Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    09-05-2024 16:23

General

  • Target

    2ad3b43bab543feeaf885a8437f57260_JaffaCakes118.exe

  • Size

    827KB

  • MD5

    2ad3b43bab543feeaf885a8437f57260

  • SHA1

    e819b840779103e5ba1eb5daa0085f005db2b24c

  • SHA256

    48c0a41a1c195645583c2b0fbf22708fd945078e2628637f7dfb691dfba5893e

  • SHA512

    95773dd8f148ec70f13f666507cce8e8452e3c73198e67bdafa6207f941448239265f1e3a23017af2760e78f19000e66f802f852ef456c9fe04686354169f274

  • SSDEEP

    24576:xHS8ojy3NlFk2eNne0POIebvBNOzEB9D/0huu:xHrojy9l3we0P0N0IDcIu

Malware Config

Extracted

Family

hawkeye_reborn

Attributes
  • fields

  • name

Signatures

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

  • M00nD3v Logger payload 6 IoCs

    Detects M00nD3v Logger payload in memory.

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 5 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Drops startup file 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2ad3b43bab543feeaf885a8437f57260_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2ad3b43bab543feeaf885a8437f57260_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pzxir2qu\pzxir2qu.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2936
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3073.tmp" "c:\Users\Admin\AppData\Local\Temp\pzxir2qu\CSCB5D6283159554CE99864B9E941BD4CA2.TMP"
        3⤵
          PID:2560
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /query
        2⤵
          PID:2588
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /create /sc MINUTE /tn iRDgQZ /MO 1 /tr "C:\Users\Admin\AppData\Roaming\mediac\mediac.exe\
          2⤵
          • Creates scheduled task(s)
          PID:2860
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2232
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp5C62.tmp"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1232
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp4E11.tmp"
            3⤵
            • Accesses Microsoft Outlook accounts
            PID:796
      • C:\Windows\system32\taskeng.exe
        taskeng.exe {4A25A1D2-FEE2-4F1D-897B-3F11A41FF1E9} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:552
        • C:\Users\Admin\AppData\Roaming\mediac\mediac.exe
          C:\Users\Admin\AppData\Roaming\mediac\mediac.exe "C:\Users\Admin\AppData\Roaming\mediac\mediac.exe\"
          2⤵
          • Drops startup file
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:264
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z4myl11t\z4myl11t.cmdline"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2020
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF122.tmp" "c:\Users\Admin\AppData\Local\Temp\z4myl11t\CSC618802A1B9E841288EF39FA2ACABB941.TMP"
              4⤵
                PID:1684
            • C:\Windows\SysWOW64\schtasks.exe
              "schtasks.exe" /query
              3⤵
                PID:2844
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
                3⤵
                • Suspicious use of SetThreadContext
                PID:1928
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp19B8.tmp"
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1412
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmpB86.tmp"
                  4⤵
                  • Accesses Microsoft Outlook accounts
                  PID:2860
            • C:\Users\Admin\AppData\Roaming\mediac\mediac.exe
              C:\Users\Admin\AppData\Roaming\mediac\mediac.exe "C:\Users\Admin\AppData\Roaming\mediac\mediac.exe\"
              2⤵
              • Drops startup file
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:560
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ppvodtxu\ppvodtxu.cmdline"
                3⤵
                  PID:1912
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDA29.tmp" "c:\Users\Admin\AppData\Local\Temp\ppvodtxu\CSC2E210E00F2E14651A1CF8742B3F68CD.TMP"
                    4⤵
                      PID:2908
                  • C:\Windows\SysWOW64\schtasks.exe
                    "schtasks.exe" /query
                    3⤵
                      PID:1632
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
                      3⤵
                        PID:2748
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
                        3⤵
                        • Suspicious use of SetThreadContext
                        PID:2752
                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp30D.tmp"
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2384

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\RES3073.tmp

                    Filesize

                    1KB

                    MD5

                    0c7b0ac958b61fba8f22b9f45904020c

                    SHA1

                    e084091101d7645097ecc323076b71a72a259d3a

                    SHA256

                    1ff58b5fc7a4c71398b3aad112a3ff27a64c820f5087ea36fc34486554313a1b

                    SHA512

                    ea74ceb06c19712782f01defee7bb0e0e7031976da06f3e6c3febcd96b999c831c6428b130489b814c0d11dd86d94817380aa9dd1469c63274cd37d72d03f8e8

