modiloader | 9de9bae2e8dbf3216d8c1d2332a14af25c5e3a1d8a788f0e393ca0e97b4d4d22

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdfae3fcb0d03636c2972373748e2c96_JaffaCakes118.exe
Size

492KB
MD5

bdfae3fcb0d03636c2972373748e2c96
SHA1

ae64cde9c5a1f2d3d6890370b44175d28fe1df94
SHA256

9de9bae2e8dbf3216d8c1d2332a14af25c5e3a1d8a788f0e393ca0e97b4d4d22
SHA512

c535ea9d07504911f0b188568e14b33e73c558d4aefbc501716567cfd1ec5c4521c409d0797088421ac2f54887496ff220ce125fea7d8e03455d069fb22f4d55
SSDEEP

6144:ETJoIOhOhVmbWctVvju2UgserqTzw3t6Z8Oj1GvFt4C5g/93vnT1fy94mP6Ep+Nw:tIFhGLLQ90vFtklxa9445EUexwt87jqb

Score

10^/10

modiloader discovery trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 1 IoCs

resource	yara_rule
behavioral1/memory/2052-5-0x0000000000400000-0x0000000000543024-memory.dmp	modiloader_stage2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2052 set thread context of 2364	2052	bdfae3fcb0d03636c2972373748e2c96_JaffaCakes118.exe	29

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSINFO\SetupWay.txt	bdfae3fcb0d03636c2972373748e2c96_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bdfae3fcb0d03636c2972373748e2c96_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430639413"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3EB634E1-61DA-11EF-B066-DEBA79BDEBEA} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2364	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2364	2052	bdfae3fcb0d03636c2972373748e2c96_JaffaCakes118.exe	29
PID 2052 wrote to memory of 2364	2052	bdfae3fcb0d03636c2972373748e2c96_JaffaCakes118.exe	29
PID 2052 wrote to memory of 2364	2052	bdfae3fcb0d03636c2972373748e2c96_JaffaCakes118.exe	29
PID 2052 wrote to memory of 2364	2052	bdfae3fcb0d03636c2972373748e2c96_JaffaCakes118.exe	29
PID 2052 wrote to memory of 2364	2052	bdfae3fcb0d03636c2972373748e2c96_JaffaCakes118.exe	29
PID 2364 wrote to memory of 2300	2364	IEXPLORE.EXE	30
PID 2364 wrote to memory of 2300	2364	IEXPLORE.EXE	30
PID 2364 wrote to memory of 2300	2364	IEXPLORE.EXE	30
PID 2364 wrote to memory of 2300	2364	IEXPLORE.EXE	30

C:\Users\Admin\AppData\Local\Temp\bdfae3fcb0d03636c2972373748e2c96_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bdfae3fcb0d03636c2972373748e2c96_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2052
- C:\program files\internet explorer\IEXPLORE.EXE
  "C:\program files\internet explorer\IEXPLORE.EXE"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db2af93088db0d0dcbc4f608d388b63d

SHA1
d9c90f55ae85260250af3159dc0ba9f44bcf58a8

SHA256
b516999799f41e61f963c7da9eca2564e7da3408b8c3e2c2cadcfff61868c06f

SHA512
fea8fd3fe6c8b6cf9a8544384b50537066e1f95923321c590f50a12094c3e61fd17bdff7111e3165c58a80656f628a3bf5956d2e3d62ec3839f816f98fcd7660

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6332d37db8b55d14e32ce8430a3fe031

SHA1
7b16e3a5deb1db23ab2363741a89cbc63c3e8031

SHA256
132d682f3a134b657fe34ce45d11c8a5b7732686879fb1803d949a9ad92d3380

SHA512
b0e8d47cbc0c9b95f0f939354a5ae8f241f1768530201d08275d0ebc9d7c0ae6a7566b30f6aa9b37a53f35cf6c83d3509dfb18cbde4cc0d2eec962cb43d8271d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7bce53dfeb977c494e303f6c17ac6b2

