14c96fd6748713e8d1c561a073b6d777c4da7b31f3b1157c2698f24f16e75d5e

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

newstuff.exe
Size

2.8MB
MD5

65f8a01db5c275706e9f13d875441b25
SHA1

906103ef1d080d47a1159fce236c7450b95917f3
SHA256

14c96fd6748713e8d1c561a073b6d777c4da7b31f3b1157c2698f24f16e75d5e
SHA512

6d65b3cd5dfe6c8ca49032e01b79b9894ac0340ec6451a89e4199eb200983ac0d6c63952b70ec99c42a7ea72b30304ed2d5e6ea8980de1f8fbccc1d368498a7b
SSDEEP

49152:XXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEV4fa/me:XXzhW148Pd+Tf1mpcOldJQ3/V4yx

Score

10^/10

evasion persistence themida trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	newstuff.exe

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	newstuff.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	icsys.icn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	newstuff.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	icsys.icn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe

Executes dropped EXE 6 IoCs

pid	Process
324	newstuff.exe
604	icsys.icn.exe
1008	explorer.exe
2812	spoolsv.exe
2100	svchost.exe
3004	spoolsv.exe

Loads dropped DLL 6 IoCs

pid	Process
2140	newstuff.exe
2140	newstuff.exe
604	icsys.icn.exe
1008	explorer.exe
2812	spoolsv.exe
2100	svchost.exe

