Overview

overview

10

Static

static

3

JaffaCakes...86.exe

windows7-x64

10

JaffaCakes...86.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    24-01-2025 15:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_22d8537b3cd2f668d3f65ac3eb6dce86.exe

  • Size

    964KB

  • MD5

    22d8537b3cd2f668d3f65ac3eb6dce86

  • SHA1

    c3cf4b2d7c0eeab78574e04066c83d13e2fde78c

  • SHA256

    6e3310dc399edd83271c6f5bd3c013f5d6107c4c1329d08923a689297f951ced

  • SHA512

    1fb7992555ced3344f9a2045c8147a018dc03e9937e8759f8c4de871ad4c6a3fab22cb0a39a4ede038ba9ea6ca08ab75cf3c22eefa634d1f7185792acdfea4a4

  • SSDEEP

    24576:VNDtgSt8ux/FI5QhM5BtON/X5aP/SdqJyybYfxk/5GFaidS0:djImitOWXSdSrbjz

Score
10/10
ponycredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    defense_evasion
  • Drops file in Drivers directory 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 16 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 52 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 6 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Suspicious use of UnmapMainImage
    PID:332
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies WinLogon for persistence
    PID:1224
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d8537b3cd2f668d3f65ac3eb6dce86.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_22d8537b3cd2f668d3f65ac3eb6dce86.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2176
      • C:\Users\Admin\u2AzQ8M2.exe
        C:\Users\Admin\u2AzQ8M2.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1532
        • C:\Users\Admin\qaoku.exe
          "C:\Users\Admin\qaoku.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2616
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del u2AzQ8M2.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1488
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2420
      • C:\Users\Admin\2eod.exe
        C:\Users\Admin\2eod.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2976
        • C:\Users\Admin\2eod.exe
          "C:\Users\Admin\2eod.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2848
        • C:\Users\Admin\2eod.exe
          "C:\Users\Admin\2eod.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2692
        • C:\Users\Admin\2eod.exe
          "C:\Users\Admin\2eod.exe"
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:2196
        • C:\Users\Admin\2eod.exe
          "C:\Users\Admin\2eod.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2880
        • C:\Users\Admin\2eod.exe
          "C:\Users\Admin\2eod.exe"
          4⤵
          • Executes dropped EXE
          PID:1220
      • C:\Users\Admin\3eod.exe
        C:\Users\Admin\3eod.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • System policy modification
        PID:2024
        • C:\Users\Admin\3eod.exe
          C:\Users\Admin\3eod.exe startC:\Users\Admin\AppData\Roaming\D49BF\BD91D.exe%C:\Users\Admin\AppData\Roaming\D49BF
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:844
        • C:\Users\Admin\3eod.exe
          C:\Users\Admin\3eod.exe startC:\Program Files (x86)\BF26E\lvvm.exe%C:\Program Files (x86)\BF26E
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2288
        • C:\Program Files (x86)\LP\1D4D\55ED.tmp
          "C:\Program Files (x86)\LP\1D4D\55ED.tmp"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:892
      • C:\Users\Admin\4eod.exe
        C:\Users\Admin\4eod.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Unexpected DNS network traffic destination
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:896
        • C:\Users\Admin\AppData\Local\a0440614\X
          *0*bc*b064bf06*31.193.3.240:53
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1484
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2856
      • C:\Users\Admin\5eod.exe
        C:\Users\Admin\5eod.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Adds Run key to start application
        PID:1844
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_22d8537b3cd2f668d3f65ac3eb6dce86.exe
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2372
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1748
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2560
  • C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
    1⤵
      PID:1440
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1672
    • C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
      1⤵
        PID:800

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      3
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Privilege Escalation

      Boot or Logon Autostart Execution

      3
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Defense Evasion

      Hide Artifacts

      1
      T1564

      Hidden Files and Directories

      1
      T1564.001

      Modify Registry

      5
      T1112

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      3
      T1552

      Credentials In Files

      3
      T1552.001

      Discovery

      Peripheral Device Discovery

      1
      T1120

      Process Discovery

      1
      T1057

      Query Registry

      3
      T1012

      System Information Discovery

      2
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      2
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\5eod.exe
        Filesize

