d629977c9ff1649c48d93d2fc489bf8591660a5aa9edd8208b71bf8786658ac9

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3fa8173cb89c967ea4828a933a9e42e0N.exe
Size

2.6MB
MD5

3fa8173cb89c967ea4828a933a9e42e0
SHA1

e62757b9a9d44aab83fb6d4a6575c8ea71029ed6
SHA256

d629977c9ff1649c48d93d2fc489bf8591660a5aa9edd8208b71bf8786658ac9
SHA512

842d6faf1a310c93e4de8f23426e95bbd68b082256f01ec3f4591628a1c07b6d8102e185a050fbd1fc93e8943fd901ed18c324757c2d5b4e15c97d3df5ec4dd6
SSDEEP

49152:lS5IvAG44oOCdcSzNIJG70V6Do4yV/5mc5aNZJ350zg5bEJ60IZGnpw/YA:lS5G4DOT5JGIVzh/5aZX0zgd0IZGpwF

Score

10^/10

discovery evasion persistence themida trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3fa8173cb89c967ea4828a933a9e42e0N.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3fa8173cb89c967ea4828a933a9e42e0N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3fa8173cb89c967ea4828a933a9e42e0N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe

Executes dropped EXE 4 IoCs

pid	Process
2688	explorer.exe
2792	spoolsv.exe
2564	svchost.exe
2596	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2688	explorer.exe
2792	spoolsv.exe
2564	svchost.exe

Themida packer 18 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2488-0-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/files/0x0009000000015f10-7.dat	themida
behavioral1/memory/2488-9-0x00000000037A0000-0x0000000003DB3000-memory.dmp	themida
behavioral1/memory/2688-12-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/files/0x00080000000160ab-18.dat	themida
behavioral1/memory/2792-24-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/files/0x000800000001629c-34.dat	themida
behavioral1/memory/2488-37-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2564-36-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2596-44-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2596-49-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2792-51-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2488-53-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2688-54-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2564-56-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2688-57-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2564-68-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2688-69-0x0000000000400000-0x0000000000A13000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3fa8173cb89c967ea4828a933a9e42e0N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2688	explorer.exe
2792	spoolsv.exe
2564	svchost.exe
2596	spoolsv.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	3fa8173cb89c967ea4828a933a9e42e0N.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3fa8173cb89c967ea4828a933a9e42e0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2604	schtasks.exe
2364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2564	svchost.exe
2564	svchost.exe
2564	svchost.exe
2564	svchost.exe
2564	svchost.exe
2564	svchost.exe
2564	svchost.exe
2564	svchost.exe
2564	svchost.exe
2564	svchost.exe
2564	svchost.exe
2564	svchost.exe
2564	svchost.exe
2564	svchost.exe
2564	svchost.exe
2564	svchost.exe
2688	explorer.exe
2564	svchost.exe
2564	svchost.exe
2564	svchost.exe
2564	svchost.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2564	svchost.exe
2564	svchost.exe
2688	explorer.exe
2688	explorer.exe
2564	svchost.exe
2688	explorer.exe
2564	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2564	svchost.exe
2688	explorer.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2488	3fa8173cb89c967ea4828a933a9e42e0N.exe
2688	explorer.exe
2688	explorer.exe
2792	spoolsv.exe
2792	spoolsv.exe
2564	svchost.exe
2564	svchost.exe
2596	spoolsv.exe
2596	spoolsv.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2688	2488	3fa8173cb89c967ea4828a933a9e42e0N.exe	30
PID 2488 wrote to memory of 2688	2488	3fa8173cb89c967ea4828a933a9e42e0N.exe	30
PID 2488 wrote to memory of 2688	2488	3fa8173cb89c967ea4828a933a9e42e0N.exe	30
PID 2488 wrote to memory of 2688	2488	3fa8173cb89c967ea4828a933a9e42e0N.exe	30
PID 2688 wrote to memory of 2792	2688	explorer.exe	31
PID 2688 wrote to memory of 2792	2688	explorer.exe	31
PID 2688 wrote to memory of 2792	2688	explorer.exe	31
PID 2688 wrote to memory of 2792	2688	explorer.exe	31
PID 2792 wrote to memory of 2564	2792	spoolsv.exe	32
PID 2792 wrote to memory of 2564	2792	spoolsv.exe	32
PID 2792 wrote to memory of 2564	2792	spoolsv.exe	32
PID 2792 wrote to memory of 2564	2792	spoolsv.exe	32
PID 2564 wrote to memory of 2596	2564	svchost.exe	33
PID 2564 wrote to memory of 2596	2564	svchost.exe	33
PID 2564 wrote to memory of 2596	2564	svchost.exe	33
PID 2564 wrote to memory of 2596	2564	svchost.exe	33
PID 2688 wrote to memory of 3008	2688	explorer.exe	34
PID 2688 wrote to memory of 3008	2688	explorer.exe	34
PID 2688 wrote to memory of 3008	2688	explorer.exe	34
PID 2688 wrote to memory of 3008	2688	explorer.exe	34
PID 2564 wrote to memory of 2604	2564	svchost.exe	35
PID 2564 wrote to memory of 2604	2564	svchost.exe	35
PID 2564 wrote to memory of 2604	2564	svchost.exe	35
PID 2564 wrote to memory of 2604	2564	svchost.exe	35
PID 2564 wrote to memory of 2364	2564	svchost.exe	38
PID 2564 wrote to memory of 2364	2564	svchost.exe	38
PID 2564 wrote to memory of 2364	2564	svchost.exe	38
PID 2564 wrote to memory of 2364	2564	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\3fa8173cb89c967ea4828a933a9e42e0N.exe
"C:\Users\Admin\AppData\Local\Temp\3fa8173cb89c967ea4828a933a9e42e0N.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2688
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2564
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2596
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 08:43 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2604
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 08:44 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2364
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\spoolsv.exe

