc616
SSDEEP

12288:iPPMnQwGCh8TBgsy3h8VJO5hWzRzONjx5dFacPes8FFi3PpXG1/licdVhANT7yk6:EtwNaBg3IOxNjLdF+UG1/lDdVhkCkMPD

Score

8^/10

adware persistence privilege_escalation stealer

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 2 IoCs

pid	Process
2620	wlanmsm32.exe
2768	EhStorShell32.exe

Loads dropped DLL 5 IoCs

pid	Process
2200	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
2620	wlanmsm32.exe
2620	wlanmsm32.exe
2620	wlanmsm32.exe
2768	EhStorShell32.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{118641E9-425B-46E2-8AF8-8E6091431AB2}	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dbcf6f901406P.manifest	wlanmsm32.exe
File opened for modification	C:\Windows\SysWOW64\dbcf6f901406S.manifest	wlanmsm32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	wlanmsm32.exe
File created	C:\Windows\SysWOW64\wlanmsm32.exe	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\560036071	wlanmsm32.exe
File opened for modification	C:\Windows\SysWOW64\wlanmsm32.exe	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dbcf6f901406C.manifest	wlanmsm32.exe
File opened for modification	C:\Windows\SysWOW64\dbcf6f901406O.manifest	wlanmsm32.exe
File created	C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-032.dll	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\560036071	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\XMLHTTP_UUID_Default = e94186115b42e2468af88e6091431ab2	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe

Modifies data under HKEY_USERS 47 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5EDDF476-43FB-43FA-9D71-9C1361D02203}\WpadDecision = "0"	wlanmsm32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6e-66-71-aa-0a-5d\WpadDecisionReason = "1"	wlanmsm32.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Xqeezjwhmk\CLSID	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-20\Software	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\Main\XMLHTTP_UUID_Default = e94186115b42e2468af88e6091431ab2	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5EDDF476-43FB-43FA-9D71-9C1361D02203}\WpadDecisionTime = c04f6f92e6cbda01	wlanmsm32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	wlanmsm32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5EDDF476-43FB-43FA-9D71-9C1361D02203}\WpadNetworkName = "Network 3"	wlanmsm32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wlanmsm32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Xqeezjwhmk\CLSID	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Xqeezjwhmk	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Xqeezjwhmk\CLSID\ = "{5e8349eb-203a-48bd-858a-80a5b3343add}"	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\Main\XMLHTTP_UUID_Default = e94186115b42e2468af88e6091431ab2	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wlanmsm32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6e-66-71-aa-0a-5d	wlanmsm32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6e-66-71-aa-0a-5d\WpadDecisionTime = c04f6f92e6cbda01	wlanmsm32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	wlanmsm32.exe
Key created	\REGISTRY\USER\.DEFAULT	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Xqeezjwhmk	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wlanmsm32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	wlanmsm32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6e-66-71-aa-0a-5d\WpadDetectedUrl	wlanmsm32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wlanmsm32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	wlanmsm32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wlanmsm32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5EDDF476-43FB-43FA-9D71-9C1361D02203}\6e-66-71-aa-0a-5d	wlanmsm32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6e-66-71-aa-0a-5d\WpadDecision = "0"	wlanmsm32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	wlanmsm32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Xqeezjwhmk\CLSID\ = "{5e8349eb-203a-48bd-858a-80a5b3343add}"	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Xqeezjwhmk	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-20	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	wlanmsm32.exe
Key created	\REGISTRY\USER\S-1-5-19	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Xqeezjwhmk\CLSID	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	wlanmsm32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\6e-66-71-aa-0a-5d\WpadDecisionTime = 80acaadfe6cbda01	wlanmsm32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\dbcf6f90 = " "	wlanmsm32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5EDDF476-43FB-43FA-9D71-9C1361D02203}	wlanmsm32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5EDDF476-43FB-43FA-9D71-9C1361D02203}\WpadDecisionTime = 80acaadfe6cbda01	wlanmsm32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wlanmsm32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	wlanmsm32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5EDDF476-43FB-43FA-9D71-9C1361D02203}\WpadDecisionReason = "1"	wlanmsm32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Xqeezjwhmk\CLSID	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Xqeezjwhmk\CLSID\ = "{5e8349eb-203a-48bd-858a-80a5b3343add}"	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	wlanmsm32.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5e8349eb-203a-48bd-858a-80a5b3343add}	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Software\Xqeezjwhmk\CLSID	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fsharproj\PersistentHandler	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fsharproj\PersistentHandler\ = "{86db11b7-4cf0-4b39-a494-16aeb5441956}"	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Xqeezjwhmk\CLSID	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Software\Xqeezjwhmk\CLSID\ = "{5e8349eb-203a-48bd-858a-80a5b3343add}"	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{118641E9-425B-46E2-8AF8-8E6091431AB2}	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{118641E9-425B-46E2-8AF8-8E6091431AB2}\InprocServer32	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{118641E9-425B-46E2-8AF8-8E6091431AB2}\InprocServer32\ = "C:\\Windows\\SysWow64\\api-ms-win-core-localization-l1-2-032.dll"	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Xqeezjwhmk	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Xqeezjwhmk\CLSID\ = "{5e8349eb-203a-48bd-858a-80a5b3343add}"	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Software\Xqeezjwhmk\CLSID	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Software	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\Software\Xqeezjwhmk	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fsharproj	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{118641E9-425B-46E2-8AF8-8E6091431AB2}\InprocServer32\ThreadingModel = "Both"	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2200	1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2768	2620	wlanmsm32.exe	29
PID 2620 wrote to memory of 2768	2620	wlanmsm32.exe	29
PID 2620 wrote to memory of 2768	2620	wlanmsm32.exe	29
PID 2620 wrote to memory of 2768	2620	wlanmsm32.exe	29

