119f5eee1cb9f7d0695703a6cf17a6cb5082edeef7b3fbc20b38fec785d6ddad

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

060228813d63e7077c6d55a066d5f2ba.exe
Size

1.0MB
MD5

060228813d63e7077c6d55a066d5f2ba
SHA1

4bd553aaf5e37528479f307c290efe20c0dfa7c7
SHA256

119f5eee1cb9f7d0695703a6cf17a6cb5082edeef7b3fbc20b38fec785d6ddad
SHA512

0e10388e1d7729ff402204897943f4bc278cea8bd81c6a8f20311d3b6ddebc22bb5788debf6ad05270a5654b79fccf0d548aba8c31225395cacd0e369afc2c86
SSDEEP

24576:tGFMmg2ffPyYFQ9h5feQF7j4J6ruJvlsY915MpR+:wOmBffWDWpQYCpo

Score

7^/10

evasion trojan upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00050000000194ac-472.dat	acprotect

Executes dropped EXE 4 IoCs

pid	Process
2216	3635819d763d01812c8189816e508cd6.exe
2676	3635819d763d01812c8189816e508cd6.exe
2800	3635819d763d01812c8189816e508cd6.exe
2408	f2446673478f6b8a494b7749e1405895.exe

Loads dropped DLL 29 IoCs

pid	Process
2164	060228813d63e7077c6d55a066d5f2ba.exe
2164	060228813d63e7077c6d55a066d5f2ba.exe
2216	3635819d763d01812c8189816e508cd6.exe
2216	3635819d763d01812c8189816e508cd6.exe
2676	3635819d763d01812c8189816e508cd6.exe
2676	3635819d763d01812c8189816e508cd6.exe
2800	3635819d763d01812c8189816e508cd6.exe
2800	3635819d763d01812c8189816e508cd6.exe
2800	3635819d763d01812c8189816e508cd6.exe
2800	3635819d763d01812c8189816e508cd6.exe
2800	3635819d763d01812c8189816e508cd6.exe
2800	3635819d763d01812c8189816e508cd6.exe
2800	3635819d763d01812c8189816e508cd6.exe
2800	3635819d763d01812c8189816e508cd6.exe
2800	3635819d763d01812c8189816e508cd6.exe
2800	3635819d763d01812c8189816e508cd6.exe
2800	3635819d763d01812c8189816e508cd6.exe
2800	3635819d763d01812c8189816e508cd6.exe
2800	3635819d763d01812c8189816e508cd6.exe
2800	3635819d763d01812c8189816e508cd6.exe
2800	3635819d763d01812c8189816e508cd6.exe
2800	3635819d763d01812c8189816e508cd6.exe
2800	3635819d763d01812c8189816e508cd6.exe
2164	060228813d63e7077c6d55a066d5f2ba.exe
2164	060228813d63e7077c6d55a066d5f2ba.exe
2408	f2446673478f6b8a494b7749e1405895.exe
2408	f2446673478f6b8a494b7749e1405895.exe
2408	f2446673478f6b8a494b7749e1405895.exe
2408	f2446673478f6b8a494b7749e1405895.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2800-233-0x00000000004C0000-0x00000000004CC000-memory.dmp	upx
behavioral1/memory/2800-478-0x00000000004C0000-0x00000000004CC000-memory.dmp	upx
behavioral1/files/0x00050000000194ac-472.dat	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3635819d763d01812c8189816e508cd6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0007000000014fa0-9.dat	nsis_installer_2
behavioral1/files/0x0007000000014fa0-13.dat	nsis_installer_2

