Analysis

  • max time kernel
    127s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-07-2024 21:01

Errors

Reason
Machine shutdown

General

  • Target

    TeraBox.exe

  • Size

    6.3MB

  • MD5

    7ab6073a5c400a5071bfa4ef2d936425

  • SHA1

    f794ea18eced4330979972da2a4bfa33c03afa2f

  • SHA256

    7774449e13c24d2b0b69114d9ba044e80dc8378fa3dfb5d17a142d5cb4cde8af

  • SHA512

    4371b6b49df43dab4abf90a71819276f30dca823c93335edd5513a67a646c97ef575b2ede650ceb2f0f168af13431254530e9bffc3db0f5b0eada1492c3cab73

  • SSDEEP

    98304:52XswubXaFliXVEaqz56LtbSeK78yYkVvkg7m8Etg1C9Y41WCpq:8XswuuKE7E4IDkVvkgK9fVWCo

Score
5/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TeraBox.exe
    "C:\Users\Admin\AppData\Local\Temp\TeraBox.exe"
    1⤵
    • Checks computer location settings
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4388
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=2608,8879262631534380620,7761542865807999349,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.31.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2476 /prefetch:2
      2⤵
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:1560
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2608,8879262631534380620,7761542865807999349,131072 --enable-features=CastMediaRouteProvider --lang=en-US --service-sandbox-type=network --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.31.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=3000 /prefetch:8
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3660
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2608,8879262631534380620,7761542865807999349,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.31.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:544
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2608,8879262631534380620,7761542865807999349,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.31.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:396
    • C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
      "C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe"
      2⤵
        PID:1320
      • C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
        -PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.4388.0.835156207\2075813147 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.51" -PcGuid "TBIMXV2-O_F0B74A136A7948D78B204E67515422DE-C_0-D_DD00013-M_E662F882523E-V_6528A765" -Version "1.31.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1
        2⤵
          PID:2740
        • C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
          "C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.4388.0.835156207\2075813147 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.51" -PcGuid "TBIMXV2-O_F0B74A136A7948D78B204E67515422DE-C_0-D_DD00013-M_E662F882523E-V_6528A765" -Version "1.31.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:384
        • C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
          "C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1501 -PluginPath "C:\Users\Admin\AppData\Local\Temp\module\VastPlayer\VastPlayer.dll" -ChannelName terabox.4388.1.886233946\1396240530 -QuitEventName TERABOX_VIDEO_PLAY_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.51" -PcGuid "TBIMXV2-O_F0B74A136A7948D78B204E67515422DE-C_0-D_DD00013-M_E662F882523E-V_6528A765" -Version "1.31.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1
          2⤵
            PID:4620
          • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
            "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2608,8879262631534380620,7761542865807999349,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.31.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1468
          • C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe
            "C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe" -client_info "C:\Users\Admin\AppData\Local\Temp\TeraBox_status" -update_cfg_url "aHR0cHM6Ly90ZXJhYm94LmNvbS9hdXRvdXBkYXRl" -srvwnd 702d0 -unlogin
            2⤵
              PID:3196
            • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
              "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2608,8879262631534380620,7761542865807999349,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.31.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:376
            • C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
              "C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=2608,8879262631534380620,7761542865807999349,131072 --enable-features=CastMediaRouteProvider --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.31.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2868 /prefetch:2
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:4088
          • C:\Windows\system32\LogonUI.exe
            "LogonUI.exe" /flags:0x4 /state0:0xa3972855 /state1:0x41c64e6d
            1⤵
            • Modifies data under HKEY_USERS
            • Suspicious use of SetWindowsHookEx
            PID:1820

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Download\AutoUpdate.xml

            Filesize

            24KB

            MD5

            c286cd40cd06c343b0a0daba4a8787ba

            SHA1

            971b13c25faff896033f77e0866fe21f7b26cbd5

            SHA256

            0af3d4862222a6b68993220e693c2501de14d6e922c3ecce1a60754462822c60

            SHA512

            e4ab1154ac2ece073d33277cf8d8394cec51100014589c6d997341d3553d19734b69cfc0ce9f3c87c55e34e833b7647c70a60e1972894762dba71914e38ac10b

          • C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Cache\f_000055

            Filesize

            211KB

            MD5

            151fb811968eaf8efb840908b89dc9d4

            SHA1

            7ec811009fd9b0e6d92d12d78b002275f2f1bee1

            SHA256

            043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

            SHA512

            83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

          • C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Code Cache\js\index-dir\the-real-index

            Filesize

            624B

            MD5

            0f023b62f71bb47f3e1ff64ade7d01f9

            SHA1

            d47a79d6e0e5b7857ef3fda5874d86996447af2b

            SHA256

            4f9043fe97b19fc583b6b390a7b206c51493ce74e65a01e7665a11155c0864f8

            SHA512

            0cc6af37a77e4409547f79bf82fc6204e12bdc6605a566fba27ffb320beb905386605a3691f1c6910c643a3e207693704926bec172bca96f874a7d82bc1ebe4f

          • C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Code Cache\js\index-dir\the-real-index

            Filesize

            912B

            MD5

            0b01c6b32c72ce28016d7d65faaf82c7

            SHA1

            c6143bcf1c9ef22891c25767160980bdda41df0d

            SHA256

            35efdefd6ae5996b09893e4729d7b165aa2ecc17ac7d1d012a11cb3ee547369d

            SHA512

            130ce595d1f5402b733b6af96db1287e300db81fe0a7e7c91af0947359799c9a086049853b2879418691a675de76ea7dfeb47ce95257a810825248ec417cb105