C:\Users\Admin\AppData\Local\Temp\1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c186f01de5b2c94942e630f4f777d18_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2200

C:\Windows\SysWOW64\wlanmsm32.exe
C:\Windows\SysWOW64\wlanmsm32.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2620
- C:\ProgramData\EhStorShell32.exe
  schutz
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\560036071

Filesize
31B

MD5
f1de3eab3cbd2a578f8825f7a4c7b1b6

SHA1
d8b5bf882e8afdec0dcee008478f91e0bafed717

SHA256
2bdea09240a74b197ae6257ddb8215247519b0b7b85d95227034fc93086bacc3

SHA512
12148dd0bf1be49fb91dcb4998e4b9f7eb91d0a7c25693856db741d7ae8561a1652e697af5394b8dceedc78e326ccebabe758b7adf9d618b84c18f14dc509866

Download Submit
C:\Windows\SysWOW64\560036071

Filesize
119B

MD5
daca5f70020bf70c7828d6504840fdc2

SHA1
f3887e67952f804c5d65fb3cc2ee53c320d72f8f

SHA256
07fc0ee6cf5782435ca42faafe37acd44d4a02d89f3bda290f7c6f9d4cd7ae44

SHA512
5d323569ede1b260a51577fcda27bfb5b542d9213d3eaf5459dfc5036eadd61d0aef770b003ec3a6e49b9ae26ab1c4b70f503341927af19a910f89ec476aa4cb

Download Submit
C:\Windows\SysWOW64\wlanmsm32.exe

Filesize
697KB

MD5
1c186f01de5b2c94942e630f4f777d18

SHA1
2ed4384640595888c23d90859180d95a64b1f504

SHA256
d3d07d5f9818f7531fa667fefeae8627bb5141c538973624d6c4e403387191b1

SHA512
bc41502b306a20eb99a14a4511a71b37dd25a0e7f43588a80979cc85e2702f558da28213a77585dac3e8005ca215ddc6625b4f2148f6998dcbc57766d5ffc616

Download Submit
\ProgramData\api-ms-win-core-localization-l1-2-032.dll

Filesize
153KB

MD5
3494d0beafff6f1672b16a01a0873826

SHA1
5077257165269518bc76e614f0e9e7d7588036b8

SHA256
107830b02b99f72f28abef77d7217204814af8899e41c083b342d04fdf71b8f2

SHA512
fb29634f8133714359c4d90069d3fc309dcecd96fd0641955a443c1a723470ff5277f069cf380dff79d6ddd1357525bed6593ce7d9f78a011624eb59decfb5ef

Download Submit
\Windows\SysWOW64\api-ms-win-core-localization-l1-2-032.dll

Filesize
324KB

MD5
7c3222a9593ca198d3ac9e2f36c6928d

SHA1
2ce6d6b839f9d24ea564aa1cfdb74f9ba9ce13a6

SHA256
93c35bb94e3c87c54d04089fb4f392234bf12ad249a9ca4eb20743b8e47b2ab3

SHA512
2edd96c261179ba971f3a395d969cc11dc3ea92803c8443f936fc6ec08e338a39134808f1133fa4f59b45120c1cf6a4ebd839715f41159225a6d5be823805e64

Download Submit
memory/2200-29-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2200-1-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2200-6-0x0000000010000000-0x000000001008C000-memory.dmp

Filesize
560KB

Download
memory/2200-0-0x00000000004B0000-0x00000000004B4000-memory.dmp

Filesize
16KB

Download
memory/2200-28-0x00000000004B0000-0x00000000004B4000-memory.dmp

Filesize
16KB

Download
memory/2200-5-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2620-36-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2620-24-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2620-34-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2620-66-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2620-67-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2620-79-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2768-63-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/2768-68-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download