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2144	WMIC.exe
Token: SeSecurityPrivilege	2144	WMIC.exe
Token: SeTakeOwnershipPrivilege	2144	WMIC.exe
Token: SeLoadDriverPrivilege	2144	WMIC.exe
Token: SeSystemProfilePrivilege	2144	WMIC.exe
Token: SeSystemtimePrivilege	2144	WMIC.exe
Token: SeProfSingleProcessPrivilege	2144	WMIC.exe
Token: SeIncBasePriorityPrivilege	2144	WMIC.exe
Token: SeCreatePagefilePrivilege	2144	WMIC.exe
Token: SeBackupPrivilege	2144	WMIC.exe
Token: SeRestorePrivilege	2144	WMIC.exe
Token: SeShutdownPrivilege	2144	WMIC.exe
Token: SeDebugPrivilege	2144	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2144	WMIC.exe
Token: SeRemoteShutdownPrivilege	2144	WMIC.exe
Token: SeUndockPrivilege	2144	WMIC.exe
Token: SeManageVolumePrivilege	2144	WMIC.exe
Token: 33	2144	WMIC.exe
Token: 34	2144	WMIC.exe
Token: 35	2144	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2144	WMIC.exe
Token: SeSecurityPrivilege	2144	WMIC.exe
Token: SeTakeOwnershipPrivilege	2144	WMIC.exe
Token: SeLoadDriverPrivilege	2144	WMIC.exe
Token: SeSystemProfilePrivilege	2144	WMIC.exe
Token: SeSystemtimePrivilege	2144	WMIC.exe
Token: SeProfSingleProcessPrivilege	2144	WMIC.exe
Token: SeIncBasePriorityPrivilege	2144	WMIC.exe
Token: SeCreatePagefilePrivilege	2144	WMIC.exe
Token: SeBackupPrivilege	2144	WMIC.exe
Token: SeRestorePrivilege	2144	WMIC.exe
Token: SeShutdownPrivilege	2144	WMIC.exe
Token: SeDebugPrivilege	2144	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2144	WMIC.exe
Token: SeRemoteShutdownPrivilege	2144	WMIC.exe
Token: SeUndockPrivilege	2144	WMIC.exe
Token: SeManageVolumePrivilege	2144	WMIC.exe
Token: 33	2144	WMIC.exe
Token: 34	2144	WMIC.exe
Token: 35	2144	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2288	WMIC.exe
Token: SeSecurityPrivilege	2288	WMIC.exe
Token: SeTakeOwnershipPrivilege	2288	WMIC.exe
Token: SeLoadDriverPrivilege	2288	WMIC.exe
Token: SeSystemProfilePrivilege	2288	WMIC.exe
Token: SeSystemtimePrivilege	2288	WMIC.exe
Token: SeProfSingleProcessPrivilege	2288	WMIC.exe
Token: SeIncBasePriorityPrivilege	2288	WMIC.exe
Token: SeCreatePagefilePrivilege	2288	WMIC.exe
Token: SeBackupPrivilege	2288	WMIC.exe
Token: SeRestorePrivilege	2288	WMIC.exe
Token: SeShutdownPrivilege	2288	WMIC.exe
Token: SeDebugPrivilege	2288	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2288	WMIC.exe
Token: SeRemoteShutdownPrivilege	2288	WMIC.exe
Token: SeUndockPrivilege	2288	WMIC.exe
Token: SeManageVolumePrivilege	2288	WMIC.exe
Token: 33	2288	WMIC.exe
Token: 34	2288	WMIC.exe
Token: 35	2288	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2288	WMIC.exe
Token: SeSecurityPrivilege	2288	WMIC.exe
Token: SeTakeOwnershipPrivilege	2288	WMIC.exe
Token: SeLoadDriverPrivilege	2288	WMIC.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2216	2164	060228813d63e7077c6d55a066d5f2ba.exe	29
PID 2164 wrote to memory of 2216	2164	060228813d63e7077c6d55a066d5f2ba.exe	29
PID 2164 wrote to memory of 2216	2164	060228813d63e7077c6d55a066d5f2ba.exe	29
PID 2164 wrote to memory of 2216	2164	060228813d63e7077c6d55a066d5f2ba.exe	29
PID 2216 wrote to memory of 2676	2216	3635819d763d01812c8189816e508cd6.exe	30
PID 2216 wrote to memory of 2676	2216	3635819d763d01812c8189816e508cd6.exe	30
PID 2216 wrote to memory of 2676	2216	3635819d763d01812c8189816e508cd6.exe	30
PID 2216 wrote to memory of 2676	2216	3635819d763d01812c8189816e508cd6.exe	30
PID 2676 wrote to memory of 2800	2676	3635819d763d01812c8189816e508cd6.exe	31
PID 2676 wrote to memory of 2800	2676	3635819d763d01812c8189816e508cd6.exe	31
PID 2676 wrote to memory of 2800	2676	3635819d763d01812c8189816e508cd6.exe	31
PID 2676 wrote to memory of 2800	2676	3635819d763d01812c8189816e508cd6.exe	31
PID 2164 wrote to memory of 2408	2164	060228813d63e7077c6d55a066d5f2ba.exe	36
PID 2164 wrote to memory of 2408	2164	060228813d63e7077c6d55a066d5f2ba.exe	36
PID 2164 wrote to memory of 2408	2164	060228813d63e7077c6d55a066d5f2ba.exe	36
PID 2164 wrote to memory of 2408	2164	060228813d63e7077c6d55a066d5f2ba.exe	36
PID 2408 wrote to memory of 2144	2408	f2446673478f6b8a494b7749e1405895.exe	33
PID 2408 wrote to memory of 2144	2408	f2446673478f6b8a494b7749e1405895.exe	33
PID 2408 wrote to memory of 2144	2408	f2446673478f6b8a494b7749e1405895.exe	33
PID 2408 wrote to memory of 2144	2408	f2446673478f6b8a494b7749e1405895.exe	33
PID 2408 wrote to memory of 2288	2408	f2446673478f6b8a494b7749e1405895.exe	35
PID 2408 wrote to memory of 2288	2408	f2446673478f6b8a494b7749e1405895.exe	35
PID 2408 wrote to memory of 2288	2408	f2446673478f6b8a494b7749e1405895.exe	35
PID 2408 wrote to memory of 2288	2408	f2446673478f6b8a494b7749e1405895.exe	35

