xenorat | 83f595dd0fa6b285fa753613b8bdf936f080ecf0b9689bf9705e5079868fbe2e

Analysis

max time kernel
148s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
11-05-2024 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

plswork.exe
Size

45KB
MD5

0964e2756ab7939430b382c4c748a4b6
SHA1

3d367eb27f86dd5e306b7d8919592dcef10a3465
SHA256

83f595dd0fa6b285fa753613b8bdf936f080ecf0b9689bf9705e5079868fbe2e
SHA512

5d7b2be37baf03d240115ff75f77b5e5e6157e92fe52f31b4b35debc21765aa46a3467e2b75901f1a78b43b5cbc1ca894d85da1ccafe9cc8c8ebf97e7841955b
SSDEEP

768:OdhO/poiiUcjlJInYTwH9Xqk5nWEZ5SbTDaSWI7CPW5p:Yw+jjgnJH9XqcnW85SbTLWIR

Score

10^/10

xenorat rat trojan

Malware Config

Extracted

Family

xenorat

ayumi-38161.portmap.host

Mutex

Xeno_rat_nd8912d

Attributes

delay
3000
install_path
temp
port
38161
startup_name
nothingset

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat

Executes dropped EXE 1 IoCs

pid	Process
1924	plswork.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
3740	msedge.exe
3740	msedge.exe
2272	msedge.exe
2272	msedge.exe
3420	identity_helper.exe
3420	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1924	2968	plswork.exe	80
PID 2968 wrote to memory of 1924	2968	plswork.exe	80
PID 2968 wrote to memory of 1924	2968	plswork.exe	80
PID 3740 wrote to memory of 3544	3740	msedge.exe	87
PID 3740 wrote to memory of 3544	3740	msedge.exe	87
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 1844	3740	msedge.exe	88
PID 3740 wrote to memory of 4816	3740	msedge.exe	89
PID 3740 wrote to memory of 4816	3740	msedge.exe	89
PID 3740 wrote to memory of 3852	3740	msedge.exe	90
PID 3740 wrote to memory of 3852	3740	msedge.exe	90
PID 3740 wrote to memory of 3852	3740	msedge.exe	90
PID 3740 wrote to memory of 3852	3740	msedge.exe	90
PID 3740 wrote to memory of 3852	3740	msedge.exe	90
PID 3740 wrote to memory of 3852	3740	msedge.exe	90
PID 3740 wrote to memory of 3852	3740	msedge.exe	90
PID 3740 wrote to memory of 3852	3740	msedge.exe	90
PID 3740 wrote to memory of 3852	3740	msedge.exe	90
PID 3740 wrote to memory of 3852	3740	msedge.exe	90
PID 3740 wrote to memory of 3852	3740	msedge.exe	90
PID 3740 wrote to memory of 3852	3740	msedge.exe	90
PID 3740 wrote to memory of 3852	3740	msedge.exe	90
PID 3740 wrote to memory of 3852	3740	msedge.exe	90
PID 3740 wrote to memory of 3852	3740	msedge.exe	90
PID 3740 wrote to memory of 3852	3740	msedge.exe	90
PID 3740 wrote to memory of 3852	3740	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\plswork.exe
"C:\Users\Admin\AppData\Local\Temp\plswork.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\XenoManager\plswork.exe
  "C:\Users\Admin\AppData\Local\Temp\XenoManager\plswork.exe"
  2⤵
  - Executes dropped EXE
  PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://appdata/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc14533cb8,0x7ffc14533cc8,0x7ffc14533cd8
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,14973647684379519503,14809574297611751431,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,14973647684379519503,14809574297611751431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,14973647684379519503,14809574297611751431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14973647684379519503,14809574297611751431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14973647684379519503,14809574297611751431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14973647684379519503,14809574297611751431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14973647684379519503,14809574297611751431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,14973647684379519503,14809574297611751431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,14973647684379519503,14809574297611751431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14973647684379519503,14809574297611751431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14973647684379519503,14809574297611751431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14973647684379519503,14809574297611751431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2984 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14973647684379519503,14809574297611751431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,14973647684379519503,14809574297611751431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\plswork.exe.log

