245500ee74fd9b8b021c38be617d72261d02a6d3fb8f9402fa0a10d5a1f41f93

Analysis

max time kernel
149s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe
Size

496KB
MD5

a42208c4a96c249f3d6fe39f43144f36
SHA1

ff90b696d74d75932e122c774a95fc4671a41d86
SHA256

245500ee74fd9b8b021c38be617d72261d02a6d3fb8f9402fa0a10d5a1f41f93
SHA512

ce1977713291c941b47a1435f55db11e18a882a2c452b1a57bc115db68206d13c7b67fd780ddd728fda20a8fa5b329218700ec6c09188f3e8b9d1e0471fa0869
SSDEEP

12288:tFz2y90KU7E7B8aNHaqGQnZrCIn3dTTXV2hl:tt2yZU7E7SaXGQnZuInN/XVe

Score

7^/10

discovery evasion persistence trojan upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exeGoogleUpdate.exeGoogleUpdate.exe

pid	Process
2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe
1632	GoogleUpdate.exe
920	GoogleUpdate.exe

Loads dropped DLL 9 IoCs

Processes:

a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exea42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exeGoogleUpdate.exeGoogleUpdate.exe

pid	Process
3024	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe
2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe
2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe
2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe
2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe
2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe
1632	GoogleUpdate.exe
1632	GoogleUpdate.exe
920	GoogleUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate.exe = "C:\\Program Files (x86)\\Google\\GoogleUpdate.exe"	reg.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exeGoogleUpdate.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GoogleUpdate.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exeGoogleUpdate.exe

description	pid	Process	procid_target
PID 3024 set thread context of 2620	3024	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	31
PID 1632 set thread context of 920	1632	GoogleUpdate.exe	36
PID 1632 set thread context of 2072	1632	GoogleUpdate.exe	37

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2620-115-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2620-111-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2620-109-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2620-125-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2620-122-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2620-118-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2620-311-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/920-318-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exeGoogleUpdate.exe

description	ioc	Process
File created	C:\Program Files (x86)\Google\GoogleUpdate.exe	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdate.exe	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdate.exe	GoogleUpdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

reg.exeGoogleUpdate.exeGoogleUpdate.exesvchost.exea42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exea42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exeGoogleUpdate.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2072	svchost.exe
Token: SeSecurityPrivilege	2072	svchost.exe
Token: SeTakeOwnershipPrivilege	2072	svchost.exe
Token: SeLoadDriverPrivilege	2072	svchost.exe
Token: SeSystemProfilePrivilege	2072	svchost.exe
Token: SeSystemtimePrivilege	2072	svchost.exe
Token: SeProfSingleProcessPrivilege	2072	svchost.exe
Token: SeIncBasePriorityPrivilege	2072	svchost.exe
Token: SeCreatePagefilePrivilege	2072	svchost.exe
Token: SeBackupPrivilege	2072	svchost.exe
Token: SeRestorePrivilege	2072	svchost.exe
Token: SeShutdownPrivilege	2072	svchost.exe
Token: SeDebugPrivilege	2072	svchost.exe
Token: SeSystemEnvironmentPrivilege	2072	svchost.exe
Token: SeChangeNotifyPrivilege	2072	svchost.exe
Token: SeRemoteShutdownPrivilege	2072	svchost.exe
Token: SeUndockPrivilege	2072	svchost.exe
Token: SeManageVolumePrivilege	2072	svchost.exe
Token: SeImpersonatePrivilege	2072	svchost.exe
Token: SeCreateGlobalPrivilege	2072	svchost.exe
Token: 33	2072	svchost.exe
Token: 34	2072	svchost.exe
Token: 35	2072	svchost.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe
Token: SeDebugPrivilege	920	GoogleUpdate.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exea42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exeGoogleUpdate.exeGoogleUpdate.exesvchost.exe

pid	Process
3024	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe
2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe
1632	GoogleUpdate.exe
920	GoogleUpdate.exe
2072	svchost.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exea42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.execmd.exeGoogleUpdate.exe

