Overview

overview

8

Static

static

8

HealthcareDire...59.doc

windows7_x64

4

HealthcareDire...59.doc

windows10-2004_x64

1
General
Target

HealthcareDirective_159.doc

Filesize

219KB

Completed

21-05-2022 12:48

Task

behavioral1

Score
4/10
MD5

2e0ef931fd3e5d1c6850a10bada1d318

SHA1

819577bf6d9830b14944b2f6d2265e42b5fbff4f

SHA256

d021532bbc51db3ba1e273e427e9788d21c32069d77869593ac6acce7c5f55e9

SHA512

8dc1cf64f67c56db82749a6ff2f21ca3e2a2e319ee306737a373dcb65c6fe418a1c1ca7c120274ddbe02072ce291fba114fb7e1106efc6154c8454751f498fae

Malware Config
Signatures 8

Filter: none

Defense Evasion
  • Drops file in Windows directory
    WINWORD.EXE

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\Debug\WIA\wiatrace.logWINWORD.EXE
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings
    WINWORD.EXE

    Tags

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"WINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\editWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML EditorWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shellWINWORD.EXE
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"WINWORD.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"WINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shellWINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"WINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML EditorWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\commandWINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\ToolbarWINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft ExcelWINWORD.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"WINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMANDWINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML EditorWINWORD.EXE
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000WINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""WINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML EditorWINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExtWINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNoteWINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"WINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shellWINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\editWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shellWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\editWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\editWINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMANDWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\commandWINWORD.EXE
  • Modifies registry class
    WINWORD.EXE

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl"WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.htmWINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5"WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\commandWINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents"WINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{67B4DC72-81E2-42E4-807C-0FDE4C96C874}\2.0\FLAGSWINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton"WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}WINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""WINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfileWINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea"WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\VersionWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandlerWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexecWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\commandWINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3"WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\commandWINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\commandWINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\commandWINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\editWINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}WINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\commandWINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText"WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents"WINWORD.EXE
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\editWINWORD.EXE
    Key deleted\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\EditWINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\TypeLib\{67B4DC72-81E2-42E4-807C-0FDE4C96C874}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}WINWORD.EXE
    Set value (str)\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"WINWORD.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption"WINWORD.EXE
    Key created\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}WINWORD.EXE
  • Suspicious behavior: AddClipboardFormatListener
    WINWORD.EXE

    Reported IOCs

    pidprocess
    1896WINWORD.EXE
  • Suspicious use of FindShellTrayWindow
    WINWORD.EXE

    Reported IOCs

    pidprocess
    1896WINWORD.EXE
    1896WINWORD.EXE
  • Suspicious use of SetWindowsHookEx
    WINWORD.EXE

    Reported IOCs

    pidprocess
    1896WINWORD.EXE
    1896WINWORD.EXE
  • Suspicious use of WriteProcessMemory
    WINWORD.EXE

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1896 wrote to memory of 7481896WINWORD.EXEsplwow64.exe
    PID 1896 wrote to memory of 7481896WINWORD.EXEsplwow64.exe
    PID 1896 wrote to memory of 7481896WINWORD.EXEsplwow64.exe
    PID 1896 wrote to memory of 7481896WINWORD.EXEsplwow64.exe
Processes 2
  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\HealthcareDirective_159.doc"
    Drops file in Windows directory
    Modifies Internet Explorer settings
    Modifies registry class
    Suspicious behavior: AddClipboardFormatListener
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1896
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      PID:748
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads

                        • memory/748-69-0x0000000000000000-mapping.dmp

                          Download

                        • memory/748-70-0x000007FEFC4B1000-0x000007FEFC4B3000-memory.dmp

                          Download

                        • memory/1896-54-0x0000000072FA1000-0x0000000072FA4000-memory.dmp

                          Download

                        • memory/1896-57-0x00000000765F1000-0x00000000765F3000-memory.dmp

                          Download

                        • memory/1896-58-0x0000000071A0D000-0x0000000071A18000-memory.dmp

                          Download

                        • memory/1896-59-0x00000000005A8000-0x00000000005AC000-memory.dmp

                          Download

                        • memory/1896-60-0x00000000005A8000-0x00000000005AC000-memory.dmp

                          Download

                        • memory/1896-62-0x00000000005A8000-0x00000000005AC000-memory.dmp

                          Download

                        • memory/1896-61-0x00000000005A8000-0x00000000005AC000-memory.dmp

                          Download

                        • memory/1896-63-0x00000000005A8000-0x00000000005AC000-memory.dmp

                          Download

                        • memory/1896-65-0x00000000005A8000-0x00000000005AC000-memory.dmp

                          Download

                        • memory/1896-64-0x00000000005A8000-0x00000000005AC000-memory.dmp

                          Download

                        • memory/1896-66-0x00000000005A8000-0x00000000005AC000-memory.dmp

                          Download

                        • memory/1896-67-0x00000000005A8000-0x00000000005AC000-memory.dmp

                          Download

                        • memory/1896-68-0x00000000005A8000-0x00000000005AC000-memory.dmp

                          Download

                        • memory/1896-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

                          Download

                        • memory/1896-55-0x0000000070A21000-0x0000000070A23000-memory.dmp

                          Download

                        • memory/1896-72-0x00000000005A8000-0x00000000005AC000-memory.dmp

                          Download

                        • memory/1896-71-0x00000000005A8000-0x00000000005AC000-memory.dmp

                          Download

                        • memory/1896-74-0x00000000005A8000-0x00000000005AC000-memory.dmp

                          Download

                        • memory/1896-73-0x00000000005A8000-0x00000000005AC000-memory.dmp

                          Download

                        • memory/1896-75-0x00000000005A8000-0x00000000005AC000-memory.dmp

                          Download

                        • memory/1896-76-0x000000005FFF0000-0x0000000060000000-memory.dmp

                          Download