Overview

overview

10

Static

static

8

52f44039d9...ae.xls

windows7-x64

10

52f44039d9...ae.xls

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2024 21:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    52f44039d97483f8ba440cc2f1745cbc4bb9663d27ef9ea40e2788e2813994ae.xls

  • Size

    192KB

  • MD5

    8347418fb4da55c1e1afe281a84c6c4d

  • SHA1

    426e1a5950a97345ac8ed1d11cb7aea1c90fedd2

  • SHA256

    52f44039d97483f8ba440cc2f1745cbc4bb9663d27ef9ea40e2788e2813994ae

  • SHA512

    9192ec1f65dad0faddca5eb0d3353cff66d60bb41a66a27d7afa5328550011e6139516e9850a2c5e1156126f145bdb915b0374e97ddf0def9784d7e8ec250b3d

  • SSDEEP

    3072:MrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAq3OLFyhxTchWwaZYwP+1oVET5K8lsq/:2xEtjPOtioVjDGUU1qfDlavx+W2QnAqE

Score
10/10
xenoratdiscoverymacromacro_on_actionrattrojan

Malware Config

Extracted

Family

xenorat

C2

dns.stipamana.com

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    12000

  • install_path

    appdata

  • port

    4567

  • startup_name

    mrec

Signatures

  • Detect XenoRat Payload 1 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Xenorat family
    xenorat
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\52f44039d97483f8ba440cc2f1745cbc4bb9663d27ef9ea40e2788e2813994ae.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFLLTU.vbs"
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      PID:3944
  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4108
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4212
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2200
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /Create /TN "mrec" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD38C.tmp" /F
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2580
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        3⤵
        • Executes dropped EXE
        PID:1732
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 152
          4⤵
          • Program crash
          PID:4084
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5036
        • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
          "C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2980
          • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            5⤵
            • Executes dropped EXE
            PID:4392
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 80
              6⤵
              • Program crash
              PID:1388
          • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4964
          • C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            C:\Users\Admin\AppData\Roaming\UpdateManager\GFKMTE.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3668
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1732 -ip 1732
    1⤵
      PID:4904
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4392 -ip 4392
      1⤵
        PID:1372

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
        Filesize

        717B

        MD5

        822467b728b7a66b081c91795373789a

        SHA1

        d8f2f02e1eef62485a9feffd59ce837511749865

        SHA256

        af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

        SHA512

        bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5EC004B7FD8CB72D80A747F531B799BC
        Filesize

        504B

        MD5

        468c10fe6e033605fdc3eb77dac1a0b9

        SHA1

        f2afc12dc5c537c067334987f42d0e23457d50ae

        SHA256

        6f1ccbff6df00d9812182caa9e98b2ceea1f056527efff69f28f38b1fac8b817

        SHA512

        7e08a6d72c7d809edd92fe4560008f69fd98d2f0d802bea341acb6ef6fb7beb073e953b838a735761ea0d081749982bb16426e322923596feed78d08ad79e77d

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
        Filesize

        471B

        MD5

        e81d1a452656da5266f453cb1a0fbcd4

        SHA1

        142b115501d7af306d8f887be66bc89e92e81521

        SHA256

        0a36be52eebc55142cc433203364f79cbe29bef5a6d0ce4bbf04fa41656de368

        SHA512

        4f782226101f3d628a7853c1ed828b16acd3fded03b3dc3329a68f3cf6f1c2c8a9748ff4abd5970c74244a7656eeafd2f3041743a8961ad0fced2843f2cbc987

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
        Filesize

        192B

        MD5

        0d6e5c6efb6dbd580d3500d146ea9b69

        SHA1

        18efb18699ea4a0713b7373810c3c9d9c7627d06

        SHA256

        40ee955840f3b561a383cf27478b0745cf8b09aee62d1d652af1b264a4698ad3

        SHA512

        e0942e2b347bf70e0799ce6023182faa2b4f93166913fdecc8ad5725b9fb60148ad2f235be716794e5413864f4cecead22ac0048377886552a59de6b96e071fa

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5EC004B7FD8CB72D80A747F531B799BC
        Filesize

