Overview

overview

10

Static

static

8

Estado de cuenta.xls

windows7-x64

10

Estado de cuenta.xls

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2024 08:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Estado de cuenta.xls

  • Size

    192KB

  • MD5

    31795aff2f438defa01c82368886353c

  • SHA1

    3f4c6dfa01693fea70f3113c11aeb5812b0c6cdb

  • SHA256

    75a5568c91850b8332bf8ac3d6a0acbe24a2bbb9a7941994709ba3cbaa255c5a

  • SHA512

    9ceebe6f8c7ee47b23c9e9350b7afdb21064edc45009ad8d1400566959d669b5aa2fd426d19c3302d701e05d5a09e9ed4088c1869168f4237b2b7417e21a49df

  • SSDEEP

    6144:BxEtjPOtioVjDGUU1qfDlavx+W2QnAu+Ly9ckwDwPq5XlsqhwxNNipu:s+VkGUqLsqyi

Score
10/10
xenoratdiscoverymacromacro_on_actionrattrojan

Malware Config

Extracted

Family

xenorat

C2

dns.stipamana.com

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    12000

  • install_path

    appdata

  • port

    4567

  • startup_name

    mrec

Signatures

  • Detect XenoRat Payload 1 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Xenorat family
    xenorat
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Estado de cuenta.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2752
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\TDCNX.vbs"
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      PID:4336
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4860
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4280
        • C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
          "C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3860
          • C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4384
          • C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4300
          • C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\DNKFU.exe
            5⤵
            • Executes dropped EXE
            PID:652
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 80
              6⤵
              • Program crash
              PID:4820
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1556
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2844
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "mrec" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD997.tmp" /F
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:4104
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 652 -ip 652
    1⤵
      PID:2808

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
      Filesize

      717B

      MD5

      822467b728b7a66b081c91795373789a

      SHA1

      d8f2f02e1eef62485a9feffd59ce837511749865

      SHA256

      af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

      SHA512

      bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\571AD299D4068543C8553D40E79010FA
      Filesize

      504B

      MD5

      7a1f814e2a871f3d16dcd5a88a4865f3

      SHA1

      bbb720fedc188a92c19b1303cf42551c4636b948

      SHA256

      da477890ff49815dce6931f9aeda5aeff9b36f548a891d820084e7256a077ee6

      SHA512

      87c5b06faa5f09504a78f057690a548aee5378058f0e4aa704132037e6092a67e57dba9f4a5a635b492378a280d55135ca6f5060ccd35596cde90f16ae12cea5

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
      Filesize

      471B

      MD5

      e81d1a452656da5266f453cb1a0fbcd4

      SHA1

      142b115501d7af306d8f887be66bc89e92e81521

      SHA256

      0a36be52eebc55142cc433203364f79cbe29bef5a6d0ce4bbf04fa41656de368

      SHA512

      4f782226101f3d628a7853c1ed828b16acd3fded03b3dc3329a68f3cf6f1c2c8a9748ff4abd5970c74244a7656eeafd2f3041743a8961ad0fced2843f2cbc987

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
      Filesize

      192B

      MD5

      6e81811affab27cf04e9f5d0ecbad708

      SHA1

      95415cd4ca7c34165c2582470d9ecc7937282771

      SHA256

      08ce74d29987cdefe99cfb644df374acf9c0cbcca671288fcc3bd94fc0c4655f

      SHA512

      e3870a016eef636443af56d67eb24d96bfeb9619b2b6ff228b3cf727b848c080e9874cae8b3af9f8f4eb3338210510635f792f31c8ccf58324abbfdfd6b5730e

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\571AD299D4068543C8553D40E79010FA
      Filesize

      550B

      MD5

      39a0586de3d184a7b24d7e1658584458

      SHA1

      ea8603e7833b0ed8611bfe18ee917a5c081c7b9c

      SHA256

      2f08b4c5603396309006ad75611ac3d659f2332c64a47344dc9486a0e79e122a

      SHA512

      1fa19b4f33c6971295ddc7d8b36735c8bcbe9b4b01c18de233ac36b1df47cf54cf3fbbc7f5b95970656138718f136565600209a575fb49869c1c58c0363aae1e

