786e925b0401aeb92cd2a200a7afcf03fa8a49fdf4eed29f2dcb88ebf22e1d61

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

117d965ae8c01edce9c5f85d3f468604.exe
Size

397KB
MD5

117d965ae8c01edce9c5f85d3f468604
SHA1

c9c040fbccc82601d9b0d66fdbac2f32afff614c
SHA256

786e925b0401aeb92cd2a200a7afcf03fa8a49fdf4eed29f2dcb88ebf22e1d61
SHA512

6c91513249ded2567e60f9be4adbc47cc299a5fd07ea2a03362d3e3adbea6c30d6d4607c1612e77f3ae1e40dfc53df98a61a7e20a8ed78cd047245335fe41ea7
SSDEEP

6144:NhE1+bhN9Ofb9manj+4t0XMPChlE9Ayyx1TGOwCb54EWPzRB2dQU6711trUhAk5n:c1+bhNofBNjoMPChu7H4CvuyGzJZ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3324 set thread context of 388	3324	117d965ae8c01edce9c5f85d3f468604.exe	20

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\360\360rpt.exe	117d965ae8c01edce9c5f85d3f468604.exe
File opened for modification	C:\Program Files (x86)\360\plugin.dat	117d965ae8c01edce9c5f85d3f468604.exe
File opened for modification	C:\Program Files (x86)\360\	117d965ae8c01edce9c5f85d3f468604.exe
File created	C:\Program Files (x86)\360\360rpt.exe	117d965ae8c01edce9c5f85d3f468604.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
388	117d965ae8c01edce9c5f85d3f468604.exe
388	117d965ae8c01edce9c5f85d3f468604.exe
388	117d965ae8c01edce9c5f85d3f468604.exe
388	117d965ae8c01edce9c5f85d3f468604.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	388	117d965ae8c01edce9c5f85d3f468604.exe
Token: SeDebugPrivilege	388	117d965ae8c01edce9c5f85d3f468604.exe
Token: SeDebugPrivilege	388	117d965ae8c01edce9c5f85d3f468604.exe
Token: SeDebugPrivilege	388	117d965ae8c01edce9c5f85d3f468604.exe
Token: SeDebugPrivilege	3180	117d965ae8c01edce9c5f85d3f468604.exe
Token: SeDebugPrivilege	3180	117d965ae8c01edce9c5f85d3f468604.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 388	3324	117d965ae8c01edce9c5f85d3f468604.exe	20
PID 3324 wrote to memory of 388	3324	117d965ae8c01edce9c5f85d3f468604.exe	20
PID 3324 wrote to memory of 388	3324	117d965ae8c01edce9c5f85d3f468604.exe	20
PID 3324 wrote to memory of 388	3324	117d965ae8c01edce9c5f85d3f468604.exe	20
PID 3324 wrote to memory of 388	3324	117d965ae8c01edce9c5f85d3f468604.exe	20
PID 3324 wrote to memory of 388	3324	117d965ae8c01edce9c5f85d3f468604.exe	20
PID 3324 wrote to memory of 388	3324	117d965ae8c01edce9c5f85d3f468604.exe	20
PID 3324 wrote to memory of 388	3324	117d965ae8c01edce9c5f85d3f468604.exe	20
PID 3324 wrote to memory of 388	3324	117d965ae8c01edce9c5f85d3f468604.exe	20
PID 3324 wrote to memory of 388	3324	117d965ae8c01edce9c5f85d3f468604.exe	20
PID 3324 wrote to memory of 388	3324	117d965ae8c01edce9c5f85d3f468604.exe	20
PID 3324 wrote to memory of 388	3324	117d965ae8c01edce9c5f85d3f468604.exe	20
PID 3324 wrote to memory of 388	3324	117d965ae8c01edce9c5f85d3f468604.exe	20
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5
PID 388 wrote to memory of 616	388	117d965ae8c01edce9c5f85d3f468604.exe	5

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:772
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:812
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4648
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:2988
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4380
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4100
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3756
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:4580
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4872
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:4720
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4120
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:676
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4056
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3996
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3900
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:3172

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Users\Admin\AppData\Local\Temp\117d965ae8c01edce9c5f85d3f468604.exe
"C:\Users\Admin\AppData\Local\Temp\117d965ae8c01edce9c5f85d3f468604.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Users\Admin\AppData\Local\Temp\117d965ae8c01edce9c5f85d3f468604.exe
  C:\Users\Admin\AppData\Local\Temp\117d965ae8c01edce9c5f85d3f468604.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Users\Admin\AppData\Local\Temp\117d965ae8c01edce9c5f85d3f468604.exe
    C:\Users\Admin\AppData\Local\Temp\117d965ae8c01edce9c5f85d3f468604.exe
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:3180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:5036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3136

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:5044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3720

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:1624

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2868

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2720

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2472

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2228

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1900

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
PID:428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/388-31-0x00000000007B0000-0x00000000007BA000-memory.dmp

Filesize
40KB

Download
memory/388-59-0x0000000002310000-0x000000000231A000-memory.dmp

Filesize
40KB

Download
memory/388-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/388-17-0x0000000002160000-0x0000000002190000-memory.dmp

Filesize
192KB

Download
memory/388-12-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/388-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/388-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/388-6-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/388-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/388-3-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/388-1123-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/388-24-0x00000000007A0000-0x00000000007AA000-memory.dmp

Filesize
40KB

Download
memory/388-45-0x00000000022F0000-0x00000000022FA000-memory.dmp

Filesize
40KB

Download
memory/388-38-0x00000000022E0000-0x00000000022EA000-memory.dmp

Filesize
40KB

Download
memory/388-10-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/388-52-0x0000000002300000-0x000000000230A000-memory.dmp

Filesize
40KB

Download
memory/388-14-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/388-66-0x0000000002320000-0x000000000232A000-memory.dmp

Filesize
40KB

Download
memory/388-73-0x0000000010410000-0x000000001041A000-memory.dmp

Filesize
40KB

Download
memory/3180-636-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/3180-637-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/3180-1127-0x00000000108B0000-0x00000000108E0000-memory.dmp

Filesize
192KB

Download
memory/3180-1130-0x00000000108B0000-0x00000000108E0000-memory.dmp

Filesize
192KB

Download
memory/3324-13-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download