d0a4fdfe2b8c1b73c2b91ab34be69589aba44d9f4c76f98ddc269776fabcf1af

Analysis

max time kernel
150s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 02:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Size

2.0MB
MD5

a92803c0b24d5d737e3f9ba283eba870
SHA1

22febe87f747717f7cb9acc138611603e4d31293
SHA256

d0a4fdfe2b8c1b73c2b91ab34be69589aba44d9f4c76f98ddc269776fabcf1af
SHA512

3126a1acd1e2b4817139d90a7cb62dc5f5a8cbdb4f95ad6bddb0c5bb7ce82688bb36d6f11c14fa37ad825b55e889eb9351da92fd724d7873d3c380e2e0a56f23
SSDEEP

24576:/059Its8fzBuRNfLC+wf0Zl+s3UiR/DvGnvUGfyOHgbp/5t6yhJXtK8:/Qe0RZEf0Zks3UipDvGnvRboH6L8

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4464	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
4464	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\hlz.dll	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
File opened for modification	C:\Windows\hlz.dll	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\Programmable	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\CurVer\ = "QMDispatch.QMVBSRoutine.1"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\ProxyStubClsid32	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\TypeLib	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\ProgID\ = "QMDispatch.QMFunction"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\0\win32\ = "C:\\Windows\\hlz.dll"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\TypeLib\ = "{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InprocServer32\ = "C:\\Windows\\hlz.dll"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\TypeLib\ = "{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\HELPDIR\ = "C:\\Windows\\"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\TypeLib	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\FLAGS\ = "0"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\TypeLib\ = "{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\InprocHandler32	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\ = "QMRoutine Class"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\ProxyStubClsid32	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\TypeLib\Version = "1.0"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\TypeLib	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\VersionIndependentProgID\ = "QMDispatch.QMVBSRoutine"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\ = "IQMVBSRoutine"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\ProgID	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ProgID\ = "QMDispatch.QMRoutine.1"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ = "QMRoutine Class"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ProgID\ = "QMDispatch.QMVBSRoutine.1"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\TypeLib\ = "{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\TypeLib\Version = "1.0"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\TypeLib	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine.1\CLSID\ = "{241D7F03-9232-4024-8373-149860BE27C0}"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\Programmable	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine.1\CLSID\ = "{C07DB6A3-34FC-4084-BE2E-76BB9203B049}"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine.1\ = "QMVBSRoutine Class"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\ = "IQMRoutine"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\CurVer	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\TypeLib\Version = "1.0"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\VersionIndependentProgID\ = "QMDispatch.QMRoutine"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\ = "IQMVBSRoutine"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\CurVer\ = "QMDispatch.QMRoutine.1"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\InprocHandler32\ = "ole32.dll"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\TypeLib\ = "{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ = "QMVBSRoutine Class"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\TypeLib\ = "{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\InprocHandler32	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\LocalServer32	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine.1	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\VersionIndependentProgID	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine.1\CLSID	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ProgID	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine.1	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\TypeLib\Version = "1.0"	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine.1\CLSID	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\CurVer	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4464	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4464	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4464	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
4464	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
4464	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
4464	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
4464	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
4464	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
4464	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
4464	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
4464	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
4464	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
4464	a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a92803c0b24d5d737e3f9ba283eba870_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\C6EA.tmp

Filesize
415B

MD5
633591008d34d213ae23ac67a4b2eb6b

SHA1
ea61c94a88113b81242c863810c34d4ed2530f93

SHA256
5425e289758dbe0bac10fc42c1bd848246b158137f2069a78a6197ceb1296142

SHA512
941dadcce713cf3b542d733ecfe7b9c63851b05dd717b3bb5e2944f0b1daa189c9bd7c245e4706c5ad28befa177fab376c6a60ae45fa925e4a25e400965ce6c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp01.dll

Filesize
44KB

MD5
142b83e39f48b2af064dacab3ecce059

SHA1
760488b306ba573d8b19791b45fa470534b2e02d

SHA256
65c3fe96c3f6d297f7b4a3b82afd072b32096cd218c02c8d2f40293be15e45bb

SHA512
992c399d9f45b3d05cdb0dffdae24721763b18abe0b0ae2ffd130b40ff3dc7b6d19a22a3a09380d84fe5d406d6164562c9051148bf3d2e790a3a4fde897d765d

Download Submit
C:\Users\Admin\AppData\Local\Temp\twbjkg.dll

Filesize
60KB

MD5
b46a277054a58d119d72af954bafe427

SHA1
521212f5e3b5de55d9faa68a407b3711dc2c6de2

SHA256
f0cdb5444f2a984d847600a6f622611ad468a7a344d31b57770e18ba0c817c47

SHA512
1ebcbeb82150f447202433571443c01389e3e85e6f733fe66be3ad76abdb984b8222b6f94e3feb8d322b4b481c89400edd534cf07bf4919eeff5696f0e1fb514

Download Submit
memory/4464-71-0x0000000000400000-0x00000000005DF000-memory.dmp

Filesize
1.9MB

Download
memory/4464-72-0x0000000000400000-0x00000000005DF000-memory.dmp

Filesize
1.9MB

Download
memory/4464-73-0x0000000000400000-0x00000000005DF000-memory.dmp

Filesize
1.9MB

Download
memory/4464-74-0x0000000000400000-0x00000000005DF000-memory.dmp

Filesize
1.9MB

Download
memory/4464-75-0x0000000000400000-0x00000000005DF000-memory.dmp

Filesize
1.9MB

Download
memory/4464-76-0x0000000000400000-0x00000000005DF000-memory.dmp

Filesize
1.9MB

Download
memory/4464-77-0x0000000000400000-0x00000000005DF000-memory.dmp

Filesize
1.9MB

Download
memory/4464-78-0x0000000000400000-0x00000000005DF000-memory.dmp

Filesize
1.9MB

Download
memory/4464-90-0x0000000000400000-0x00000000005DF000-memory.dmp

Filesize
1.9MB

Download