SHA1
0df941d560efbb7eba5d8e45e641ca972246a478

SHA256
111a41a332c0919bd188ad98c9621634e09c76ad65efad39be255d993730641f

SHA512
176214a3c34565c667611e26270ffc1891ee420a280fad08d6ca69ca16bc657d4e13169406a2ea6d2ad14cf72765950e40db6c7b1267ee7ae9d526fb1f03698a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b28be6f15c65835c1c43baf641fe565

SHA1
2a995dc9ccea3f540d8c661f1d86bfbb0577951d

SHA256
a8d0aa6faf3fedc90eb6a76c2efb0c8c0a7ea1fcac4af41c348b01526e108397

SHA512
8fa4344e3598f7fc9768e36bb99aa6e614a5abc4ef14addf19ec36a12fc06776b2445fc0728ca115ce9d4b9ac83258c4a3450aede80e30bb1393a114b5ca8c43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1412218d8357068adaf13115b67b2fc0

SHA1
2087a532f50a80ab8f2586c73c92d0b6ab4e4586

SHA256
03d8288bb1f224e397608f9c58bb8e6a5b956f6a94c337da43de535ab81a1ddb

SHA512
db9f6d3106690da88a12f90b81f085c4d78498dd1c13e67e54527d861089bce425a6fc83d8225dd555798362c6fd0f2fff30d1301339cc0ca1b172bb7f7824ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fec8a03df3a784bd81401d7f4ea18859

SHA1
89169bd7fcfd13a3809db6a1720b8c5b2a18f57b

SHA256
8a858c5c386c1a97973bc50e21f8a65d8a69c41023b04d02c1f1e5e3a6327ae4

SHA512
3599dbe468a06cf92e0f8bde926d83140c2cc02a0e90de1df9a73bd1341d0b5f2113c24cf74bc0f3139277afd978e31f537bd4526c0c727a30a8c5e7a6e3dd91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d4cf26fb49ae630ae97516f4f8d7c62

SHA1
df28e91cac6d5b19d20b22189ac9aec964bd3f01

SHA256
d437a90ffb497055d3807813ff79ee65dd4bc77cc6d4d3cc21da82d7728fd7fa

SHA512
9dcaaa776409c750106e48d4f9a503d5954a76e305e785010fc733ff84fb6ce400f0459dd4c3dd170a08ae80a6a097a1e89700c6b4d934a528fae4db40fa29fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0a32613ef279c5b65ebb5b05c3cdc81

SHA1
64b5b2adee6cc8b9b7c17ae3d98b47c1b01a9be4

SHA256
fbf8e57ce0a106c5109e66ee9636a2a83e24171740dc79ac548761daee76cfda

SHA512
baf0076a73fe54ed00c53741d0de18654a750e6d5276f7d2573f76ff41e1c975050810aafe09f17011099dda92cafcec994b426686108cbdbae58d3075ffbf7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbd3351050728b808bada21d013635c5

SHA1
3435d998ff670f6694c5f6cd4498a8f4ed9298a1

SHA256
8a945872180fbe5102db0cd1ad601cedfac5e92cf9319ca0a49c8af2c4e95bd0

SHA512
ddad45baa9ef042ef2937d8bac0a70f68552df3f49297821c763073e8c4169c9d24495db27f6a5898e1910843ec42a9fcc647792e80052494c088f931675b8e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e794f3707be03c6c9a4abe973402ca1c

SHA1
8f8207bebaf2ca21274e97332610dca2647f9b99

SHA256
6a12f7f8b8e94af59e18f8e57268532b30174f7dbd026dfb35e88f5e350f532d

SHA512
54496894543a37701cfb1f42c9fe1a2961edb8e9847be7b37deff9dbec55712e3ad5617f05019ebb259b2617a714682b36afb9af61cfa4a21c53ca3652bf2386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d9f1a48d2e257770536eea39180c6ff

SHA1
5249528b5e8a160e026fbdccbd79f1a1158343bc

SHA256
dbb8171f940e57e2f0aad05d5105e193a5f302c7414295bddb6571feb39b4bad

SHA512
d81ebc6d0cb04034acf7e3a7f7baa5b00edab09aa719d605d93f898c8eec4b9f9fb966bc58df563f7ecb93fe29935ccd10953aea4af31461e2f5a1e2d27b384e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26fa629352a4b50a98565ce3a22b7797

