Overview

overview

10

Static

static

10

JaffaCakes...df.exe

windows7-x64

10

JaffaCakes...df.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-01-2025 19:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_67e26dc512c6a542fbd887cafacc4fdf.exe

  • Size

    807KB

  • MD5

    67e26dc512c6a542fbd887cafacc4fdf

  • SHA1

    57dcdedfb49f9838de218a2eb32389c5c9c19246

  • SHA256

    2b5ec56fcf349871329110290ad803c113ed6f659a220efb90f197353f5f81df

  • SHA512

    36f1cd31c9f74bc53c71fd2d329387a562c488dabfff3122b810bde1f0c4597298547b4cec2727068e1cfc90663af3681645e19647836c752f7531ba4a9014cf

  • SSDEEP

    24576:FYkjlQgR+tmbs1t9qgYohxfloUZhjaoJKwbgy:FYsQhtmMKcoUvPJKwbgy

Score
10/10
cycbotmodiloaderponybackdoorcredential_accessdiscoveryevasionpersistenceratspywarestealertrojanupx

Malware Config

Signatures

  • Cycbot

    Cycbot is a backdoor and trojan written in C++..

    backdoorratcycbot
  • Cycbot family
    cycbot
  • Detects Cycbot payload 2 IoCs

    Cycbot is a backdoor and trojan written in C++.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Modiloader family
    modiloader
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • ModiLoader Second Stage 9 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 54 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 2 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Drops desktop.ini file(s)
    • Suspicious use of UnmapMainImage
    PID:336
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    1⤵
      PID:860
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1120
        • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_67e26dc512c6a542fbd887cafacc4fdf.exe
          "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_67e26dc512c6a542fbd887cafacc4fdf.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1508
          • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_67e26dc512c6a542fbd887cafacc4fdf.exe
            JaffaCakes118_67e26dc512c6a542fbd887cafacc4fdf.exe
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2692
            • C:\Users\Admin\eQDewf74.exe
              C:\Users\Admin\eQDewf74.exe
              4⤵
              • Modifies visiblity of hidden/system files in Explorer
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2684
              • C:\Users\Admin\knjuuc.exe
                "C:\Users\Admin\knjuuc.exe"
                5⤵
                • Modifies visiblity of hidden/system files in Explorer
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:3032
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c tasklist&&del eQDewf74.exe
                5⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2564
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2620
            • C:\Users\Admin\aihost.exe
              C:\Users\Admin\aihost.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1516
              • C:\Users\Admin\aihost.exe
                aihost.exe
                5⤵
                • Executes dropped EXE
                • Maps connected drives based on registry
                • Suspicious behavior: EnumeratesProcesses
                PID:2848
            • C:\Users\Admin\bihost.exe
              C:\Users\Admin\bihost.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2440
              • C:\Users\Admin\bihost.exe
                bihost.exe
                5⤵
                • Executes dropped EXE
                • Maps connected drives based on registry
                • Suspicious behavior: EnumeratesProcesses
                PID:1540
            • C:\Users\Admin\cihost.exe
              C:\Users\Admin\cihost.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1360
              • C:\Users\Admin\cihost.exe
                C:\Users\Admin\cihost.exe startC:\Users\Admin\AppData\Roaming\D4ECD\8D33C.exe%C:\Users\Admin\AppData\Roaming\D4ECD
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1844
              • C:\Users\Admin\cihost.exe
                C:\Users\Admin\cihost.exe startC:\Program Files (x86)\CDC67\lvvm.exe%C:\Program Files (x86)\CDC67
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2552
              • C:\Program Files (x86)\LP\3CDD\8575.tmp
                "C:\Program Files (x86)\LP\3CDD\8575.tmp"
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:1772
            • C:\Users\Admin\dihost.exe
              C:\Users\Admin\dihost.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2236
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1128
            • C:\Users\Admin\eihost.exe
              C:\Users\Admin\eihost.exe
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1416
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_67e26dc512c6a542fbd887cafacc4fdf.exe
              4⤵
              • Deletes itself
              • System Location Discovery: System Language Discovery
              PID:1008
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                5⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2324
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:332
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2892
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
        1⤵
          PID:2140

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Active Setup

        1
        T1547.014

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Active Setup

        1
        T1547.014

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Hide Artifacts

        1
        T1564

        Hidden Files and Directories

        1
        T1564.001

        Modify Registry

        4
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        3
        T1552

        Credentials In Files

        3
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Process Discovery

        1
        T1057

        Query Registry

        3
        T1012

        System Information Discovery

        2
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        2
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\D4ECD\DC67.4EC
          Filesize

          600B

          MD5

          bb8adb0b52c20ea491ed2f6322bf7efb

          SHA1

          46415470746d7a56c0c71bf2d7a8cc988eb748e1

          SHA256

          34cd30d4fa431e8e40951586e78305746bcfeb90db5364b3d1df737797cd0d9e

          SHA512

          9e41b819b33d65bfdfa150413b0d7bc411c727b0b80575591a90043a912256203b2062e7661aea68adf8da2accec49b791f0624e28330c643cf1d8e795260989