                  • C:\Users\Admin\AppData\Local\Temp\RESDA29.tmp

                    Filesize

                    1KB

                    MD5

                    08fc1cd2fe6aa28abac8c135efc08b67

                    SHA1

                    03626802826ca984d9f3f806585025eaacfaaf30

                    SHA256

                    618bded94543ce17784c2ff0f3cb8adc7b9d1b749c958624cab1cd029c9b26f2

                    SHA512

                    49a17a0fd7e8ccb71113c2d2322d15dce7a1621d07a1a13403fcc865097580fd20645b3aa188511cf85369332238ee2d256787f4662e7382ad8421fc56f067a6

                  • C:\Users\Admin\AppData\Local\Temp\RESF122.tmp

                    Filesize

                    1KB

                    MD5

                    678bccbd6aaa89a9fd5b509e8bae0506

                    SHA1

                    68959bfdf4c0b95cf69a66cb362f3f772a9cedd4

                    SHA256

                    8fefde67dd1f60d9590c28ec1ac8d5dbeae6d5421b3c0a213f827835c0786439

                    SHA512

                    27ca349ebf7a879148a31b2d1c058ca074d00edc989dcc3ce5c7c8f5d7409bf6910d5ac27cc89f938bd6535edc90f3e7bc6f8efbeb1858f740359fb60da51109

                  • C:\Users\Admin\AppData\Local\Temp\ppvodtxu\ppvodtxu.dll

                    Filesize

                    7KB

                    MD5

                    f264315ed91e54048c7c70f7bab56cde

                    SHA1

                    de9c22f263553929f76a56a03ec317c79b087d6f

                    SHA256

                    ecf0689163a00343e23dff59a8001c5becfbb6be6f15a405d724c31c5557334c

                    SHA512

                    69b2b03a571046296c8d0da56d6677950255dfa91afd7f69cfc181a91676ee52aff395abf49894f4e3ad8cc04b37acc737ea0ba68db447d7c3beae03802a4f84

                  • C:\Users\Admin\AppData\Local\Temp\ppvodtxu\ppvodtxu.pdb

                    Filesize

                    19KB

                    MD5

                    4a1ccaa34b34e33de2f1d4896939b7e7

                    SHA1

                    22d2a3f4c49e3528bbd5902054fa4bff606ad0da

                    SHA256

                    ea3ecde72635f54bb9c8974ece5eb925f921e0d1e5bfa6ddd785ac8b953ecb2c

                    SHA512

                    ae575e36e7920ddc4326b4a0553ea85f4743f4c6cba57e55b4f3251b8c636c93e76dd775c380a7edeb32b2067588eb8e35fd07c7c38ad97b5aca3b9a0b1c46d8

                  • C:\Users\Admin\AppData\Local\Temp\pzxir2qu\pzxir2qu.dll

                    Filesize

                    7KB

                    MD5

                    2132d354b35c3e3786189d8b10a14b25

                    SHA1

                    e9c3b98863a07a6fc90c8f242e08a9156f2bad72

                    SHA256

                    1ff74239ee4a1fb093aac43fcc9aabe4921ec41f8d1082594659d676053c3434

                    SHA512

                    5a5144bd367c1b60dc8493775ece6fa58dc2f0852dfd03ecbc47bb960dc4084ed5fdaa967a4fc9adb2a570077b3b7ad55877eac8504c8e61442a0985aac9a22c

                  • C:\Users\Admin\AppData\Local\Temp\pzxir2qu\pzxir2qu.pdb

                    Filesize

                    19KB

                    MD5

                    14f0024ab1363fa504b386636bd3256f

                    SHA1

                    868f72f313b0607726bc485357ad0a69d3b336d6

                    SHA256

                    5f4b9711ac1b9144bdc8a094a157a812887e7ce1496ba8eebbf345cee854482c

                    SHA512

                    3285400f4e554627179005a801b348908c494010588722a54382c4ecdee80bd32dc6ba29e95ea1f9097637196a2d47430fea1b875af7f8249a5ea7c9eab4d777