          • C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Code Cache\js\index-dir\the-real-index~RFe586e55.TMP

            Filesize

            48B

            MD5

            f97c99ba70acdd90c5e2d5856be44a18

            SHA1

            fd6276b19827cc3e39bcb870b14a4c184f29a5ee

            SHA256

            171afb61c0b4bdd9d52c5046500fe406e9c404d024ed461386d08102065a86ad

            SHA512

            02d3589c0b7c0b6911f7b80b744d7841878ce7b9bb7415b9a48059e7e71a708e1df67f94d769f47db56934473a7708a686ee0cd4a817bd353ca3120522dcebd3

          • C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\IndexedDB\https_www.terabox.com_0.indexeddb.leveldb\CURRENT

            Filesize

            16B

            MD5

            46295cac801e5d4857d09837238a6394

            SHA1

            44e0fa1b517dbf802b18faf0785eeea6ac51594b

            SHA256

            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

            SHA512

            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

          • C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Network Persistent State

            Filesize

            1KB

            MD5

            a830f04e51ce42d2a8c18064bd18e56f

            SHA1

            db80edcece8ce5d5cc1ee32c535a861363693c48

            SHA256

            ec6394d1dc378d4228d7b086a6f54a2aee4a1072f65b60308237421e5970604f

            SHA512

            57e350027a7b542ae83a49a9deb0ae72f4562a4b4a4f2b7426f8971ef1244def36d7970019601a9520ecc4daa3488c36f5d0dc2f65ed9862cbf6b0fd1b01b412

          • C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Network Persistent State

            Filesize

            1KB

            MD5

            3d9f5131524486cac0f626cfdf69c5fc

            SHA1

            c4a16854ed6ab7144b451fd835e2dd1c7a45692e

            SHA256

            5ee1e032ee3708dcf5cb282464f5afc324c4069d242013b0366685e9f4daad2c

            SHA512

            cc0cba6c3cb18aacc07bc792a295cb415f2c9207bbf0335abb579c7c48e5ffdde3222246c7cd88e8a609fca6ef75063b236ea8f802ad80f7e148cee774173f09

          • C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Network Persistent State~RFe58cdda.TMP

            Filesize

            59B

            MD5

            78bfcecb05ed1904edce3b60cb5c7e62

            SHA1

            bf77a7461de9d41d12aa88fba056ba758793d9ce

            SHA256

            c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572

            SHA512

            2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73

          • C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\TransportSecurity

            Filesize

            869B

            MD5

            f68ab82770b86843b64a852bf15532da

            SHA1

            500f6127768c6598d0ff688dc35101be97e6b55b

            SHA256

            dad162d79ae9de35917532d26684f447a4b4e50cd2a8c3904c4b8c1aade9f1d9

            SHA512

            0681bd939486228cbd15280ac46e5ead9221b15b49e4ce9001b955fc4e3026742c57340d3c9f9d4244d35be30df5853a048e7e0ace12b078ab1e04a7dcdd893d

          • C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\TransportSecurity~RFe589e8d.TMP

            Filesize

            702B

            MD5

            e4e5327c5c0d69eb7e3e4853086e8aff

            SHA1

            3e5c819bbe25bcbadf30e9b4b1483247e195e9cd

            SHA256

            2673e1eef7198d8eb975fa78a0eee64330efb7f8a00b0577f4908199f4b077da

            SHA512

            ccda7452384ba07db5583f1bcfedb996145a9e6931ab54fd8387193dffbc40ea67d4a07dde53b83e06e78074c689de559a0972badf3dd5e61e23ae80b5ec79e7

          • C:\Users\Admin\AppData\Local\Temp\TeraBox_status

            Filesize

            113B

            MD5

            7613fc18c4ce1baf570c411b55796386

            SHA1

            9ce4074b4c4ff8eee83bad4fafa01e52b4a4a713

            SHA256

            d6b0fdb11e47325cf1d52897a02fdddb80faf19dee37c3e81c775b40c27074bc

            SHA512

            ae2cbe77ed10be560f1ad679193a35a6005b5a2fba3100f8a4dfe05c93dcf4033297bbbf8c5a40dcece38e42947c24cd9fdf3a4755951ebc2a3074cbac0c1452

          • memory/384-253-0x0000000003130000-0x0000000003131000-memory.dmp

            Filesize

            4KB

          • memory/384-257-0x0000000064FC0000-0x00000000663EC000-memory.dmp

            Filesize

            20.2MB

          • memory/384-256-0x0000000003160000-0x0000000003161000-memory.dmp

            Filesize

            4KB

          • memory/384-251-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

            Filesize

            4KB

          • memory/384-252-0x0000000003100000-0x0000000003101000-memory.dmp

            Filesize

            4KB

          • memory/384-254-0x0000000003140000-0x0000000003141000-memory.dmp

            Filesize

            4KB

          • memory/384-255-0x0000000003150000-0x0000000003151000-memory.dmp

            Filesize

            4KB

          • memory/384-250-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

            Filesize

            4KB

          • memory/4388-334-0x00000000004E0000-0x0000000000B41000-memory.dmp

            Filesize

            6.4MB

          • memory/4388-5-0x00000000004EA000-0x00000000004EB000-memory.dmp

            Filesize

            4KB

          • memory/4388-24-0x00000000004E0000-0x0000000000B41000-memory.dmp

            Filesize

            6.4MB

          • memory/4388-434-0x00000000004E0000-0x0000000000B41000-memory.dmp

            Filesize

            6.4MB