          Download Submit

        • C:\Users\Admin\AppData\Roaming\D4ECD\DC67.4EC
          Filesize

          996B

          MD5

          f29f4bf1613fc086968db1b3817b37e2

          SHA1

          8769079fcb3b856f484569d574f644ce1e5f7c97

          SHA256

          4a25724872812580c6ea404fbdfbf931c5308a3d6b3cfa196caa665a6c73cd84

          SHA512

          2d14d7495ea96cd7d1ba7753f0d9267b2556f2dc693bdc2245556c6bfd3ff2b7cdf0ba00c23e9e754609cddb7f5712d36ef4d9ccee66d4e18f2a43217917964b

          Download Submit

        • C:\Users\Admin\AppData\Roaming\D4ECD\DC67.4EC
          Filesize

          1KB

          MD5

          2bd4de0eac7910966fe105959b70cd80

          SHA1

          e870959b1ae62e874cdf45487beccd6b592acb59

          SHA256

          d5918d8ab32183c21a19fdd6278a98a122a5b54450a6569705c77df15e2c82bc

          SHA512

          d3a4e32dc2302adda49ef55ed41092947f13f503aae047705149e34051a17224941de8260803ac1e14b7e158f9f722225058c24565e62d2f7d33a20d1d633790

          Download Submit

        • C:\Windows\system32\consrv.dll
          Filesize

          53KB

          MD5

          63e99b675a1337db6d8430195ea3efd2

          SHA1

          1baead2bf8f433dc82f9b2c03fd65ce697a92155

          SHA256

          6616179477849205eb4075b75a042056d196f45d67f78929dbb3317a35ccbea9

          SHA512

          f5b986eafa38dbc9ad7759784ac887ecbb9c8d8009a3f33e91b9c9ceeaf043ed3e4ddab8e6b6b77e54aed9fcecab02442c8ff253f2136ea06996d05ddd68199f

          Download Submit

        • \??\globalroot\systemroot\assembly\temp\@
          Filesize

          2KB

          MD5

          924ba9216cd2fbfed56c46c34c895c94

          SHA1

          39523fd855f33790398cc98ac9b2642d30eaf2d5

          SHA256

          e0787d5c30a6e4eb8a92981e7415408c93956c0a6a50a01ddef0ae667a9400e9

          SHA512

          724459bc629e73f4c3547051f3ff01b2d586e133dad3809ed41352a6acf67c86d792e5382e91e5885c21bed318f00e4810cb927fadbbb7076becefa7c7617681

          Download Submit

        • \Program Files (x86)\LP\3CDD\8575.tmp
          Filesize

          100KB

          MD5

          4c04ec47c44bc997519e18ce5f20e9d6

          SHA1

          680968fe85eaa19ac68b8dabf3371dd81684ed83

          SHA256

          446ddf0822deef56cedbfa0910143c744835ed765d128408d9ea994a569581a2

          SHA512

          e33e959e25d09152c1f64d60a7733f7c7a1dfd9f0bee6ed1f8aa18cf5e5248442e365d211c4555e0723b4e23e97c0a99d43b8fe6538cc9c77f0d39fd73616279

          Download Submit

        • \Users\Admin\aihost.exe
          Filesize

          229KB

          MD5

          c7b9733430c4bf7f56a0c89d7f2dd9cf

          SHA1

          0a894c98e17a8c81a378a37c2230cf188932d21e

          SHA256

          8047916855a52a9b5e97c010e8fc2dc01a9ed91d2798a6869f8669ea4a92940d

          SHA512

          4aefe0746e896c00bc908128ba63e13d2abed9e839d13da14042365afb81d85bf75537292f7323a56694258ddec7a88b57202721b62651cfcbef2932c0cb2464

          Download Submit

        • \Users\Admin\bihost.exe
          Filesize

          119KB

          MD5

          386fef8fdb975e7c102921910db7f9fb

          SHA1

          cdf3f86411189db08c8c0f887f26c2572ecc0889

          SHA256

          ae06d784c51702aff587d235d48de3b1162872069fac4602d921d023527efae0

          SHA512

          6ab8c2721c81bdff414e8cdbd7ca006abf3ed8c0155510d6c92555885038f33c1cf08372302b6465196f69aa15a7305fb05eb2e12026f1fc96a797646b8d2352

          Download Submit

        • \Users\Admin\cihost.exe
          Filesize

          279KB

          MD5

          4df3241b8f53ad2d1c0bba6dc1b97e02

          SHA1

          f0c43893143a3442a453f56c9c4f740941b1d097

          SHA256

          407e0425757e28262c3054c1dc981a9f41cf83cd67ecfbf37d3b8fe74db54199

          SHA512

          e90e4a8b708fb9d3213f73e641fa39625a38fa969270ef1123206fb30d04837f018b9838aa02a234265c0b9ba765f567b748a7b73c437b96daba7a15e5e38663