Filesize
2.6MB

MD5
5ac319cdd23bc56e986978473f831182

SHA1
1564ce3320cf35b59f3b3e0acc83b00f852c4c4f

SHA256
e3e8367ae8eaf2178eab67fede8b5ea54c1c93de4c3fe3edb725f082366199a3

SHA512
36aaed1c8aa039b37c558aecac10049b12db3e19133deaafd424f3c069c8b40131a124eaf8642f5f929330a00ffecb63b5512a40a25092d52dd55c33a716d8fc

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
2.6MB

MD5
0e79a0dbfadc2871e127cce26a09c0ec

SHA1
4af0942199a3061298e8c9957923aec6ca4b3e18

SHA256
e7108bd74f4165f44fd00364d4e22043df298b8ce23394963f7652043c8932a5

SHA512
07b3f44b327fc94e9ae9a75179e1f28d74aab1bc0b2344f04b0efb6adcf9ff3771134e656777c24ffb8a18ca10fc342120de9c5024f57acc10ad67fcd97e8f3f

Download Submit
\Windows\Resources\Themes\explorer.exe

Filesize
2.6MB

MD5
fdf0b63d47efb66e27b66e26bde76b0f

SHA1
6307aa855671ec092d8c53f486b96c5bd584ab67

SHA256
d37a4492cd47d212c59afb6a488d78986e54a9c51e8a553250accc0848e8fc75

SHA512
ec454158e61c6082e6778f88e0dcd078a735d5bec3edd952622aa569c487c759f6480e0d3784e629fcd52176c7661df56631d06d02ed36f454c16c56c49c21ba

Download Submit
memory/2488-53-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2488-9-0x00000000037A0000-0x0000000003DB3000-memory.dmp

Filesize
6.1MB

Download
memory/2488-1-0x00000000771C0000-0x00000000771C2000-memory.dmp

Filesize
8KB

Download
memory/2488-37-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2488-0-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2564-36-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2564-68-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2564-56-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2596-44-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2596-49-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2688-12-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2688-54-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2688-55-0x00000000037D0000-0x0000000003DE3000-memory.dmp

Filesize
6.1MB

Download
memory/2688-23-0x00000000037D0000-0x0000000003DE3000-memory.dmp

Filesize
6.1MB

Download
memory/2688-57-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2688-69-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2792-51-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2792-35-0x0000000003730000-0x0000000003D43000-memory.dmp

Filesize
6.1MB

Download
memory/2792-24-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download