Filesize
226B

MD5
1294de804ea5400409324a82fdc7ec59

SHA1
9a39506bc6cadf99c1f2129265b610c69d1518f7

SHA256
494398ec6108c68573c366c96aae23d35e7f9bdbb440a4aab96e86fcad5871d0

SHA512
033905cc5b4d0c0ffab2138da47e3223765146fa751c9f84b199284b653a04874c32a23aae577d2e06ce6c6b34fec62331b5fc928e3baf68dc53263ecdfa10c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0c5042350ee7871ccbfdc856bde96f3f

SHA1
90222f176bc96ec17d1bdad2d31bc994c000900c

SHA256
b8b1cb139d4d19a85adce0152fa3c4f6adfb73a322d7253820e848c6f82afc1b

SHA512
2efdb535fa6a06c4f9702b2129f2dd07c330e37fd10b492f2236007c660c1707773c22005d1e1fa580dbf633dc1a700ada3b7b611ef9accd9555a17a244f61ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e027def9b55f3d49cde9fb82beba238

SHA1
64baabd8454c210162cbc3a90d6a2daaf87d856a

SHA256
9816e980b04f1fe7efaa4b9c83ff6a0fdd485ee65a884c001b43a0cad7c39d83

SHA512
a315e1336c5ec70cbb002969e539068ba92f3ec681b6d863db95227fd1808a778fd994e2fb03f28f0e401677aa5f7c66813e315b6b99a5065384c49586f9782e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
328cffb57a9c2eef6473ee5c110a9552

SHA1
f4ecf21dc27c84c4e3bce37fa92e152908641799

SHA256
6f32439913f94f3e4e9d1677e30a23dc88e348cbcb7d3e50da6eb87e2990d2d2

SHA512
a2ff2289487bfb00f82841ac3c1474e55ed283511e23650bf3414dcf7990bc7ec8f314bef9d01d545c61d36ef42e82e64258c441d4fed9081267567b1f252ff2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cca09db5ea63e66fb6728f8a0ac9b2fa

SHA1
9aee70a233159a1db7e1260bbb1eb1090036a4bf

SHA256
ec53647a0c86114765f5456cea9e1b8963f7f60df37e8f194ded338cf26587cd

SHA512
1d751830e0bd61c1845ccac06abfd06ed8727beb046f8c03cab245df945788c6e2e3ab52f75c5e5a5326afe882254f78ffb8fc6676b5f2168e83c68679f8a67d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b702eeeff8d64c37fd56ef3718efd9a1

SHA1
9bd9178d085a13a9ecacef866749eefc23499c24

SHA256
f6c6ba4c90e4ea868a5ef6e2558cb972e9f6a36a8821fc2ad2d5a24fdd5ce67c

SHA512
168f1109340a2419cc5f5ac6b972cde18f833910148c9afc42d041e47ca0a54f8fc978be06a75d08615b1bb95aba4b9001d4262a93d6f470863d124df6e9a9a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\XenoManager\plswork.exe

Filesize
45KB

MD5
0964e2756ab7939430b382c4c748a4b6

SHA1
3d367eb27f86dd5e306b7d8919592dcef10a3465

SHA256
83f595dd0fa6b285fa753613b8bdf936f080ecf0b9689bf9705e5079868fbe2e

SHA512
5d7b2be37baf03d240115ff75f77b5e5e6157e92fe52f31b4b35debc21765aa46a3467e2b75901f1a78b43b5cbc1ca894d85da1ccafe9cc8c8ebf97e7841955b

Download Submit
memory/1924-15-0x0000000074340000-0x0000000074AF1000-memory.dmp

Filesize
7.7MB

Download
memory/1924-16-0x0000000074340000-0x0000000074AF1000-memory.dmp

Filesize
7.7MB

Download
memory/1924-17-0x0000000074340000-0x0000000074AF1000-memory.dmp

Filesize
7.7MB

Download
memory/2968-1-0x0000000000B70000-0x0000000000B82000-memory.dmp

Filesize
72KB

Download
memory/2968-0-0x000000007434E000-0x000000007434F000-memory.dmp

Filesize
4KB

Download