C:\Users\Admin\AppData\Local\Temp\060228813d63e7077c6d55a066d5f2ba.exe
"C:\Users\Admin\AppData\Local\Temp\060228813d63e7077c6d55a066d5f2ba.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\3635819d763d01812c8189816e508cd6.exe
  C:\Users\Admin\AppData\Local\Temp\3635819d763d01812c8189816e508cd6.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Users\Admin\AppData\Local\Temp\3635819d763d01812c8189816e508cd6.exe
    C:\Users\Admin\AppData\Local\Temp\3635819d763d01812c8189816e508cd6.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\3635819d763d01812c8189816e508cd6.exe
      C:\Users\Admin\AppData\Local\Temp\3635819d763d01812c8189816e508cd6.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      PID:2800
- C:\Users\Admin\AppData\Local\Temp\f2446673478f6b8a494b7749e1405895.exe
  C:\Users\Admin\AppData\Local\Temp\f2446673478f6b8a494b7749e1405895.exe /CHANNEL=FREESO010Zdccb8bc73dcff2d0a8884af7d221c4da /FORCED=1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2408

C:\Windows\SysWOW64\Wbem\WMIC.exe
WMIC /namespace:\\root\cimv2 PATH Win32_BIOS Get Version, SerialNumber /FORMAT:textvaluelist.xsl
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2144

C:\Windows\SysWOW64\Wbem\WMIC.exe
WMIC /namespace:\\root\cimv2 PATH Win32_ComputerSystem Get Model, Manufacturer /FORMAT:textvaluelist.xsl
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3635819d763d01812c8189816e508cd6.exe

Filesize
640KB

MD5
1a1c8b8b19a684d114e526f2de74657e

SHA1
d28998d1028d54cca84adbd5fcdc90949935abbf

SHA256
d808fef3fe12322bfdfb6b681edc22315a772dafdec099c3e40e02c982e01e6f

SHA512
095d322957aae8a60e3c520036d54d90ccb31045c220a161be02b1ca089246826c79caa40a7b408ebeb56d58f5cc4adb27d169d67192ff686a02868d148b7dba

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd1A27.tmp\7a0c7559331d92414337ab9237a8a62c13d544ee.lua

Filesize
15KB

MD5
7bf73b6249ed6cc73bc9af1fe5d3bf6b

SHA1
7f25228043b91a11eb02e443f2b3f20e88edf008

SHA256
f4c4bd5657b442b51e962d6c05ad79befc911d217f4131f8a6074f018d32dd98

SHA512
c2989717fd2d2676ed2ebcb2a56a68def862f5cbe721c0ce0f0a68a0bc9147a6a6f4a8b41f085a17709cdaf04cf79d5621eff198a1ccb0007ac6aa852526c93d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd1A27.tmp\7c5fb38f536c5e201a10ce382c0756a186346bc2.lua

