cb380a4e22199067b5f96a64bffba9c647622b8168b130dba05ac8eade53b326

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c94bd82103e915b07c9c68f52fd55e0N.exe
Size

2.6MB
MD5

4c94bd82103e915b07c9c68f52fd55e0
SHA1

9f16769de516835de4b54ba6481cb0a576ff2fad
SHA256

cb380a4e22199067b5f96a64bffba9c647622b8168b130dba05ac8eade53b326
SHA512

58c5ca4cf908ce426bc0ec1676057a3f03a9c7286beff2729670128df05dcb038c2d45d659c51efd8b5aecaec1067762db6093fd9dce2a85dd3a4e618d8eca82
SSDEEP

49152:lS5IvAG44oOCdcSzNIJG70V6Do4yV/5mc5aNZJ350zg5bEJ60IZGnpw/YP:lS5G4DOT5JGIVzh/5aZX0zgd0IZGpwC

Score

10^/10

discovery evasion persistence themida trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4c94bd82103e915b07c9c68f52fd55e0N.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4c94bd82103e915b07c9c68f52fd55e0N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4c94bd82103e915b07c9c68f52fd55e0N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe

Executes dropped EXE 4 IoCs

pid	Process
2740	explorer.exe
2052	spoolsv.exe
2628	svchost.exe
2648	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2740	explorer.exe
2052	spoolsv.exe
2628	svchost.exe

Themida packer 18 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2712-0-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/files/0x0033000000016d89-7.dat	themida
behavioral1/memory/2740-11-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/files/0x0004000000017801-17.dat	themida
behavioral1/memory/2052-23-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/files/0x00080000000186b7-30.dat	themida
behavioral1/memory/2712-33-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2628-35-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2740-43-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2648-44-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2648-49-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2052-51-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2712-53-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2740-55-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2628-56-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2740-65-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2628-68-0x0000000000400000-0x0000000000A13000-memory.dmp	themida
behavioral1/memory/2740-69-0x0000000000400000-0x0000000000A13000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4c94bd82103e915b07c9c68f52fd55e0N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2740	explorer.exe
2052	spoolsv.exe
2628	svchost.exe
2648	spoolsv.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	4c94bd82103e915b07c9c68f52fd55e0N.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c94bd82103e915b07c9c68f52fd55e0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2684	schtasks.exe
764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2628	svchost.exe
2740	explorer.exe
2628	svchost.exe
2628	svchost.exe
2740	explorer.exe
2740	explorer.exe
2740	explorer.exe
2628	svchost.exe
2740	explorer.exe
2628	svchost.exe
2740	explorer.exe
2628	svchost.exe
2740	explorer.exe
2628	svchost.exe
2628	svchost.exe
2740	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2628	svchost.exe
2740	explorer.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2712	4c94bd82103e915b07c9c68f52fd55e0N.exe
2740	explorer.exe
2740	explorer.exe
2052	spoolsv.exe
2052	spoolsv.exe
2628	svchost.exe
2628	svchost.exe
2648	spoolsv.exe
2648	spoolsv.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2740	2712	4c94bd82103e915b07c9c68f52fd55e0N.exe	30
PID 2712 wrote to memory of 2740	2712	4c94bd82103e915b07c9c68f52fd55e0N.exe	30
PID 2712 wrote to memory of 2740	2712	4c94bd82103e915b07c9c68f52fd55e0N.exe	30
PID 2712 wrote to memory of 2740	2712	4c94bd82103e915b07c9c68f52fd55e0N.exe	30
PID 2740 wrote to memory of 2052	2740	explorer.exe	31
PID 2740 wrote to memory of 2052	2740	explorer.exe	31
PID 2740 wrote to memory of 2052	2740	explorer.exe	31
PID 2740 wrote to memory of 2052	2740	explorer.exe	31
PID 2052 wrote to memory of 2628	2052	spoolsv.exe	32
PID 2052 wrote to memory of 2628	2052	spoolsv.exe	32
PID 2052 wrote to memory of 2628	2052	spoolsv.exe	32
PID 2052 wrote to memory of 2628	2052	spoolsv.exe	32
PID 2628 wrote to memory of 2648	2628	svchost.exe	33
PID 2628 wrote to memory of 2648	2628	svchost.exe	33
PID 2628 wrote to memory of 2648	2628	svchost.exe	33
PID 2628 wrote to memory of 2648	2628	svchost.exe	33
PID 2740 wrote to memory of 1060	2740	explorer.exe	34
PID 2740 wrote to memory of 1060	2740	explorer.exe	34
PID 2740 wrote to memory of 1060	2740	explorer.exe	34
PID 2740 wrote to memory of 1060	2740	explorer.exe	34
PID 2628 wrote to memory of 2684	2628	svchost.exe	35
PID 2628 wrote to memory of 2684	2628	svchost.exe	35
PID 2628 wrote to memory of 2684	2628	svchost.exe	35
PID 2628 wrote to memory of 2684	2628	svchost.exe	35
PID 2628 wrote to memory of 764	2628	svchost.exe	38
PID 2628 wrote to memory of 764	2628	svchost.exe	38
PID 2628 wrote to memory of 764	2628	svchost.exe	38
PID 2628 wrote to memory of 764	2628	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\4c94bd82103e915b07c9c68f52fd55e0N.exe
"C:\Users\Admin\AppData\Local\Temp\4c94bd82103e915b07c9c68f52fd55e0N.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2740
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2628
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2648
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:41 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2684
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:42 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:764
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\spoolsv.exe

