6c1ec6433e1d991ec587ae14bd00d9c37ed8395896caa6ce19e1b48a12a50346

Analysis

max time kernel
74s
max time network
56s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WinaeroTweaker-1.62.1.0-setup.exe
Size

5.7MB
MD5

157e743031c4e6be81ab205ee109f944
SHA1

06c39459502adf9ccab19111bef0877b6f21d670
SHA256

6c1ec6433e1d991ec587ae14bd00d9c37ed8395896caa6ce19e1b48a12a50346
SHA512

eaa9a078a093bc108b28c1469cf82a301b2ce0a5d66e293f89d94a12d1dab383d4b79e60a6a9514555a692e23ca4c99fa67885cac9f04c584c80b1bfd6cd6e35
SSDEEP

98304:nkL+yAKH/+GFeGCYKtl/gOGhpslPXCuutHpKx8o3zEOqWAwPWBCBnQX5FHin1KTc:c+5KH/+Grg5gOEuO8x8wAOPAwEynMFaN

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2140	WinaeroTweaker-1.62.1.0-setup.tmp
564	WinaeroTweaker.exe
2152	WinaeroTweaker.exe

Loads dropped DLL 4 IoCs

pid	Process
2208	WinaeroTweaker-1.62.1.0-setup.exe
2140	WinaeroTweaker-1.62.1.0-setup.tmp
2140	WinaeroTweaker-1.62.1.0-setup.tmp
2140	WinaeroTweaker-1.62.1.0-setup.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Winaero Tweaker\WinaeroTweaker.exe	WinaeroTweaker-1.62.1.0-setup.tmp
File opened for modification	C:\Program Files\Winaero Tweaker\WinaeroTweaker_x86_64.dll	WinaeroTweaker-1.62.1.0-setup.tmp
File opened for modification	C:\Program Files\Winaero Tweaker\no_tab_explorer.exe	WinaeroTweaker-1.62.1.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\unins000.dat	WinaeroTweaker-1.62.1.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-TCL1L.tmp	WinaeroTweaker-1.62.1.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-9INRU.tmp	WinaeroTweaker-1.62.1.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-0FPIQ.tmp	WinaeroTweaker-1.62.1.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-1K2VG.tmp	WinaeroTweaker-1.62.1.0-setup.tmp
File opened for modification	C:\Program Files\Winaero Tweaker\Elevator.exe	WinaeroTweaker-1.62.1.0-setup.tmp
File opened for modification	C:\Program Files\Winaero Tweaker\WinaeroControls.dll	WinaeroTweaker-1.62.1.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-06AHJ.tmp	WinaeroTweaker-1.62.1.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-HJJI4.tmp	WinaeroTweaker-1.62.1.0-setup.tmp
File opened for modification	C:\Program Files\Winaero Tweaker\WinaeroTweakerHelper.exe	WinaeroTweaker-1.62.1.0-setup.tmp
File opened for modification	C:\Program Files\Winaero Tweaker\WinaeroTweaker_i386.dll	WinaeroTweaker-1.62.1.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-PISBG.tmp	WinaeroTweaker-1.62.1.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-LLU0E.tmp	WinaeroTweaker-1.62.1.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-1FID7.tmp	WinaeroTweaker-1.62.1.0-setup.tmp
File opened for modification	C:\Program Files\Winaero Tweaker\unins000.dat	WinaeroTweaker-1.62.1.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-NG49N.tmp	WinaeroTweaker-1.62.1.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-7UAIR.tmp	WinaeroTweaker-1.62.1.0-setup.tmp
File created	C:\Program Files\Winaero Tweaker\is-82718.tmp	WinaeroTweaker-1.62.1.0-setup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
2668	taskkill.exe
2684	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C6B23B31-D627-11EE-9298-4A4F109F65B0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2140	WinaeroTweaker-1.62.1.0-setup.tmp
2140	WinaeroTweaker-1.62.1.0-setup.tmp
564	WinaeroTweaker.exe
564	WinaeroTweaker.exe
564	WinaeroTweaker.exe
564	WinaeroTweaker.exe
564	WinaeroTweaker.exe
2152	WinaeroTweaker.exe
2152	WinaeroTweaker.exe
2152	WinaeroTweaker.exe
2152	WinaeroTweaker.exe
2152	WinaeroTweaker.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2668	taskkill.exe
Token: SeDebugPrivilege	2684	taskkill.exe
Token: SeDebugPrivilege	564	WinaeroTweaker.exe
Token: SeDebugPrivilege	2152	WinaeroTweaker.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2140	WinaeroTweaker-1.62.1.0-setup.tmp
2488	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2488	iexplore.exe
2488	iexplore.exe
2988	IEXPLORE.EXE