          Download Submit

        • \Users\Admin\dihost.exe
          Filesize

          244KB

          MD5

          88537f3fd69e60683c4467e89b7651af

          SHA1

          2c14a9010bed93b0622efe283a34de343ca33244

          SHA256

          4a7897e22ad30c516920e6441dc360a98114f15d9652b89909758f4966029692

          SHA512

          b3d070628092558770e08386eeabf69efc613ce163ce1f50cc00a81a78cbec6b667a84a4f09144b7f0c145ec28929b78deee4f7cab10ce7ac9a2f9c536ce8084

          Download Submit

        • \Users\Admin\eQDewf74.exe
          Filesize

          180KB

          MD5

          42836a2ee8ce9deef8d846272ef3949f

          SHA1

          79f698c53e56c96c859a0155e02a24c93e120145

          SHA256

          5569f623253918233149531fbd49bd624af013695bf0f7d8b53ef58b062e6a37

          SHA512

          786802f71512228215ddac4d23a7eec6e8cfb8ab4c02ba0a03b06241431e70c202e845ce08222945f668218d91dd6630e9e5499be0b44fda7b3dc29e98231d85

          Download Submit

        • \Users\Admin\eihost.exe
          Filesize

          28KB

          MD5

          f06f7a3945f4f78ee2c6d1ed35cbb5be

          SHA1

          ac1ab0f60a94286b6f01b40431e6f87f6e9899bf

          SHA256

          a2c720d07e18b73143b040ab817bad7da98ed2a262d55e6119b9cbd8b93dbbe3

          SHA512

          23f1fc1f15aab030c3d19a1c166479a52659b91dac00fff1301ddfd6e5e62279d45ec176f2e891098eb0d613d1f148952bf71341227b35f52c3bc2bf5fcdad14

          Download Submit

        • \Users\Admin\knjuuc.exe
          Filesize

          180KB

          MD5

          2df3a3ff87617ee438741d172ab25148

          SHA1

          8ba545b96607e4f81ff1278e73fa4c2223fc767b

          SHA256

          5c615ff21654d2b9be9d091c70b39d62136da7934247aa7a4e0969e00b860459

          SHA512

          b6cf09ccbc177d28f8aa614d49da3becc93917f4d5df30796283b5a38f0b101e7b0109fa55cd5f658494d95d3f52e4f40da64c88d433f446fb11efe421992b98

          Download Submit

        • \Windows\assembly\GAC_32\Desktop.ini
          Filesize

          4KB

          MD5

          758f90d425814ea5a1d2694e44e7e295

          SHA1

          64d61731255ef2c3060868f92f6b81b4c9b5fe29

          SHA256

          896221147d8172197cbbf06c45d461141ce6b4af38027c1a22d57c1165026433

          SHA512

          11858e498309f611ee6241c026a402d6d979bffe28d4cbf7c9d5a89c3f3de25e1d253ab552ef7bc7cc43dd056307bd625e2e4f09beb21f0214c3946113b97ca9

          Download Submit

        • memory/1360-125-0x0000000000400000-0x000000000046B000-memory.dmp

          Filesize

          428KB

          Download

        • memory/1508-10-0x0000000000400000-0x0000000000417000-memory.dmp

          Filesize

          92KB

          Download

        • memory/1516-69-0x0000000000400000-0x0000000000416000-memory.dmp

          Filesize

          88KB

          Download

        • memory/1540-92-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

          Download

        • memory/1540-81-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

          Download

        • memory/1540-79-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

          Download

        • memory/1540-124-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

          Download

        • memory/1540-83-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

          Download

        • memory/1540-94-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

          Download

        • memory/1540-93-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

          Download

        • memory/1540-87-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

          Download

        • memory/1844-127-0x0000000000400000-0x000000000046B000-memory.dmp

          Filesize

          428KB

          Download

        • memory/2236-128-0x0000000000340000-0x000000000037C000-memory.dmp

          Filesize

          240KB

          Download

        • memory/2236-138-0x0000000000400000-0x000000000045D000-memory.dmp

          Filesize

          372KB

          Download

        • memory/2236-203-0x0000000000340000-0x000000000037C000-memory.dmp

          Filesize

          240KB

          Download

        • memory/2236-136-0x0000000000340000-0x000000000037C000-memory.dmp

          Filesize

          240KB

          Download

        • memory/2236-132-0x0000000000340000-0x000000000037C000-memory.dmp

          Filesize

          240KB

          Download

        • memory/2440-88-0x0000000000400000-0x0000000000416000-memory.dmp

          Filesize

          88KB

          Download

        • memory/2692-2-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/2692-4-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/2692-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2692-364-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/2692-102-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/2692-15-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/2692-13-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/2692-12-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/2692-0-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/2692-6-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/2848-62-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

          Download

        • memory/2848-54-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

          Download

        • memory/2848-52-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

          Download

        • memory/2848-56-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

          Download

        • memory/2848-59-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

          Download

        • memory/2848-123-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

          Download

        • memory/2848-66-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

          Download

        • memory/2848-70-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

          Download