Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-12-2024 01:54

General

  • Target

    dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe

  • Size

    881KB

  • MD5

    dc7995dba8cf2cbaee063c4a1b54a058

  • SHA1

    de07f4dd4bb61cea6f058addaa0b6ad922e1790b

  • SHA256

    c42c871cd29b62344d701a854d15b370e7987d7daad60a8574d4e6b5a5636678

  • SHA512

    bb2242fce06e808b7547fc27bf2459c7f0d2e1c3b64c2c20110ef9da093945622697cb2c9496ffe9760c4fa42ced6f9238992bab997a7acdcc78348f9655b9f8

  • SSDEEP

    12288:wu+c+R2Swz+EHJh8LlWDoLaMVR3obhwxDzKQUwSIHvHq+luKwyB:r+gSe7h8LnXJo9iDzKBwSIy+lgyB

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dc7995dba8cf2cbaee063c4a1b54a058_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4208
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3476
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3432
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1620
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2084
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1264
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:5100
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1520
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2652
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2788
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3012
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4920
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2280
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1004
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4520
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3260
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3976
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3716
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3732
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1224
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-NetConnection
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2488

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    c018e16dd35f28481778200f64d48f7d

    SHA1

    1c62dc5094a3c3c1a029a6c364e085f8b394a5f8

    SHA256

    1eca7f2483e92089e119033f7da113033c06f53bd1925eb2029fcbd00cf14425

    SHA512

    2b100699503cb3c9775faf2ccb3f2365fa412eef29e2d8e631e1fa606bd2c5a4652c3dfb929da0d9964fd1ccf123ee81c509a9a45b03028fb045c6ce3f6c19c7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    3124b64293c805065cb7ddc57929637f

    SHA1

    ec9a69d5d1a7f6a1a30c208763685bc3ddf98f74

    SHA256

    93bb72cdf5cf3fd6b5014e85a924b911c00181b30c4935d5a6777e04f112108c

    SHA512

    82df172dc666f5c66c603e3b8021b1967131002760fa81dc6cf53de63e6739a5b51a2d3886481a9b8deae9e2384ce452e5a20c50157a93bef6c8cede4cae0fa5

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    78f33494d1b195eb9d13fbd921388bde

    SHA1

    38898be0ac4619598adecc5c8ec3a535b56f1158

    SHA256

    e4ff5647acf159934519245f436bf2adaff9c7ccf47b09cfc3c9ae61f61df01f

    SHA512

    ee14e5d10a31d0b2652594849d350e9049cde769dd548c2944e9305f6d4bee5126f450eb92e67a95f5e48ddf8c866630abfbb02398146f88b14ffbe8ca4ac7d5

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    a286e61b0b316a5f7a1567f6f0da1a44

    SHA1

    79f8bb3f818289526b4c1b67f8bc7952a096a196

    SHA256

    fd12c55e785c8d1e477c1dce5626c249e158b0c62e3780141da03beab69f3d4c

    SHA512

    b6e4832c1a490b5c352b6aa0a14b9f4ca677734da4df49c801b181aa7e35df60807777c30785b54458099297d02834e1f672ed7d960f6d56ee0d6dbdb5eaad28

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    ed386d05569b8e1cc910d1a55d07690d

    SHA1

    e0b89f27ccbccd9cbd1151a689a2578bb90fc386

    SHA256

    e9eb795ca09df3e981ce922c9ff86c256124b5a393067de2be81126e649bfe88

    SHA512

    18c2d6e92145106bba1e75a8e912d1a7aafd89cc7b90bb797ff4375d82acde4c78524ee33e5b79b398c4347ee7dedfcb27690f11fd81edd85dfc6bf3dc01b600

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    07c34aadcff80c69a73d98d1c04a7bc5

    SHA1

    c88fefda530da3853502ddc843f87125a2ddc811

    SHA256

    92ca231257872a5af940201919d53ee99a73f0b40c0e73e0e7cfb471cb7d7a82

    SHA512

    40504e4e5771f753f375f51beebc4e78a8624186e8ce19be7ce4e05d62ff56fc5bdd7daf4338ad2f3809f1a3e177048e227fb29db121c3d9c20a86aaac194834

