modiloader | ba0ad305e5680f0f61789e864090fc11772378937b8adf1536b3273112c73d55

Analysis

max time kernel
148s
max time network
155s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-11-2022 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba0ad305e5680f0f61789e864090fc11772378937b8adf1536b3273112c73d55.exe
Size

243KB
MD5

44643696a1c92cad0c89458847d6712d
SHA1

b2d8c4b2dfae4b17b3bdbcf32984da816d6bbbd7
SHA256

ba0ad305e5680f0f61789e864090fc11772378937b8adf1536b3273112c73d55
SHA512

f0a81d56c6a6d5cd4c991831ba281b989952a212c247bded6c26616d4365298c9905025bbe6925e4bf851fd119ab05fb8994b5a98a8fd3bdd55453e46b76521f
SSDEEP

6144:ttsH5vwieeDU5kU6qjBq+W8jZ7rvaU3+mW4ZeoSKo:ywiex5khq8jeFzF7ZeoSZ

Score

10^/10

modiloader evasion trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

IMG0012.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" IMG0012.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	IMG0012.exe

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1692-61-0x0000000000400000-0x0000000000451000-memory.dmp	modiloader_stage2
behavioral1/memory/1692-66-0x0000000000400000-0x0000000000451000-memory.dmp	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

IMG0012.exe

pid process

1692 IMG0012.exe

pid	process
1692	IMG0012.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\IMG0012.exe	upx
C:\Users\Admin\AppData\Local\Temp\IMG0012.exe	upx
\Users\Admin\AppData\Local\Temp\IMG0012.exe	upx
behavioral1/memory/896-60-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/1692-61-0x0000000000400000-0x0000000000451000-memory.dmp	upx
behavioral1/memory/1692-66-0x0000000000400000-0x0000000000451000-memory.dmp	upx

Loads dropped DLL 5 IoCs

Processes:

ba0ad305e5680f0f61789e864090fc11772378937b8adf1536b3273112c73d55.exeIMG0012.exeIEXPLORE.EXE

pid	process
896	ba0ad305e5680f0f61789e864090fc11772378937b8adf1536b3273112c73d55.exe
896	ba0ad305e5680f0f61789e864090fc11772378937b8adf1536b3273112c73d55.exe
1692	IMG0012.exe
1692	IMG0012.exe
956	IEXPLORE.EXE

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

IMG0012.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IMG0012.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	IMG0012.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081955ca59313f24aae2cd98cc9c5411d00000000020000000000106600000001000020000000df6d08794b65e8d19b4cd4fe16d6d7b9dc416ed953d8839e3afcff1a494cbcc4000000000e800000000200002000000061a118e8f0185b0a7b3aed98da55d512a871648263aaf78f7b70c9c22b30375090000000f522bfe1ccf24f3467cf8331f628e2ef8de11595dc1f0058a2935eeb2af7af640f63d41a8b9cefbae7070b099131b17da1936da81f912e079c17f674ffc8eca3e102b17ebd0c76ae2611294eb59c1d2dbd30e519fa97d780842ce85d92cd6d3d0cf2dd8d3b213a9b3e680ddfb2a4ffc4225373d0d2d8ef6dc0918e06276ff7f7215d07d87fbd80d8872b8f22844d9076400000002ea0f12bf520f4c8faab2973e8e0acc28ec226a77a30f04f6997c36b53ddf2b31d4f9207fa130219d7f07f9d25e8f8a5f0504a97091323d01594b3ca660acb72	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081955ca59313f24aae2cd98cc9c5411d000000000200000000001066000000010000200000005732507b07af9195d549d896e7a2a4268e92105bdf62eaba4c0444227451a4c3000000000e80000000020000200000000d1712b08e31ecdfa654717fefd25561895c894d81c0191f2c8d35bf1d75fb71200000000c4907d94b07627133d3c3f4a40dd28b497afe04ca631ea54fe736223639eae6400000007676d0422dd2af177445b99f6ff0c7c8a69b34461992038ae62fc7eac9e4b719cbba22035a356591e2212c8046a7ae2347c7a40ccce47f03fb370fce80d7c7a9	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d08544b60204d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376498715"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF8FFE61-6FF5-11ED-A993-42FEA5F7B9B2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