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
      Filesize

      412B

      MD5

      a967e83a8caa64a7b6d0cee11b575786

      SHA1

      8d28e483f259b33446bf18bbb0bc695475f209de

      SHA256

      71ad59db8ce6e830ed770f71a768139e1cb1b09b709a664faa7bb0007b71fe14

      SHA512

      152530e128c12d76c1ca19f181f1fc255239ef1b5f3921200893eb014365789b53aab329e7131d7680fd5e59a6d98f61e02461b90db20d16025b9510e9866022

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DNKFU.exe.log
      Filesize

      706B

      MD5

      d95c58e609838928f0f49837cab7dfd2

      SHA1

      55e7139a1e3899195b92ed8771d1ca2c7d53c916

      SHA256

      0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339

      SHA512

      405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\36727A33-936C-4566-AB2A-1A0AE2CC00C6
      Filesize

      176KB

      MD5

      62fde58b63f2824cdf89e6213022f6d6

      SHA1

      43eedbcfea082877f1e1897667f0cb7c3eb3b3f4

      SHA256

      2ff7705d36c292b69cf8bbc3ee1f7db884df32b66ba1080ca9ab22ed3e38fa19

      SHA512

      d84d809f4273324da53d4fa1e0ad0cbced7abaa4a598cef6846a8fb43009f4bd7c20887406c74e773377de6bc8beee11f2dadbf64722ef2c44c4e3682cbadb64

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
      Filesize

      11KB

      MD5

      1e5ecfdfa98f838a803bb7134228ce1f

      SHA1

      b6f79d3cb54e61c291398add463176f384a3d035

      SHA256

      ba510da203f301dcd9d198015f7a4a52eb6bcfc4a5068ccb5892beb4afe7f607

      SHA512

      343e220c823385a9c8b3a79dc151e69b6e4ce6cf57c342e8823bea231561c375f94b8ddff184ce98ed10fbfa5493e0869996cb2e56c047f2434880133e4f23ae

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
      Filesize

      2KB

      MD5

      6c93c72fa8f701afee0a3cc05aba1441

      SHA1

      6e026ab5e256bae370d17138afb7e6622301b2fb

      SHA256

      95089baaed092aa2dd45f8e90f03dbd594b9090a234691eca4ad93415f787f83

      SHA512

      9014dc25fa87cc49009e6eef72bf5f09aa919fe22bc3f121c95bb326b59a771cc924e7309eb59206c23ac9442b1cda780dc08cf575fc879d62f62a59fa3cf4cd

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
      Filesize

      2KB

      MD5

      8c4a58a55bb5d93e20fa32ecb2655e4b

      SHA1

      73f4f18f599646cded89cbabaf225443c59ec163

      SHA256

      1c9da7f140163a8d737f41d0d3904905a51e1d40c2aff3e41a44c0cffd4a6aaa

      SHA512

      9e80586624eb33039bce58e7259231d3e080de391a9a41ae2889b7fbf6503ff4d8f7cc6113c40cc9d17791a36c7379e3af8f5ad2607b44bda69e4989096b9125

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Qj.doc
      Filesize

      193KB

      MD5

      ce24313f8b01015afc7d6f5e668bd703

      SHA1

      d86c8ee00b3f4db999a94557e7ae62ee2cd87c0e

      SHA256

      b7d50f4fb2342f63f86df5da89e7be2d3490adaccb37a5a6df2c1927c46aec60

      SHA512

      b5e1f7a31e22afdf20b6b206e3815613714758f091481e15f73ca371f2bccb6833fd4b50c4f53869a315948c0a2e94ad7cb1753a764b0d0d234b5f511bf7b710

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\TCDC96B.tmp\iso690.xsl
      Filesize