2988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2140	2208	WinaeroTweaker-1.62.1.0-setup.exe	28
PID 2208 wrote to memory of 2140	2208	WinaeroTweaker-1.62.1.0-setup.exe	28
PID 2208 wrote to memory of 2140	2208	WinaeroTweaker-1.62.1.0-setup.exe	28
PID 2208 wrote to memory of 2140	2208	WinaeroTweaker-1.62.1.0-setup.exe	28
PID 2208 wrote to memory of 2140	2208	WinaeroTweaker-1.62.1.0-setup.exe	28
PID 2208 wrote to memory of 2140	2208	WinaeroTweaker-1.62.1.0-setup.exe	28
PID 2208 wrote to memory of 2140	2208	WinaeroTweaker-1.62.1.0-setup.exe	28
PID 2140 wrote to memory of 2312	2140	WinaeroTweaker-1.62.1.0-setup.tmp	29
PID 2140 wrote to memory of 2312	2140	WinaeroTweaker-1.62.1.0-setup.tmp	29
PID 2140 wrote to memory of 2312	2140	WinaeroTweaker-1.62.1.0-setup.tmp	29
PID 2140 wrote to memory of 2312	2140	WinaeroTweaker-1.62.1.0-setup.tmp	29
PID 2140 wrote to memory of 2592	2140	WinaeroTweaker-1.62.1.0-setup.tmp	30
PID 2140 wrote to memory of 2592	2140	WinaeroTweaker-1.62.1.0-setup.tmp	30
PID 2140 wrote to memory of 2592	2140	WinaeroTweaker-1.62.1.0-setup.tmp	30
PID 2140 wrote to memory of 2592	2140	WinaeroTweaker-1.62.1.0-setup.tmp	30
PID 2312 wrote to memory of 2684	2312	cmd.exe	33
PID 2312 wrote to memory of 2684	2312	cmd.exe	33
PID 2312 wrote to memory of 2684	2312	cmd.exe	33
PID 2312 wrote to memory of 2684	2312	cmd.exe	33
PID 2592 wrote to memory of 2668	2592	cmd.exe	34
PID 2592 wrote to memory of 2668	2592	cmd.exe	34
PID 2592 wrote to memory of 2668	2592	cmd.exe	34
PID 2592 wrote to memory of 2668	2592	cmd.exe	34
PID 2140 wrote to memory of 564	2140	WinaeroTweaker-1.62.1.0-setup.tmp	39
PID 2140 wrote to memory of 564	2140	WinaeroTweaker-1.62.1.0-setup.tmp	39
PID 2140 wrote to memory of 564	2140	WinaeroTweaker-1.62.1.0-setup.tmp	39
PID 2140 wrote to memory of 564	2140	WinaeroTweaker-1.62.1.0-setup.tmp	39
PID 2140 wrote to memory of 2488	2140	WinaeroTweaker-1.62.1.0-setup.tmp	40
PID 2140 wrote to memory of 2488	2140	WinaeroTweaker-1.62.1.0-setup.tmp	40
PID 2140 wrote to memory of 2488	2140	WinaeroTweaker-1.62.1.0-setup.tmp	40
PID 2140 wrote to memory of 2488	2140	WinaeroTweaker-1.62.1.0-setup.tmp	40
PID 2488 wrote to memory of 2988	2488	iexplore.exe	42
PID 2488 wrote to memory of 2988	2488	iexplore.exe	42
PID 2488 wrote to memory of 2988	2488	iexplore.exe	42
PID 2488 wrote to memory of 2988	2488	iexplore.exe	42
PID 564 wrote to memory of 2284	564	WinaeroTweaker.exe	43
PID 564 wrote to memory of 2284	564	WinaeroTweaker.exe	43
PID 564 wrote to memory of 2284	564	WinaeroTweaker.exe	43
PID 2152 wrote to memory of 1412	2152	WinaeroTweaker.exe	45
PID 2152 wrote to memory of 1412	2152	WinaeroTweaker.exe	45
PID 2152 wrote to memory of 1412	2152	WinaeroTweaker.exe	45

C:\Users\Admin\AppData\Local\Temp\WinaeroTweaker-1.62.1.0-setup.exe
"C:\Users\Admin\AppData\Local\Temp\WinaeroTweaker-1.62.1.0-setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\is-TC2IA.tmp\WinaeroTweaker-1.62.1.0-setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-TC2IA.tmp\WinaeroTweaker-1.62.1.0-setup.tmp" /SL5="$400E0,5091039,832000,C:\Users\Admin\AppData\Local\Temp\WinaeroTweaker-1.62.1.0-setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im winaerotweaker.exe /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im winaerotweaker.exe /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2684
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im winaerotweakerhelper.exe /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im winaerotweakerhelper.exe /f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2668
- - C:\Program Files\Winaero Tweaker\WinaeroTweaker.exe
    "C:\Program Files\Winaero Tweaker\WinaeroTweaker.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:564
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 564 -s 776
      4⤵
      PID:2284
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://winaero.com/?utm_source=software&utm_medium=in-app&utm_campaign=winaerotweaker&utm_content=setupcheckbox
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2988

