9b8b350e2b9e591281d97181b8112250cbae41502215dd686b34977e73d2b554

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Size

2.4MB
MD5

3b64a15e5b6b46c5b8f67a7d94e9e253
SHA1

ded313b81188dc3ef09679aae4c5500ebef2659a
SHA256

9b8b350e2b9e591281d97181b8112250cbae41502215dd686b34977e73d2b554
SHA512

4be6173c8f5c1ca6b9b21b644da9094eea8062869b4799a64171704451801c33d540e17c68b01ea2902373f48f5b49d01b05acbac22ad3f36640a8266bc0b5b1
SSDEEP

24576:caJaJF5+7m7hf0ZwvSmMFvHNC1EtoGUJAMz0jBTDGWOv/Hgbpi:cDJ8mlf0ZwUHg1EtoGUJAMz0jBTD3O9

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1260	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
1260	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
1260	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe

Modifies registry class 62 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\qmacro\\qdisp.dll"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\ProgID\ = "QMDispatch.QMFunction"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\LocalServer32	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary.Inner\CLSID	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\CLSID\ = "{241D7F03-9232-4024-8373-149860BE27C0}"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\qmacro\\qdisp.dll"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\ProgID	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction\CLSID	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction\ = "QMDispatch.QMFunction"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\ = "QMDispatch.QMRoutine"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ProgID	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InProcServer32	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ProgID\ = "QMDispatch.QMRoutine"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\qmacro\\qdisp.dll"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary\CLSID\ = "{EBEB87A6-E151-4054-AB45-A6E094C5334B}"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ = "QMDispatch.QMVBSRoutine"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}\LocalServer32	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\ = "QMDispatch.QMLibrary"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}\ProgID	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}\InprocHandler32\ = "ole32.dll"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ProgID	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\CLSID\ = "{C07DB6A3-34FC-4084-BE2E-76BB9203B049}"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction\CLSID\ = "{EBEB87A4-E151-4054-AB45-A6E094C5334B}"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary.Inner\CLSID\ = "{EBEB87A5-E151-4054-AB45-A6E094C5334B}"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\ = "QMDispatch.QMVBSRoutine"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InProcServer32	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InprocServer32	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InProcServer32\ThreadingModel = "Apartment"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\InprocHandler32	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary.Inner\ = "QMDispatch.QMLibrary.Inner"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary\CLSID	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\ProgID\ = "QMDispatch.QMLibrary"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InProcServer32\ThreadingModel = "Apartment"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}\ProgID\ = "QMDispatch.QMLibrary.Inner"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InprocServer32	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3B64A1~1.EXE"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}\InprocHandler32	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ProgID\ = "QMDispatch.QMVBSRoutine"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary\ = "QMDispatch.QMLibrary"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A5-E151-4054-AB45-A6E094C5334B}\ = "QMDispatch.QMLibrary.Inner"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3B64A1~1.EXE"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMLibrary.Inner	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ = "QMDispatch.QMRoutine"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\InProcServer32	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\InprocHandler32\ = "ole32.dll"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\CLSID	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\ = "QMDispatch.QMFunction"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\ProgID	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\CLSID	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\InprocServer32	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EBEB87A6-E151-4054-AB45-A6E094C5334B}\InProcServer32\ThreadingModel = "Apartment"	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1260	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1260	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1260	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
1260	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
1260	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
1260	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
1260	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
1260	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
1260	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
1260	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
1260	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
1260	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
1260	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
1260	3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3b64a15e5b6b46c5b8f67a7d94e9e253_JaffaCakes118.ini

Filesize
50B

MD5
52f125f8639e4bf2d46825376bd70a5d

SHA1
8cf26ac080b698b11926c707ed44f03bedb9ecc9

SHA256
fa918a5a58be6eceb0763003444bda2a824f7ce6a13934a2cd6e08458493bac0

SHA512
43897ed016cc5972c36a0addb14a29c1b0175fea79b76683586f3c3f547636b577a88262641c6bc24917d15cd98e6e9aab868e6e1b7ec25107cb6aea8980b6fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\9FB9.tmp

Filesize
1KB

MD5
b22e34ca7adce4d8276065f74e458dab

SHA1
9daf9e3cfe1d1f704a20c274dccfc23520a4fc40

SHA256
a8e7c77056a0324fed28dee2195643dc20f0f5df2648c3ac5b439db8c75505e7

SHA512
20668e7f98ccfdf79bd3bccdbd0f47df3ff94366f6e271e33f964c68512f470c9a996344c0da788f517798ca60311283845084d302609ccc8272fbfac4a4ca6a

Download Submit
\Users\Admin\AppData\Local\Temp\cfgdll.dll

Filesize
45KB

MD5
1479c26076bb69ef920b567bbe166fb5

SHA1
725b96c0aa4d3ed117ab4f9ddedc5243b1b5b489

SHA256
ec4f7a4bce0407f7d04492e036b149b5db0224231b8ecbb77eb88cf94507be3a

SHA512
afad589f9c512ba40149a25055ec9beba761933a64aed3b10aa4263150adcfad7b0c93e94c173a97e446117f2b4006861914944856be1bf227b04ce6704068b3

Download Submit
\Users\Admin\AppData\Roaming\qmacro\qdisp.dll

Filesize
41KB

MD5
a20de3836893f50f73c61ec0a2e45ad7

SHA1
eee63ff2190d6e2ed3eb4041c51075b4ed961c88

SHA256
2bcdf199d79f40191ba92513021f99390a8e07abdb151975e5df739b46d97473

SHA512
cab618b4b07bbdc36e5b679da9afa2d9e3f5ebdfef11c10e461dc9a588db2cabf1589ce10898dae8a9a12a0b5f571a6dffeb4faff504ea31eed9eba0c6b76f40

Download Submit
memory/1260-75-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/1260-101-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/1260-55-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/1260-62-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/1260-44-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/1260-82-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/1260-97-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/1260-51-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/1260-108-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/1260-112-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/1260-119-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/1260-126-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/1260-130-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download
memory/1260-137-0x0000000000400000-0x0000000000673000-memory.dmp

Filesize
2.4MB

Download