defendnot | 800e772f537565970a4d0873a91e631f0a74ebc354485df30e82865053ea2966

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 11.2MB
Sample260922-qflhhawcqg
SHA256 800e772f537565970a4d0873a91e631f0a74ebc354485df30e82865053ea2966
MD5 fb9389a7b2c117daa86601020fe905d0
SHA1 353a5d83cb7f1cb00173a29b0fed14853e015df7
SHA512 9dbaba815f612f73e86a1ad31c77b650847d311a02c167a51600a62b22bc56da6936947fe4bb88cf89c687f8528861235d03397f80e3ab87294e8de47ba7a7d4
SSDEEP 196608:o5S+WTpiUg/0fFT4nneSrbnQ5Z5sTjVYH:o5S+WyM14nneUgsdYH
TLSH
T1DAC69E07ECA145E9C0A9E1358A669263BB727C485F3523D33B50F3282F76BD06E7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution defendnot hacktool persistence spyware

Malware Config

Signatures

Family: Defendnot
Defendnot is a tool designed to disable Microsoft Defender.
hacktool defendnot

Detects Defendnot 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c608-52.dat	family_defendnot

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4692	powershell.exe
1852	powershell.exe
2156	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
3468	defendnot-loader.exe
5244	updater_txWvRkgb.exe
4516	defendnot-loader.exe

Loads dropped DLL 2 IoCs

pid	Process
5052	Taskmgr.exe
616	Taskmgr.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\judgment\sroiadlyuerm	explorer.exe
File opened for modification	C:\Program Files\forwardly\aoffeost.dat	explorer.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SERVIC~1\LOCALS~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe
File opened for modification	C:\Windows\6PfmPbJy\defendnot-loader.pdb	file.exe
File opened for modification	C:\Windows\6PfmPbJy\defendnot.pdb	file.exe
File opened for modification	C:\Windows\6PfmPbJy\extra-strip.bat	file.exe
File opened for modification	C:\Windows\6PfmPbJy\defendnot.dll	file.exe
File opened for modification	C:\Windows\6PfmPbJy\defendnot-loader.exe	file.exe
File created	C:\Windows\6PfmPbJy\ctx.bin	defendnot-loader.exe
File opened for modification	C:\Windows\6PfmPbJy\ctx.bin	defendnot-loader.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3420	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1852	powershell.exe
1852	powershell.exe
2156	powershell.exe
2156	powershell.exe
4692	powershell.exe
4692	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4980	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeIncreaseQuotaPrivilege	1852	powershell.exe
Token: SeSecurityPrivilege	1852	powershell.exe
Token: SeTakeOwnershipPrivilege	1852	powershell.exe
Token: SeLoadDriverPrivilege	1852	powershell.exe
Token: SeSystemProfilePrivilege	1852	powershell.exe
Token: SeSystemtimePrivilege	1852	powershell.exe
Token: SeProfSingleProcessPrivilege	1852	powershell.exe
Token: SeIncBasePriorityPrivilege	1852	powershell.exe
Token: SeCreatePagefilePrivilege	1852	powershell.exe
Token: SeBackupPrivilege	1852	powershell.exe
Token: SeRestorePrivilege	1852	powershell.exe
Token: SeShutdownPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeSystemEnvironmentPrivilege	1852	powershell.exe
Token: SeRemoteShutdownPrivilege	1852	powershell.exe
Token: SeUndockPrivilege	1852	powershell.exe
Token: SeManageVolumePrivilege	1852	powershell.exe
Token: 33	1852	powershell.exe
Token: 34	1852	powershell.exe
Token: 35	1852	powershell.exe
Token: 36	1852	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeIncreaseQuotaPrivilege	2156	powershell.exe
Token: SeSecurityPrivilege	2156	powershell.exe
Token: SeTakeOwnershipPrivilege	2156	powershell.exe
Token: SeLoadDriverPrivilege	2156	powershell.exe
Token: SeSystemProfilePrivilege	2156	powershell.exe
Token: SeSystemtimePrivilege	2156	powershell.exe
Token: SeProfSingleProcessPrivilege	2156	powershell.exe
Token: SeIncBasePriorityPrivilege	2156	powershell.exe
Token: SeCreatePagefilePrivilege	2156	powershell.exe
Token: SeBackupPrivilege	2156	powershell.exe
Token: SeRestorePrivilege	2156	powershell.exe
Token: SeShutdownPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeSystemEnvironmentPrivilege	2156	powershell.exe
Token: SeRemoteShutdownPrivilege	2156	powershell.exe
Token: SeUndockPrivilege	2156	powershell.exe
Token: SeManageVolumePrivilege	2156	powershell.exe
Token: 33	2156	powershell.exe
Token: 34	2156	powershell.exe
Token: 35	2156	powershell.exe
Token: 36	2156	powershell.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeShutdownPrivilege	4980	explorer.exe
Token: SeCreatePagefilePrivilege	4980	explorer.exe
Token: SeShutdownPrivilege	4980	explorer.exe
Token: SeCreatePagefilePrivilege	4980	explorer.exe
Token: SeShutdownPrivilege	4980	explorer.exe
Token: SeCreatePagefilePrivilege	4980	explorer.exe
Token: SeShutdownPrivilege	4980	explorer.exe
Token: SeCreatePagefilePrivilege	4980	explorer.exe
Token: SeShutdownPrivilege	4980	explorer.exe
Token: SeCreatePagefilePrivilege	4980	explorer.exe
Token: SeShutdownPrivilege	4980	explorer.exe
Token: SeCreatePagefilePrivilege	4980	explorer.exe
Token: SeShutdownPrivilege	4980	explorer.exe
Token: SeCreatePagefilePrivilege	4980	explorer.exe
Token: SeShutdownPrivilege	4980	explorer.exe
Token: SeCreatePagefilePrivilege	4980	explorer.exe
Token: SeShutdownPrivilege	4980	explorer.exe
Token: SeCreatePagefilePrivilege	4980	explorer.exe
Token: SeShutdownPrivilege	4980	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5244	updater_txWvRkgb.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5956 wrote to memory of 1852	5956	file.exe	89
PID 5956 wrote to memory of 2156	5956	file.exe	92
PID 5956 wrote to memory of 3468	5956	file.exe	94
PID 5956 wrote to memory of 4692	5956	file.exe	95
PID 3468 wrote to memory of 5052	3468	defendnot-loader.exe	97
PID 5956 wrote to memory of 5244	5956	file.exe	98
PID 5244 wrote to memory of 4980	5244	updater_txWvRkgb.exe	80
PID 4980 wrote to memory of 5828	4980	explorer.exe
PID 4516 wrote to memory of 616	4516	defendnot-loader.exe	102
PID 4516 wrote to memory of 3420	4516	defendnot-loader.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Microsoft
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath C:\Windows
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2156
- - C:\Windows\6PfmPbJy\defendnot-loader.exe
    C:\Windows\6PfmPbJy\defendnot-loader.exe --silent
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Windows\SYSTEM32\Taskmgr.exe
      Taskmgr.exe
      4⤵
      Loads dropped DLL
      PID:5052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command C:\Users\Admin\AppData\Local\Temp\dn-2558633592.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- - C:\Users\Admin\AppData\Local\Microsoft\updater_txWvRkgb.exe
    C:\Users\Admin\AppData\Local\Microsoft\updater_txWvRkgb.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5244