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    2f238205c57c41ccc6f983cb3b8ab54d

    SHA1

    1fdb32ac82ef9c1b7a67ad2e92c803aae011d8cf

    SHA256

    56e2722e0591a9395a2fbd452308028116464f995b84f175455e8b3360add80b

    SHA512

    c0f07573008666f3e71676a23f7f378564bd1a08e6bee813982319972ad36785a745e715d85fef8406e1a3d3011dafe9399addf53b4f03bc2c9f73dcf5a379ad

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    03876375fd9d1aa675c85e6454bc7a06

    SHA1

    ac3053b021f0592e3e26bac893bb7e45d7ada6e1

    SHA256

    91c0b395931b5ec4c0b37e2394d0267d2675ca6218f1123df93dbfbed24c3a63

    SHA512

    9c9dc559b7da93b68bd2fd0dd4b98564d30b24f281cd2a009cfe0cf9fdfa4fef42b764988105688048c8d7a66295df9a84740d8bf4ffd7147c4a800169068492

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    8fd1c512f7cea8f5512a32b8abff7d32

    SHA1

    9c793782afe3df2da9d64d56c23f8f02ec913134

    SHA256

    698fa884ca81205e2ea4990eb88def23f926f6b03b7170d3e05a94fa823abc5d

    SHA512

    590c6923f227fa09348f458d6a20c51f045530723f8574ebe13b9290a5d24eae98ecf84febc75eaa529ac843358b34a7b24be65cbf8f091b580b60168a576cef

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    77a3405cb0a6e27f64e4c819f4e9dae5

    SHA1

    747b8d942a490e70f73f311a0c8f4144efa92704

    SHA256

    2b4c6b28359f29beca014f99422cebddca6c53b8dd3c770a94484aff4913138b

    SHA512

    9c599084c9fb1465ed56dc0f9c7310b211568e03077ed76f97c15dd6986c8a17fe7affb97c83595a156140eb0d3fc351c5272694f406af61877d6ac5ed103e05

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    2e756be5bd28634558c9aef155c9a566

    SHA1

    b83fee875fc295afa8ad79df8dffb20cfe54f1a3

    SHA256

    612aa5cab09c359c8b21540971f817cf55348ce9f7d41e4438d1228f9b08ff5a

    SHA512

    efa908038fdf2be8cfc2a4d43c629b0bdab6a34c0f59410ae7d0f0420bacea9596a29c92ea5e2c6ab162bd656cda8f27c80cdc4ad8f84e60276fef6ca7331395

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    11ec69ee976de00f50060396d9a35d83

    SHA1

    871717366929fa8198e6a354a2d1195e01697dfd

    SHA256

    588de42c81cbc41416d6d30b9c7dad40aca3038f7d44abca01ad319ac852f322

    SHA512

    09cf2337bac8c2a2261529bd1a92822b8dc1c3e9a79ac2b3c5928b7b781af68be1a1316f907aad8fdcc26315a79cd3c16e3fbef239f876f046fe4e5ac79736e4

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    8452b3adfa872882c2f80a3d4628ff9e

    SHA1

    05385daa3b13c8ce22079a85e7452667afe33ad3

    SHA256

    10eb9e9f9a2f17dcca3ed0b31f0b8e0f5156581905222fa05b662ffdc12e0092

    SHA512

    a6978a9faa215ac0f31d58b73b624810568f9a43b96428aae4c5b5783d78f0584e42775e32c8d37c5994d7cb933f86776d802f4c588fadde89f0801081143155

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    3bcdc0b551c328241bc8c41dfa94c9e2

    SHA1

    747f97fbdd2c63477f3e59946a28d8c533811310

    SHA256

    92cb36bebb24e7d6e3f26e84516862c003fc78091d145bc00a28bbec24cd108a

    SHA512

    89e8b88bbd1201d7a482d40ea2f33974b64aac64fdd637eb59a87c39440bf135ec893f610e1786975c284958f56180523bd6a5d09eb4030bb1dae3f0c7b2dfb9

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    92227f9111b1b4dd2a068c9e732306e7

