Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

c1d60bd69f...18.exe

windows7-x64

8

c1d60bd69f...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    25/08/2024, 23:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c1d60bd69f7401a7b89e68477568890b_JaffaCakes118.exe

  • Size

    27KB

  • MD5

    c1d60bd69f7401a7b89e68477568890b

  • SHA1

    69bb44e4deee308720df5d7875ada0713a77500b

  • SHA256

    8acc540558b6b27cb3cb317f518be14c8fa14357c95f9121645b6f05b77ae934

  • SHA512

    03497a5c2283442eb8861ba1354d43652f4088793ee56e2113098e6566f65781829a9afb6cf7db9ade3cc7dfee0960d306da14e7e365617534f6636b11b4c636

  • SSDEEP

    768:vGt/RmafR6e2pjX9rNxpyxc7JbTi3ckCI:vYRVke2p79RxWc7n8

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
    adwarespyware
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c1d60bd69f7401a7b89e68477568890b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c1d60bd69f7401a7b89e68477568890b_JaffaCakes118.exe"
    1⤵
    • Event Triggered Execution: Image File Execution Options Injection
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop McShield
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1084
      • C:\Windows\SysWOW64\net.exe
        net stop McShield
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1744
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop McShield
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2368
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop KWhatchsvc
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2596
      • C:\Windows\SysWOW64\net.exe
        net stop KWhatchsvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2672
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop KWhatchsvc
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2676
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop KPfwSvc
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Windows\SysWOW64\net.exe
        net stop KPfwSvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2600
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop KPfwSvc
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2744
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop "Symantec AntiVirus"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Windows\SysWOW64\net.exe
        net stop "Symantec AntiVirus"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2336
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Symantec AntiVirus"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2896
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop "Symantec AntiVirus Drivers Services"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2688
      • C:\Windows\SysWOW64\net.exe
        net stop "Symantec AntiVirus Drivers Services"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2460
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Symantec AntiVirus Drivers Services"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2456
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop "Symantec AntiVirus Definition Watcher"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2476
      • C:\Windows\SysWOW64\net.exe
        net stop "Symantec AntiVirus Definition Watcher"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2536
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Symantec AntiVirus Definition Watcher"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1708
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop "McAfee Framework ·þÎñ"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2984
      • C:\Windows\SysWOW64\net.exe
        net stop "McAfee Framework ·þÎñ"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1956
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "McAfee Framework ·þÎñ"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2988
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop "McAfee Framework Service"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1684
      • C:\Windows\SysWOW64\net.exe
        net stop "McAfee Framework Service"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1384
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "McAfee Framework Service"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1576
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop "Network Associates McShield"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2144
      • C:\Windows\SysWOW64\net.exe
        net stop "Network Associates McShield"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1216
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Network Associates McShield"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2432
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop "Network Associates Task Manager"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2808
      • C:\Windows\SysWOW64\net.exe
        net stop "Network Associates Task Manager"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:536
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Network Associates Task Manager"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2924
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop "Norton AntiVirus Server"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1964
      • C:\Windows\SysWOW64\net.exe
        net stop "Norton AntiVirus Server"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2716
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Norton AntiVirus Server"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2792
    • C:\Users\Admin\AppData\Local\Temp\c1d60bd69f7401a7b89e68477568890b_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\c1d60bd69f7401a7b89e68477568890b_JaffaCakes118.exe
      2⤵
      • Executes dropped EXE
      PID:2860
    • C:\Windows\SysWOW64\cacls.exe
      "C:\Windows\System32\cacls.exe" C:\Windows\system32\packet.dll /e /p everyone:f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2916
    • C:\Windows\SysWOW64\cacls.exe
      "C:\Windows\System32\cacls.exe" C:\Windows\system32\pthreadVC.dll /e /p everyone:f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1972
    • C:\Windows\SysWOW64\cacls.exe
      "C:\Windows\System32\cacls.exe" C:\Windows\system32\wpcap.dll /e /p everyone:f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2400
    • C:\Windows\SysWOW64\cacls.exe
      "C:\Windows\System32\cacls.exe" C:\Windows\system32\drivers\npf.sys /e /p everyone:f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1676
    • C:\Windows\SysWOW64\cacls.exe
      "C:\Windows\System32\cacls.exe" C:\Windows\system32\npptools.dll /e /p everyone:f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1900
    • C:\Windows\SysWOW64\cacls.exe
      "C:\Windows\System32\cacls.exe" C:\Windows\system32\drivers\acpidisk.sys /e /p everyone:f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1932
    • C:\Windows\SysWOW64\cacls.exe
      "C:\Windows\System32\cacls.exe" C:\Windows\system32\wanpacket.dll /e /p everyone:f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:892
    • C:\Windows\SysWOW64\cacls.exe
      "C:\Windows\System32\cacls.exe" C:\Documents and Settings\All Users\¡¸¿ªÊ¼¡¹²Ëµ¥\³ÌÐò\Æô¶¯ /e /p everyone:f
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2168
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:3068
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\AUTORUN.INF
    Filesize