SHA1
2f96c14202d8a36abdc223b087c2c480e18c6621

SHA256
17cb66112ad213df1881ccd3536fc3edacb6c3ed013425039f58300712c427b1

SHA512
f90c6c04cff3e5c120cff0d8f8b2d04402dbd8e231f8f81cde462d9a7623f2a88532d742b7e0293ed3c83d489ea8fd82e7c1c239150994c3006ba47c89e92017

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b14a20bdbb1fe60983c5b41d72638953

SHA1
1dc927cc10617e9746c1b5e0c9436866b3faa3e2

SHA256
bae845c4afde1b3f9facae38d9b32344e6b903eaf51361bbf93215f6be6682fd

SHA512
76d44797e7dfb7657ba6f14eb42bbff8fc7baa450dda2110671d90434e189dcee2cf80dff4c24aa73cf2c91f8fe7d9500039abcb60869866561013d72723791d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e608fe2d05bb2779a4bffe7e9a99d3b

SHA1
cafcf2d4f930aa03df877c767a0d3593357fe62c

SHA256
f7f5ab4be7fe3eb3f7da247c75b302458dd28afbfd4671c607c4b33a9722d7b2

SHA512
c1facd22f1a9a69e1776af27ef7cf180c41e911595b8ce03979f8a977ebf770856918a173758e6116f802539726a5726d9a0d08ac7277fbd5c486184feb720be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d0e35e7a9e1965fba52d660ca9fd7d5

SHA1
ce029f7a2776750151215f940d0321bf755ebac2

SHA256
252bfaf9625ad9a4f7e5c70c6376ef08aecba3fd1b7aa2d38ab1ff39e46b38c1

SHA512
079e149c4f6e0d92e2245e9e6daedfa48e7157a49e848f40f39515ec2d40c2cd3d1985a8a24301ed93e82f8e40c860fe946a527cb8fb92a08719e436f25df4e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ee7c9b91f8de731026f21d965d4dc82

SHA1
c6cbeab0955bf5b78f9dddce7cb3e723bb954e7d

SHA256
0f2d23165cc2c7fcbbc420714f188072f274fd9d2039a451b0f67d3dec91e4fb

SHA512
89f43f3b39059cd5578f0a42a19dd826ae5766ec0f95b92c459718948882a08151a6dc418f2e21f111bd0d52142286199bd4aa0276930b7e698b29656a03453d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d16690df2da085215a492777a8ac34d

SHA1
f80eabbab1be7be2a28ad4b20c105dd5b35e74c2

SHA256
a779b1e4d9120530e5718fdb51c41d8cd4bb9a4e0edebbcc0db9de0e94856e22

SHA512
a5ad1b18d5e34a4dc38884af531d4cdee3d28d116b17bc6a2d5db2f4db3326adbc79b7f4e3b336d513b55a02144f5a99dd262a7d409a128558f99eb03e59cc3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2477c401ab8e1f0c39e4060def24e77

SHA1
d44cdbcd571db2e56e103c4c27a2d1ac9c0c51b5

SHA256
24f9f865104be98bef4038915c0211571e63604972e29d96ca8ec52fc5c399e9

SHA512
b30c1405c5af238abda92b994d9d28c6aa507f8cbcd502dbaae367b7bac92b111c11ee5144f8af60f3826a6860ffe65ca90b5c21fe4cdbc5defe0e8582fcd81e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab570.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5E0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2052-5-0x0000000000400000-0x0000000000543024-memory.dmp

Filesize
1.3MB

Download
memory/2052-0-0x0000000000400000-0x0000000000543024-memory.dmp

Filesize
1.3MB

Download
memory/2052-1-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2052-4-0x0000000000415000-0x0000000000416000-memory.dmp

Filesize
4KB

Download
memory/2364-3-0x00000000001B0000-0x00000000002F4000-memory.dmp

Filesize
1.3MB

Download