840fb5ee19fc8d0ce9ac390ee71a3ee53cfcff5b3978d56c06c2ac981ec414e3

Analysis

max time kernel
145s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
Size

644KB
MD5

8af1cb2cc60741dbac95ed339a403bcc
SHA1

82ea9ea3eeb7428d3ae47dd2e505070364589f75
SHA256

840fb5ee19fc8d0ce9ac390ee71a3ee53cfcff5b3978d56c06c2ac981ec414e3
SHA512

8d27134dceb3d9378422caf695cf0ca814cd65bb334d51a96a271a2b79285639e3be6866896337b6e139b9353016cf0f6955289ae28679a5573516bb618f12fc
SSDEEP

6144:T82p4pFHfzMepymgWPnviP6Koa0nArn20l96tCF2eKNBDRlC8HQQDhy5OwbY6ilV:Hp4pNfz3ymJnJ8QCFkxCaQTOllyu

Score

10^/10

discovery persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe

Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\R:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\B:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\P:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\S:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\X:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\Y:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\Z:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\H:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\K:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\M:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\Q:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\U:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\V:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\A:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\E:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\I:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\L:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\O:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\T:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\W:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\G:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened (read-only)	\??\J:	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
File opened for modification	C:\AUTORUN.INF	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe

Suspicious behavior: MapViewOfSection 23 IoCs

pid	Process
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 368	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	3
PID 816 wrote to memory of 368	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	3
PID 816 wrote to memory of 368	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	3
PID 816 wrote to memory of 368	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	3
PID 816 wrote to memory of 368	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	3
PID 816 wrote to memory of 368	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	3
PID 816 wrote to memory of 368	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	3
PID 816 wrote to memory of 380	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	4
PID 816 wrote to memory of 380	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	4
PID 816 wrote to memory of 380	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	4
PID 816 wrote to memory of 380	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	4
PID 816 wrote to memory of 380	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	4
PID 816 wrote to memory of 380	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	4
PID 816 wrote to memory of 380	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	4
PID 816 wrote to memory of 412	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	5
PID 816 wrote to memory of 412	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	5
PID 816 wrote to memory of 412	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	5
PID 816 wrote to memory of 412	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	5
PID 816 wrote to memory of 412	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	5
PID 816 wrote to memory of 412	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	5
PID 816 wrote to memory of 412	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	5
PID 816 wrote to memory of 464	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	6
PID 816 wrote to memory of 464	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	6
PID 816 wrote to memory of 464	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	6
PID 816 wrote to memory of 464	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	6
PID 816 wrote to memory of 464	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	6
PID 816 wrote to memory of 464	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	6
PID 816 wrote to memory of 464	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	6
PID 816 wrote to memory of 480	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	7
PID 816 wrote to memory of 480	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	7
PID 816 wrote to memory of 480	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	7
PID 816 wrote to memory of 480	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	7
PID 816 wrote to memory of 480	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	7
PID 816 wrote to memory of 480	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	7
PID 816 wrote to memory of 480	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	7
PID 816 wrote to memory of 488	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	8
PID 816 wrote to memory of 488	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	8
PID 816 wrote to memory of 488	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	8
PID 816 wrote to memory of 488	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	8
PID 816 wrote to memory of 488	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	8
PID 816 wrote to memory of 488	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	8
PID 816 wrote to memory of 488	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	8
PID 816 wrote to memory of 588	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	9
PID 816 wrote to memory of 588	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	9
PID 816 wrote to memory of 588	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	9
PID 816 wrote to memory of 588	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	9
PID 816 wrote to memory of 588	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	9
PID 816 wrote to memory of 588	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	9
PID 816 wrote to memory of 588	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	9
PID 816 wrote to memory of 664	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	10
PID 816 wrote to memory of 664	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	10
PID 816 wrote to memory of 664	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	10
PID 816 wrote to memory of 664	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	10
PID 816 wrote to memory of 664	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	10
PID 816 wrote to memory of 664	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	10
PID 816 wrote to memory of 664	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	10
PID 816 wrote to memory of 748	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	11
PID 816 wrote to memory of 748	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	11
PID 816 wrote to memory of 748	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	11
PID 816 wrote to memory of 748	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	11
PID 816 wrote to memory of 748	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	11
PID 816 wrote to memory of 748	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	11
PID 816 wrote to memory of 748	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	11
PID 816 wrote to memory of 796	816	JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe	12

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:464
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:588
  - - C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe
      4⤵
      PID:1660
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1740
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:664
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:748
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:796
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1296
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:848
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:984
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:284
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:1012
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1032
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1196
- - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
    3⤵
    PID:1456
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2484
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2520
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:480
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:412

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1336
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8af1cb2cc60741dbac95ed339a403bcc.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.exe

Filesize
645KB

MD5
385551c497f478a6d3bb4c4e36367e8f

SHA1
2588036bfcad4a8e27535ac27361d50c9bc353ad

SHA256
3de056316d101b44593a2d21c7162089cf7df1aa17d7017b8c38295e3e974285

SHA512
c4ef0f39917440690813d40725dbc88ebc7c83854f5edf58b6945efa30f4a6e28f4de9ccef5e93bbd06c54a1f18df9e92f71d05b8f1b6b25946fe4a6690698c9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
de657198062a1eb0fe28d8ee399e7786

SHA1
0b1497610c1f7bfb5d14058f70343e15442f9414

SHA256
33c5d1c47587f992c68a9c6395195d4ad663250d83f4dcb2b04a2a5ca2d5f668

SHA512
c68c3f1df258fc024fac4af0b4f320025a55b953119dd7fa6549806c84cc45d81b51980944c1a9a69ccc526da4b10dde725601e7f6709f3c9bacf00f75d7dd27

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.exe

Filesize
645KB

MD5
38a22022e8873f394924f5d294e57a6a

SHA1
9c49a9596f494dc11940df83e0d54cc6b132aed3

SHA256
aea252005ca9c400e6392c45af26ad6ec433b0c7324b74083119c7cbaf40c3c4

SHA512
800af3acf8ee079043a1bb1a2ff300b9af474ad10fd3940112548e0a20f269579d49cfd8698ee6a24361cb3eb5ad176db5fa164f35d48d10b3743c76122604e1

Download Submit
F:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
memory/816-0-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/816-2-0x00000000774E0000-0x00000000774E1000-memory.dmp

Filesize
4KB

Download
memory/816-1-0x00000000774DF000-0x00000000774E0000-memory.dmp

Filesize
4KB

Download
memory/816-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/816-79-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/816-85-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download