                  • C:\Users\Admin\AppData\Local\Temp\tmp5C62.tmp

                    Filesize

                    2B

                    MD5

                    f3b25701fe362ec84616a93a45ce9998

                    SHA1

                    d62636d8caec13f04e28442a0a6fa1afeb024bbb

                    SHA256

                    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                    SHA512

                    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                  • C:\Users\Admin\AppData\Local\Temp\z4myl11t\z4myl11t.dll

                    Filesize

                    7KB

                    MD5

                    97193f2b31f0b488259198deec77d9fb

                    SHA1

                    a14a1b41813f6796536e7abd04a4c60cae7daccc

                    SHA256

                    2a05d7800267bdc7e3dabcc0a1ec9b3243f84c5c0a14321111dd8e9477ab4830

                    SHA512

                    d8d44741263d6fdc8bdb4d341c47077777398cb841bebe94947a6c462fa33af30f1bc7946151baa5c39252409c84f7366d035e812845f9a1338197d88109e87b

                  • C:\Users\Admin\AppData\Local\Temp\z4myl11t\z4myl11t.pdb

                    Filesize

                    19KB

                    MD5

                    685ed6c90bdf179e57da802589d168c6

                    SHA1

                    6ade072240112aa40e5343291495421e2c8b28b9

                    SHA256

                    97a1cfd594865887ddf3ac42eb16adf26fd427a44461d444a16578b597e733f3

                    SHA512

                    6a8c82c3c386a9a202726788e0414209f675c3caf3b4b367f83844ab043b6f08282ee679819f1594bcb8810becd461ec04760cedb6fd6f0bbda6773b59b8df8f

                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iRDgQZ.url

                    Filesize

                    82B

                    MD5

                    4db23607f69a6b46a59582ffa56cdee7

                    SHA1

                    b0a97f1c1e1ecbeb83a8eaaba469484a80767048

                    SHA256

                    c1ca35bb1129d646fce770121e0a76e7922d668449d01fd265f0c4da3bb839f4

                    SHA512

                    6e3c133012f104f03c9f939ed6b349dea4b3f615a9b0983c0ea1e290a28580052a106ec6b5aaae0e71f8f1f39e3e92b040fa9d3ae0f6ac682b86f3f60d1730b9

                  • C:\Users\Admin\AppData\Roaming\mediac\mediac.exe

                    Filesize

                    827KB

                    MD5

                    2ad3b43bab543feeaf885a8437f57260

                    SHA1

                    e819b840779103e5ba1eb5daa0085f005db2b24c

                    SHA256

                    48c0a41a1c195645583c2b0fbf22708fd945078e2628637f7dfb691dfba5893e

                    SHA512

                    95773dd8f148ec70f13f666507cce8e8452e3c73198e67bdafa6207f941448239265f1e3a23017af2760e78f19000e66f802f852ef456c9fe04686354169f274

                  • \??\c:\Users\Admin\AppData\Local\Temp\ppvodtxu\CSC2E210E00F2E14651A1CF8742B3F68CD.TMP

                    Filesize

                    1KB

                    MD5

                    7c3e4a5955488b322e8a3509147988a6

                    SHA1

                    11d6cdf0e5be4a6907760975c64f307f5357c430

                    SHA256

                    100806616d2b136c0b4b30eb8a606a59b76be9307b2cfde25d1678d44ffa57c6

                    SHA512

                    66800218d6f20def0afdf2e0fc27ef55f1f5a1b17ee9096c6e146eb51f9bccbc6008515b793afe7827966eb26791fa087611b6ee853e801f14696b55eed838ff

