b6648ca78d53b653dc1ee71e72d9eb8867199894c307434857eb662576c7cbde

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 10:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e749b1dbe7c7e586450b1b497559e57c_JaffaCakes118.exe
Size

1.2MB
MD5

e749b1dbe7c7e586450b1b497559e57c
SHA1

a2c8e9afa8c2c777a0430e5afbcd15dc9d839268
SHA256

b6648ca78d53b653dc1ee71e72d9eb8867199894c307434857eb662576c7cbde
SHA512

f1d182ae1b0cee1a433303ea1ee1007454fd10ed6593ecefa65dbb2a55b87d9c809827b7ce831ba1d8959bfe96c9b5c318fad438250b0661734b894a092d826c
SSDEEP

24576:H6Po6XvZlG6nEoozhNX3yLoR+S6WdICs3lDCGNLKXdvM:l6XvZlG6nEoyNX3yLoR+Sjps2G4vM

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b00000001224c-10.dat	acprotect

Loads dropped DLL 3 IoCs

pid	Process
1704	e749b1dbe7c7e586450b1b497559e57c_JaffaCakes118.exe
2468	regsvr32.exe
1704	e749b1dbe7c7e586450b1b497559e57c_JaffaCakes118.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1704-0-0x0000000000400000-0x0000000000563000-memory.dmp	upx
behavioral1/memory/1704-3-0x0000000000400000-0x0000000000563000-memory.dmp	upx
behavioral1/memory/1704-5-0x0000000000400000-0x0000000000563000-memory.dmp	upx
behavioral1/files/0x000b00000001224c-10.dat	upx
behavioral1/memory/1704-12-0x0000000010000000-0x0000000010014000-memory.dmp	upx
behavioral1/memory/1704-18-0x0000000000400000-0x0000000000563000-memory.dmp	upx
behavioral1/memory/1704-19-0x0000000010000000-0x0000000010014000-memory.dmp	upx
behavioral1/memory/1704-20-0x0000000000400000-0x0000000000563000-memory.dmp	upx
behavioral1/memory/1704-22-0x0000000000400000-0x0000000000563000-memory.dmp	upx
behavioral1/memory/1704-24-0x0000000000400000-0x0000000000563000-memory.dmp	upx
behavioral1/memory/1704-25-0x0000000000400000-0x0000000000563000-memory.dmp	upx
behavioral1/memory/1704-27-0x0000000000400000-0x0000000000563000-memory.dmp	upx
behavioral1/memory/1704-29-0x0000000000400000-0x0000000000563000-memory.dmp	upx
behavioral1/memory/1704-31-0x0000000000400000-0x0000000000563000-memory.dmp	upx
behavioral1/memory/1704-33-0x0000000000400000-0x0000000000563000-memory.dmp	upx
behavioral1/memory/1704-35-0x0000000000400000-0x0000000000563000-memory.dmp	upx
behavioral1/memory/1704-37-0x0000000000400000-0x0000000000563000-memory.dmp	upx
behavioral1/memory/1704-39-0x0000000000400000-0x0000000000563000-memory.dmp	upx
behavioral1/memory/1704-41-0x0000000000400000-0x0000000000563000-memory.dmp	upx
behavioral1/memory/1704-43-0x0000000000400000-0x0000000000563000-memory.dmp	upx
behavioral1/memory/1704-45-0x0000000000400000-0x0000000000563000-memory.dmp	upx
behavioral1/memory/1704-47-0x0000000000400000-0x0000000000563000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\zlib.dll	e749b1dbe7c7e586450b1b497559e57c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mswinsck.ocx	e749b1dbe7c7e586450b1b497559e57c_JaffaCakes118.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx, 1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\mswinsck.ocx"	regsvr32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1704	e749b1dbe7c7e586450b1b497559e57c_JaffaCakes118.exe
1704	e749b1dbe7c7e586450b1b497559e57c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2468	1704	e749b1dbe7c7e586450b1b497559e57c_JaffaCakes118.exe	28
PID 1704 wrote to memory of 2468	1704	e749b1dbe7c7e586450b1b497559e57c_JaffaCakes118.exe	28
PID 1704 wrote to memory of 2468	1704	e749b1dbe7c7e586450b1b497559e57c_JaffaCakes118.exe	28
PID 1704 wrote to memory of 2468	1704	e749b1dbe7c7e586450b1b497559e57c_JaffaCakes118.exe	28
PID 1704 wrote to memory of 2468	1704	e749b1dbe7c7e586450b1b497559e57c_JaffaCakes118.exe	28
PID 1704 wrote to memory of 2468	1704	e749b1dbe7c7e586450b1b497559e57c_JaffaCakes118.exe	28
PID 1704 wrote to memory of 2468	1704	e749b1dbe7c7e586450b1b497559e57c_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\e749b1dbe7c7e586450b1b497559e57c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e749b1dbe7c7e586450b1b497559e57c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s "C:\Windows\system32\mswinsck.ocx"
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:2468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mswinsck.ocx

Filesize
105KB

MD5
9484c04258830aa3c2f2a70eb041414c

SHA1
b242a4fb0e9dcf14cb51dc36027baff9a79cb823

SHA256
bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

SHA512
9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

Download Submit
\Windows\SysWOW64\zlib.dll

Filesize
27KB

MD5
200d52d81e9b4b05fa58ce5fbe511dba

SHA1
c0d809ee93816d87388ed4e7fd6fca93d70294d2

SHA256
d4fe89dc2e7775f4ef0dfc70ed6999b8f09635326e05e08a274d464d1814c617

SHA512
7b1df70d76855d65cf246051e7b9f7119720a695d41ace1eb00e45e93e6de80d083b953269166bdee7137dbd9f3e5681e36bb036f151cea383c10d82957f39c5

Download Submit
memory/1704-22-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1704-18-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1704-5-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1704-2-0x0000000001D00000-0x0000000001DE7000-memory.dmp

Filesize
924KB

Download
memory/1704-12-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/1704-1-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1704-24-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1704-19-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/1704-20-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1704-21-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1704-3-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1704-0-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1704-33-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1704-27-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1704-29-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1704-31-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1704-25-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1704-35-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1704-37-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1704-39-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1704-41-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1704-43-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1704-45-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download
memory/1704-47-0x0000000000400000-0x0000000000563000-memory.dmp

Filesize
1.4MB

Download