Filesize
392B

MD5
77c50916f90b43c09e38e07b94ce4356

SHA1
2407be8f458d1aa2f1ffa45b21f782c44e68331f

SHA256
902fc7d3982d9386d60c4c304574381563ee28e73de993e28cde7f90499ca1cb

SHA512
039a24175948dfbd8c23b070d3aeb7bd93186a6093cbbe760981f1ef87bf7f97ed1f6bf5c6a7d2b9b12834e6776da03c40a03f7f43a9d7803a7f459a8a023ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd1A27.tmp\FloatingProgress.dll

Filesize
25KB

MD5
0f26c6d34d3841e93145dd00d0175651

SHA1
57b068569d0eb2336503beed87589629ab2a6f1f

SHA256
0cc5dc45b6a04ec236f4ecf0eeee212096b1561179d71c49dd5fc82aba706741

SHA512
72785e520d78a4ebd8779e5497806406c1b91b9c05ed82a392a6af689781e26c77f0032c66540b80e2e7e457128df2afd0647b0dbc970a11d0cd4ee3930d47a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd1A27.tmp\a2a55e68a147ddb026454c38213bc01a3979f52c.lua

Filesize
13KB

MD5
d4913b3dfc6136467ca1367e5464f32f

SHA1
f186c17758c4b95770f2bc4004e3f672a47d12bf

SHA256
0ed1939e72fa1e6e24e5c3b8dd1ee8604b4572711d1274fa16dd0d3a46d6b848

SHA512
c0e40fda1bf6833a039dbb4046439b25321789d0395a07832f10b3ebe5051d6905a506f1922f0f3ce54a78795e495fe2c08899f2254264035e7fe236cce3f4f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd1A27.tmp\step1.lua

Filesize
53KB

MD5
966e7a1d6e0124af8fb30584ac477fb1

SHA1
ab6d78d224be0d504196661b12ef65fd4f35d422

SHA256
df0e627304add6595e583d7bb7843ce21f51ab2a5b56526d3f0a0b5023183e65

SHA512
d82900eb32e12781f87481edbc4ac873e9b13dd98d4bd3c695a6c0bbe70753b5854dc002c8e65499e5d5ce315d537a5bbea726456c187f9cfbbee30afaf74fa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd1A27.tmp\versioninfo.dll

Filesize
6KB

MD5
ebc5bb904cdac1c67ada3fa733229966

SHA1
3c6abfa0ddef7f3289f38326077a5041389b15d2

SHA256
3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75

SHA512
fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd1E6A.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nso197C.tmp\LuaBridge.dll

Filesize
62KB

MD5
4e08fe995ab74ba4d145ddb77ea095fc

SHA1
e4bb337e40069c097e7abd566b7427b11fb124ee

SHA256
ace3c561f186dfbb5c992f85ea2ab4d3061894509af6960e9d819152afa46b17

SHA512
b056fbe0e79d90f8ce0908eb2b75f589e4415ed462868aaff6032f12dde394058cd221d317b92fc4809aa27d6cf2e801c4215db3cab1267ebd9dbc9af7b7041f

Download Submit
\Users\Admin\AppData\Local\Temp\3635819d763d01812c8189816e508cd6.exe

Filesize
713KB

MD5
e33c1603437f025d65365c1d6f851bef

SHA1
afd06c8f09335837c7c164def6eaf4683ea8658a

SHA256
4356b7b3a01120b2e5d1e624afe09fc545fc5b8a62bbd50c1112dc2a3139bbc7

SHA512
020394eff413f9d663b3c53cb03e06903932277c580505d33680523004ec4351c482b8d5588157b773e21f4ae69a4a50725dca8555d97c69ae09a90150576e85

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1A27.tmp\1370ebd534807c69ad0db6461cbf3f3fd03c434f.dll