                  • \??\c:\Users\Admin\AppData\Local\Temp\ppvodtxu\ppvodtxu.cmdline

                    Filesize

                    312B

                    MD5

                    844036f999c7ecc4606e7b695db2ac00

                    SHA1

                    f96fab33d4849eb93971fdf6880a2fbd91039432

                    SHA256

                    47e113da1efd39454c9c22671e17bcc1f843e64efd5cd883fcd4e018c60445a6

                    SHA512

                    bc99ab3b92b63ac39a36cd179d83cca8d70dff22c6187e369931315b5f7022ca5856037c87f95a6a013dbdfc823d2ac5350db43d1a52bb9a889eb46b8ace159d

                  • \??\c:\Users\Admin\AppData\Local\Temp\pzxir2qu\CSCB5D6283159554CE99864B9E941BD4CA2.TMP

                    Filesize

                    1KB

                    MD5

                    7d53d8c75c6a0671ef6bc9325fafcf81

                    SHA1

                    6cc757ca588088846277d0c137b016995b6b44eb

                    SHA256

                    3b42f4f9c22e6e96e0bab5f21f2f85a6dde31eabb6c1067c38ea372095989f61

                    SHA512

                    4cc59715eb9dca5172d92b38bad5a4ab462c96e8e98cbcb11e05970fba0c8decb249cf1ec3566f767904bdf4ad8c03304e898e8a2b139617ac9336970a1a5e6e

                  • \??\c:\Users\Admin\AppData\Local\Temp\pzxir2qu\pzxir2qu.0.cs

                    Filesize

                    4KB

                    MD5

                    a04a63817eb03e5e7bad5a6a3d4209dc

                    SHA1

                    1fc0258571ca78dbfa7aafe96195c27236319cfe

                    SHA256

                    365e777df680a31c2d643ae25b623081dec6e523e70608cc28e86516e2bff634

                    SHA512

                    13b83170e5a7816b1327623907bb5a244ff0159b23a3130c35d6a278e74be8366aa27a09e20abfaceb92c3d88f6568ecae9795d49d396c13c6c1a57770f4d33b

                  • \??\c:\Users\Admin\AppData\Local\Temp\pzxir2qu\pzxir2qu.cmdline

                    Filesize

                    312B

                    MD5

                    f5178f248a401a262d993e3050be90e7

                    SHA1

                    9f71241290202a624a97a559f44b806a4c79d6e0

                    SHA256

                    da8b179d23bb5bd63615275fb16f571a15c94721e7bb71b05d2090d1faedde83

                    SHA512

                    2818caec1434d4790910c42b9fd28f8874c69e2a1c419bc6da260a413a3fb34a7ee2ba47bf4f1ddeac69e60a5e921c279cda31eca62ad01777dd2a81d0c8b2c0

                  • \??\c:\Users\Admin\AppData\Local\Temp\z4myl11t\CSC618802A1B9E841288EF39FA2ACABB941.TMP

                    Filesize

                    1KB

                    MD5

                    a9d983686cc025b49e4ce6f26ffcaf9c

                    SHA1

                    42d22dfa20999addac16cb798b412b4aa7f6330e

                    SHA256

                    1052c8a37cbcd542dd916d9b52b7cc2fae132feb513c59e409e53f3da75061b2

                    SHA512

                    9ae41a01980bc2062a1b45f086a2e03fceac52eb1efa8603803d555642357f16725df8ade414e47b73dd0da5e57278e377451ad788e878a00fc39a01d82e48f8

                  • \??\c:\Users\Admin\AppData\Local\Temp\z4myl11t\z4myl11t.cmdline

                    Filesize

                    312B

                    MD5

                    9e947d487af1224be70d4f24d9003581

                    SHA1

                    fe89419d277c8f53342d0a4b54e2c0a04c28bf0b

                    SHA256

                    91e868bac97f3c55bb33d6756ef87ec69001fd9b1cd921651c8bde35c14f08b3

                    SHA512

                    2ffff358e89f8af40518a50c09023c5e04ddb90638799a75ddc6bf94b5edfd2526be08829e43af9c94d77fbb8da91da900a7f6bc67ca471bce91f54133fa7216