Filesize
2.6MB

MD5
f79e74c96c523b4de3dfd8955918dbc9

SHA1
d2319e15711ed22eb325fe491948a56c4d486a76

SHA256
910a6802ca3b255973e4b080d95a17e780081751e1572afee7d5ad7d3bb70053

SHA512
2f358dc848176bcd5058e450693e155d87319c31308f4dde26473af02e23ab02312316bd3fbdc9b2b7593494ab4a83af3942e530466a35d9857ff4c114bf7d72

Download Submit
\Windows\Resources\Themes\explorer.exe

Filesize
2.6MB

MD5
86239c36aaa65bb6da918f341e338df6

SHA1
5f70a670218b79ae418bd14118821d061394bb00

SHA256
522247149894a808e87a5e33eb060442488e2690f4e4c4d42abf41cd664a0163

SHA512
f34a01ce115159f57adbbbecd56b57ecd145f9591a6c696225687d91a068c1c6a4fae78288a6550267aa4bb106b68f666b2eac5e7e3386839b4c58ad46cf9e08

Download Submit
\Windows\Resources\svchost.exe

Filesize
2.6MB

MD5
6ac260b57da0130cf0ca91fab5f8e477

SHA1
a0ad7eb65ba8ed68b946646f3b4a3409dbd25151

SHA256
e01e4127268c44a54be886fa106c60edee56b2656f5f134611f28e4952df8c3c

SHA512
5ec3d776b3e19c5d339b1bc59d1a237a7a59c12255d75472e5febd8874a99fdfd3c74af8ba6c0ae2022966b00d726715cf2fa1ee55f0fd73450e4de2a71c4a32

Download Submit
memory/2052-23-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2052-51-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2628-68-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2628-58-0x00000000032E0000-0x00000000038F3000-memory.dmp

Filesize
6.1MB

Download
memory/2628-56-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2628-35-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2648-44-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2648-49-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2712-53-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2712-42-0x0000000003260000-0x0000000003873000-memory.dmp

Filesize
6.1MB

Download
memory/2712-33-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2712-0-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2712-1-0x0000000077000000-0x0000000077002000-memory.dmp

Filesize
8KB

Download
memory/2740-43-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2740-54-0x00000000033D0000-0x00000000039E3000-memory.dmp

Filesize
6.1MB

Download
memory/2740-55-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2740-22-0x00000000033D0000-0x00000000039E3000-memory.dmp

Filesize
6.1MB

Download
memory/2740-11-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2740-65-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download
memory/2740-69-0x0000000000400000-0x0000000000A13000-memory.dmp

Filesize
6.1MB

Download