        120KB

        MD5

        3fe209cb336f44a0719e53e3b9354aa8

        SHA1

        c37a59ba00521c78d81f0e7cf2713b41593e12a3

        SHA256

        19102a9ce99b067f69ec9b53844aa2e29fbed3d53efbb06e24501ee70af60db1

        SHA512

        6e872ee319e1900fa8ab9b257ec3ee62cc2578476bfc2770090255706f5ea685a5034a1c7b857a088547e130c5cc2b35d65aed54df6965a5274e019293065c09

        Download Submit

      • C:\Users\Admin\AppData\Roaming\D49BF\F26E.49B
        Filesize

        600B

        MD5

        f774bfa64d6e8d4694d7c8c39b563e02

        SHA1

        af44587cd236d9fffcc0f5a302493fabdce96f0f

        SHA256

        691a095190bfd025708c8f6716a1d0dc5a34c15bcc7ad260f4a12d5adf0d57d2

        SHA512

        7d9ab8d9f65ff2af70269e33365056a0f73dbe9e99d8773fa4d74777195bec7fe8d48a2fc034433c78fbc0cc5371e3bebb101b6f81d85a09fb8dec4089fa4e13

        Download Submit

      • C:\Users\Admin\AppData\Roaming\D49BF\F26E.49B
        Filesize

        996B

        MD5

        5a68e9f80fa6b61d733e547141824cf6

        SHA1

        5b733fa978ed26101fb80fae6e36c9288baa8d91

        SHA256

        4427b3e842bc091a94f9da5649bcf2d8d9bdd839acfd995f1c47a1a3c0900ce9

        SHA512

        ab4039f42aafdcf1eb3e9dc78530747b6c650bf3f379cf9ed862e52714e2b03a881ee360776543c3a1f72baa98f6e8f567ecebb41331c4b704a3fd3d31f3282b

        Download Submit

      • C:\Windows\system32\consrv.dll
        Filesize

        29KB

        MD5

        1149c1bd71248a9d170e4568fb08df30

        SHA1

        6f77f183d65709901f476c5d6eebaed060a495f9

        SHA256

        c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1

        SHA512

        9e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459

        Download Submit

      • \Program Files (x86)\LP\1D4D\55ED.tmp
        Filesize

        100KB

        MD5

        340f18faddf54d738f6e56fe3d8b1d54

        SHA1

        bb247a2f8db305906d558c0c665cc7fd7f86ff67

        SHA256

        4613dcf13e53312b483bfebb7866b9e1111c434beabd1b19a03721ab7a2ec572

        SHA512

        e47e375ec6c8cd07411da44cec52c35c1c28e3fce9d09acf390371ea6b1c456e1d43f87d7b5de6f8ba9b233d11caf25cfd5b4890f356b510688286322d7cab74

        Download Submit

      • \Users\Admin\2eod.exe
        Filesize

        136KB

        MD5

        449cf714ddba0f68cb17bc7f9698949b

        SHA1

        3639bfa3d1563f9a4e2caad9a21074e87b3bfa73

        SHA256

        3c3c398934492f2073aa3a725bff53909ef1bd1a7df82a7467a66d712df12010

        SHA512

        8a08aef0b537395f2503790c7eee4c28986c4fd76670d05018004b3c77011fa4b9d8d3d791ec65ccf6a638f47f007666ea708957776772d5ab6f6d5cae64c81f

        Download Submit

      • \Users\Admin\3eod.exe
        Filesize

        282KB

        MD5

        2c24a5f9f31ac5a0d3830187617cf6dc

        SHA1

        e71116ab32e0dfa7495f0562c86f232df7202991

        SHA256

        007e9c74a2ee70d46460c91a3c36aa08602bb51a792e89f2d89a358ecbac94c6

        SHA512

        f59a98a728c0d923443d10b2419b6a9bb5ac613949f26fa923240cc2162c93bc462e65f46f46000a1120065bf344b32ddba0f674cfc8007dd1d7591f4cb19b04