Themida packer 25 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2140-0-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/files/0x000d0000000122b8-10.dat	themida
behavioral1/memory/604-14-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/files/0x0008000000014fe1-20.dat	themida
behavioral1/memory/1008-26-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/files/0x0008000000015364-33.dat	themida
behavioral1/memory/2812-38-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/files/0x0007000000016cf0-48.dat	themida
behavioral1/memory/2140-49-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2812-50-0x0000000003230000-0x0000000003846000-memory.dmp	themida
behavioral1/memory/2100-51-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/604-54-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/3004-60-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2140-65-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/1008-66-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2140-67-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/604-68-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/1008-69-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2812-70-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2100-71-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2812-72-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/3004-73-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/2100-75-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/3004-78-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral1/memory/1008-90-0x0000000000400000-0x0000000000A16000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	icsys.icn.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	newstuff.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2140	newstuff.exe
604	icsys.icn.exe
1008	explorer.exe
2812	spoolsv.exe
2100	svchost.exe
3004	spoolsv.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	newstuff.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2488	schtasks.exe
1528	schtasks.exe
1016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2140	newstuff.exe
2140	newstuff.exe
2140	newstuff.exe
2140	newstuff.exe
2140	newstuff.exe
2140	newstuff.exe
2140	newstuff.exe
2140	newstuff.exe
2140	newstuff.exe
2140	newstuff.exe
2140	newstuff.exe
2140	newstuff.exe
2140	newstuff.exe
2140	newstuff.exe
2140	newstuff.exe
2140	newstuff.exe
604	icsys.icn.exe
604	icsys.icn.exe
604	icsys.icn.exe
604	icsys.icn.exe
604	icsys.icn.exe
604	icsys.icn.exe
604	icsys.icn.exe
604	icsys.icn.exe
604	icsys.icn.exe
604	icsys.icn.exe
604	icsys.icn.exe
604	icsys.icn.exe
604	icsys.icn.exe
604	icsys.icn.exe
604	icsys.icn.exe
604	icsys.icn.exe
604	icsys.icn.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
1008	explorer.exe
2100	svchost.exe
2100	svchost.exe
2100	svchost.exe
2100	svchost.exe
2100	svchost.exe
2100	svchost.exe
2100	svchost.exe
2100	svchost.exe
2100	svchost.exe
2100	svchost.exe
2100	svchost.exe
2100	svchost.exe
2100	svchost.exe
2100	svchost.exe
2100	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1008	explorer.exe
2100	svchost.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2140	newstuff.exe
2140	newstuff.exe
604	icsys.icn.exe
604	icsys.icn.exe
1008	explorer.exe
1008	explorer.exe
2812	spoolsv.exe
2812	spoolsv.exe
2100	svchost.exe
2100	svchost.exe
3004	spoolsv.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 324	2140	newstuff.exe	28
PID 2140 wrote to memory of 324	2140	newstuff.exe	28
PID 2140 wrote to memory of 324	2140	newstuff.exe	28
PID 2140 wrote to memory of 324	2140	newstuff.exe	28
PID 2140 wrote to memory of 604	2140	newstuff.exe	29
PID 2140 wrote to memory of 604	2140	newstuff.exe	29
PID 2140 wrote to memory of 604	2140	newstuff.exe	29
PID 2140 wrote to memory of 604	2140	newstuff.exe	29
PID 604 wrote to memory of 1008	604	icsys.icn.exe	30
PID 604 wrote to memory of 1008	604	icsys.icn.exe	30
PID 604 wrote to memory of 1008	604	icsys.icn.exe	30
PID 604 wrote to memory of 1008	604	icsys.icn.exe	30
PID 1008 wrote to memory of 2812	1008	explorer.exe	31
PID 1008 wrote to memory of 2812	1008	explorer.exe	31
PID 1008 wrote to memory of 2812	1008	explorer.exe	31
PID 1008 wrote to memory of 2812	1008	explorer.exe	31
PID 2812 wrote to memory of 2100	2812	spoolsv.exe	32
PID 2812 wrote to memory of 2100	2812	spoolsv.exe	32
PID 2812 wrote to memory of 2100	2812	spoolsv.exe	32
PID 2812 wrote to memory of 2100	2812	spoolsv.exe	32
PID 2100 wrote to memory of 3004	2100	svchost.exe	34
PID 2100 wrote to memory of 3004	2100	svchost.exe	34
PID 2100 wrote to memory of 3004	2100	svchost.exe	34
PID 2100 wrote to memory of 3004	2100	svchost.exe	34
PID 1008 wrote to memory of 2752	1008	explorer.exe	36
PID 1008 wrote to memory of 2752	1008	explorer.exe	36
PID 1008 wrote to memory of 2752	1008	explorer.exe	36
PID 1008 wrote to memory of 2752	1008	explorer.exe	36
PID 2100 wrote to memory of 2488	2100	svchost.exe	38
PID 2100 wrote to memory of 2488	2100	svchost.exe	38
PID 2100 wrote to memory of 2488	2100	svchost.exe	38
PID 2100 wrote to memory of 2488	2100	svchost.exe	38
PID 2100 wrote to memory of 1528	2100	svchost.exe	40
PID 2100 wrote to memory of 1528	2100	svchost.exe	40
PID 2100 wrote to memory of 1528	2100	svchost.exe	40
PID 2100 wrote to memory of 1528	2100	svchost.exe	40
PID 2100 wrote to memory of 1016	2100	svchost.exe	42
PID 2100 wrote to memory of 1016	2100	svchost.exe	42
PID 2100 wrote to memory of 1016	2100	svchost.exe	42
PID 2100 wrote to memory of 1016	2100	svchost.exe	42

C:\Users\Admin\AppData\Local\Temp\newstuff.exe
"C:\Users\Admin\AppData\Local\Temp\newstuff.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- \??\c:\users\admin\appdata\local\temp\newstuff.exe
  c:\users\admin\appdata\local\temp\newstuff.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:604
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1008
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2812
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2100
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:3004
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:57 /f
        6⤵
        Creates scheduled task(s)
        
        PID:2488
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:58 /f
        6⤵
        Creates scheduled task(s)
        
        PID:1528
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:59 /f
        6⤵
        Creates scheduled task(s)
        
        PID:1016
  - - C:\Windows\Explorer.exe
      C:\Windows\Explorer.exe
      4⤵
      PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\explorer.exe

