d4594268a88e3240b8a3798b395f95af67d53eae1f58828df6e105dd655864c5

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe
Size

141KB
MD5

8a9d2d636c3eb83778a71d2912eaab6e
SHA1

2df18d58f2ee33b15ee38eae2120110db9235377
SHA256

d4594268a88e3240b8a3798b395f95af67d53eae1f58828df6e105dd655864c5
SHA512

35176a61fafd73d9440769d26274cc42c94ce7d319a90f011ef9d073bbb16d815d98d36afb26ffd74cedf788bb1ba9083f318a13d1af424514f707b069e375f2
SSDEEP

1536:4qTPSrAkdxOz/UY1pDC3iFA/cZ2IKpIPHvaSq/yiU/GOao8sCnEMvDY7hfhUxdcm:XT6k+2X3DASA/9IZPaPsaEMryqWxF7O

Score

8^/10

discovery evasion persistence privilege_escalation spyware stealer

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2656	netsh.exe

Deletes itself 1 IoCs

pid	Process
1780	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2684	foqyva.exe

Loads dropped DLL 2 IoCs

pid	Process
2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe
2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\{AB502C2B-5B90-4B28-768A-5FC69DA908E6} = "C:\\Users\\Admin\\AppData\\Roaming\\Ybare\\foqyva.exe"	foqyva.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2276 set thread context of 1780	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe	35

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Privacy	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\506F7DFF-00000001.eml:OECustomProperty	WinMail.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe
2684	foqyva.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe
Token: SeSecurityPrivilege	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe
Token: SeSecurityPrivilege	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe
Token: SeManageVolumePrivilege	1716	WinMail.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1716	WinMail.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1716	WinMail.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1716	WinMail.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2760	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe	30
PID 2276 wrote to memory of 2760	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe	30
PID 2276 wrote to memory of 2760	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe	30
PID 2276 wrote to memory of 2760	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe	30
PID 2276 wrote to memory of 2684	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe	32
PID 2276 wrote to memory of 2684	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe	32
PID 2276 wrote to memory of 2684	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe	32
PID 2276 wrote to memory of 2684	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe	32
PID 2760 wrote to memory of 2656	2760	cmd.exe	33
PID 2760 wrote to memory of 2656	2760	cmd.exe	33
PID 2760 wrote to memory of 2656	2760	cmd.exe	33
PID 2760 wrote to memory of 2656	2760	cmd.exe	33
PID 2684 wrote to memory of 1116	2684	foqyva.exe	19
PID 2684 wrote to memory of 1116	2684	foqyva.exe	19
PID 2684 wrote to memory of 1116	2684	foqyva.exe	19
PID 2684 wrote to memory of 1116	2684	foqyva.exe	19
PID 2684 wrote to memory of 1116	2684	foqyva.exe	19
PID 2684 wrote to memory of 1176	2684	foqyva.exe	20
PID 2684 wrote to memory of 1176	2684	foqyva.exe	20
PID 2684 wrote to memory of 1176	2684	foqyva.exe	20
PID 2684 wrote to memory of 1176	2684	foqyva.exe	20
PID 2684 wrote to memory of 1176	2684	foqyva.exe	20
PID 2684 wrote to memory of 1196	2684	foqyva.exe	21
PID 2684 wrote to memory of 1196	2684	foqyva.exe	21
PID 2684 wrote to memory of 1196	2684	foqyva.exe	21
PID 2684 wrote to memory of 1196	2684	foqyva.exe	21
PID 2684 wrote to memory of 1196	2684	foqyva.exe	21
PID 2684 wrote to memory of 1348	2684	foqyva.exe	23
PID 2684 wrote to memory of 1348	2684	foqyva.exe	23
PID 2684 wrote to memory of 1348	2684	foqyva.exe	23
PID 2684 wrote to memory of 1348	2684	foqyva.exe	23
PID 2684 wrote to memory of 1348	2684	foqyva.exe	23
PID 2684 wrote to memory of 2276	2684	foqyva.exe	29
PID 2684 wrote to memory of 2276	2684	foqyva.exe	29
PID 2684 wrote to memory of 2276	2684	foqyva.exe	29
PID 2684 wrote to memory of 2276	2684	foqyva.exe	29
PID 2684 wrote to memory of 2276	2684	foqyva.exe	29
PID 2684 wrote to memory of 1716	2684	foqyva.exe	34
PID 2684 wrote to memory of 1716	2684	foqyva.exe	34
PID 2684 wrote to memory of 1716	2684	foqyva.exe	34
PID 2684 wrote to memory of 1716	2684	foqyva.exe	34
PID 2684 wrote to memory of 1716	2684	foqyva.exe	34
PID 2276 wrote to memory of 1780	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe	35
PID 2276 wrote to memory of 1780	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe	35
PID 2276 wrote to memory of 1780	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe	35
PID 2276 wrote to memory of 1780	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe	35
PID 2276 wrote to memory of 1780	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe	35
PID 2276 wrote to memory of 1780	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe	35
PID 2276 wrote to memory of 1780	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe	35
PID 2276 wrote to memory of 1780	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe	35
PID 2276 wrote to memory of 1780	2276	8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe	35
PID 2684 wrote to memory of 3020	2684	foqyva.exe	37
PID 2684 wrote to memory of 3020	2684	foqyva.exe	37
PID 2684 wrote to memory of 3020	2684	foqyva.exe	37
PID 2684 wrote to memory of 3020	2684	foqyva.exe	37
PID 2684 wrote to memory of 3020	2684	foqyva.exe	37
PID 2684 wrote to memory of 1392	2684	foqyva.exe	38
PID 2684 wrote to memory of 1392	2684	foqyva.exe	38
PID 2684 wrote to memory of 1392	2684	foqyva.exe	38
PID 2684 wrote to memory of 1392	2684	foqyva.exe	38
PID 2684 wrote to memory of 1392	2684	foqyva.exe	38

