silverrat | 1ade996dd1fc081601f3ab8befa1307f908499e4bde9968f12ab39dc85ad74ad

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 22:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SilverClient.exe
Size

44KB
MD5

73da3b5354e231ee5b518758a190ced6
SHA1

a1d5ce5fa7721870a7500eb40337fc56cf72d7e2
SHA256

1ade996dd1fc081601f3ab8befa1307f908499e4bde9968f12ab39dc85ad74ad
SHA512

069a553b74b36251e860b2992ef5688418e022f173fbece7778e14066f4eee030669ecf6b5c1ea96225ec768da0b729306fc51d711dfd30fdf91450a8e1c97f4
SSDEEP

768:JX8w9gjLHx+6AHOTVR/Z5WIRULQeq9hLiuB6SyDADv+/nU:JMw4tAar/Z5zGsr9loJAD2/nU

Score

10^/10

silverrat evasion persistence trojan

Malware Config

Extracted

Family

silverrat

Version

1.0.0.0

FBIInvestigation-41427.portmap.host:41427

Mutex

xhhCQtIByF

Attributes

certificate
MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==
decrypted_key
-|S.S.S|-
discord
https://discord.com/api/webhooks/1307565058028736522/BvuPOnvMCGBluGhgPBunWxSW6sccMPE50iCM97Bct0vExaNkF3__xy6dkdmzHQG2t597
key
yy6zDjAUmbB09pKvo5Hhug==
key_x509
RFNmZ1JPaXBaQXBxS05BdUdsQWNWU0VHREZSbmRK
payload_url
https://g.top4top.io/p_2522c7w8u1.png
reconnect_delay
4
server_signature
LU2wsiaOZ+/gZCLn0p/f7HnmbeuGF/B6ewFYcy0TAoCbL4cHqQZDETE02FQQQOpK0ycwb+sWB6hmbN5YVwd5kelF++2dUp3hd3yuGDK5LGIXWBz+kDFpcPCj87CLCJRnsV5khSfdXX9dLF5Iq0+fMAJb5S3M7kMYTsLsEP19/AWVP8WG1ZzsQMrjEZXfiXYvM1317wLwiXYPMy+spia0hVEZl7sXN7oM09PyHBVF2AYlmggjBUUkLVvhXasGKhBltrgdopTpGkPVUI1wr6Vaj0V55MG85DmcxRl6c99Tnn8/mi7xx1GOIki2wSrwXHf0LTW+EaPhc/JrdrZxlJtWZHRsGJGORjeN+sk4/p3rXWGvT3j8Wl44vyZAEmkJzOsWaDB6Mqnhf1BC+HfGjTayVUD+Rosklv3ZAwGhl4X9kN/Zv9oyfs0686LvfL5eGTRoidP0vr5NBsISTuJ6UFZ3qfIBaEVc97kNbntqIUj/jIy9AJr9/qgPCTLBPmaqiFYqlKcySYG9FcEvHosS08+vKgjs6tXypcocqOgacjWjg2/C/1RLqwrFSbucdNkvG0d5IFHHniydWX4aRcSpT1F3DRFW+uY1TpEPLpL/SZdgown4ZwlGCgkxjo/TPOADHZBYY1fqqqXbXO1nxQew+sspmqw4pz2Gb+XXUQmK2cq71xQ=

Signatures

SilverRat
SilverRat is trojan written in C#.
trojan silverrat
Silverrat family
silverrat

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4324	attrib.exe
2156	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	SilverClient.exe

Executes dropped EXE 1 IoCs

pid	Process
2776	$77Windows Security Notification.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "\"C:\\Users\\Admin\\Windows Security Notification\\$77Windows Security Notification.exe\""	SilverClient.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
24	discord.com
25	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1988	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
4320	SilverClient.exe
2776	$77Windows Security Notification.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
300	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeBackupPrivilege	1692	vssvc.exe
Token: SeRestorePrivilege	1692	vssvc.exe
Token: SeAuditPrivilege	1692	vssvc.exe
Token: SeDebugPrivilege	4320	SilverClient.exe
Token: SeDebugPrivilege	2776	$77Windows Security Notification.exe
Token: SeDebugPrivilege	300	taskmgr.exe
Token: SeSystemProfilePrivilege	300	taskmgr.exe
Token: SeCreateGlobalPrivilege	300	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe
300	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2776	$77Windows Security Notification.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 4324	4320	SilverClient.exe	87
PID 4320 wrote to memory of 4324	4320	SilverClient.exe	87
PID 4320 wrote to memory of 2156	4320	SilverClient.exe	89
PID 4320 wrote to memory of 2156	4320	SilverClient.exe	89
PID 4320 wrote to memory of 752	4320	SilverClient.exe	105
PID 4320 wrote to memory of 752	4320	SilverClient.exe	105
PID 752 wrote to memory of 1988	752	cmd.exe	107
PID 752 wrote to memory of 1988	752	cmd.exe	107
PID 752 wrote to memory of 2776	752	cmd.exe	108
PID 752 wrote to memory of 2776	752	cmd.exe	108
PID 2776 wrote to memory of 3276	2776	$77Windows Security Notification.exe	110
PID 2776 wrote to memory of 3276	2776	$77Windows Security Notification.exe	110
PID 2776 wrote to memory of 4760	2776	$77Windows Security Notification.exe	112
PID 2776 wrote to memory of 4760	2776	$77Windows Security Notification.exe	112
PID 2776 wrote to memory of 4412	2776	$77Windows Security Notification.exe	114
PID 2776 wrote to memory of 4412	2776	$77Windows Security Notification.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2156	attrib.exe
4324	attrib.exe