                  • memory/264-57-0x0000000001250000-0x000000000130C000-memory.dmp

                    Filesize

                    752KB

                  • memory/264-72-0x00000000004D0000-0x00000000004D8000-memory.dmp

                    Filesize

                    32KB

                  • memory/560-134-0x00000000004C0000-0x00000000004C8000-memory.dmp

                    Filesize

                    32KB

                  • memory/796-105-0x0000000000400000-0x000000000041C000-memory.dmp

                    Filesize

                    112KB

                  • memory/796-116-0x0000000000400000-0x000000000041C000-memory.dmp

                    Filesize

                    112KB

                  • memory/796-107-0x0000000000400000-0x000000000041C000-memory.dmp

                    Filesize

                    112KB

                  • memory/796-109-0x0000000000400000-0x000000000041C000-memory.dmp

                    Filesize

                    112KB

                  • memory/796-111-0x0000000000400000-0x000000000041C000-memory.dmp

                    Filesize

                    112KB

                  • memory/796-113-0x0000000000400000-0x000000000041C000-memory.dmp

                    Filesize

                    112KB

                  • memory/1232-49-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                    Filesize

                    4KB

                  • memory/1232-41-0x0000000000400000-0x000000000045B000-memory.dmp

                    Filesize

                    364KB

                  • memory/1232-43-0x0000000000400000-0x000000000045B000-memory.dmp

                    Filesize

                    364KB

                  • memory/1232-53-0x0000000000400000-0x000000000045B000-memory.dmp

                    Filesize

                    364KB

                  • memory/1232-45-0x0000000000400000-0x000000000045B000-memory.dmp

                    Filesize

                    364KB

                  • memory/1232-47-0x0000000000400000-0x000000000045B000-memory.dmp

                    Filesize

                    364KB

                  • memory/1232-39-0x0000000000400000-0x000000000045B000-memory.dmp

                    Filesize

                    364KB

                  • memory/1232-50-0x0000000000400000-0x000000000045B000-memory.dmp

                    Filesize

                    364KB

                  • memory/1232-51-0x0000000000400000-0x000000000045B000-memory.dmp

                    Filesize

                    364KB

                  • memory/1412-100-0x0000000000400000-0x000000000045B000-memory.dmp

                    Filesize

                    364KB

                  • memory/1412-103-0x0000000000400000-0x000000000045B000-memory.dmp

                    Filesize

                    364KB

                  • memory/2232-36-0x0000000000400000-0x0000000000490000-memory.dmp

                    Filesize

                    576KB

                  • memory/2232-27-0x0000000000400000-0x0000000000490000-memory.dmp

                    Filesize

                    576KB

                  • memory/2232-25-0x0000000000400000-0x0000000000490000-memory.dmp

                    Filesize

                    576KB

                  • memory/2232-29-0x0000000000400000-0x0000000000490000-memory.dmp

                    Filesize

                    576KB

                  • memory/2232-35-0x0000000000400000-0x0000000000490000-memory.dmp

                    Filesize

                    576KB

                  • memory/2232-31-0x0000000000400000-0x0000000000490000-memory.dmp

                    Filesize

                    576KB

                  • memory/2232-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                    Filesize

                    4KB

                  • memory/2232-34-0x0000000000400000-0x0000000000490000-memory.dmp

                    Filesize

                    576KB

                  • memory/2980-0-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

                    Filesize

                    4KB

                  • memory/2980-37-0x0000000074B30000-0x000000007521E000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/2980-24-0x0000000005260000-0x00000000052F0000-memory.dmp

                    Filesize

                    576KB

                  • memory/2980-21-0x00000000005C0000-0x00000000005CC000-memory.dmp

                    Filesize

                    48KB

                  • memory/2980-20-0x00000000051C0000-0x000000000525A000-memory.dmp

                    Filesize

                    616KB

                  • memory/2980-18-0x0000000000380000-0x0000000000388000-memory.dmp

                    Filesize

                    32KB

                  • memory/2980-3-0x0000000074B30000-0x000000007521E000-memory.dmp

                    Filesize

                    6.9MB

                  • memory/2980-2-0x00000000002E0000-0x00000000002E8000-memory.dmp

                    Filesize

                    32KB

                  • memory/2980-1-0x0000000000190000-0x000000000024C000-memory.dmp

                    Filesize

                    752KB

                  We care about your privacy.

                  This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.