32d016276fa303c886e36d9239e6f602a7d699f134632b7308ebd3a556b0e979

Analysis

max time kernel
92s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Size

109KB
MD5

f01e962abcc35b0b96aea14ba111cdec
SHA1

b48fc68d24b109d2ac1e3a80149d76ca6f546953
SHA256

32d016276fa303c886e36d9239e6f602a7d699f134632b7308ebd3a556b0e979
SHA512

e4e088fc0f4201a3b47afdf39754a6fb29ccbd4d6d49b20e5948a2884b08097a22ccbb236fc98e1f629c61f721f79c0c7bcd8319e5a126d391b7a6b1129d15e0
SSDEEP

1536:unMqIyDyIwLhCyod+8pY/QOXArp7x0MJKn8rgiHPyKkk:unMv3LhCPoQOXArltr5vvz

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4564	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\LockX.ocx	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\LockX.ocx	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4564 set thread context of 4444	4564	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe	85

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2FCE7AA-98F5-4EAB-9E48-19C554C69D5F}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\LockX.ocx"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2FCE7AA-98F5-4EAB-9E48-19C554C69D5F}\1.0\HELPDIR	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2FCE7AA-98F5-4EAB-9E48-19C554C69D5F}\1.0\HELPDIR\ = "C:\\Windows\\system32"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D1998DB-81DC-4D39-A56A-85528841A141}\TypeLib\ = "{A2FCE7AA-98F5-4EAB-9E48-19C554C69D5F}"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}\MiscStatus	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}\VERSION\ = "1.0"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LockX.Lock\ = "LockX.Lock"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33F2DC0A-B786-4C8C-BF2F-F7B4AC86395B}\ = "_Lock"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33F2DC0A-B786-4C8C-BF2F-F7B4AC86395B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D1998DB-81DC-4D39-A56A-85528841A141}	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D1998DB-81DC-4D39-A56A-85528841A141}\TypeLib\Version = "1.0"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33F2DC0A-B786-4C8C-BF2F-F7B4AC86395B}\TypeLib\Version = "1.0"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}\ = "LockX.Lock"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}\Control	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}\MiscStatus\ = "0"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}\VERSION	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D1998DB-81DC-4D39-A56A-85528841A141}\TypeLib	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33F2DC0A-B786-4C8C-BF2F-F7B4AC86395B}	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}\TypeLib\ = "{A2FCE7AA-98F5-4EAB-9E48-19C554C69D5F}"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2FCE7AA-98F5-4EAB-9E48-19C554C69D5F}\1.0	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2FCE7AA-98F5-4EAB-9E48-19C554C69D5F}\1.0\0\win32	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33F2DC0A-B786-4C8C-BF2F-F7B4AC86395B}	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}\MiscStatus\1\ = "148881"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33F2DC0A-B786-4C8C-BF2F-F7B4AC86395B}\ProxyStubClsid	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33F2DC0A-B786-4C8C-BF2F-F7B4AC86395B}\ = "_Lock"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33F2DC0A-B786-4C8C-BF2F-F7B4AC86395B}\TypeLib	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2FCE7AA-98F5-4EAB-9E48-19C554C69D5F}\1.0\ = "LockX"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33F2DC0A-B786-4C8C-BF2F-F7B4AC86395B}\TypeLib\Version = "1.0"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D1998DB-81DC-4D39-A56A-85528841A141}\ProxyStubClsid32	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}\ProgID	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LockX.Lock\Clsid\ = "{C0733BEF-425C-4E28-8A5A-8CCA4E589748}"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33F2DC0A-B786-4C8C-BF2F-F7B4AC86395B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D1998DB-81DC-4D39-A56A-85528841A141}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}\Control\	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\LockX.ocx, 30000"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2FCE7AA-98F5-4EAB-9E48-19C554C69D5F}\1.0\FLAGS	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33F2DC0A-B786-4C8C-BF2F-F7B4AC86395B}\TypeLib	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33F2DC0A-B786-4C8C-BF2F-F7B4AC86395B}\TypeLib\ = "{A2FCE7AA-98F5-4EAB-9E48-19C554C69D5F}"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}\InprocServer32\ThreadingModel = "Apartment"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D1998DB-81DC-4D39-A56A-85528841A141}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2FCE7AA-98F5-4EAB-9E48-19C554C69D5F}\1.0\FLAGS\ = "2"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2FCE7AA-98F5-4EAB-9E48-19C554C69D5F}\1.0\0	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33F2DC0A-B786-4C8C-BF2F-F7B4AC86395B}\ProxyStubClsid32	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33F2DC0A-B786-4C8C-BF2F-F7B4AC86395B}\TypeLib\ = "{A2FCE7AA-98F5-4EAB-9E48-19C554C69D5F}"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D1998DB-81DC-4D39-A56A-85528841A141}\ = "__Lock"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33F2DC0A-B786-4C8C-BF2F-F7B4AC86395B}\ProxyStubClsid32	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D1998DB-81DC-4D39-A56A-85528841A141}\ProxyStubClsid32	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D1998DB-81DC-4D39-A56A-85528841A141}\TypeLib	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}\MiscStatus\1	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33F2DC0A-B786-4C8C-BF2F-F7B4AC86395B}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D1998DB-81DC-4D39-A56A-85528841A141}\ProxyStubClsid	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D1998DB-81DC-4D39-A56A-85528841A141}	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}\InprocServer32	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}\TypeLib	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D1998DB-81DC-4D39-A56A-85528841A141}\TypeLib\Version = "1.0"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}\ProgID\ = "LockX.Lock"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}\InprocServer32\ = "C:\\Windows\\SysWow64\\LockX.ocx"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0733BEF-425C-4E28-8A5A-8CCA4E589748}\ToolboxBitmap32	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LockX.Lock	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D1998DB-81DC-4D39-A56A-85528841A141}\ = "Lock"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D1998DB-81DC-4D39-A56A-85528841A141}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2FCE7AA-98F5-4EAB-9E48-19C554C69D5F}	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D1998DB-81DC-4D39-A56A-85528841A141}\ = "__Lock"	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4444	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
4444	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
4444	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
4444	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4564	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4444	4564	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe	85
PID 4564 wrote to memory of 4444	4564	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe	85
PID 4564 wrote to memory of 4444	4564	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe	85
PID 4564 wrote to memory of 4444	4564	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe	85
PID 4564 wrote to memory of 4444	4564	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe	85
PID 4564 wrote to memory of 4444	4564	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe	85
PID 4564 wrote to memory of 4444	4564	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe	85
PID 4444 wrote to memory of 3464	4444	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe	56
PID 4444 wrote to memory of 3464	4444	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe	56
PID 4444 wrote to memory of 3464	4444	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe	56
PID 4444 wrote to memory of 3464	4444	f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3464
- C:\Users\Admin\AppData\Local\Temp\f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Users\Admin\AppData\Local\Temp\f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\f01e962abcc35b0b96aea14ba111cdec_JaffaCakes118.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\LockX.ocx

Filesize
36KB

MD5
88bda3c2469728757bf5c6660c9f2ea1

SHA1
b344e646fbc4c2fa11a4bdda67b93135fa22994d

SHA256
ff6197564b7094e7184de7e6dba6982ad66e11772d6198e58465ec1e83be77f2

SHA512
0cecd4abb8e8116ff332df50ba6318fa62948faea5230beaf7850aed1c963a5b8158d6a43b9d108d75d26ae1f3474eac033c80adea9da83af38e2e169923ca87

Download Submit
memory/3464-15-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/3464-16-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Filesize
4KB

Download
memory/4444-10-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/4444-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4444-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4444-14-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/4444-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4444-19-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/4444-20-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/4444-21-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/4564-13-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/4564-0-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download