Overview

overview

10

Static

static

10

JaffaCakes...81.exe

windows10-2004-x64

10

JaffaCakes...81.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250410-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/04/2025, 07:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_bd36eb92298dee321befd322face8581.exe

  • Size

    650KB

  • MD5

    bd36eb92298dee321befd322face8581

  • SHA1

    f38a87b73c75e11b170a05a1a0f6202f4530d611

  • SHA256

    d63670e6cd078ec7c9352badd62297cf1002988bd69402f95ce0728d7dc00730

  • SHA512

    086c1b5bf70626de19c685b2d5d4ca39ad541fb2260953f86ab6b223878a24ea20dec9360adf0f0ccd40bdb5fc29e82e8b1a0e22d5c78f4a88f0d0aac10fad24

  • SSDEEP

    12288:jk0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+T:I0QRWoJEfg0oChGdJQbjPbNW5tYeP+G6

Score
10/10
darkcometguest16defense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

87.178.162.248:1604

Mutex

DC_MUTEX-1CLCD4K

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    mQXNtU6Y0Pl3

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

rc4.plain

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Darkcomet family
    darkcomet
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies firewall policy service 3 TTPs 64 IoCs
    defense_evasion
  • Modifies security service 2 TTPs 22 IoCs
    defense_evasion
  • Windows security bypass 2 TTPs 44 IoCs
    defense_evasiontrojan
  • Disables RegEdit via registry modification 22 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 21 IoCs
  • Windows security modification 2 TTPs 42 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 63 IoCs
    defense_evasion
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd36eb92298dee321befd322face8581.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd36eb92298dee321befd322face8581.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:368
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd36eb92298dee321befd322face8581.exe" +s +h
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5320
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd36eb92298dee321befd322face8581.exe" +s +h
        3⤵
        • Sets file to hidden
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:4340
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3484
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Sets file to hidden
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:4672
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd36eb92298dee321befd322face8581.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:5680
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 4
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3668
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
      2⤵
      • Modifies firewall policy service
      • Modifies security service
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:4204
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3460
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      2⤵
      • Modifies firewall policy service
      • Modifies security service
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3036
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4428
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      2⤵
      • Modifies firewall policy service
      • Modifies security service
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:4516
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4548
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      2⤵
      • Modifies firewall policy service
      • Modifies security service
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:4784
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1772
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      2⤵
      • Modifies firewall policy service
      • Modifies security service
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:4572
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5880
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      2⤵
      • Modifies firewall policy service
      • Modifies security service
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:5520
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1276
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      2⤵
      • Modifies firewall policy service
      • Modifies security service
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:5340
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6064
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      2⤵
      • Modifies firewall policy service
      • Modifies security service
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:6100
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3460
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      2⤵
      • Modifies firewall policy service
      • Modifies security service
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:4516
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      2⤵
      • Modifies firewall policy service
      • Modifies security service
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:2908
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5436
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      2⤵
      • Modifies firewall policy service
      • Modifies security service
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:3096
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      2⤵
      • Modifies firewall policy service
      • Modifies security service
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:4924
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5220
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      2⤵
      • Modifies firewall policy service
      • Modifies security service
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:5920
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3736
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      2⤵
      • Modifies firewall policy service
      • Modifies security service
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:1436
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    1⤵
      PID:1324
      • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
        C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
        2⤵
        • Modifies firewall policy service
        • Modifies security service
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • System policy modification
        PID:4024
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      1⤵
        PID:4132
        • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
          C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
          2⤵
          • Modifies firewall policy service
          • Modifies security service
          • Windows security bypass
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • System policy modification
          PID:992
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
        1⤵
          PID:5684
          • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
            C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
            2⤵
            • Modifies firewall policy service
            • Modifies security service
            • Windows security bypass
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • System policy modification
            PID:1948
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
          1⤵
            PID:2740
            • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
              C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
              2⤵
              • Modifies firewall policy service
              • Modifies security service
              • Windows security bypass
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Windows security modification
              • System Location Discovery: System Language Discovery
              • System policy modification
              PID:464
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
            1⤵
              PID:2552
              • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
                C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
                2⤵
                • Modifies firewall policy service
                • Modifies security service
                • Windows security bypass
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Windows security modification
                • System Location Discovery: System Language Discovery
                • System policy modification
                PID:1028
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
              1⤵
                PID:5248
                • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
                  C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
                  2⤵
                  • Modifies firewall policy service
                  • Modifies security service
                  • Windows security bypass
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Windows security modification
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • System policy modification
                  PID:3680
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
                1⤵
                  PID:2680
                  • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
                    C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
                    2⤵
                    • Modifies firewall policy service
                    • Modifies security service
                    • Windows security bypass
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Windows security modification
                    • System Location Discovery: System Language Discovery
                    • System policy modification
                    PID:848

                Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Persistence

                Boot or Logon Autostart Execution

                2
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Winlogon Helper DLL

                1
                T1547.004

                Create or Modify System Process

                2
                T1543

                Windows Service

                2
                T1543.003

                Privilege Escalation

                Boot or Logon Autostart Execution

                2
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Winlogon Helper DLL

                1
                T1547.004

                Create or Modify System Process

                2
                T1543

                Windows Service

                2
                T1543.003

                Defense Evasion

                Hide Artifacts

                2
                T1564

                Hidden Files and Directories

                2
                T1564.001

                Impair Defenses

                3
                T1562

                Disable or Modify System Firewall

                1
                T1562.004

                Disable or Modify Tools

                2
                T1562.001

                Modify Registry

                7
                T1112

                Credential Access

                Discovery

                Query Registry

                1
                T1012

                Remote System Discovery

                1
                T1018

                System Information Discovery

                2
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                1
                T1016

                Internet Connection Discovery

                1
                T1016.001

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
                  Filesize

                  650KB

                  MD5

                  bd36eb92298dee321befd322face8581

                  SHA1

                  f38a87b73c75e11b170a05a1a0f6202f4530d611

                  SHA256

                  d63670e6cd078ec7c9352badd62297cf1002988bd69402f95ce0728d7dc00730

                  SHA512

                  086c1b5bf70626de19c685b2d5d4ca39ad541fb2260953f86ab6b223878a24ea20dec9360adf0f0ccd40bdb5fc29e82e8b1a0e22d5c78f4a88f0d0aac10fad24

                  Download Submit

                • memory/368-0-0x00000000023C0000-0x00000000023C1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/368-15-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/464-44-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/848-50-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/992-40-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/1028-46-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/1436-36-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/1948-42-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/2908-28-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/3036-7-0x0000000002060000-0x0000000002061000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/3036-9-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/3096-30-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/3680-48-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/4024-38-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/4204-16-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/4428-8-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/4516-26-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/4516-11-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/4572-18-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/4784-13-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/4924-32-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/5340-22-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/5520-20-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/5920-34-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download

                • memory/6100-24-0x0000000000400000-0x00000000004B0000-memory.dmp

                  Filesize

                  704KB

                  Download