      263KB

      MD5

      ff0e07eff1333cdf9fc2523d323dd654

      SHA1

      77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

      SHA256

      3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

      SHA512

      b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tmpD997.tmp
      Filesize

      1KB

      MD5

      5c8fe4f5f1e1e45ed639b7c4c8c8ab0a

      SHA1

      f46c6596614c34e0dc0dd04b31b0d9863ed80d2e

      SHA256

      2bdd53d79e6397484b617c2c307d3b88e0e93e29546ef0dd7389614c1e7d3c20

      SHA512

      c1b2c9a3f452e3f7b09f9d3c76a37f86de76884e1a388f51ef41cc4a9a78a74504a03ea000fbe6204861e251a7bb2a0ddf4d6e0ac51ef184dd9d8c61e60ef9fe

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
      Filesize

      16B

      MD5

      d29962abc88624befc0135579ae485ec

      SHA1

      e40a6458296ec6a2427bcb280572d023a9862b31

      SHA256

      a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

      SHA512

      4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
      Filesize

      2KB

      MD5

      8e50e0a41484221c20514b70474248b2

      SHA1

      f5837d02eaa46829aecec7e341a20dbec55ca3ae

      SHA256

      7f701640f39adcbfe357822022a84d6371374a244187faf1998c7a4b2d370975

      SHA512

      c86f6a500ab72bb38639b8c3609734e1ad310c9604fb2a1ac1a563d5cee4855723969db46746ba6a7432b887dcd3e832e1bdc7d6747549ed36e20ba23ca79a55

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DNKFU.exe
      Filesize

      174KB

      MD5

      da302f1f3b3f3a7df3dde94d870a2e22

      SHA1

      4c8e57bce883b2c2357065e95e4f4e1119d7b08d

      SHA256

      e84e765247bd6d7d756789ba7c07d61a12c2e265136e0ca65acdc919d4ca98bc

      SHA512

      0c4e38cb7387e647e2238cfd086c0122c12d9a9b9f827a56515722d4534a1ac3cc5a9c3e538095a696e84c52df1b7a75dd08a03a0e286cc79bdf398b2a93fdec

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\TDCNX.vbs
      Filesize

      10KB

      MD5

      c818cba07e014f95bcf8b133eaba0ee6

      SHA1

      83852a470bf54205d59cf40675034f2129a10771

      SHA256

      6b30fade6f3a26071148b661172fb9d8976c5d1d890a407bd06b5a4ae801b9b3

      SHA512

      c718d0d1d43d7b36f6b3988d5e7de327d14f9d94ae43b62d7a5169c7580b57fbb83e49c2cb209e0328f748668a554878a083a763639b640806f4addd9430e78b

      Download Submit

    • memory/2752-15-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-7-0x00007FFD33970000-0x00007FFD33980000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2752-37-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-39-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-36-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-18-0x00007FFD31540000-0x00007FFD31550000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2752-4-0x00007FFD33970000-0x00007FFD33980000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2752-10-0x00007FFD31540000-0x00007FFD31550000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2752-17-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-11-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-0-0x00007FFD33970000-0x00007FFD33980000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2752-16-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-14-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-12-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-13-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-8-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-1-0x00007FFD7398D000-0x00007FFD7398E000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2752-109-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-3-0x00007FFD33970000-0x00007FFD33980000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2752-2-0x00007FFD33970000-0x00007FFD33980000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2752-6-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-158-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-5-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-149-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-38-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-9-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-133-0x00007FFD738F0000-0x00007FFD73AE5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2752-132-0x00007FFD7398D000-0x00007FFD7398E000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2844-289-0x0000000005730000-0x0000000005796000-memory.dmp

      Filesize

      408KB

      Download

    • memory/4280-116-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

      Download

    • memory/4860-115-0x0000000007C50000-0x0000000007C56000-memory.dmp

      Filesize

      24KB

      Download

    • memory/4860-114-0x0000000007D90000-0x0000000007E22000-memory.dmp

      Filesize

      584KB

      Download

    • memory/4860-113-0x0000000008340000-0x00000000088E4000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/4860-112-0x0000000007CF0000-0x0000000007D8C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/4860-111-0x0000000005230000-0x0000000005264000-memory.dmp

      Filesize

      208KB

      Download

    • memory/4860-110-0x0000000005790000-0x0000000005796000-memory.dmp

      Filesize

      24KB

      Download

    • memory/4860-108-0x0000000000E40000-0x0000000000E70000-memory.dmp

      Filesize

      192KB

      Download