a461119f4dcaca45b8438792b6daba9a83d520f47127ebb7a7ed6d68c0ac1008

Analysis

max time kernel
43s
max time network
137s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Install_New_theme (1).bat
Size

600B
MD5

99638e3caf39bd8aac3010f291727fcd
SHA1

f688f9f969ffaf78c62f17f8a8df44490b952514
SHA256

a461119f4dcaca45b8438792b6daba9a83d520f47127ebb7a7ed6d68c0ac1008
SHA512

638bdc5e83558daf1c3d14e1ef3669d578ce3bc0df7c4643441e00d1d334397d409bb1329f07d559f0b7de21cfee406abfde24f7bc4d3129f2cf52e53612e84f

Score

6^/10

execution

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
25	drive.google.com
26	drive.google.com
27	drive.google.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1652	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1652	powershell.exe
2668	chrome.exe
2668	chrome.exe

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe
Token: SeShutdownPrivilege	2668	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe
2668	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1652	1956	cmd.exe	29
PID 1956 wrote to memory of 1652	1956	cmd.exe	29
PID 1956 wrote to memory of 1652	1956	cmd.exe	29
PID 2668 wrote to memory of 2664	2668	chrome.exe	31
PID 2668 wrote to memory of 2664	2668	chrome.exe	31
PID 2668 wrote to memory of 2664	2668	chrome.exe	31
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2472	2668	chrome.exe	33
PID 2668 wrote to memory of 2864	2668	chrome.exe	34
PID 2668 wrote to memory of 2864	2668	chrome.exe	34
PID 2668 wrote to memory of 2864	2668	chrome.exe	34
PID 2668 wrote to memory of 2576	2668	chrome.exe	35
PID 2668 wrote to memory of 2576	2668	chrome.exe	35
PID 2668 wrote to memory of 2576	2668	chrome.exe	35
PID 2668 wrote to memory of 2576	2668	chrome.exe	35
PID 2668 wrote to memory of 2576	2668	chrome.exe	35
PID 2668 wrote to memory of 2576	2668	chrome.exe	35
PID 2668 wrote to memory of 2576	2668	chrome.exe	35
PID 2668 wrote to memory of 2576	2668	chrome.exe	35
PID 2668 wrote to memory of 2576	2668	chrome.exe	35
PID 2668 wrote to memory of 2576	2668	chrome.exe	35
PID 2668 wrote to memory of 2576	2668	chrome.exe	35
PID 2668 wrote to memory of 2576	2668	chrome.exe	35
PID 2668 wrote to memory of 2576	2668	chrome.exe	35
PID 2668 wrote to memory of 2576	2668	chrome.exe	35
PID 2668 wrote to memory of 2576	2668	chrome.exe	35
PID 2668 wrote to memory of 2576	2668	chrome.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Install_New_theme (1).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; $p='-new_theme'; """ & { $(try { iwr -useb 'https://raw.githubusercontent.com/SpotX-Official/spotx-official.github.io/main/run.ps1' } catch { $p+= ' -m'; iwr -useb 'https://spotx-official.github.io/run.ps1' })} $p """" | iex
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7639758,0x7fef7639768,0x7fef7639778
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1200 --field-trial-handle=1216,i,12590655275996503738,4581344064240608969,131072 /prefetch:2
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1536 --field-trial-handle=1216,i,12590655275996503738,4581344064240608969,131072 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1572 --field-trial-handle=1216,i,12590655275996503738,4581344064240608969,131072 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1596 --field-trial-handle=1216,i,12590655275996503738,4581344064240608969,131072 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1216,i,12590655275996503738,4581344064240608969,131072 /prefetch:1
  2⤵
  PID:624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1420 --field-trial-handle=1216,i,12590655275996503738,4581344064240608969,131072 /prefetch:2
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3188 --field-trial-handle=1216,i,12590655275996503738,4581344064240608969,131072 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3420 --field-trial-handle=1216,i,12590655275996503738,4581344064240608969,131072 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3416 --field-trial-handle=1216,i,12590655275996503738,4581344064240608969,131072 /prefetch:8
  2⤵
  PID:700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3420 --field-trial-handle=1216,i,12590655275996503738,4581344064240608969,131072 /prefetch:8
  2⤵
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1760 --field-trial-handle=1216,i,12590655275996503738,4581344064240608969,131072 /prefetch:1
  2⤵
  PID:2596

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
363B

MD5
6c68c6a535de82d500339c68789fcbf0

SHA1
f498ae2bb2828bbd72d172a2794ae80f74a67049

SHA256
2215c67b72ff85abe8963a0a0fdbdf75c9af24107a800d8303d09a2d3cc409c6

SHA512
13d4108891f620b27e6e21c44d1d2f4c7aec8617d6a8bd1dc65e13d2d2539c4a11824bc1700ff4dfdee350e84f8bee7a967c363e7f02aec665893439cb7739fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
4ada1881c1405b48d663908f21554691

SHA1
d5e623c748a761da4ef0cb7f95c6aacf8ef0bc0c

SHA256
6c7988547c122524e55599df0fdaab4b1aa9a5189f19d6a4aa56b30dae6d6afc

SHA512
a30716903c2bd0253e7ff09268e7078c82fc3f5cfd785768a3f03e7d02eb82cdc84e5c7d63fc349e26dd19381c70d384341be89cd0e0e669079c572cd5fa9dfc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
be94da19e3fb319c356da6a92a62ec5a

SHA1
ba2679e70280204ecffa14447dee80c2c0f6a872

SHA256
d87f12d6fe8b6995e7ceb33f8bd9c49f16fe2454337c938fc6674c492280d4de

SHA512
8f79bf6bf57d74db00ae341932b4cb55dd94fbc6857f28c15ab5311c822941a3c8092d75ed61dd3e8f063aff60d86700687158cbc8053109976e5608ceb332ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
062412f3d30b56b4ca5f0df2ecd68bae

SHA1
e0c15b0849c060f7021cefa343539c33532ca6ba

SHA256
734ba409651a61753b634bf6300bf9c99a729c17539e6e0fa91c7f2fb75dfd8b

SHA512
48bf67c4dc3df6a82b7cfd832f1e6ffbeb73bd08e05675b2f870b5d97309e03d45a6798f67a4f3ce3c28cf6b104fd67c64f13674631542988872aaa00e048904

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
memory/1652-8-0x000007FEF5B80000-0x000007FEF651D000-memory.dmp

Filesize
9.6MB

Download
memory/1652-12-0x000007FEF5B80000-0x000007FEF651D000-memory.dmp

Filesize
9.6MB

Download
memory/1652-11-0x000007FEF5B80000-0x000007FEF651D000-memory.dmp

Filesize
9.6MB

Download
memory/1652-10-0x000007FEF5B80000-0x000007FEF651D000-memory.dmp

Filesize
9.6MB

Download
memory/1652-6-0x0000000002890000-0x0000000002898000-memory.dmp

Filesize
32KB

Download
memory/1652-4-0x000007FEF5E3E000-0x000007FEF5E3F000-memory.dmp

Filesize
4KB

Download
memory/1652-9-0x000007FEF5B80000-0x000007FEF651D000-memory.dmp

Filesize
9.6MB

Download
memory/1652-7-0x000007FEF5B80000-0x000007FEF651D000-memory.dmp

Filesize
9.6MB

Download
memory/1652-5-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download