        Download Submit

      • \Users\Admin\4eod.exe
        Filesize

        277KB

        MD5

        00b72668c42555c6d9e3cee383730fc0

        SHA1

        509a7c39baf2b9a46813c641cca687b37e244d5a

        SHA256

        baaacce5c3f18154d4925ec6568ccf66f4ab9ee5477bd0faf44f08d9397641dd

        SHA512

        1bfa5cd6081a5e8556b452cf4741831da829fcc9e2b51c77c92a4fdacfa1b934d14bc049f8185be09b1447664f55956f69e7fd16a868c9655eb32f9b9ef02e78

        Download Submit

      • \Users\Admin\AppData\Local\a0440614\X
        Filesize

        38KB

        MD5

        72de2dadaf875e2fd7614e100419033c

        SHA1

        5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

        SHA256

        c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

        SHA512

        e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

        Download Submit

      • \Users\Admin\qaoku.exe
        Filesize

        320KB

        MD5

        3d2e9afd2acf0898d5200ca8e37ca885

        SHA1

        208d1239b1e4a872babfae881c3a0ca8bd2c4cbf

        SHA256

        f771f615224f2f7ff390de4ccb9a385647e5955cbf26c06489373a5ad8d970d1

        SHA512

        d3da0b6bcd118331d5e00640bbabd1fe31d3cfdcf8685557d2e7ad7e25416a0683c826dcf25e166f249b2b98aa3d955eaaa64b6d3e7df44d310b00143b4e1799

        Download Submit

      • \Users\Admin\u2AzQ8M2.exe
        Filesize

        320KB

        MD5

        ca2acc28a24d14c7e282bd1c689229d0

        SHA1

        c253b9ce5fa1db5bd8a02a49af44a751331e624c

        SHA256

        bd67e3974c9108c7f2bd1cb266f6c3aad420fc63860fd653d0198e26927e2c25

        SHA512

        007c6df499080b538deeffa552d09e0cddba64c6494fe98d6eaf883bd39180d4d9fba0bf08f7d650b256bd54fa52deafc415865dd69b00426452470a173ab2d2

        Download Submit

      • \systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
        Filesize

        2KB

        MD5

        3a7482ba479bf81871823c500396d7f4

        SHA1

        4bfe4b0745895cce782cc0a90a8cfe9ba1cc3ca0

        SHA256

        93fd7ce6c6fc5480976b1053b6fe569c589ff5e32ed7731074b827a220b7877e

        SHA512

        4841c45264b44e15a96a438fe6c6ab94b56fa59f67b09f75b2c74850af88df7f5b9b2071d490eb1da4132cfe190f2ab716d8d86e9f80e87d1663bc48213f7cf3

        Download Submit

      • memory/332-130-0x0000000000EA0000-0x0000000000EAB000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1224-119-0x0000000002160000-0x0000000002166000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1224-123-0x0000000002160000-0x0000000002166000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1224-141-0x0000000002180000-0x000000000218B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1224-137-0x0000000002180000-0x000000000218B000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1224-115-0x0000000002160000-0x0000000002166000-memory.dmp

        Filesize

        24KB

        Download

      • memory/1844-457-0x0000000000400000-0x0000000000B19000-memory.dmp

        Filesize

        7.1MB

        Download

      • memory/1844-489-0x0000000000400000-0x0000000000B19000-memory.dmp

        Filesize

        7.1MB

        Download

      • memory/2176-456-0x0000000002C20000-0x0000000003339000-memory.dmp

        Filesize

        7.1MB

        Download

      • memory/2176-458-0x0000000002C20000-0x0000000003339000-memory.dmp

        Filesize

        7.1MB

        Download

      • memory/2196-75-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2196-76-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2196-74-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2196-72-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2196-69-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2196-67-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2196-65-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/2692-62-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2692-61-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2692-64-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2692-63-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2692-56-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2692-54-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2692-52-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2848-105-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2848-49-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2848-47-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2848-44-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2848-45-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2848-40-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2848-38-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2848-42-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2880-81-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2880-161-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2880-79-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2880-84-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2880-87-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download

      • memory/2880-86-0x0000000000400000-0x0000000000407000-memory.dmp

        Filesize

        28KB

        Download