    SHA1

    9d971961bad7765237cec267c9c3eb44131845ec

    SHA256

    260fb806b511a4f8bb3d29381f73ed46bd5685b36747029f1035eed81ad4ac81

    SHA512

    6c0a29356b75c08fe4e8ee5b37d0bc0916523f2956f1a099b0075c3470497c7edb6021a15393edf38d6fe9f042499b2e7fac142834050d380582b31e28c5249b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    8df6762a901d77d440f90232f1fda5ba

    SHA1

    ab2a7486cb1aa6d9e9f20ee1a10cf54cfad6b71c

    SHA256

    111bd398548c74f3e5294275a0a5fd7d73e416c764911b8b8933e0b10aeb322d

    SHA512

    2e079e391dab77900b873543484725aa7554e4c9943da1358e4f8128d899676ca2c2b18b20029897a26e251d12ff28901f6fd28869d2d171318bf59c70778397

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    1b6d5be4c8e0f55c317976775e4e0a3b

    SHA1

    5094d9dacc1287aa78eb658543ccb16050e0ee34

    SHA256

    7018a9b7602ec6ee0d553818140234530acaf42815a4a532572c4db92a4dd581

    SHA512

    e5bd9de8701daf9a4eb4ff4987e1c54a10e6d796b97f86e0492f49d5bde9fa894d12efdff2439da1db6f3cc6bc002c0be8ed168a954b93a22fb26bc7630d5653

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    5b3f16e94f183630bff4777ae6d18ca3

    SHA1

    d91808d4eb182f9b685dd6523467b60a07a0df53

    SHA256

    3aa722fe1be665473c61ed19ce8ca4aa144a0f9ff9c2865e47930e75b50d084e

    SHA512

    afb0c82babe990620d7fc917df97104fef43058a67445b99b82aaf17dc9ac6c517cf24dceeab19b2f0fe0a87396ca314e93ec32cff333a5979a6ed0f9910b896

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    18e0e389e10450719bbdcf44563d1510

    SHA1

    ab77cd86907a80272a79032b0b664b56974df8a1

    SHA256

    d244bbbd60785babe8fa5275087149e7ba9e3ebf6e4debd7bb4fa42b4871353d

    SHA512

    c857e0ccdcd12f8c7087530fb698bf912deba2e3e465fe265ecb9f22c8ecd995f93662e9d45b22cc6c59ebc9ba7aa3f319c20b127f91dbd7743d7763ac9784e7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    23KB

    MD5

    a4a1489f9256938fbfe27cf941e7f9e6

    SHA1

    3401f5b53c604d941c3f6b059498bd14db3953eb

    SHA256

    5ac4ffe4ea5f209933f0d3670a48f07445da9d2912f84c28f1243478f574d1db

    SHA512

    ac43a72888525c32bfe7429796a7edc12d9e5889468c3db6af0f7036a483ccb249c162de8fb0470b9440ee623d0b400d36e985be50a82501161d8c29f1007f61

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p0lbodxa.g4z.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/1004-304-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/1224-430-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/1264-134-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/1520-177-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/1520-175-0x0000000005F50000-0x00000000062A4000-memory.dmp

    Filesize

    3.3MB

  • memory/1620-92-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/2084-113-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/2280-283-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/2488-451-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/2652-198-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/2788-219-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/3012-240-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/3260-346-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/3432-58-0x0000000075190000-0x0000000075940000-memory.dmp

    Filesize

    7.7MB

  • memory/3432-68-0x00000000061F0000-0x0000000006544000-memory.dmp

    Filesize

    3.3MB

  • memory/3432-81-0x0000000075190000-0x0000000075940000-memory.dmp

    Filesize

    7.7MB

  • memory/3432-56-0x0000000075190000-0x0000000075940000-memory.dmp

    Filesize

    7.7MB

  • memory/3432-57-0x0000000075190000-0x0000000075940000-memory.dmp

    Filesize

    7.7MB

  • memory/3432-70-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/3476-35-0x0000000006F80000-0x0000000007023000-memory.dmp