Filesize
2.6MB

MD5
88e18653a67cb9e112163c41d80fa66a

SHA1
960e27ca6828ca322833d9681bb2b7a18f6000bd

SHA256
7cb21a93ef440fc2226533b63fc3c5a973f1b9b6d955c9789bf55f9cd1af6998

SHA512
bb86763fb4e03fddd2778dc889cda1b996b7a8c17e20036b949d82c00a4df0b2e50d56d218ba6814f10799ba6194b0163430adf45f7bd3aca02f6537beba150e

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
2.6MB

MD5
bc3c856d54b7c64a34821a372a417c60

SHA1
bc3700c0966c4e88e69e78db42671535a8449904

SHA256
a18bfe98dcf5ed821b7bab54799bc0bc153b9a33d5923cad491b1cabaf4f13a2

SHA512
73ba235c5cc1bf0a3b1ade3f744e469d92e7a823511291f7ca0ae9b519be6ce6723dd05d4b3f161e354c6b2d9a798e10a146c7c0d5e8cc67ef21818c1d297e21

Download Submit
\Users\Admin\AppData\Local\Temp\newstuff.exe

Filesize
239KB

MD5
6109c703543ce917ab5b9975735f78ef

SHA1
88c6d3fc7076dce3826f8f03feac041cc15fd9b8

SHA256
3e1cb481036dba2c97f3d390b7266d194a2bc7b2640ddc085d8e9c8d43baa0b1

SHA512
94234381bff3cf743e3c441b820595a084794f822e35a2b91cf28cf59517eff4fb8d27cc6490861c463f78d03860b02e592a20a66e3b367a515460e9ccf3597e

Download Submit
\Windows\Resources\Themes\icsys.icn.exe

Filesize
2.6MB

MD5
d513836f9ae72161ba1a862e8e13c43a

SHA1
8ed0157cd5ecb06d10389841eef74dbc2a2bf1fa

SHA256
b92bd1d20732e76e41c0149cff89a6302c2f854730369a198843eef3adfdde95

SHA512
b9a895a1a71b0fd9a21e253cfbe575be6549611b8e44c67646410d776a6ccb283ae08e1abc8a30fedbc2f01fd482e79abccc8a2983bd42bf624fcd2ee10fd59a

Download Submit
\Windows\Resources\spoolsv.exe

Filesize
2.6MB

MD5
14645760d5ce292e03e61d919682356f

SHA1
b3adbf2661be8a546b6bb1bdac1473dbbf1e730a

SHA256
520d0eb116a1647997e1a908bb2ce40199e0a88ad75332d5f1a05c1300acb20d

SHA512
8dd3cbcdf3dc1ab31fa03ae3f92313737ae27184f33b948de9256e35b0d0f6587997c6a9c8809f8f586b1c0ec9901bdbce32e878c8e2d43fdb1818ebf2716dd3

Download Submit
memory/604-25-0x0000000003440000-0x0000000003A56000-memory.dmp

Filesize
6.1MB

Download
memory/604-54-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/604-14-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/604-68-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/604-61-0x0000000003440000-0x0000000003A56000-memory.dmp

Filesize
6.1MB

Download
memory/1008-26-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1008-37-0x0000000003320000-0x0000000003936000-memory.dmp

Filesize
6.1MB

Download
memory/1008-69-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1008-90-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1008-66-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2100-51-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2100-71-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2100-75-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2140-65-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2140-59-0x0000000003250000-0x0000000003866000-memory.dmp

Filesize
6.1MB

Download
memory/2140-67-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2140-49-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2140-0-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2140-1-0x0000000076F50000-0x0000000076F52000-memory.dmp

Filesize
8KB

Download
memory/2812-50-0x0000000003230000-0x0000000003846000-memory.dmp

Filesize
6.1MB

Download
memory/2812-38-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2812-70-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2812-72-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/3004-73-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/3004-60-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/3004-78-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download