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1116

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1176

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8a9d2d636c3eb83778a71d2912eaab6e_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp6211b072.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="explore" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\Ybare\foqyva.exe"
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2656
- - C:\Users\Admin\AppData\Roaming\Ybare\foqyva.exe
    "C:\Users\Admin\AppData\Roaming\Ybare\foqyva.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2684
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp83de82a6.bat"
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:1780

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1348

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail.exe" -Embedding
1⤵
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1716

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:3020

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials in Registry

T1552.002

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.log

Filesize
2.0MB

MD5
31b45715098c04c63e114b5235c8db7e

SHA1
4271f446d9f8a31897625786bee40e008b003dc2

SHA256
334b5bcf0f1dfd4bdac9c13f0d2faa8b62ca6b148adf0d21585001aa13a454cd

SHA512
a470da1652c3b5b96d84269bd6279c962220d2d5dc7855617abf4ce79cf637f91bdf92a7274400918013f088777323a04e7fd906c85ffbb523d52f67e374cab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6211b072.bat

Filesize
201B

MD5
2d86367bf62ece253d11a705316b2f3b

SHA1
ff3ca79572b3df65c75b0da3d7f5ebd38ec36813

SHA256
2c9a9e443bcc007bacc98b0c7cfaad3efe2bbc1ac5d0cb168f385aa9adfb1a62

SHA512
a9effb23baaf2b333beaf9403123b87163a402c5f928b6547ce052da0943c9438593ee31729e940c320935fe7aeeeb8a772be0d608667fc48620b4f6fb64134b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp83de82a6.bat

Filesize
271B

MD5
77b65031cddb0b59ca7d496ac44ebc46

SHA1
289e88b8e7db72f560cf12de0c52b156672d5aa8

SHA256
2ca540de23857da76e7d84cd610705a0b3ab75811d070459f060ab7f19777076

SHA512
7b991ddd1d96336016a146e1f28b6343a702fd57b08b5b57f3547f1a7c0937b81d5da8bfacce98ae37709c01eb525c1f10d143508a5a541ad25551a9f1e33143