C:\Windows\6PfmPbJy\defendnot-loader.exe
C:\Windows\6PfmPbJy\defendnot-loader.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\SYSTEM32\Taskmgr.exe
  Taskmgr.exe
  2⤵
  - Loads dropped DLL
  PID:616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:3420

C:\Program Files\Windows Defender\MpCmdRun.exe
"C:\Program Files\Windows Defender\MpCmdRun.exe" -wdenable
1⤵
- Drops file in Windows directory
PID:5636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7c8bf5aed8f939218421e7a6a175d0620aeb675d302b42c66b502f4415ad9d98
MD5 8e40a9b5f6569297bf00b4a0fe495826
SHA1 074688f7d65b5ca3b165102d7c64ea1e758b02d9
SHA512 e5d75df6d14c9356eed14736f3df9e640f8799d8c4e55be42ecac07ed2458feedaa45c8bc785a565f004a275d61e70ca7bab54af48c638d57c0e64861af63e86
TLSH
T1F5216B37B3DD8614C899413A10CDAC1036B6C7DB80DECFAB7B84D655A42F699CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3122bb6da954dc4a07f27f1fb71f77f57f8a7491719f8bc1b4e65962b5f3bbc5
MD5 7c3249bf4fbb8079af3329f820a91c2b
SHA1 75c75a27a51b20aadc0a52bc07b33b6ec02e4764
SHA512 dd5006381a080b5e3ec513ecc3d9ad8d637e5ef7eef43fdecc263e69b8c44ef9c3e9532aae4b19c8839dfb5f0afabfcc9e1f4cb6bf6cc1f40c471b6ed954b68f
TLSH
T112219833B3CD8624C89A013A10CDAC1036B6C7CB40DECFAB7B80E655A43F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

updater_txWvRkgb.exe

Path C:\Users\Admin\AppData\Local\Microsoft\updater_txWvRkgb.exe
Size 714KB
SHA256 55fcccc9c9b8a0546234f9aa2929a21baadcb409d81e6eb92824d9f8a1192f69
MD5 6e4d9a5638e9d62d853397f8354e7a6a
SHA1 ebfd6f6f95d41b434814992a2d5bed7adedd7223
SHA512 2b2eacff8557190e5119abfa852f1e1890e0ebefd272f81a24ee4a7d67e333e826e2196d3fd845773ada1b14b26c56a5b1727eef5fb994bc283139a0500cef40
SSDEEP 12288:9mTWJML1BTYr4hXGRAbBrdyl9KKT+pcrU//AM2QLq1Ip5e3d0:9tJMLaAemRyYqc5qd
TLSH
T1D9F4F156BFF005F5E76CD13494AA3B125533F5668B30C5EF83D025CA2EEA9809E3DA90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_whckwzm4.t1c.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_whckwzm4.t1c.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dn-2558633592.ps1