Filesize
193KB

MD5
e390287499549de31da007f7f0ae4d10

SHA1
a8c6caebb151d60ea56f4c96a7194c0e5f076692

SHA256
b2e3b0e8d6c3fd23dc7d94fccc5151f07bf2e59271431268a58b5e99074b825b

SHA512
6c393bca7ea74747917e65f2e5e4822f034ef60defa5f3232b8f9a731ac8e00cffee3d44ab817f3986739b685506e0027647de50b3534e3436ca569d0c25b474

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1A27.tmp\87a5250e7389d052be3fdc257872ebd873ef2deb.dll

Filesize
80KB

MD5
4bf7db111acfa7c28ad36606107b3322

SHA1
6f20b9f6663ce0c309a2ce60e718d64ffb6c75b3

SHA256
bfe8445c38ee71240e856f85d79e94123d7179bf43688de0e2a14e32e6ef21b0

SHA512
0a5e66a65b80e15d8198f2934c58227ae17680f0fbea9865b2f44af82a29c53d4f95cf9616b4dfd75202420eb73b7d962cf2c84fdad6ce26afe1eb4bb978d0b6

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1A27.tmp\LuaXml_lib.dll

Filesize
11KB

MD5
7292b642bd958aeb7fd7cfd19e45b068

SHA1
19a800620d041634abae5b5d096cb0e87ce4c188

SHA256
90f1bb98e034fcf7bfddb8cb0a85b27a9c9ddb01b926b4e139e1e8fc53d41d09

SHA512
bd758e0833454e0aa2af976ac94fde17c5401102c5991887cefbe8e337974381584c73e2d1e50e49263c55c3788e24dc7f8bd0b9d2a76a6cbe38e48dd9d6c44a

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1A27.tmp\System.dll

Filesize
10KB

MD5
7e3c808299aa2c405dffa864471ddb7f

SHA1
b5de7804dd35ed7afd0c3b59d866f1a0749495e0

SHA256
91c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd

SHA512
599f61d5270227a68e5c4b8db41b5aa7bc17a4bbe91dd7336b410516fa6107f4f5bf0bbb3f6cc4b2e15b16bf9495fdc70832bab6262046cb136ad18f0c9b3738

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1A27.tmp\f40368059830399ce8189100003d317f2739d087.dll

Filesize
52KB

MD5
4a4845ba1666907f708c9c10a31ec227

SHA1
1ebf626adc84147e5114885ce779f92d6eb68f3a

SHA256
a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d

SHA512
d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1A27.tmp\lua51.dll

Filesize
255KB

MD5
fceee0026aafd237afdb4aea4ecd3557

SHA1
3e10da57143599eae915a688178abada78b8d82b

SHA256
85db1e17c0fad08d9732405e781cda1e1613ace31c540a6e559cd8777df2c62c

SHA512
9c974918c8afec8d8a58fc1239f269544b9dfe867459bb61901462f56f71a3dd574d3b2263dd14b99ff8a23c8096c408be3620785fd4476b975a43b999f559f2

Download Submit
\Users\Admin\AppData\Local\Temp\nsiA1F.tmp\nxs.dll

Filesize
6KB

MD5
8ca09b6200ffa05b54c6672d855beb4a

SHA1
daa16fe49c8b2250e9d2383b861cda51f876de49

SHA256
033e93ad470241c92762924ccfceafb849a525e263e5d4a3dbcfc2e07a8803c3

SHA512
6ab97181ec45430888d8ad3fd411de22423e1c057833e282af085a975198338c95f7ba10b7c69f33298afc88ddd38d01ab010998fd4a8ba8abb8561796bf9f14

Download Submit
memory/2800-154-0x00000000004A0000-0x00000000004AE000-memory.dmp

Filesize
56KB

Download
memory/2800-479-0x0000000074450000-0x00000000744AE000-memory.dmp

Filesize
376KB

Download
memory/2800-477-0x00000000003F0000-0x00000000003F9000-memory.dmp

Filesize
36KB

Download
memory/2800-478-0x00000000004C0000-0x00000000004CC000-memory.dmp

Filesize
48KB

Download
memory/2800-233-0x00000000004C0000-0x00000000004CC000-memory.dmp

Filesize
48KB

Download
memory/2800-122-0x0000000000470000-0x0000000000486000-memory.dmp

Filesize
88KB

Download
memory/2800-48-0x0000000074450000-0x00000000744AE000-memory.dmp

Filesize
376KB

Download