e8a5046279f1900b43403e960ad119fe90b798bb64af439a8382a1721074b48d

Analysis

max time kernel
135s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

api-ms-win-core-handle-l1-1-0.dll
Size

18KB
MD5

cce27ff9b1e78b61955682788452f785
SHA1

a2e2a40cea25ea4fd64b8deaf4fbe4a2db94107a
SHA256

8ee2de377a045c52bbb05087ae3c2f95576edfb0c2767f40b13454f2d9f779de
SHA512

1fcec1cd70426e3895c48598dfc359839d2b3f2b1e3e94314872a866540353460ec932bf3841e5afe89aa4d6c6fac768e21ae368d68c2bb15f65960f6f5d7d5b
SSDEEP

192:yW1hWBJ9M7tOZk7Cjdks/nGfe4pBjSYj+a2W5RKTt3E2sVWQ4GWJ9xqZsqnajkZ9:yW1hW+5OZkum0GftpBjt7m3SlGlmToC

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2188	WINWORD.EXE
2188	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
4748	msedge.exe
4748	msedge.exe
948	identity_helper.exe
948	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2188	WINWORD.EXE
2188	WINWORD.EXE
2188	WINWORD.EXE
2188	WINWORD.EXE
2188	WINWORD.EXE
2188	WINWORD.EXE
2188	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 2840	4748	msedge.exe	101
PID 4748 wrote to memory of 2840	4748	msedge.exe	101
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 4700	4748	msedge.exe	102
PID 4748 wrote to memory of 2804	4748	msedge.exe	103
PID 4748 wrote to memory of 2804	4748	msedge.exe	103
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104
PID 4748 wrote to memory of 4940	4748	msedge.exe	104

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-core-handle-l1-1-0.dll,#1
1⤵
PID:4604

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Files.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\UnblockSuspend.mht
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffde7f146f8,0x7ffde7f14708,0x7ffde7f14718
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,8050117005441414975,17521580367687437273,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,8050117005441414975,17521580367687437273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,8050117005441414975,17521580367687437273,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8050117005441414975,17521580367687437273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8050117005441414975,17521580367687437273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,8050117005441414975,17521580367687437273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,8050117005441414975,17521580367687437273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8050117005441414975,17521580367687437273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8050117005441414975,17521580367687437273,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8050117005441414975,17521580367687437273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,8050117005441414975,17521580367687437273,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
38a6c3a3cbc8f873b8656d91f713fe08

SHA1
ab37cf86c03d3dda3337bd63465789bebb9ccf38

SHA256
81c9e827b2f295c05a8b7929c414c2cdbc30c8646f4664ff18d2e41c2169b7d2

SHA512
2c65bdadfdb6644806a3ce1f20dd7230e03fda2e7e0a1a3ba0c24e0d7a392a76e37f64aa43f5003ebaf23b9d0ac43c2ba1e31e4bc29b7cb19379c5e85133adb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fff7baaecd2910a23afb1619a2719446

SHA1
72b6d2cbeebfbdf6ad2dc0ddfb07af4f73d88110

SHA256
c8f96269e65e98ac349c5821bb0152e5e674c66b18c345e70d22449fa7760206

SHA512
e36dd749372e598ea2d5ca3bf4fca6f1dfa6f4821ce4f11359f76961900f231e6a4fb03d6478d1dabc039c004ead4a252cfee500b0b06b764330aead1c4da4bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
faeb86150d302ffc7abf300b56b9d4c1

SHA1
b655de5798c31ecf783929dabdaf02cf49d6d49e

SHA256
4ca873450c3f24573a37ebf67cf06cd5c9ff4439504b8928bd76d9d901992bc1

SHA512
0bf842c95a5f73ad6a3c70797339a6a6b2eca296fee1061952a588c950850dc207ba81c914ee4ffd30396eb3e2ffe5070b3d7d2d1d8b5556a6e5781133e919dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Filesize
2KB

MD5
f9fbe041919457b474a64673bebd9e94

SHA1
db837001270467d77a27ddd12978ae6ba7e8d8f8

SHA256
04780a0437e158ef6891facee510f149fee4f309763e9de669cd93d6eb9a962d

SHA512
b60fa6546b4c926d753cc141e72c0fea1aa1f69e49b1b421a94f1a92b6ff11a256e741939676e60d65dade0cf29d5f0ef1513c6fd92657a60ed534ff4aa89eb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