        546B

        MD5

        90274d67a1b0513807543800dea6b050

        SHA1

        bf042bdc5f910e229bc64e3b0452bda34271ecfe

        SHA256

        df059abc6fa3caa6bd6a43c341c108ef2f2d8636159404f94982438ddaa2f0a3

        SHA512

        f2604d6c36e433bec7d7dfe7441d532a0ee6a69cbe4ab0428033d1f1c48bdc7b3d048168a2f2527219abbb6f9887ff85c9cca04635f38ab60fd025d6a970223c

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
        Filesize

        412B

        MD5

        121c51f5cfd2268acb984a1021aa28a7

        SHA1

        1bf000654cb381997e4e0f8906e2624506e85a56

        SHA256

        2ff01070b9ca0edad81a2aa42e44981f922541069ef4ae20bf49bd30ebfb8170

        SHA512

        372f7f303c02cb46c495c20d71b9c0f02c5f64d740d464b6fffe5aa580d2b99897a248776c49dcdb5db305e0e4ada8cd09a8c78630f23ac01c7962c06878bbe0

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GFKMTE.exe.log
        Filesize

        706B

        MD5

        d95c58e609838928f0f49837cab7dfd2

        SHA1

        55e7139a1e3899195b92ed8771d1ca2c7d53c916

        SHA256

        0407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339

        SHA512

        405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\D5ACAA4C-D5EC-4C35-8A91-DCAD9A8B9B80
        Filesize

        176KB

        MD5

        aef1e92cc1ce79d28d7d4e86564d1f69

        SHA1

        60879abd7cf3e4239950e8e7ecdfabb0015efb77

        SHA256

        45b973648163ab030561da6a87fedc2ec7b788f5b7bb1c2855c10299e540fc18

        SHA512

        9730209665aa651bb08ecf7217a1a407220fda411e7b84fde0999cbb53391d8bb441ba2c4db436ef31a94c4eb9c4828ea704bfe1451f4a45d818740b2605ae6f

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
        Filesize

        11KB

        MD5

        02c0d19591b1c0f0613b5c6d14fcbf2d

        SHA1

        e95dfc9aa7b948efc7dc71c829a0e9fbdab0d15e

        SHA256

        35bf5e49ad52cbf446898e4ef282dc2e036385924263a2ed31ef0ce5059fd648

        SHA512

        088e37351cc8dac3d9c23b6b3f64da02f1621074fbd3001642631d33795d564c4c18de36907475939da3dd69beb46ef65c2dd8d95bb42047968db5a4fc094e6a

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
        Filesize

        2KB

        MD5

        f8ecfee3c49b14565526e5fa3e3d35c7

        SHA1

        1d1e4992dae9ab6d7228714ebda9ada1ec107516

        SHA256

        9c57e6e3cb99bf21d87fa3d234d588120244ed213f1faaec12abc1ad7c09c7da

        SHA512

        c7e8f5bfd08a7c7a69b5f9050be32e376d002aa954533cf7fff496e027985768c3a48235f21d9d9efb4ce45eec42e5b4e8c8622638b8c27dda41668af74449e8

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
        Filesize

        2KB

        MD5

        e8e1b825b6b237e58fe1b2bdbbf8a7e1

        SHA1

        865aa0809f2dae07a9ff28bab15775a01b00080e

        SHA256

        02338122593bb10b47a4439cd0bfad6a78e06022a2c998c97832f8748e9ba484

        SHA512

        328d79901c704eaf91b5696a9a0d533be18c7e69616a0c12b8a9d02f79618bc85c6da6bbc1215189e6af796518968d577f862b23452d7335590d9d7d66ab65d5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\TCDD36D.tmp\gb.xsl
        Filesize

        262KB

        MD5

        51d32ee5bc7ab811041f799652d26e04

        SHA1

        412193006aa3ef19e0a57e16acf86b830993024a

        SHA256

        6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

        SHA512

        5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmpD38C.tmp
        Filesize

