972314f63afae9707d99fcaa4c7347e814d6e275f13b157a0db13649e6191bd6

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-10-2024 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Size

92KB
MD5

26db6e3a6d757d0d8a4d825209e2d2fa
SHA1

9c4819859104fa285e30bce70b036db423127ccc
SHA256

972314f63afae9707d99fcaa4c7347e814d6e275f13b157a0db13649e6191bd6
SHA512

d6d38348e634a2a61dec8aa724a5151c25a0c994d8f5c83c9af37b6aca3838f0f0569f36dd4c05c487fb00a2c02212e2944f2e0fe9c9c8028210830083855e6d
SSDEEP

1536:ddrN/hSfwAh9h3YRgJd5Tmleentkwn7zmTx3FO1RSR/:LN/hcwAB3IgJd5TGeentkw7aTPOTS9

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SysWOW64\DWDSREGT.EXE	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
File opened for modification	\??\c:\windows\SysWOW64\dwdsregt.exe	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dbglogfolder\n_inst_09_10_24.log	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msnav32.ax	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
File created	\??\c:\windows\SysWOW64\dwdsregt.exe	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 23 IoCs

pid	Process
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeRestorePrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeBackupPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeRestorePrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeBackupPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeRestorePrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeBackupPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeRestorePrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeBackupPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeRestorePrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeBackupPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeRestorePrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeBackupPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeRestorePrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeBackupPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 380	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	3
PID 1820 wrote to memory of 380	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	3
PID 1820 wrote to memory of 380	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	3
PID 1820 wrote to memory of 380	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	3
PID 1820 wrote to memory of 380	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	3
PID 1820 wrote to memory of 388	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	4
PID 1820 wrote to memory of 388	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	4
PID 1820 wrote to memory of 388	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	4
PID 1820 wrote to memory of 388	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	4
PID 1820 wrote to memory of 388	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	4
PID 1820 wrote to memory of 420	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	5
PID 1820 wrote to memory of 420	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	5
PID 1820 wrote to memory of 420	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	5
PID 1820 wrote to memory of 420	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	5
PID 1820 wrote to memory of 420	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	5
PID 1820 wrote to memory of 472	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	6
PID 1820 wrote to memory of 472	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	6
PID 1820 wrote to memory of 472	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	6
PID 1820 wrote to memory of 472	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	6
PID 1820 wrote to memory of 472	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	6
PID 1820 wrote to memory of 488	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	7
PID 1820 wrote to memory of 488	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	7
PID 1820 wrote to memory of 488	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	7
PID 1820 wrote to memory of 488	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	7
PID 1820 wrote to memory of 488	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	7
PID 1820 wrote to memory of 496	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	8
PID 1820 wrote to memory of 496	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	8
PID 1820 wrote to memory of 496	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	8
PID 1820 wrote to memory of 496	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	8
PID 1820 wrote to memory of 496	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	8
PID 1820 wrote to memory of 588	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	9
PID 1820 wrote to memory of 588	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	9
PID 1820 wrote to memory of 588	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	9
PID 1820 wrote to memory of 588	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	9
PID 1820 wrote to memory of 588	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	9
PID 1820 wrote to memory of 672	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	10
PID 1820 wrote to memory of 672	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	10
PID 1820 wrote to memory of 672	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	10
PID 1820 wrote to memory of 672	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	10
PID 1820 wrote to memory of 672	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	10
PID 1820 wrote to memory of 740	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	11
PID 1820 wrote to memory of 740	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	11
PID 1820 wrote to memory of 740	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	11
PID 1820 wrote to memory of 740	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	11
PID 1820 wrote to memory of 740	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	11
PID 1820 wrote to memory of 804	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	12
PID 1820 wrote to memory of 804	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	12
PID 1820 wrote to memory of 804	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	12
PID 1820 wrote to memory of 804	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	12
PID 1820 wrote to memory of 804	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	12
PID 1820 wrote to memory of 852	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	13
PID 1820 wrote to memory of 852	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	13
PID 1820 wrote to memory of 852	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	13
PID 1820 wrote to memory of 852	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	13
PID 1820 wrote to memory of 852	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	13
PID 1820 wrote to memory of 960	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	15
PID 1820 wrote to memory of 960	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	15
PID 1820 wrote to memory of 960	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	15
PID 1820 wrote to memory of 960	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	15
PID 1820 wrote to memory of 960	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	15
PID 1820 wrote to memory of 108	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	16
PID 1820 wrote to memory of 108	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	16
PID 1820 wrote to memory of 108	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	16
PID 1820 wrote to memory of 108	1820	26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe	16

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:388
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:472
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:588
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1352
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1528
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:672
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:740
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:804
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1168
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:852
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:960
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:108
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1008
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1036
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1116
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:836
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2288
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2440
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:488
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:496

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe"
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\dwdsregt.exe

Filesize
124KB

MD5
6edecca93cfb0187f42de469cbfc3608

SHA1
6ab38d2c5eed3ab542bddaa7a9c498d8a6ff7180

SHA256
883c4c5a5a05c0a4c0b3ceeb78f0c806aa94be84a88ead02b946378cea18d4de

SHA512
4b9b0cfa99d1f691fb1e8388bca28280f9aa94bf45da9a9cead298563aa1daaeedeb440710beae8c14bd831f19921c000e50d52d83cf41984ce40b44dac8d327

Download Submit
\Users\Admin\AppData\Local\Temp\26db6e3a6d757d0d8a4d825209e2d2fa_JaffaCakes118.exe

Filesize
92KB

MD5
26db6e3a6d757d0d8a4d825209e2d2fa

SHA1
9c4819859104fa285e30bce70b036db423127ccc

SHA256
972314f63afae9707d99fcaa4c7347e814d6e275f13b157a0db13649e6191bd6

SHA512
d6d38348e634a2a61dec8aa724a5151c25a0c994d8f5c83c9af37b6aca3838f0f0569f36dd4c05c487fb00a2c02212e2944f2e0fe9c9c8028210830083855e6d

Download Submit
memory/1820-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1820-2-0x00000000772DF000-0x00000000772E0000-memory.dmp

Filesize
4KB

Download
memory/1820-1-0x00000000772E0000-0x00000000772E1000-memory.dmp

Filesize
4KB

Download
memory/1820-15-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1820-14-0x00000000026A0000-0x00000000026B0000-memory.dmp

Filesize
64KB

Download