IMG0012.exevssvc.exeIEXPLORE.EXE

description	pid	process
Token: SeDebugPrivilege	1692	IMG0012.exe
Token: SeBackupPrivilege	268	vssvc.exe
Token: SeRestorePrivilege	268	vssvc.exe
Token: SeAuditPrivilege	268	vssvc.exe
Token: SeDebugPrivilege	1692	IMG0012.exe
Token: SeDebugPrivilege	956	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1264 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIMG0012.exe

pid process

1264 iexplore.exe
1264 iexplore.exe
956 IEXPLORE.EXE
956 IEXPLORE.EXE
1692 IMG0012.exe
1692 IMG0012.exe

pid	process
1264	iexplore.exe

pid	process
1264	iexplore.exe
1264	iexplore.exe
956	IEXPLORE.EXE
956	IEXPLORE.EXE
1692	IMG0012.exe
1692	IMG0012.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ba0ad305e5680f0f61789e864090fc11772378937b8adf1536b3273112c73d55.exeiexplore.exe

description	pid	process	target process
PID 896 wrote to memory of 1692	896	ba0ad305e5680f0f61789e864090fc11772378937b8adf1536b3273112c73d55.exe	IMG0012.exe
PID 896 wrote to memory of 1692	896	ba0ad305e5680f0f61789e864090fc11772378937b8adf1536b3273112c73d55.exe	IMG0012.exe
PID 896 wrote to memory of 1692	896	ba0ad305e5680f0f61789e864090fc11772378937b8adf1536b3273112c73d55.exe	IMG0012.exe
PID 896 wrote to memory of 1692	896	ba0ad305e5680f0f61789e864090fc11772378937b8adf1536b3273112c73d55.exe	IMG0012.exe
PID 896 wrote to memory of 1264	896	ba0ad305e5680f0f61789e864090fc11772378937b8adf1536b3273112c73d55.exe	iexplore.exe
PID 896 wrote to memory of 1264	896	ba0ad305e5680f0f61789e864090fc11772378937b8adf1536b3273112c73d55.exe	iexplore.exe
PID 896 wrote to memory of 1264	896	ba0ad305e5680f0f61789e864090fc11772378937b8adf1536b3273112c73d55.exe	iexplore.exe
PID 896 wrote to memory of 1264	896	ba0ad305e5680f0f61789e864090fc11772378937b8adf1536b3273112c73d55.exe	iexplore.exe
PID 1264 wrote to memory of 956	1264	iexplore.exe	IEXPLORE.EXE
PID 1264 wrote to memory of 956	1264	iexplore.exe	IEXPLORE.EXE
PID 1264 wrote to memory of 956	1264	iexplore.exe	IEXPLORE.EXE
PID 1264 wrote to memory of 956	1264	iexplore.exe	IEXPLORE.EXE

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

IMG0012.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" IMG0012.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	IMG0012.exe

C:\Users\Admin\AppData\Local\Temp\ba0ad305e5680f0f61789e864090fc11772378937b8adf1536b3273112c73d55.exe
"C:\Users\Admin\AppData\Local\Temp\ba0ad305e5680f0f61789e864090fc11772378937b8adf1536b3273112c73d55.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:896

C:\Users\Admin\AppData\Local\Temp\IMG0012.exe
"C:\Users\Admin\AppData\Local\Temp\IMG0012.exe"
2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1692

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\kub.gif
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1264 CREDAT:275457 /prefetch:2
3⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:956

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IMG0012.exe
Filesize
113KB

MD5
849dfc2e717d555679040c40ddbefee4

SHA1
e15aca3e1f9036ca94f091340e2cf29d3add4933

SHA256
0e07607bf4988792060788b79db2ef4c3f08c822f84d53f94df19bbe4a01a6da

SHA512
e92e080e9f81ca601a29bfbc3bbb9fde3ba521fcc7daf952a8d7c0aed09a96c698b79ed8145ec53fe2d8058e11282883295abb9ee3adfaaf468a43b08cb9d309

