banload | d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1c

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2024 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
Size

5.6MB
MD5

9b810439391c9c861fe0cfb439b36e50
SHA1

797fbe20d5d4ed7e2351c423ba17b9f3957654df
SHA256

d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1c
SHA512

3b9d98600c4aa3b0e4bea6011a70c87d63b82789eafb0fea2f466410b5203a6b976e8832c82403f0167a5f5252254289f8164746731e9838c03c61ed0d7a0d8b
SSDEEP

98304:RF8QUitE4iLqaPWGnEv+OKQr8MAvFrpHv/kAZIlnHyLF06Sud19nEntkKl:RFQWEPnPBnEmOKIbGpPMAZcy3qyKl

Score

10^/10

banload discovery downloader dropper evasion ransomware trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe

Renames multiple (249) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe

Drops file in Program Files directory 64 IoCs

Processes:

d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe

Modifies registry class 8 IoCs

Processes:

d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DisplayName = "@C:\\Program Files\\Microsoft Office\\Root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Office16\\oregres.dll,-403"	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DisableLowILProcessIsolation = "1"	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocHandler32	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocHandler32\ = "ole32.dll"	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE"	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Microsoft Excel previewer"	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe

description	pid	Process
Token: 33	1360	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
Token: SeIncBasePriorityPrivilege	1360	d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe

C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
"C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini.tmp

Filesize
5.7MB

MD5
f29231d1d1c6539cfe8f7f96a4d22c91

SHA1
72f13c74d209421b23d1703b53eabb2a5a912b39

SHA256
5f0e5fbd94c3e44b85ffa968b194ecf9b8ffaa98236a6451a614ab0fe4ebda84

SHA512
4bb5c10da629cdeabfd31bfb9d90a3c68a78b1716a8e3a98001e880620e13820159086a71269beef8db4735703a3af59044b0ff314d440c10cebefdd83b434e1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
5.8MB

MD5
dd5e94bbe1ab99a989bcd8d0cd8c46bc

SHA1
be74e049bbe2f3ab467f2a3455175867c27988d5

SHA256
b1f805012c9853ed4677d00dae9dc598987b81db73571dc8368084fcb7851dcf

SHA512
4c1d0b7a1c11a4bf9bdb20a8d0af162cedb36631e451484b10f7e9b2dfec7642d1bceeb644a1c8900886cbf9c79eb5b11d338ae2cf31c94b08ad5a0e9166dc20

Download Submit
memory/1360-0-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/1360-2-0x0000000004930000-0x0000000004B3C000-memory.dmp

Filesize
2.0MB

Download
memory/1360-9-0x0000000004930000-0x0000000004B3C000-memory.dmp

Filesize
2.0MB

Download
memory/1360-13-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/1360-12-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/1360-14-0x0000000004930000-0x0000000004B3C000-memory.dmp

Filesize
2.0MB

Download
memory/1360-33-0x0000000004930000-0x0000000004B3C000-memory.dmp

Filesize
2.0MB

Download
memory/1360-32-0x0000000004930000-0x0000000004B3C000-memory.dmp

Filesize
2.0MB

Download
memory/1360-78-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/1360-90-0x0000000004930000-0x0000000004B3C000-memory.dmp

Filesize
2.0MB

Download