544edd1531b2599607bde440b23e18d836dec80174060b871fc8faf7b702bb41

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe
Size

103KB
MD5

3c464ad52529a43af054503ca89bff6a
SHA1

fceb721248deac3f3e365d77568859552d218eef
SHA256

544edd1531b2599607bde440b23e18d836dec80174060b871fc8faf7b702bb41
SHA512

529177d25561d7f2877fcd6487b6ce97d9ee848d985ab41f45480899c8051d5c7be8f02867cc9fc50717808f37c64087606d7edfd6c3d5c49d463aca80e70da8
SSDEEP

3072:Zq60TUZO9pMwCo9mfEE2mTSnqG1oRqhBxQiOxejr:8ZTU492wCGm/enq6oRABxC

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2176	regsvr32.exe
3068	regsvr32.exe
1980	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SysWOW64\MSINET.OCX	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\SysWOW64\Move.Data	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\SysWOW64\MSINET.OCX	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\SysWOW64\Move.Data	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ProgID\ = "InetCtls.Inet.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\ = "Internet Control General Property Page Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\ = "Microsoft Internet Transfer Control, version 6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\HELPDIR\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\WINDOWS\\SysWow64\\MSINET.OCX"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\WINDOWS\\SysWow64\\MSINET.OCX"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\ = "Internet Control URL Property Page Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ = "DInetEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ToolboxBitmap32\ = "C:\\WINDOWS\\SysWow64\\MSINET.OCX, 1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0\win32\ = "C:\\WINDOWS\\SysWow64\\MSINET.OCX"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0\win32\ = "C:\\WINDOWS\\SysWow64\\MSINET.OCX"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\ = "Microsoft Internet Transfer Control, version 6.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\1\ = "132497"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ = "IInet"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CurVer\ = "InetCtls.Inet.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\ = "Microsoft Internet Transfer Control 6.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\VersionIndependentProgID\ = "InetCtls.Inet"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\ = "Internet Control URL Property Page Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CLSID\ = "{48E59293-9880-11CF-9754-00AA00C00908}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\WINDOWS\\SysWow64\\MSINET.OCX"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\VersionIndependentProgID\ = "InetCtls.Inet"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1980	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2304	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe
1980	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe
1980	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe
1980	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2176	2304	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	30
PID 2304 wrote to memory of 2176	2304	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	30
PID 2304 wrote to memory of 2176	2304	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	30
PID 2304 wrote to memory of 2176	2304	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	30
PID 2304 wrote to memory of 2176	2304	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	30
PID 2304 wrote to memory of 2176	2304	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	30
PID 2304 wrote to memory of 2176	2304	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	30
PID 2304 wrote to memory of 1980	2304	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	31
PID 2304 wrote to memory of 1980	2304	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	31
PID 2304 wrote to memory of 1980	2304	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	31
PID 2304 wrote to memory of 1980	2304	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	31
PID 1980 wrote to memory of 3068	1980	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	32
PID 1980 wrote to memory of 3068	1980	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	32
PID 1980 wrote to memory of 3068	1980	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	32
PID 1980 wrote to memory of 3068	1980	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	32
PID 1980 wrote to memory of 3068	1980	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	32
PID 1980 wrote to memory of 3068	1980	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	32
PID 1980 wrote to memory of 3068	1980	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	32
PID 1980 wrote to memory of 1836	1980	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	35
PID 1980 wrote to memory of 1836	1980	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	35
PID 1980 wrote to memory of 1836	1980	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	35
PID 1980 wrote to memory of 1836	1980	3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe	35

C:\Users\Admin\AppData\Local\Temp\3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s C:\WINDOWS\system32\MSINET.OCX
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:2176
- C:\Users\Admin\AppData\Local\Temp\3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\3c464ad52529a43af054503ca89bff6a_JaffaCakes118.exe
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s C:\WINDOWS\system32\MSINET.OCX
    3⤵
    - Loads dropped DLL
    - Modifies registry class
    PID:3068
- - C:\Windows\SysWOW64\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\SysWOW64\MSINET.OCX

Filesize
62KB

MD5
f15fff6a8547d03a2db82264075d34e7

SHA1
adca52fb990b2109f22540356a0ead3e5481684e

SHA256
d8eb0d4cbd89e6907284291594ee63f1321058ccda547c2adc92ee49e429173b

SHA512
b94773f3e2c4399c8310c275e6e85808273016febaffbe52f7dc8d48a7f051217bfcdefd2a067aa97325754669091a419cfc0e659b36ab0bc66d1bd80c2d48cc

Download Submit
C:\WINDOWS\SysWOW64\Move.Data

Filesize
24KB

MD5
2729834b9cd020fe63ea0817af3383f4

SHA1
e0048b9340ad4eeab3c03c825b862e33fe26568e

SHA256
b0666185eb0f9178a5eba9fa44b0811ca71626961ae8618b76fcbd5d8854ed49

SHA512
f16f80d4c052a23c2c2a6250ebfef8c82f8e96a8b0096a7a28e3b157a9ba1176202503bbd03c2fb31face7b5ace016395f8c31d5fdfb115d1ce538e9c7c6ecad

Download Submit
\??\c:\zt.dll

Filesize
5B

MD5
d5cd9f572ebe004f98d8afb856d232c2

SHA1
584079f5d23dd1142ce6c42561934fb3200150cf

SHA256
773ac3bfde8adb749433b89f1e62d185687558b2ee1383c8e7dfba930c22467d

SHA512
6fb8ca1331313fc9a9b9240766c65b448956398a7a920e0b7132dc5800c69ead4bd4400a87a62eb9ee78a9912cd0fbcaa017596db2f5811db7fbc6542c75fe8e

Download Submit
memory/1980-25-0x00000000234C0000-0x00000000234EE000-memory.dmp

Filesize
184KB

Download
memory/1980-26-0x00000000234C0000-0x00000000234EE000-memory.dmp

Filesize
184KB

Download
memory/1980-43-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1980-34-0x0000000004830000-0x00000000052EA000-memory.dmp

Filesize
10.7MB

Download
memory/1980-13-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1980-33-0x00000000234C0000-0x00000000234EE000-memory.dmp

Filesize
184KB

Download
memory/1980-31-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1980-27-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2176-7-0x00000000234C0000-0x00000000234EE000-memory.dmp

Filesize
184KB

Download
memory/2176-6-0x00000000234C0000-0x00000000234EE000-memory.dmp

Filesize
184KB

Download
memory/2304-28-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2304-30-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2304-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2304-12-0x00000000003B0000-0x00000000003E6000-memory.dmp

Filesize
216KB

Download
memory/3068-19-0x00000000234C0000-0x00000000234EE000-memory.dmp

Filesize
184KB

Download