Download Submit
C:\Users\Admin\AppData\Roaming\Urbua\qyukerg.one

Filesize
380B

MD5
a2416c1f83939e99429c7b0b2ff441e9

SHA1
76a25b4116df4cec71450d5949bea02b70bd1358

SHA256
dbb8200a57f06321f551d9ea40f9a2e0d650868d5c7c34a4341020c25fecae42

SHA512
edc005ab5e3fa84aaa4481a33a309b62018705ee477c1aa8fd221cd3e9c7d78786c71f399a9baf41b00335f277d836990e51f70d650d9dc34ddcd58918c7bdf5

Download Submit
\Users\Admin\AppData\Roaming\Ybare\foqyva.exe

Filesize
141KB

MD5
31a36b22a3f6ae8f438fe3b752efbc26

SHA1
584b7e8f5c8b811fa6f920b1ec06425a2eabd84c

SHA256
eb643c947fa51b8a4a39ce509fc4e51cd8af39b74a8451b8dd8b54a2c7316f7d

SHA512
95e66dfe1371ab29ef1d9b3c1b8f1851e256b6f9c93d17aa8534f3e4df482dc66c8d6787f5555150fca4d10a9f78bf58e7319783e9407683bc6090b403ef7a43

Download Submit
memory/1116-21-0x00000000021E0000-0x0000000002207000-memory.dmp

Filesize
156KB

Download
memory/1116-20-0x00000000021E0000-0x0000000002207000-memory.dmp

Filesize
156KB

Download
memory/1116-18-0x00000000021E0000-0x0000000002207000-memory.dmp

Filesize
156KB

Download
memory/1116-19-0x00000000021E0000-0x0000000002207000-memory.dmp

Filesize
156KB

Download
memory/1116-22-0x00000000021E0000-0x0000000002207000-memory.dmp

Filesize
156KB

Download
memory/1176-27-0x0000000002130000-0x0000000002157000-memory.dmp

Filesize
156KB

Download
memory/1176-25-0x0000000002130000-0x0000000002157000-memory.dmp

Filesize
156KB

Download
memory/1176-24-0x0000000002130000-0x0000000002157000-memory.dmp

Filesize
156KB

Download
memory/1176-26-0x0000000002130000-0x0000000002157000-memory.dmp

Filesize
156KB

Download
memory/1196-30-0x0000000002D50000-0x0000000002D77000-memory.dmp

Filesize
156KB

Download
memory/1196-29-0x0000000002D50000-0x0000000002D77000-memory.dmp

Filesize
156KB

Download
memory/1196-32-0x0000000002D50000-0x0000000002D77000-memory.dmp

Filesize
156KB

Download
memory/1196-31-0x0000000002D50000-0x0000000002D77000-memory.dmp

Filesize
156KB

Download
memory/1348-42-0x0000000001E20000-0x0000000001E47000-memory.dmp

Filesize
156KB

Download
memory/1348-40-0x0000000001E20000-0x0000000001E47000-memory.dmp

Filesize
156KB

Download
memory/1348-38-0x0000000001E20000-0x0000000001E47000-memory.dmp

Filesize
156KB

Download
memory/1348-36-0x0000000001E20000-0x0000000001E47000-memory.dmp

Filesize
156KB

Download
memory/2276-52-0x0000000000320000-0x0000000000347000-memory.dmp

Filesize
156KB

Download
memory/2276-81-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2276-50-0x0000000000320000-0x0000000000347000-memory.dmp

Filesize
156KB

Download
memory/2276-0-0x0000000000403000-0x0000000000407000-memory.dmp

Filesize
16KB

Download
memory/2276-54-0x0000000000320000-0x0000000000347000-memory.dmp

Filesize
156KB

Download
memory/2276-1-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2276-46-0x0000000000320000-0x0000000000347000-memory.dmp

Filesize
156KB

Download
memory/2276-230-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2276-2-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2276-63-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2276-61-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2276-59-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2276-69-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2276-67-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2276-71-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2276-65-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2276-75-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2276-73-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2276-57-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2276-55-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2276-83-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2276-132-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2276-48-0x0000000000320000-0x0000000000347000-memory.dmp

Filesize
156KB

Download
memory/2276-79-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2276-78-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2276-3-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2276-168-0x0000000000403000-0x0000000000407000-memory.dmp

Filesize
16KB

Download
memory/2684-14-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2684-16-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2684-33-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2684-347-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download