C:\Users\Admin\AppData\Local\Temp\SilverClient.exe
"C:\Users\Admin\AppData\Local\Temp\SilverClient.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\Windows Security Notification"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4324
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\Windows Security Notification\$77Windows Security Notification.exe"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEFEE.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1988
- - C:\Users\Admin\Windows Security Notification\$77Windows Security Notification.exe
    "C:\Users\Admin\Windows Security Notification\$77Windows Security Notification.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /query /TN $77Windows Security Notification.exe
      4⤵
      PID:3276
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /Create /SC ONCE /TN "$77Windows Security Notification.exe" /TR "C:\Users\Admin\Windows Security Notification\$77Windows Security Notification.exe \"\$77Windows Security Notification.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4760
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /query /TN $77Windows Security Notification.exe
      4⤵
      PID:4412

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEFEE.tmp.bat

Filesize
190B

MD5
654cdfdd4f29569a1ba3b1212b3d363f

SHA1
a9804d60b90b25bd2300750ac99d67b4c58f95f8

SHA256
81a2006e237c697d8328a495b44b33e991dffdca4cb6084ba09634609801f3a8

SHA512
b728f994b0183bc15b2dea936e156c2b98476321132ce67199e964c715821c40c503039e3a0ac3b8f7366adfc5b5d144e05e02ae7c49261e9e12ef3f49288faa

Download Submit
C:\Users\Admin\Windows Security Notification\$77Windows Security Notification.exe

Filesize
44KB

MD5
73da3b5354e231ee5b518758a190ced6

SHA1
a1d5ce5fa7721870a7500eb40337fc56cf72d7e2

SHA256
1ade996dd1fc081601f3ab8befa1307f908499e4bde9968f12ab39dc85ad74ad

SHA512
069a553b74b36251e860b2992ef5688418e022f173fbece7778e14066f4eee030669ecf6b5c1ea96225ec768da0b729306fc51d711dfd30fdf91450a8e1c97f4

Download Submit
memory/300-15-0x00000163DEC50000-0x00000163DEC51000-memory.dmp

Filesize
4KB

Download
memory/300-23-0x00000163DEC50000-0x00000163DEC51000-memory.dmp

Filesize
4KB

Download
memory/300-19-0x00000163DEC50000-0x00000163DEC51000-memory.dmp

Filesize
4KB

Download
memory/300-20-0x00000163DEC50000-0x00000163DEC51000-memory.dmp

Filesize
4KB

Download
memory/300-21-0x00000163DEC50000-0x00000163DEC51000-memory.dmp

Filesize
4KB

Download
memory/300-13-0x00000163DEC50000-0x00000163DEC51000-memory.dmp

Filesize
4KB

Download
memory/300-22-0x00000163DEC50000-0x00000163DEC51000-memory.dmp

Filesize
4KB

Download
memory/300-14-0x00000163DEC50000-0x00000163DEC51000-memory.dmp

Filesize
4KB

Download
memory/300-25-0x00000163DEC50000-0x00000163DEC51000-memory.dmp

Filesize
4KB

Download
memory/300-24-0x00000163DEC50000-0x00000163DEC51000-memory.dmp

Filesize
4KB

Download
memory/4320-3-0x00007FFB497F0000-0x00007FFB4A2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4320-1-0x0000000000B70000-0x0000000000B80000-memory.dmp

Filesize
64KB

Download
memory/4320-0-0x00007FFB497F3000-0x00007FFB497F5000-memory.dmp

Filesize
8KB

Download
memory/4320-9-0x00007FFB497F0000-0x00007FFB4A2B1000-memory.dmp

Filesize
10.8MB

Download
memory/4320-2-0x00007FFB497F0000-0x00007FFB4A2B1000-memory.dmp

Filesize
10.8MB

Download