locky | 13302b92d75ad29f88d8a0330c153ed0c5156c659a129e852251a3e3552f8537

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-10-2024 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4be3deb2244ef733b4cc0acb71137481_JaffaCakes118.exe
Size

524KB
MD5

4be3deb2244ef733b4cc0acb71137481
SHA1

6b82b0f3dba275ea3b104bed6c4a35372cb7fb32
SHA256

13302b92d75ad29f88d8a0330c153ed0c5156c659a129e852251a3e3552f8537
SHA512

543cd968bceb879e2b3ee66373900d0cda9d5934b1deee9c18c6408070574c193b96429ddbcda0b876e994551eb2d03c009d3ba81d0412d1fc2ec39b10bed77c
SSDEEP

12288:L/yDzz6y9v3lbQW/bAol5DUnxR09GhMJFXG9y6xo9Bca1SVF5ARU+glNYJyQUdUf:L/yvZL/8oXDUxK9GhMHXG9y6xo9Bca8y

Score

10^/10

locky locky_osiris defense_evasion discovery ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
ransomware locky_osiris
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\DesktopOSIRIS.bmp"	4be3deb2244ef733b4cc0acb71137481_JaffaCakes118.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4be3deb2244ef733b4cc0acb71137481_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\Desktop\WallpaperStyle = "0"	4be3deb2244ef733b4cc0acb71137481_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\Desktop\TileWallpaper = "0"	4be3deb2244ef733b4cc0acb71137481_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
2988	identity_helper.exe
2988	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 3428	3008	4be3deb2244ef733b4cc0acb71137481_JaffaCakes118.exe	86
PID 3008 wrote to memory of 3428	3008	4be3deb2244ef733b4cc0acb71137481_JaffaCakes118.exe	86
PID 3008 wrote to memory of 684	3008	4be3deb2244ef733b4cc0acb71137481_JaffaCakes118.exe	102
PID 3008 wrote to memory of 684	3008	4be3deb2244ef733b4cc0acb71137481_JaffaCakes118.exe	102
PID 684 wrote to memory of 4040	684	msedge.exe	104
PID 684 wrote to memory of 4040	684	msedge.exe	104
PID 3008 wrote to memory of 2496	3008	4be3deb2244ef733b4cc0acb71137481_JaffaCakes118.exe	103
PID 3008 wrote to memory of 2496	3008	4be3deb2244ef733b4cc0acb71137481_JaffaCakes118.exe	103
PID 3008 wrote to memory of 2496	3008	4be3deb2244ef733b4cc0acb71137481_JaffaCakes118.exe	103
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 5116	684	msedge.exe	106
PID 684 wrote to memory of 4068	684	msedge.exe	107
PID 684 wrote to memory of 4068	684	msedge.exe	107
PID 684 wrote to memory of 3888	684	msedge.exe	108
PID 684 wrote to memory of 3888	684	msedge.exe	108
PID 684 wrote to memory of 3888	684	msedge.exe	108
PID 684 wrote to memory of 3888	684	msedge.exe	108
PID 684 wrote to memory of 3888	684	msedge.exe	108
PID 684 wrote to memory of 3888	684	msedge.exe	108
PID 684 wrote to memory of 3888	684	msedge.exe	108
PID 684 wrote to memory of 3888	684	msedge.exe	108
PID 684 wrote to memory of 3888	684	msedge.exe	108
PID 684 wrote to memory of 3888	684	msedge.exe	108
PID 684 wrote to memory of 3888	684	msedge.exe	108
PID 684 wrote to memory of 3888	684	msedge.exe	108
PID 684 wrote to memory of 3888	684	msedge.exe	108

C:\Users\Admin\AppData\Local\Temp\4be3deb2244ef733b4cc0acb71137481_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4be3deb2244ef733b4cc0acb71137481_JaffaCakes118.exe"
1⤵
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\DesktopOSIRIS.htm
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9750846f8,0x7ff975084708,0x7ff975084718
    3⤵
    PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,15654182119653708165,8238747517526485707,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,15654182119653708165,8238747517526485707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,15654182119653708165,8238747517526485707,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15654182119653708165,8238747517526485707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15654182119653708165,8238747517526485707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:1616
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,15654182119653708165,8238747517526485707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
    3⤵
    PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,15654182119653708165,8238747517526485707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15654182119653708165,8238747517526485707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
    3⤵
    PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15654182119653708165,8238747517526485707,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15654182119653708165,8238747517526485707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,15654182119653708165,8238747517526485707,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
    3⤵
    PID:4436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\4be3deb2244ef733b4cc0acb71137481_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
264b78514ebedd9721c93da944ca5442

SHA1
7399d4002082229809a0151d7d3eea2bf4bb91af

SHA256
47139215d30a7aadf064c8f005530adbc693baed90f55c23b6992849ee3b7b79

SHA512
22ed79ce240a260e00e45de76449e2259d00cf0d5be3ee75d07b1bcd44cd180cb9c1aa3ca165ba8e0a37aff0712eebe0b36985dfe28a88ac56838858e3e1236f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
be551f8059ef870d51eb87738958fdc4

SHA1
c3ec9a1e27193c1a02c75f1c74564b9d0e662cb2

SHA256
8316876fc9aea01e02bfe764900f589a1f351c08573e9e75e657f05dd4f8a405

SHA512
bb2bbbd061716e146998aef16404af3b48815484ed89b6444e0cf604553d9838d97be1e72ee39f26512c91daebcb278d152994153382777c024dd55252555bc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
55c7c49561b4b3de8e0a3197fe093e04

SHA1
829291961350cd4fccc1417f3fb30dcd3961650f

SHA256
879ff7d3faa92c05543bf53b523641c1f0c4d0102f7ed86152e41fa9c7bc25e9

SHA512
209322952b68e15fcd1c5912c7bb0788d559725606325d3bbc10b81fa0bbff543cfdde01694f79377b0c5bfc4af29a45fadd2cbb3952b0f016ebaac17dd69ec0

Download Submit
C:\Users\Admin\Music\OSIRIS-aa1b.htm

Filesize
8KB

MD5
a6b20d4b0dac9e78e3fbfdd9d04c2742

SHA1
69f3cac12b62a8b0537e7b572aeb16881788fe4c

SHA256
c82f6b0bf92c534f802bafa55b2de9ade31185aaf56620e34e78a69bde81e018

SHA512
25442500b4a8f69c3e9033ec6e26b5b3a72a65e4b74263219465a615c9693aa2e84610ef0227ec8e3439b952a544c18d6ed1f1210cb74aa30853581cd01cd903

Download Submit
memory/3008-5-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download
memory/3008-14-0x0000000002A00000-0x0000000002A27000-memory.dmp

Filesize
156KB

Download
memory/3008-13-0x0000000002A00000-0x0000000002A27000-memory.dmp

Filesize
156KB

Download
memory/3008-15-0x0000000002A00000-0x0000000002A27000-memory.dmp

Filesize
156KB

Download
memory/3008-9-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/3008-358-0x0000000002A00000-0x0000000002A27000-memory.dmp

Filesize
156KB

Download
memory/3008-8-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download
memory/3008-6-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/3008-0-0x0000000002A40000-0x0000000002AB7000-memory.dmp

Filesize
476KB

Download
memory/3008-4-0x0000000002A40000-0x0000000002AB7000-memory.dmp

Filesize
476KB

Download
memory/3008-3-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download
memory/3008-2-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download
memory/3008-1-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download