snakekeylogger | ca33bd5e2218c80c2d4f17bfc53f3b187541f519e459e01e1d013862c7dcd4bb

Analysis

max time kernel
141s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PackingListU0190219xlsx.vbe
Size

14KB
MD5

48d02287f3c633ccf96c6f01acd5ca9f
SHA1

2ad6405243f648937727731608d638c495b2fe46
SHA256

e575a3ecc136ad114643bbd7beb2ffc3d5550fa66955bd2c8f4ef4394e11dc87
SHA512

4835bb0f03bfb204e3aba46957af08f02889f7b43c60017151eafc479ba47e6ab50f6caec9cbb07cce4a6a600e6f7c576068d300e65bf762d7cf3cc59673d3c7
SSDEEP

384:GA79Z5lXWUBFplgtfcQ///y+KAhxF2asn:Go5lXH9atx//N/TIn

Score

10^/10

snakekeylogger collection credential_access discovery keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
juguly.shop
Port:
587
Username:
[email protected]
Password:
d8GsruZs5Zg6
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/4972-214-0x00000000009B0000-0x00000000009D6000-memory.dmp	family_snakekeylogger

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	1736	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
53	checkip.dyndns.org

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1816 set thread context of 4972	1816	powershell.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1000	WINWORD.EXE
1000	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1816	powershell.exe
1816	powershell.exe
1452	powershell.exe
1452	powershell.exe
1452	powershell.exe
1816	powershell.exe
1816	powershell.exe
4972	MSBuild.exe
4972	MSBuild.exe
4972	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeDebugPrivilege	1452	powershell.exe
Token: SeDebugPrivilege	4972	MSBuild.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1000	WINWORD.EXE
1000	WINWORD.EXE
1000	WINWORD.EXE
1000	WINWORD.EXE
1000	WINWORD.EXE
1000	WINWORD.EXE
1000	WINWORD.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 1816	4660	WScript.exe	92
PID 4660 wrote to memory of 1816	4660	WScript.exe	92
PID 4660 wrote to memory of 1452	4660	WScript.exe	100
PID 4660 wrote to memory of 1452	4660	WScript.exe	100
PID 1816 wrote to memory of 4972	1816	powershell.exe	102
PID 1816 wrote to memory of 4972	1816	powershell.exe	102
PID 1816 wrote to memory of 4972	1816	powershell.exe	102
PID 1816 wrote to memory of 4972	1816	powershell.exe	102
PID 1816 wrote to memory of 4972	1816	powershell.exe	102
PID 1816 wrote to memory of 4972	1816	powershell.exe	102
PID 1816 wrote to memory of 4972	1816	powershell.exe	102
PID 1816 wrote to memory of 4972	1816	powershell.exe	102
PID 1452 wrote to memory of 2656	1452	powershell.exe	103
PID 1452 wrote to memory of 2656	1452	powershell.exe	103
PID 1816 wrote to memory of 2380	1816	powershell.exe	104
PID 1816 wrote to memory of 2380	1816	powershell.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PackingListU0190219xlsx.vbe"
1⤵
- Blocklisted process makes network request
PID:1736

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Roaming\WEOhONLdSgJdcTV.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4972
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1816" "2760" "2700" "2764" "0" "0" "2768" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:2380
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1452" "2672" "2600" "2676" "0" "0" "2680" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:2656

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\SkipCopy.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B25.tmp.xml

Filesize
4KB

MD5
df40ad6dc2a90348acaeea6a74a3a4f3

SHA1
0199e2dcfb4a84db30333e146fa81eb972f5f900

SHA256
518ed9c73d866b77d28d9c1039b0cf07e9c0b5b1eb69193222e88fdc22db037b

SHA512
1ca5e6952453f01657f6b1f6683a4b424603b1004f8f7ec55a913fef8622f6a9cdee3ead3263c2cda22adbd7075afc1dc4cefd75d7ac325a9fb21b92be2ed0ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
9461a7cfb20ff5381df28f51b80c5ef1

SHA1
c86c53fca1dcbe307dafbefbb366abf52c9f5eca

SHA256
d4af1948337d0deb725f4f2b1fe1a9b60f4519841e28748b11bfd62ccd71e028

SHA512
da1e17f67dfebb004ba93d489be504fd7af6d62709ada2581ffa77880baecdaa0015b49d36333d18216d9dc6aad7b0ea2e5bd224d8d3f65ee9b66a05fc45e304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
a26df49623eff12a70a93f649776dab7

SHA1
efb53bd0df3ac34bd119adf8788127ad57e53803

SHA256
4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

SHA512
e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
e471065a1b3dd2a880666e8f93c0299f

SHA1
c4bb2ab71b256d7b1665bb857f22cfa6c76b0150

SHA256
0b0e6bd2aa2a2296ab8de04d5009393e04d0fb478fcd0fd24f0d3beabef94275

SHA512
1724e8f50e5d9414bbbe9fcc5dc4267584dbec57615abc787898b0830460bd0e35f1e27f67a2e1d8010dff10856486178048de0d0679c6e180c4af2a388749a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCD1887.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ofaquvt3.ik2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
376B

MD5
0576f1b64bcc22b174a73377aef8137a

SHA1
0fc19fd19f6fc836cf8ff4874e27daf6db190bf7

SHA256
395a5b1b3881ab2b579de179e98de8ead45a998fb46da27389ecd194d8bf39fa

SHA512
7793c569281294e9c50fa93a6b481cd6de177b2fad309cc71a1f92e3dfebd946ce0846e8d775253113b47f9f6c4a54e23759c5598a156e0f63e4fd03ac2f1534