        1KB

        MD5

        dabe93a03c5560ab1670cf79b8d28566

        SHA1

        69738fe43d4550ece028ff2795a54bbad0985414

        SHA256

        743e8b28a38e98ea27ef07f17b7529976979c7b01eab92586a6cb686c0d1f68d

        SHA512

        15b3b49c46901e00a73def834225df28fd843af1e9ae594c7d061406209f6ce57277673c9c1ae3ed541f989fa499fd3e88929e00ebded6d23301f8d3680a6c57

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\¸¸.doc
        Filesize

        195KB

        MD5

        7ea9da3dd3db6f3fadf04ac76b54434b

        SHA1

        b30b950191046d999e71aaa54fb2648c6655ce9b

        SHA256

        947bce97211371e730a2b8b79c2ec4d154904e8faa7bed2583c5c6c420230170

        SHA512

        f94eb382dedb8c3952dbc0f3b9040201455cec641c845bedf5765a2772aa98cb20d92b3e0edadcd92fd7cdb77e7c6f37d26bdd276cceea733237e28f04240f9d

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
        Filesize

        16B

        MD5

        d29962abc88624befc0135579ae485ec

        SHA1

        e40a6458296ec6a2427bcb280572d023a9862b31

        SHA256

        a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

        SHA512

        4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\GFKMTE.exe
        Filesize

        166KB

        MD5

        57fcc042b0f7783567878d217ae69e25

        SHA1

        83032ec361ea8b15ef956536999b754db6a12423

        SHA256

        13bd3ee226114db8e18f2fe414a7e2c4e0937eda7d8a02b2efebaa2af8238564

        SHA512

        4fe2ce713333d9a16d65ca5ccdc3a2e687b84a58b6b1e43b43c3f508edb2cc04478a5595efc43202decf7f86b50fd43382246fbc12553117a9177fb13d987b67

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\PFLLTU.vbs
        Filesize

        10KB

        MD5

        087bcef76143b81090deef4ee4679995

        SHA1

        6ebd4fd212d0583157ae03bb0eb5841c53e281fc

        SHA256

        87334eb3f39cffdfeed453f67a7c338fe378b75c49946451ca1a0e4e151bba00

        SHA512

        b2f93705760d4d1cf5fe0ac354100916d16b6c4fd62117254238a600aabe6257fc791f1ce498bd2d0cfdd47e19f304dc5a68a06b7958658f34859afaa582ed4d

        Download Submit

      • memory/2200-140-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

        Download

      • memory/2872-14-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-128-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-6-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-36-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-37-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-42-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-19-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-20-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-18-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-16-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-0-0x00007FFD33E50000-0x00007FFD33E60000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2872-15-0x00007FFD314F0000-0x00007FFD31500000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2872-99-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-9-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-10-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-13-0x00007FFD314F0000-0x00007FFD31500000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2872-11-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-12-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-127-0x00007FFD73E6D000-0x00007FFD73E6E000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2872-17-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-3-0x00007FFD33E50000-0x00007FFD33E60000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2872-2-0x00007FFD33E50000-0x00007FFD33E60000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2872-1-0x00007FFD73E6D000-0x00007FFD73E6E000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2872-4-0x00007FFD33E50000-0x00007FFD33E60000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2872-176-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-175-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-137-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-7-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2872-8-0x00007FFD33E50000-0x00007FFD33E60000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2872-5-0x00007FFD73DD0000-0x00007FFD73FC5000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2980-165-0x0000000002FB0000-0x0000000002FE2000-memory.dmp

        Filesize

        200KB

        Download

      • memory/4212-139-0x000000000AE00000-0x000000000AE06000-memory.dmp

        Filesize

        24KB

        Download

      • memory/4212-138-0x000000000AF90000-0x000000000B022000-memory.dmp

        Filesize

        584KB

        Download

      • memory/4212-136-0x000000000B4A0000-0x000000000BA44000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/4212-135-0x000000000AE50000-0x000000000AEEC000-memory.dmp

        Filesize

        624KB

        Download

      • memory/4212-134-0x00000000059C0000-0x00000000059F2000-memory.dmp

        Filesize

        200KB

        Download

      • memory/4212-133-0x00000000059B0000-0x00000000059B6000-memory.dmp

        Filesize

        24KB

        Download

      • memory/4212-132-0x0000000000F50000-0x0000000000F80000-memory.dmp

        Filesize

        192KB

        Download