C:\Program Files\Winaero Tweaker\WinaeroTweaker.exe
"C:\Program Files\Winaero Tweaker\WinaeroTweaker.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2152 -s 764
  2⤵
  PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Winaero Tweaker\WinaeroControls.dll

Filesize
428KB

MD5
e3053e6ca40b44d5937a5b6ca1de7fa1

SHA1
f0cd747c34834a82ad1a1860b41a53a0981e91ef

SHA256
aa1e84244d46228f198cf3e1373658032c2f4d01c25db1c4966ffb87eb9bdc8b

SHA512
c8176b29016d244c0760222a4f42dc3a05a189a8c139061db08e8aae6639734b7198f79514586fadea21616781975002bac9a6acd3b96167317045d9f81be265

Download Submit
C:\Program Files\Winaero Tweaker\WinaeroTweaker.exe

Filesize
2.8MB

MD5
5d30d927ca6d0a372295c8548e52a98b

SHA1
1f7ccf0c875378d14b73208f159b555c4bd21a46

SHA256
a9d56ecd77a27217a2daec3ef3730022ed8c329815bd340e59b73c32d4d22e3a

SHA512
74e3e0905e0eb638b939879c3bf4b1fe4a042337999d61d6be9b71290f65f964639a4c1fdd6fdc9d32d04958b808bc1991b875bcae810de1c6dde3b1497c58b6

Download Submit
\Program Files\Winaero Tweaker\WinaeroTweaker.exe

Filesize
5.1MB

MD5
bd58a64a60d76cc1cfa38fd1c27419f5

SHA1
db1f416b55131682547f007351ad859edc5468c2

SHA256
69ecfd7ad61617a769d230d6d6db082d965c5550f92c4913cd60ef47d3158d38

SHA512
ab11ffbf0b2d39a2255357dd22489610cf6ee1f2316f6028d7120454e31ffc9c0ea794be9d134afe7fea91606f38c14bbfcf19de0bd7d085f02964d1c3ecf32b

Download Submit
\Users\Admin\AppData\Local\Temp\is-ANSB5.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-TC2IA.tmp\WinaeroTweaker-1.62.1.0-setup.tmp

Filesize
3.0MB

MD5
7ce94ddf4648f1d972c77764e24b527f

SHA1
a061a2bac5fdc29d03db7cef56b1e242f54b5b8b

SHA256
5f252a8d3629e51f265de8002be947a24a78b101330a71b4b01afbe59edd716d

SHA512
b15d4ff889bae492f3418c0d9ca0c1bbe89a3ffb95309924735873c166b937bba6da28dca451fb408204ab2704416ac0733547e8717b81e1d2a0fba0c116c47a

Download Submit
memory/564-71-0x000007FEF4760000-0x000007FEF514C000-memory.dmp

Filesize
9.9MB

Download
memory/564-87-0x000007FEF4760000-0x000007FEF514C000-memory.dmp

Filesize
9.9MB

Download
memory/564-76-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download
memory/564-75-0x0000000000280000-0x00000000002F0000-memory.dmp

Filesize
448KB

Download
memory/564-73-0x000000001B480000-0x000000001B500000-memory.dmp

Filesize
512KB

Download
memory/564-72-0x000000001B5E0000-0x000000001B810000-memory.dmp

Filesize
2.2MB

Download
memory/564-66-0x0000000001270000-0x0000000001796000-memory.dmp

Filesize
5.1MB

Download
memory/2140-15-0x0000000000400000-0x0000000000713000-memory.dmp

Filesize
3.1MB

Download
memory/2140-69-0x0000000000400000-0x0000000000713000-memory.dmp

Filesize
3.1MB

Download
memory/2140-61-0x0000000000400000-0x0000000000713000-memory.dmp

Filesize
3.1MB

Download
memory/2140-18-0x0000000000400000-0x0000000000713000-memory.dmp

Filesize
3.1MB

Download
memory/2140-16-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2140-13-0x0000000000400000-0x0000000000713000-memory.dmp

Filesize
3.1MB

Download
memory/2140-7-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2152-89-0x000007FEF3D70000-0x000007FEF475C000-memory.dmp

Filesize
9.9MB

Download
memory/2152-90-0x00000000002E0000-0x0000000000350000-memory.dmp

Filesize
448KB

Download
memory/2208-70-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2208-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/2208-12-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download