c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911d

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
Size

2.5MB
MD5

99ada45342214680ac3d2bde8dc00680
SHA1

2a03e4d3b3e3e0520bd9b662a519064cb7ace5ad
SHA256

c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911d
SHA512

85954a4c8f4487123154c97ad6043b4c68844dcb9358075cfbc150663fad8709ab9ac3b4a0e19e8875feb19f173bfeabf630e750db553fdd9ed43bff64f13dac
SSDEEP

49152:8xmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyx8:8xx9NUFkQx753uWuCyyx8

Score

10^/10

discovery evasion persistence themida trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe

Executes dropped EXE 4 IoCs

pid	Process
2784	explorer.exe
2776	spoolsv.exe
2636	svchost.exe
2740	spoolsv.exe

Loads dropped DLL 4 IoCs

pid	Process
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2784	explorer.exe
2776	spoolsv.exe
2636	svchost.exe

Themida packer 18 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2232-0-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/files/0x000900000001937b-7.dat	themida
behavioral1/memory/2784-11-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/files/0x0007000000019423-17.dat	themida
behavioral1/memory/2784-20-0x0000000003700000-0x0000000003D0E000-memory.dmp	themida
behavioral1/memory/2776-23-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/files/0x0028000000019353-30.dat	themida
behavioral1/memory/2636-35-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2232-42-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2740-46-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2740-48-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2776-50-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2232-52-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2784-53-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2636-54-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2784-55-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2636-66-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2784-67-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2784	explorer.exe
2776	spoolsv.exe
2636	svchost.exe
2740	spoolsv.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
340	schtasks.exe
2516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2636	svchost.exe
2784	explorer.exe
2636	svchost.exe
2636	svchost.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2636	svchost.exe
2636	svchost.exe
2784	explorer.exe
2784	explorer.exe
2636	svchost.exe
2784	explorer.exe
2636	svchost.exe
2636	svchost.exe
2784	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2636	svchost.exe
2784	explorer.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
2784	explorer.exe
2784	explorer.exe
2776	spoolsv.exe
2776	spoolsv.exe
2636	svchost.exe
2636	svchost.exe
2740	spoolsv.exe
2740	spoolsv.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2784	2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe	30
PID 2232 wrote to memory of 2784	2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe	30
PID 2232 wrote to memory of 2784	2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe	30
PID 2232 wrote to memory of 2784	2232	c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe	30
PID 2784 wrote to memory of 2776	2784	explorer.exe	31
PID 2784 wrote to memory of 2776	2784	explorer.exe	31
PID 2784 wrote to memory of 2776	2784	explorer.exe	31
PID 2784 wrote to memory of 2776	2784	explorer.exe	31
PID 2776 wrote to memory of 2636	2776	spoolsv.exe	32
PID 2776 wrote to memory of 2636	2776	spoolsv.exe	32
PID 2776 wrote to memory of 2636	2776	spoolsv.exe	32
PID 2776 wrote to memory of 2636	2776	spoolsv.exe	32
PID 2636 wrote to memory of 2740	2636	svchost.exe	33
PID 2636 wrote to memory of 2740	2636	svchost.exe	33
PID 2636 wrote to memory of 2740	2636	svchost.exe	33
PID 2636 wrote to memory of 2740	2636	svchost.exe	33
PID 2784 wrote to memory of 2596	2784	explorer.exe	34
PID 2784 wrote to memory of 2596	2784	explorer.exe	34
PID 2784 wrote to memory of 2596	2784	explorer.exe	34
PID 2784 wrote to memory of 2596	2784	explorer.exe	34
PID 2636 wrote to memory of 340	2636	svchost.exe	35
PID 2636 wrote to memory of 340	2636	svchost.exe	35
PID 2636 wrote to memory of 340	2636	svchost.exe	35
PID 2636 wrote to memory of 340	2636	svchost.exe	35
PID 2636 wrote to memory of 2516	2636	svchost.exe	38
PID 2636 wrote to memory of 2516	2636	svchost.exe	38
PID 2636 wrote to memory of 2516	2636	svchost.exe	38
PID 2636 wrote to memory of 2516	2636	svchost.exe	38

C:\Users\Admin\AppData\Local\Temp\c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe
"C:\Users\Admin\AppData\Local\Temp\c7465f1732610d442228a422d7521fdf475f0707f6ff1cc28ea3cc7b7477911dN.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2784
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2636
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2740
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 13:20 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:340
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 13:21 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2516
- - C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe
    3⤵
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\spoolsv.exe

Filesize
2.5MB

MD5
7f40b68cf76aaf8ccb3fd52c8654b484

SHA1
5579337ea51a3565f5728de90a70deaf56941670

SHA256
0da1e51703cbbd4ce9605304bf7414504960d0dcbbf826afe65daf1a806cc77e

SHA512
b878c4a9dc78a6aa1a68383f8e6f5dc5995fc0fd39d4d42ff36095e9146ad4affa9c8b3410c7509d7335f750b33eeeb7ea8655492b543de9a73effa082c18852

Download Submit
\Windows\Resources\Themes\explorer.exe

Filesize
2.5MB

MD5
a57d38391d724a1e984a69e9b95d11ce

SHA1
31b5dc3ca1e7fb3d1d9917802f2162e68f84e32b

SHA256
ab05bc0b813beb60b242fd5a106149c37cfbdbeeb989859e23dd6979fd03d66c

SHA512
00b85f91b0fce7d341d5bf67dfa7daba1d5bc4f3bd217ed95f027fba9e75546833eacbb864b7e8833e082b71ec73c74d9ecc4a717a0ffc6f461316568ca35b2f

Download Submit
\Windows\Resources\svchost.exe

Filesize
2.5MB

MD5
5a022e019f76ed7569c6df669b33e873

SHA1
469fff44a7aaaa44078e20406a713fe2a74b2e53

SHA256
8324389099b657540ee75130bc3fc9777f0c15c4dc3dca1267e56f6992b0b95a

SHA512
14e1892810e97b7420ed421c9ad8cbc1d8b53862e2e999729f4c8dc30694b53d408ce26adc26285bda024b81f63ab9cad982c40722b0f657f48289818357300d

Download Submit
memory/2232-1-0x0000000077AD0000-0x0000000077AD2000-memory.dmp

Filesize
8KB

Download
memory/2232-0-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2232-52-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2232-42-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2636-66-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2636-54-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2636-35-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2740-48-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2740-46-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2776-23-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2776-50-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2776-34-0x00000000035A0000-0x0000000003BAE000-memory.dmp

Filesize
6.1MB

Download
memory/2784-20-0x0000000003700000-0x0000000003D0E000-memory.dmp

Filesize
6.1MB

Download
memory/2784-53-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2784-55-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2784-11-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2784-67-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download