8650cc32a68d474938c678d1e2c15b56cd3c7553d17b82cf7fa384b9b2cfbd14

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dabff55fbaf499428753fad48a5f76d0N.exe
Size

2.5MB
MD5

dabff55fbaf499428753fad48a5f76d0
SHA1

d2f665fca08fa2a191eec5ab8c750a71a77a3854
SHA256

8650cc32a68d474938c678d1e2c15b56cd3c7553d17b82cf7fa384b9b2cfbd14
SHA512

8c32dcd2d0c2b4ee604f0e9b09b3ca2610eb98de60ce80f9091bb6b30467610ee833ab9ab48a33841a0206182b84a63b04084ea97a535c617f14437e713656ce
SSDEEP

49152:hxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxF:hxx9NUFkQx753uWuCyyxF

Score

10^/10

discovery evasion persistence themida trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	dabff55fbaf499428753fad48a5f76d0N.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dabff55fbaf499428753fad48a5f76d0N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	dabff55fbaf499428753fad48a5f76d0N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe

Executes dropped EXE 4 IoCs

pid	Process
2492	explorer.exe
2248	spoolsv.exe
2668	svchost.exe
2684	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
1852	dabff55fbaf499428753fad48a5f76d0N.exe
2492	explorer.exe
2248	spoolsv.exe
2668	svchost.exe

Themida packer 20 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1852-0-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/files/0x000b00000001739b-7.dat	themida
behavioral1/memory/2492-12-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/1852-11-0x0000000003660000-0x0000000003C6E000-memory.dmp	themida
behavioral1/memory/2492-21-0x0000000003800000-0x0000000003E0E000-memory.dmp	themida
behavioral1/files/0x00080000000173f6-19.dat	themida
behavioral1/memory/2248-24-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/files/0x000800000001746c-31.dat	themida
behavioral1/memory/2668-36-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/1852-42-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2684-45-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2684-50-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2248-52-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/1852-53-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2492-54-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2668-55-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2492-56-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2492-64-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2668-67-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2492-68-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dabff55fbaf499428753fad48a5f76d0N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
1852	dabff55fbaf499428753fad48a5f76d0N.exe
2492	explorer.exe
2248	spoolsv.exe
2668	svchost.exe
2684	spoolsv.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	dabff55fbaf499428753fad48a5f76d0N.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dabff55fbaf499428753fad48a5f76d0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1556	schtasks.exe
1996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1852	dabff55fbaf499428753fad48a5f76d0N.exe
1852	dabff55fbaf499428753fad48a5f76d0N.exe
1852	dabff55fbaf499428753fad48a5f76d0N.exe
1852	dabff55fbaf499428753fad48a5f76d0N.exe
1852	dabff55fbaf499428753fad48a5f76d0N.exe
1852	dabff55fbaf499428753fad48a5f76d0N.exe
1852	dabff55fbaf499428753fad48a5f76d0N.exe
1852	dabff55fbaf499428753fad48a5f76d0N.exe
1852	dabff55fbaf499428753fad48a5f76d0N.exe
1852	dabff55fbaf499428753fad48a5f76d0N.exe
1852	dabff55fbaf499428753fad48a5f76d0N.exe
1852	dabff55fbaf499428753fad48a5f76d0N.exe
1852	dabff55fbaf499428753fad48a5f76d0N.exe
1852	dabff55fbaf499428753fad48a5f76d0N.exe
1852	dabff55fbaf499428753fad48a5f76d0N.exe
1852	dabff55fbaf499428753fad48a5f76d0N.exe
1852	dabff55fbaf499428753fad48a5f76d0N.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2668	svchost.exe
2492	explorer.exe
2668	svchost.exe
2668	svchost.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2668	svchost.exe
2492	explorer.exe
2492	explorer.exe
2668	svchost.exe
2492	explorer.exe
2668	svchost.exe
2492	explorer.exe
2668	svchost.exe
2492	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2492	explorer.exe
2668	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1852	dabff55fbaf499428753fad48a5f76d0N.exe
1852	dabff55fbaf499428753fad48a5f76d0N.exe
2492	explorer.exe
2492	explorer.exe
2248	spoolsv.exe
2248	spoolsv.exe
2668	svchost.exe
2668	svchost.exe
2684	spoolsv.exe
2684	spoolsv.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2492	1852	dabff55fbaf499428753fad48a5f76d0N.exe	31
PID 1852 wrote to memory of 2492	1852	dabff55fbaf499428753fad48a5f76d0N.exe	31
PID 1852 wrote to memory of 2492	1852	dabff55fbaf499428753fad48a5f76d0N.exe	31
PID 1852 wrote to memory of 2492	1852	dabff55fbaf499428753fad48a5f76d0N.exe	31
PID 2492 wrote to memory of 2248	2492	explorer.exe	32
PID 2492 wrote to memory of 2248	2492	explorer.exe	32
PID 2492 wrote to memory of 2248	2492	explorer.exe	32
PID 2492 wrote to memory of 2248	2492	explorer.exe	32
PID 2248 wrote to memory of 2668	2248	spoolsv.exe	33
PID 2248 wrote to memory of 2668	2248	spoolsv.exe	33
PID 2248 wrote to memory of 2668	2248	spoolsv.exe	33
PID 2248 wrote to memory of 2668	2248	spoolsv.exe	33
PID 2668 wrote to memory of 2684	2668	svchost.exe	34
PID 2668 wrote to memory of 2684	2668	svchost.exe	34
PID 2668 wrote to memory of 2684	2668	svchost.exe	34
PID 2668 wrote to memory of 2684	2668	svchost.exe	34
PID 2492 wrote to memory of 2916	2492	explorer.exe	35
PID 2492 wrote to memory of 2916	2492	explorer.exe	35
PID 2492 wrote to memory of 2916	2492	explorer.exe	35
PID 2492 wrote to memory of 2916	2492	explorer.exe	35
PID 2668 wrote to memory of 1556	2668	svchost.exe	36
PID 2668 wrote to memory of 1556	2668	svchost.exe	36
PID 2668 wrote to memory of 1556	2668	svchost.exe	36
PID 2668 wrote to memory of 1556	2668	svchost.exe	36
PID 2668 wrote to memory of 1996	2668	svchost.exe	39
PID 2668 wrote to memory of 1996	2668	svchost.exe	39
PID 2668 wrote to memory of 1996	2668	svchost.exe	39
PID 2668 wrote to memory of 1996	2668	svchost.exe	39