description	pid	Process	procid_target
PID 3024 wrote to memory of 2620	3024	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	31
PID 3024 wrote to memory of 2620	3024	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	31
PID 3024 wrote to memory of 2620	3024	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	31
PID 3024 wrote to memory of 2620	3024	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	31
PID 3024 wrote to memory of 2620	3024	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	31
PID 3024 wrote to memory of 2620	3024	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	31
PID 3024 wrote to memory of 2620	3024	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	31
PID 3024 wrote to memory of 2620	3024	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	31
PID 3024 wrote to memory of 2620	3024	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	31
PID 3024 wrote to memory of 2620	3024	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	31
PID 3024 wrote to memory of 2620	3024	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	31
PID 2620 wrote to memory of 2364	2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	32
PID 2620 wrote to memory of 2364	2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	32
PID 2620 wrote to memory of 2364	2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	32
PID 2620 wrote to memory of 2364	2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	32
PID 2620 wrote to memory of 2364	2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	32
PID 2620 wrote to memory of 2364	2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	32
PID 2620 wrote to memory of 2364	2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	32
PID 2364 wrote to memory of 1696	2364	cmd.exe	34
PID 2364 wrote to memory of 1696	2364	cmd.exe	34
PID 2364 wrote to memory of 1696	2364	cmd.exe	34
PID 2364 wrote to memory of 1696	2364	cmd.exe	34
PID 2364 wrote to memory of 1696	2364	cmd.exe	34
PID 2364 wrote to memory of 1696	2364	cmd.exe	34
PID 2364 wrote to memory of 1696	2364	cmd.exe	34
PID 2620 wrote to memory of 1632	2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	35
PID 2620 wrote to memory of 1632	2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	35
PID 2620 wrote to memory of 1632	2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	35
PID 2620 wrote to memory of 1632	2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	35
PID 2620 wrote to memory of 1632	2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	35
PID 2620 wrote to memory of 1632	2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	35
PID 2620 wrote to memory of 1632	2620	a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe	35
PID 1632 wrote to memory of 920	1632	GoogleUpdate.exe	36
PID 1632 wrote to memory of 920	1632	GoogleUpdate.exe	36
PID 1632 wrote to memory of 920	1632	GoogleUpdate.exe	36
PID 1632 wrote to memory of 920	1632	GoogleUpdate.exe	36
PID 1632 wrote to memory of 920	1632	GoogleUpdate.exe	36
PID 1632 wrote to memory of 920	1632	GoogleUpdate.exe	36
PID 1632 wrote to memory of 920	1632	GoogleUpdate.exe	36
PID 1632 wrote to memory of 920	1632	GoogleUpdate.exe	36
PID 1632 wrote to memory of 920	1632	GoogleUpdate.exe	36
PID 1632 wrote to memory of 920	1632	GoogleUpdate.exe	36
PID 1632 wrote to memory of 920	1632	GoogleUpdate.exe	36
PID 1632 wrote to memory of 2072	1632	GoogleUpdate.exe	37
PID 1632 wrote to memory of 2072	1632	GoogleUpdate.exe	37
PID 1632 wrote to memory of 2072	1632	GoogleUpdate.exe	37
PID 1632 wrote to memory of 2072	1632	GoogleUpdate.exe	37
PID 1632 wrote to memory of 2072	1632	GoogleUpdate.exe	37
PID 1632 wrote to memory of 2072	1632	GoogleUpdate.exe	37
PID 1632 wrote to memory of 2072	1632	GoogleUpdate.exe	37
PID 1632 wrote to memory of 2072	1632	GoogleUpdate.exe	37
PID 1632 wrote to memory of 2072	1632	GoogleUpdate.exe	37
PID 1632 wrote to memory of 2072	1632	GoogleUpdate.exe	37
PID 1632 wrote to memory of 2072	1632	GoogleUpdate.exe	37

C:\Users\Admin\AppData\Local\Temp\a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\BWAXL.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdate.exe" /t REG_SZ /d "C:\Program Files (x86)\Google\GoogleUpdate.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:1696
- - C:\Program Files (x86)\Google\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\GoogleUpdate.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Program Files (x86)\Google\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\GoogleUpdate.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:920
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BWAXL.bat

Filesize
149B

MD5
230d0de063ef5fac6ddf78a06a6b4a07

SHA1
8bcba04b39b99467b2d96be25f0bbafb7e84c37f

SHA256
fe8f149d184c56d038989c811077379d51f567d68fa7e709c32228b3e68fdd7d

SHA512
057010085b093d008294df1572c82accc4118f404d0fac0a945a0966df0ffd9af33ad162821472e2842a457006551add99185fe5cb772dce61349aa11552f1d4

Download Submit
\Program Files (x86)\Google\GoogleUpdate.exe

Filesize
496KB

MD5
ba4ecca1411593e84d8f2f7d6df8db53

SHA1
9d985b3e7e4f6c3a120ea280c0c586e41c2b8506

SHA256
47f423936da308f9b384cbf4f4149d58beec8a8d126b7e0649f477ea75d29a40

SHA512
cd9391b6bb54143429d6a8986e18eecff372b8e248be830d4354c471c8db5d43f4bd7ada21171b39a8b64485067f63f8359e65cf17527bc28151ca8fae8d6153

Download Submit
\Users\Admin\AppData\Local\Temp\a42208c4a96c249f3d6fe39f43144f36_JaffaCakes118.exe

Filesize
496KB

MD5
a42208c4a96c249f3d6fe39f43144f36

SHA1
ff90b696d74d75932e122c774a95fc4671a41d86

SHA256
245500ee74fd9b8b021c38be617d72261d02a6d3fb8f9402fa0a10d5a1f41f93

SHA512
ce1977713291c941b47a1435f55db11e18a882a2c452b1a57bc115db68206d13c7b67fd780ddd728fda20a8fa5b329218700ec6c09188f3e8b9d1e0471fa0869

Download Submit
memory/920-318-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2620-122-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2620-125-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2620-107-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2620-115-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2620-113-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2620-111-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2620-109-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2620-311-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2620-118-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3024-2-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/3024-25-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/3024-11-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/3024-32-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/3024-4-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download