Download Submit
C:\Users\Admin\AppData\Local\Temp\cmsetac.dll
Filesize
33KB

MD5
49616bec13d584f8e3b7db118a487152

SHA1
25311db5ff28d48c9eeb067fb185e8dff0f2e11d

SHA256
56f1dcd83fbfe3a0e067981dc44f9478c0b2200897b3d6c799d9ef105033c70e

SHA512
5deaa832321f5a49e8649cc55b4b429810afbc45d0f0d44fa2b6d6714d0c47ce1b6656ba6bd1cd2dfbfa0654c0cd813dcd02b19cc5820888b353917d4a541d8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kub.gif
Filesize
121KB

MD5
da7c2e72525f7b41163721cad6b7f513

SHA1
8f4d787b2de385b731cc8429426c2134b7d2f12a

SHA256
925f81f01e3ad300969f10af624febf1ea74a4d8c1a613ab72e9998bd41177d7

SHA512
dc35e038473e6c4f7be06cd0b6059551b59826555a9280924ed841959070e2859050a07810c25f70c2458b4160a4da6ee6130471b2742da3d7a3170cbbacebff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0R9MH6P0.txt
Filesize
602B

MD5
42e8c3cef67c2f6f3ef0e77ee4cfc988

SHA1
c8d2988262870c8781cd917d517b71c4fa7209df

SHA256
a53bd2f763f16b7f6c6cc98a539cc18e6d13fe380d3b1d391e65b33e2c424893

SHA512
395e5c9af8a1ffe0fdea1cbb501f33ae4054d00cf0654d00d78febb421bf01b5f297531c4ac04aa0bfb55a3c7252bddd6d70eafac949086a8ac41c5a52c5575d

Download Submit
\Users\Admin\AppData\Local\Temp\IMG0012.exe
Filesize
113KB

MD5
849dfc2e717d555679040c40ddbefee4

SHA1
e15aca3e1f9036ca94f091340e2cf29d3add4933

SHA256
0e07607bf4988792060788b79db2ef4c3f08c822f84d53f94df19bbe4a01a6da

SHA512
e92e080e9f81ca601a29bfbc3bbb9fde3ba521fcc7daf952a8d7c0aed09a96c698b79ed8145ec53fe2d8058e11282883295abb9ee3adfaaf468a43b08cb9d309

Download Submit
\Users\Admin\AppData\Local\Temp\IMG0012.exe
Filesize
113KB

MD5
849dfc2e717d555679040c40ddbefee4

SHA1
e15aca3e1f9036ca94f091340e2cf29d3add4933

SHA256
0e07607bf4988792060788b79db2ef4c3f08c822f84d53f94df19bbe4a01a6da

SHA512
e92e080e9f81ca601a29bfbc3bbb9fde3ba521fcc7daf952a8d7c0aed09a96c698b79ed8145ec53fe2d8058e11282883295abb9ee3adfaaf468a43b08cb9d309

Download Submit
\Users\Admin\AppData\Local\Temp\cmsetac.dll
Filesize
33KB

MD5
49616bec13d584f8e3b7db118a487152

SHA1
25311db5ff28d48c9eeb067fb185e8dff0f2e11d

SHA256
56f1dcd83fbfe3a0e067981dc44f9478c0b2200897b3d6c799d9ef105033c70e

SHA512
5deaa832321f5a49e8649cc55b4b429810afbc45d0f0d44fa2b6d6714d0c47ce1b6656ba6bd1cd2dfbfa0654c0cd813dcd02b19cc5820888b353917d4a541d8b

Download Submit
\Users\Admin\AppData\Local\Temp\cmsetac.dll
Filesize
33KB

MD5
49616bec13d584f8e3b7db118a487152

SHA1
25311db5ff28d48c9eeb067fb185e8dff0f2e11d

SHA256
56f1dcd83fbfe3a0e067981dc44f9478c0b2200897b3d6c799d9ef105033c70e

SHA512
5deaa832321f5a49e8649cc55b4b429810afbc45d0f0d44fa2b6d6714d0c47ce1b6656ba6bd1cd2dfbfa0654c0cd813dcd02b19cc5820888b353917d4a541d8b

Download Submit
\Users\Admin\AppData\Local\Temp\ntdtcstp.dll
Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
memory/896-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/896-60-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1692-57-0x0000000000000000-mapping.dmp

Download
memory/1692-66-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1692-65-0x0000000002960000-0x000000000296E000-memory.dmp

Filesize
56KB

Download
memory/1692-61-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download