    143B

    MD5

    77959cc588db738d0b8fe7e0e71551e2

    SHA1

    6c87e5994a72ebc9e0a012eecb9572e05820d2f4

    SHA256

    d1b07ae3ba2f9a1b5522cee988c0c67b3451bec2a61f7ad19bc1c9831c447a9b

    SHA512

    407931710444de7b0335d30833bae567c06bdb6ce8b77f2140de67902ef12c7ce850bf01cdc16d37fdeb791258a1c7226b440d682e64db9b783b5a1e227a1fdd

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    ca01cd0d1a08d8298fff4213359d95a9

    SHA1

    80a0eb4d8255431f44f5fc3c3e7f820772deee48

    SHA256

    ce3641ba75233ca7fc5580d449dd072ac701e9cba69a5b13fd44ad594e7ce79d

    SHA512

    14ac638db4dda04fe854a24c32ed3bf10ee70c99786be72fbb173be1bbaa72677c42f918d175bcda293adac81ba97c7bbf504a31281f57855b587af8c6408a40

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    b9a384bdd53b6aaf1ce60c2773f1b74b

    SHA1

    1b7ea63394d1173b6b547eb800dcf5abb3d2bf55

    SHA256

    6f74c89468c50b558fd25c1456df8736a677f7211b9be50617e9264f35c68884

    SHA512

    26170dc3c14d54133587e3ec450b421b9df2f16334f1815332d88792ee2d82e175c9d5709de03d37e5ff7a23777dbe89049ff49537fb364137f5c0d2b1195ef7

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    6c5667c342122ee561908adb3332180c

    SHA1

    b05d796bd50cf1fa6baefc5e6d224f2bdb16d820

    SHA256

    d07f3adfc2a833462f7d1e7a8b19ed74282bca5b96c40f1b11dd9303336c8e60

    SHA512

    70d32a4aa276024ae8234f3ac3cdac785fa3fa72ddb4876fadcfd7b3ab595c9cf75876ae2b69ee849887fceb96c5866840d1044a1e6907430e04a8c17d3e268e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    fcfd19f398b0fff14358a4b79f9b9b53

    SHA1

    ca2529abb2081311e45479030b72ca35a830c983

    SHA256

    10a0206c0a1b982e0972311fb72ec1071fd34016581c38ee060be87ec50d2a43

    SHA512

    d6e0b14635ec8fc65f7ffd2555c06fa56dc63a2e80b86dc605d24554b52a21e00713164586ef6402951860cab888af4848eb3bc2abfb60135ad43c2d0af4fa75

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    c3c25e0b7464cf39c92c5c1f16c9c09e

    SHA1

    0e88e3324d86e5fc24215e5803ffd80815084346

    SHA256

    5123006d419f1ad11aad1ae4ae918c24a00f0f6cf4cb5ceb2a394272fa778b1f

    SHA512

    6d4fd77b21d87e7e65d65e3569ec6fd2367d471d3968f3351a360f91830388b30f202ea65a9dd1842f1c0aec3353695b8a31f7ef8720f10688cf659e5e4668e2

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    1130b3274a59850d6d3b782affc18e68

    SHA1

    4a9c73a3b6cb417332f49b0c892ab7089f4a6822

    SHA256

    d441de78c1c76e46153639b974bd4a54c396828681d9966e408a121ded3fe5ba

    SHA512

    92f33b562366f94bd079888b814dcd7ba03e4aa00d68c3152914ed74208e318ce1893f5c0bac18fa258fe2dc34fa2f7f174368b64050ba0aa275bd605d9b088d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    e0cb57e7b42ad0dcfb40178082ecad8f