    Filesize

    652KB

  • memory/3476-8-0x0000000005830000-0x0000000005896000-memory.dmp

    Filesize

    408KB

  • memory/3476-33-0x0000000006F00000-0x0000000006F1E000-memory.dmp

    Filesize

    120KB

  • memory/3476-2-0x0000000004A10000-0x0000000004A46000-memory.dmp

    Filesize

    216KB

  • memory/3476-49-0x0000000075190000-0x0000000075940000-memory.dmp

    Filesize

    7.7MB

  • memory/3476-48-0x0000000075190000-0x0000000075940000-memory.dmp

    Filesize

    7.7MB

  • memory/3476-3-0x0000000075190000-0x0000000075940000-memory.dmp

    Filesize

    7.7MB

  • memory/3476-46-0x00000000077C0000-0x00000000077CE000-memory.dmp

    Filesize

    56KB

  • memory/3476-45-0x0000000075190000-0x0000000075940000-memory.dmp

    Filesize

    7.7MB

  • memory/3476-44-0x0000000007810000-0x0000000007834000-memory.dmp

    Filesize

    144KB

  • memory/3476-43-0x00000000077E0000-0x000000000780A000-memory.dmp

    Filesize

    168KB

  • memory/3476-4-0x0000000075190000-0x0000000075940000-memory.dmp

    Filesize

    7.7MB

  • memory/3476-42-0x0000000007780000-0x000000000779A000-memory.dmp

    Filesize

    104KB

  • memory/3476-41-0x0000000007640000-0x0000000007650000-memory.dmp

    Filesize

    64KB

  • memory/3476-40-0x00000000074D0000-0x00000000074E1000-memory.dmp

    Filesize

    68KB

  • memory/3476-34-0x0000000075190000-0x0000000075940000-memory.dmp

    Filesize

    7.7MB

  • memory/3476-38-0x0000000007340000-0x000000000734A000-memory.dmp

    Filesize

    40KB

  • memory/3476-37-0x00000000072D0000-0x00000000072EA000-memory.dmp

    Filesize

    104KB

  • memory/3476-36-0x0000000007920000-0x0000000007F9A000-memory.dmp

    Filesize

    6.5MB

  • memory/3476-54-0x0000000075190000-0x0000000075940000-memory.dmp

    Filesize

    7.7MB

  • memory/3476-5-0x0000000005190000-0x00000000057B8000-memory.dmp

    Filesize

    6.2MB

  • memory/3476-53-0x0000000075190000-0x0000000075940000-memory.dmp

    Filesize

    7.7MB

  • memory/3476-39-0x0000000007560000-0x00000000075F6000-memory.dmp

    Filesize

    600KB

  • memory/3476-6-0x00000000050F0000-0x0000000005112000-memory.dmp

    Filesize

    136KB

  • memory/3476-22-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/3476-23-0x0000000075190000-0x0000000075940000-memory.dmp

    Filesize

    7.7MB

  • memory/3476-21-0x0000000006F40000-0x0000000006F72000-memory.dmp

    Filesize

    200KB

  • memory/3476-20-0x0000000005FC0000-0x000000000600C000-memory.dmp

    Filesize

    304KB

  • memory/3476-19-0x0000000005F90000-0x0000000005FAE000-memory.dmp

    Filesize

    120KB

  • memory/3476-7-0x00000000057C0000-0x0000000005826000-memory.dmp

    Filesize

    408KB

  • memory/3476-14-0x0000000005980000-0x0000000005CD4000-memory.dmp

    Filesize

    3.3MB

  • memory/3476-50-0x0000000075190000-0x0000000075940000-memory.dmp

    Filesize

    7.7MB

  • memory/3716-388-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/3732-409-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/3976-367-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/4208-1-0x0000000000710000-0x00000000007F2000-memory.dmp

    Filesize

    904KB

  • memory/4208-47-0x000000007519E000-0x000000007519F000-memory.dmp

    Filesize

    4KB

  • memory/4208-0-0x000000007519E000-0x000000007519F000-memory.dmp

    Filesize

    4KB

  • memory/4208-462-0x0000000000E60000-0x0000000000EE4000-memory.dmp

    Filesize

    528KB

  • memory/4520-325-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/4920-262-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB

  • memory/4920-260-0x0000000005B30000-0x0000000005E84000-memory.dmp

    Filesize

    3.3MB

  • memory/5100-155-0x0000000070740000-0x000000007078C000-memory.dmp

    Filesize

    304KB