Path C:\Users\Admin\AppData\Local\Temp\dn-2558633592.ps1
Size 2KB
SHA256 3888ffb268a0251bf49d7b140349006359e457a6e823e1d742da0d3057994578
MD5 4416740f2b112f9a574b79a729c37ee0
SHA1 4f5d2ad1b99f26af5064f5ed03dc5e82714d276d
SHA512 76cebb19d61ccdd0993d02d2709641f2bd2cbd3cd0d3d0fbceaf681a282c26359d01f82857736d98aa9421b9abecb3f77bf0c96364c42b73cfe2320807509127
TLSH
T17D41EF48F699C27055BA5708ED5B0A879C9F243B0202ED2073E9D3CABFE4537C2962C7
MD5 SHA1 SHA512 TLSH

Submit Download

ctx.bin

Path C:\Windows\6PfmPbJy\ctx.bin
Size 132B
SHA256 cf8c05d4e7620cd4ba0a049f96978e9fec37ef4bab51720053cf318a66670014
MD5 6419d9e96a2a134a8dd59401ee0af98e
SHA1 200d2f402a19272649da8de8b6fc5cfd1f6f64c4
SHA512 e011e53a2709a08ecd2a0ffee73db21abe59cb8cea668562da80002b0f01d627e313b862e8c46392af81a1db508f7d76611b2283a7e5f43928a1ea417af732bc
MD5 SHA1 SHA512

Submit Download

defendnot-loader.exe

Path C:\Windows\6PfmPbJy\defendnot-loader.exe
Size 581KB
SHA256 f57a4dd3bd3ce82eaf6d7143e837b3fa59a0accdac76fd3dc053433efdd50e5e
MD5 aa636642fb9c479c7a9763d18862b12e
SHA1 100d02103379ba284c465933394af8b55a90d0b1
SHA512 b03126a3ff4809511388c787bdf6c65f22306840d8b1887924bc5ac0d1e52571cb832771260decbf6e115386aec8bda0b4434086d2b3f07f47f347f768a6db82
SSDEEP 6144:iQbKLBXMhgqo62sYoFJqiE3Wy13avn7aC8xmph0lhSMXlBXBWnlgh7RB9PCn:/1sriq13UaZxmph0lhSMXli4v9m
TLSH
T14BC49D26B7A940F9E1A7C27889930A16EA737C4643516BCF03E44A675F236E04F3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

defendnot.dll

Path C:\Windows\6PfmPbJy\defendnot.dll
Size 426KB
SHA256 b0870e105c7ad37fb0bdcb9305279b2943810d55300e8721eb64bdaa588cc84e
MD5 a9283ba8a7afa573b616856fcd00d597
SHA1 904a26e329804812ea42e4a1bb2d62f9eaafcac2
SHA512 81f47b5f5323b099e3c8b2b92576f41cfdde1a3204880f9bf5692dd04b6867ac79dd93c53b830afba5cebd4aeef20a1bee37a4cf57bedfcf67f551ac1f485e5b
SSDEEP 6144:JJnzyCQ6dPBn6KjhoKUpMoAOOLph0lhSMXlBXBWnH7sLBQX1wLj:OCFJUHAOOLph0lhSMXliHoLSXS
TLSH
T11494AE15B7A590B9E16B8274C8570A05EB737C414791EBCF03A4DAB26F237D16B3EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1852-11-0x000002AA7A430000-0x000002AA7A4E2000-memory.dmp

Download

memory/1852-16-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/1852-7-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/1852-10-0x000002AA7A410000-0x000002AA7A42E000-memory.dmp

Download

memory/1852-5-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/1852-12-0x000002AA7A200000-0x000002AA7A20A000-memory.dmp

Download

memory/1852-13-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/1852-14-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/1852-15-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/1852-6-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/1852-18-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/1852-17-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/1852-20-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/1852-21-0x000002AA79909000-0x000002AA7990F000-memory.dmp

Download

memory/1852-22-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/1852-4-0x000002AA798D0000-0x000002AA798F2000-memory.dmp

Download

memory/1852-3-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/1852-0-0x00007FFDCD7AF000-0x00007FFDCD7B0000-memory.dmp

Download

memory/2156-35-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/2156-30-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/2156-31-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/2156-32-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/2156-33-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/2156-34-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/2156-29-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/2156-36-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/2156-37-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/2156-28-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/2156-24-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/2156-23-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/2156-40-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/2156-41-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/2156-43-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp

Download

memory/4980-75-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-81-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-67-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-69-0x0000000002A90000-0x0000000002A91000-memory.dmp

Download

memory/4980-66-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-77-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-88-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-89-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-91-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-87-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-85-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-68-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-83-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-82-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-97-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-96-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-95-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-93-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-92-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-78-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-79-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-76-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download

memory/4980-99-0x0000000003A70000-0x0000000003AF3000-memory.dmp

Download