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
16B

MD5
d29962abc88624befc0135579ae485ec

SHA1
e40a6458296ec6a2427bcb280572d023a9862b31

SHA256
a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

SHA512
4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

Filesize
217B

MD5
e2cf3cd0a15e6ba9b1458ef1fe323061

SHA1
b048e615caf1f016b9a7da54b3d3c57640f32c9d

SHA256
ff3dfaf6d1532c2b3780d274ff424b3ada3616e3f3d54c956ff487b0b523844e

SHA512
15206829fcb027648cfae2a8e6b17c25080c4e9bbdf03ff5c939bf9fcf63e5bf8396c7aa40996841144e96dade483ac48490e65ef21eca1ba0750fafd147fe1c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
84d9c5728faa65d9a2384432cd095c82

SHA1
d0f897e36c94d65470aa4771ed7eeda2213bb137

SHA256
730dde1fd4a22a955f9454223549cc6c69cedd7992242ce8abf23ed4f142acbc

SHA512
1f2517b73b29c090f06725cc0c8a63b3fdd86a51bedcf9b04bd8bf8903d7f259a4d395f63e190fd2ac8072bffc0f579afafff1fcfae54f6d609fc39547de5f84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
e6a2c0bd04b65736048ae5db30a2b4a5

SHA1
e4271fc2c1d8fa66abf8f5a88dbf7975dbec130e

SHA256
6318ec468e94bcc6ec8c8df1b9bdd791f83205074f12f8629564af2d035dc321

SHA512
4ddbab8da98a17a94d1b5fb5569574af751c4a0102ca89c1bb0ede7fd9484fb9dd737f3c320731a3504fa9772213fda8957b0df1a2cc5d720345804679770cba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
5d19e7489a984fc7bdb1bf2b6cbe00e9

SHA1
2d82c072b3a9c3d5098879f5ad3d373d9e971146

SHA256
4eec31aeeb8c806a0f40bc926644ea34fc2b938f729e834f25eb172aed27bb5c

SHA512
074ee8cc31fd31d0c251c69e46b6c8f81aa00b8fdb049efa46eddbff0aee4f1ae21ced405068a19dad214945baba4270babc1368394c1981dfaa5b1459755cf1

Download Submit
C:\Users\Admin\AppData\Roaming\WEOhONLdSgJdcTV.vbs

Filesize
2KB

MD5
39420007c03867df6c39fa89fd18df5c

SHA1
8e420eae009ec34c32eaa735b3785764a6f086ec

SHA256
f763a491d2417dd31f947cdc5fd92a18b8f3af533280b35da9e7ea38473ea4db

SHA512
be0de00a1f29e84e0c59870376be0c2664e0c2d22fe80cf7cf5a865f206341387de798e245e5fa4de4b7ebe1cd4517e89028de949b41208aaa49979f3ddf4a2a

Download Submit
memory/1000-22-0x00007FFF66C90000-0x00007FFF66CA0000-memory.dmp

Filesize
64KB

Download
memory/1000-16-0x00007FFF695F0000-0x00007FFF69600000-memory.dmp

Filesize
64KB

Download
memory/1000-19-0x00007FFF695F0000-0x00007FFF69600000-memory.dmp

Filesize
64KB

Download
memory/1000-21-0x00007FFF66C90000-0x00007FFF66CA0000-memory.dmp

Filesize
64KB

Download
memory/1000-17-0x00007FFF695F0000-0x00007FFF69600000-memory.dmp

Filesize
64KB

Download
memory/1000-263-0x00007FFF695F0000-0x00007FFF69600000-memory.dmp

Filesize
64KB

Download
memory/1000-18-0x00007FFF695F0000-0x00007FFF69600000-memory.dmp

Filesize
64KB

Download
memory/1000-15-0x00007FFF695F0000-0x00007FFF69600000-memory.dmp

Filesize
64KB

Download
memory/1000-260-0x00007FFF695F0000-0x00007FFF69600000-memory.dmp

Filesize
64KB

Download
memory/1000-262-0x00007FFF695F0000-0x00007FFF69600000-memory.dmp

Filesize
64KB

Download
memory/1000-261-0x00007FFF695F0000-0x00007FFF69600000-memory.dmp

Filesize
64KB

Download
memory/1816-20-0x00000208F0610000-0x00000208F0686000-memory.dmp

Filesize
472KB

Download
memory/1816-213-0x00000208F0590000-0x00000208F059A000-memory.dmp

Filesize
40KB

Download
memory/1816-94-0x00000208EE070000-0x00000208EE07A000-memory.dmp

Filesize
40KB

Download
memory/1816-14-0x00000208F0540000-0x00000208F0584000-memory.dmp

Filesize
272KB

Download
memory/1816-13-0x00000208EDFD0000-0x00000208EDFF2000-memory.dmp

Filesize
136KB

Download
memory/4972-214-0x00000000009B0000-0x00000000009D6000-memory.dmp

Filesize
152KB

Download
memory/4972-233-0x0000000005850000-0x0000000005DF4000-memory.dmp

Filesize
5.6MB

Download
memory/4972-234-0x00000000051B0000-0x000000000524C000-memory.dmp

Filesize
624KB

Download
memory/4972-235-0x00000000064E0000-0x0000000006530000-memory.dmp

Filesize
320KB

Download
memory/4972-236-0x0000000006700000-0x00000000068C2000-memory.dmp

Filesize
1.8MB

Download
memory/4972-237-0x00000000065D0000-0x0000000006662000-memory.dmp

Filesize
584KB

Download
memory/4972-238-0x0000000006590000-0x000000000659A000-memory.dmp

Filesize
40KB

Download