C:\Users\Admin\AppData\Local\Temp\dabff55fbaf499428753fad48a5f76d0N.exe
"C:\Users\Admin\AppData\Local\Temp\dabff55fbaf499428753fad48a5f76d0N.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2492
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2668
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2684
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 09:55 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1556
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 09:56 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1996
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\Resources\Themes\explorer.exe

Filesize
2.5MB

MD5
5a377cae3fc16f55fdc5821651b48ebb

SHA1
0d0f692df3e11064cfca0d288fbce6e9dcb981b9

SHA256
6d10e847b5d481a94421bc92af05ef9dda0b8f7260afaa96683182bfd61ef993

SHA512
c6951eca2eb5061040cc77e0c09ea1dc1c98b3d2d4da8e3efee419c6bae90a82397480d3dba7d509669593c1e3a1388d21cfecd4d4cdb5fb6b3fe5da5f8eaa32

Download Submit
\Windows\Resources\spoolsv.exe

Filesize
2.5MB

MD5
29c8c2e2029b8c6837f5fb0754f34b90

SHA1
bac419b39b5647be39fea82e3124d0e102e621f2

SHA256
586a713a2d945a67d75f4ac1f70e83196c1d17d9a94ea4c77b0923e502ba51a0

SHA512
93200d3ea1b7364cc32258e7b6f8bf1661cd8d93eb05ab706fae67866a5dd3efd77feda7ca48e1c712e4d22dd1b3cc4179c6bd32a9af508a7d932b420b91933a

Download Submit
\Windows\Resources\svchost.exe

Filesize
2.5MB

MD5
85ee185221bbffdff73199428048186f

SHA1
56a8377b9b6e11b73718d817e6bfeefc60c7dbc4

SHA256
142ed85fa276a8b4d8c4e82eef0456dcc7e767f0643e559db292bd4349db35a7

SHA512
ea287a78bd701b2665c98c2f64dca8e51afec4a887a440347b2a0f787c0ac49ca413d6b8693e86d47e3ab4d898ccf8c8889691154ab54c75331f8fa6d2bd485b

Download Submit
memory/1852-44-0x0000000003660000-0x0000000003C6E000-memory.dmp

Filesize
6.1MB

Download
memory/1852-1-0x0000000077230000-0x0000000077232000-memory.dmp

Filesize
8KB

Download
memory/1852-53-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/1852-11-0x0000000003660000-0x0000000003C6E000-memory.dmp

Filesize
6.1MB

Download
memory/1852-0-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/1852-42-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2248-24-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2248-35-0x00000000036D0000-0x0000000003CDE000-memory.dmp

Filesize
6.1MB

Download
memory/2248-52-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2492-21-0x0000000003800000-0x0000000003E0E000-memory.dmp

Filesize
6.1MB

Download
memory/2492-12-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2492-54-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2492-56-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2492-64-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2492-68-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2668-36-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2668-55-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2668-67-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2684-45-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2684-50-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download