Filesize
2KB

MD5
6cc5015f175c9819f64b1af8fae8509f

SHA1
49afb01d164c3e6bd1130ac9cb336312fed0997f

SHA256
b76fa6ca92de2c92de108c03e00926e8f141ee195e0dbd960881497aa34a3037

SHA512
9ef5427305582a338c8ec24be0344b402ab45fb2d88e7aad6bdb382e0863db9263af7a0999cb7b38c25d47faa7165336321e19dfdec21d366f5069abf2d62555

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
201B

MD5
35375f95b1430c8b11ebeb931fba0dda

SHA1
5122d139ac357db969c191b941bd479ceb9dc59f

SHA256
fd5691afe44306226fa973037fe144c3214867067cf88cb2285394888d959d5b

SHA512
b9043a4d4470ac90f83244a81fad5de8944b83ba1e8ab6bbc7d29fb216c2ded74bf1c7b1ca8c84535b989075660e83f676e273a1b524f9e5dd8e04fee412cc6b

Download Submit
memory/2188-18-0x00007FFE066B0000-0x00007FFE068A5000-memory.dmp

Filesize
2.0MB

Download
memory/2188-60-0x00007FFDC6730000-0x00007FFDC6740000-memory.dmp

Filesize
64KB

Download
memory/2188-11-0x00007FFDC40C0000-0x00007FFDC40D0000-memory.dmp

Filesize
64KB

Download
memory/2188-12-0x00007FFE066B0000-0x00007FFE068A5000-memory.dmp

Filesize
2.0MB

Download
memory/2188-13-0x00007FFE066B0000-0x00007FFE068A5000-memory.dmp

Filesize
2.0MB

Download
memory/2188-14-0x00007FFE066B0000-0x00007FFE068A5000-memory.dmp

Filesize
2.0MB

Download
memory/2188-16-0x00007FFE066B0000-0x00007FFE068A5000-memory.dmp

Filesize
2.0MB

Download
memory/2188-0-0x00007FFDC6730000-0x00007FFDC6740000-memory.dmp

Filesize
64KB

Download
memory/2188-17-0x00007FFE066B0000-0x00007FFE068A5000-memory.dmp

Filesize
2.0MB

Download
memory/2188-15-0x00007FFE066B0000-0x00007FFE068A5000-memory.dmp

Filesize
2.0MB

Download
memory/2188-19-0x00007FFDC40C0000-0x00007FFDC40D0000-memory.dmp

Filesize
64KB

Download
memory/2188-20-0x00007FFE066B0000-0x00007FFE068A5000-memory.dmp

Filesize
2.0MB

Download
memory/2188-10-0x00007FFE066B0000-0x00007FFE068A5000-memory.dmp

Filesize
2.0MB

Download
memory/2188-8-0x00007FFE066B0000-0x00007FFE068A5000-memory.dmp

Filesize
2.0MB

Download
memory/2188-61-0x00007FFDC6730000-0x00007FFDC6740000-memory.dmp

Filesize
64KB

Download
memory/2188-62-0x00007FFDC6730000-0x00007FFDC6740000-memory.dmp

Filesize
64KB

Download
memory/2188-59-0x00007FFDC6730000-0x00007FFDC6740000-memory.dmp

Filesize
64KB

Download
memory/2188-63-0x00007FFE066B0000-0x00007FFE068A5000-memory.dmp

Filesize
2.0MB

Download
memory/2188-9-0x00007FFE066B0000-0x00007FFE068A5000-memory.dmp

Filesize
2.0MB

Download
memory/2188-7-0x00007FFE066B0000-0x00007FFE068A5000-memory.dmp

Filesize
2.0MB

Download
memory/2188-6-0x00007FFE066B0000-0x00007FFE068A5000-memory.dmp

Filesize
2.0MB

Download
memory/2188-4-0x00007FFDC6730000-0x00007FFDC6740000-memory.dmp

Filesize
64KB

Download
memory/2188-5-0x00007FFE0674D000-0x00007FFE0674E000-memory.dmp

Filesize
4KB

Download
memory/2188-1-0x00007FFDC6730000-0x00007FFDC6740000-memory.dmp

Filesize
64KB

Download
memory/2188-2-0x00007FFDC6730000-0x00007FFDC6740000-memory.dmp

Filesize
64KB

Download
memory/2188-3-0x00007FFDC6730000-0x00007FFDC6740000-memory.dmp

Filesize
64KB

Download