    SHA1

    b6c9abba3e5957c5f819175b8c1163a8f23925bb

    SHA256

    240ac51610d4c41fbcb55c14c3be3b38163b56ef3db31c04bc85bd9e003ea1a4

    SHA512

    0ac2503a3e8ef24d4d65884b711fd537db62db4f6778c8d22feb529611ec7c0bba8fa2d6882564a722439d542ef0562ccc5eba2bb0a2c6a815fdea3c561bb1f3

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    e93b416f12e94d0f1cf0e0abdc7624fd

    SHA1

    4c6811868d54024fb2720644bd7217ee5f3e92a8

    SHA256

    f8f1809e7bc13c2ed1a750cd4ec494a0855a89b75888841b479af9cfe4cfc7ff

    SHA512

    ead449014f8e1950e60a5343bb9997601304b644a81ec1e850f61ed94428870b717f99015eef2c319550d4524fc585a58bbe2ced403fbb245200de5a87dc71d0

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    0eebf60a1c71d17d62b240c1688c4828

    SHA1

    5dcb98351c3c3b0c1aac2cc28c96d3079596e741

    SHA256

    9f85cb8d83230e688573f95a5cc5bef213f7d886e78a02e7b33ffdbf47cfff9b

    SHA512

    d273edf9458b145d8b1ecce924198d5aea6107b26f246e8672bd49996af501209d921318dc61f5515b7d223bf8fbd0f061f841f9bb5d2cf74f73af96578b4abb

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    360440eb325ee03c069f336d1b1a824d

    SHA1

    36224cfe2e92511f47c88f09138fbe96f7d2163e

    SHA256

    6f31455c7a19def5ee9b7acb9a31083a327b2fb60cb1dcab4f28f889b03d9c27

    SHA512

    1f98c548139ab786d4de6b364121908882380e08354c2534ce2918ffc6fbebb894fc6c58fff6257c5960b7bd4bc77bb4941601bc4c19cee0e14b58d2751abf75

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    4d61d6b94d6a5160fb082ed1a816bd07

    SHA1

    a092564259ea88a207a75b603d81eba35ef8a70f

    SHA256

    9b040a56611a0ed3a1f5c9ab9e1d30e9face6bcddff8d1f9f67fed0dad39239d

    SHA512

    e8f6013f03f941534b56903b90946b6f90be656e5f5e2dc52501aa76aba39a136946a7a6793c275753406b101595673dfdb8d836cd7cbb8426a0aca644e906dc

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    944a9c90b8494a16bb224a8ba09daa87

    SHA1

    6b729fa939e6ba400216f946b6136190793d30c4

    SHA256

    a3cc27f982ea5895fe61076aa6979e4d9a4ec009ccbab721db37d37d1109b8eb

    SHA512

    09c9b903e6c433becf0d7408b58017b49a85c2175ff370a28798ae3c2636249411706966330c5990b3ac95021dea7d52b02f940be68f54d3d280f4b8cbf4c217

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    28c6270948e257e69183e206267b2122

    SHA1

    d8750d231a1e443f51c2ba71f56a4bbdf99bef74

    SHA256

    466510d7a4f4e4023a836a0f58d29c623fb51ed46a0ebda42b233db840d719b7

    SHA512

    bc3d980c2cf0afb3cfa8168a6fae17d4936d44e6a738594773068aa1012306c8d4821e47fd4a968d6bd5e2a3ae2984d930ee273ad5cf59db32056693f3ebc5eb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab72E1.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar7391.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • \Users\Admin\AppData\Local\Temp\c1d60bd69f7401a7b89e68477568890b_JaffaCakes118.exe
    Filesize

    27KB

    MD5

    c1d60bd69f7401a7b89e68477568890b

    SHA1

    69bb44e4deee308720df5d7875ada0713a77500b

    SHA256

    8acc540558b6b27cb3cb317f518be14c8fa14357c95f9121645b6f05b77ae934

    SHA512

    03497a5c2283442eb8861ba1354d43652f4088793ee56e2113098e6566f65781829a9afb6cf7db9ade3cc7dfee0960d306da14e7e365617534f6636b11b4c636

    Download Submit

  • memory/2860-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2860-6-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2860-4-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3008-1-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3008-8-0x0000000013140000-0x000000001315C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/3008-0-0x0000000013140000-0x000000001315C000-memory.dmp

    Filesize

    112KB

    Download